ERTMS/ETCS National Values

Transcription

1 ERTMS/ETCS National Values Synopsis This document contains requirements and guidance for a process to determine or revise a set of values of ERTMS/ETCS National Values. Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law. RSSB members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited. In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group documents may be reproduced. Published by RSSB Copyright 2017 Rail Safety and Standards Board Limited

2 Uncontrolled when printed Issue Record Issue Date Comments One 02/09/2017 Original document. To include additional National Values from ERTMS Baseline 3 This document will be updated when necessary by distribution of a complete replacement. Superseded Documents The following Railway Group documents are superseded, either in whole or in part as indicated: Superseded documents Sections superseded Date when sections are superseded GERT8408 issue one ERTMS/ETCS National Values GEGN8608 issue one Guidance on All 02/09/2017 All 02/09/2017 Supply The authoritative version of this document is available at Enquiries on this document can be forwarded to enquirydesk@rssb.co.uk. Page 2 of 74 RSSB

3 Contents Part 1 Purpose and Introduction Purpose Context Application of this document Health and safety responsibilities Structure of this document Approval and Authorisation 8 Part 2 Requirements for Proposal of a set of Consultation on the proposed Consultation response on the proposed Optimising National Values Publishing National Values 10 Appendices 11 Appendix A 11 Definitions 68 References 74 RSSB Page 3 of 74

4 Uncontrolled when printed List of Figures Figure 1: Confidence interval of a ETCS fitted train 33 Figure 2: Chart demonstrating, by simplifying the curves as straight lines as an example, the shape of the resultant Permitted speed curve 35 Figure 3: High level schematic diagram of the processing of braking curves 36 Figure 4: Schematic diagram of how braking curves are derived 38 Figure 5: Comparison of where the 'hook' is shown if GUI curve is enabled. 41 Figure 6: Comparison of the position of the 'hook' if Q_NVSBFBPERM is enabled 42 Figure 7: Comparison of the position of the 'hook' if Q_NVINHSMICPERM is enabled 44 Figure 8: Demonstration of how A_NVMAXREDADH derates EBD and increases braking distance 46 Figure 9: DMI with TI initiated 47 Figure 10: DMI with TTI initiated 48 Figure 11: An example of a four steps Kv_int 58 Figure 12: Four steps Kv_int models 58 Figure 13: Process of extracting Kv_int 61 Figure 14: An example of a set of M_KRINT correction factors with five steps 65 Page 4 of 74 RSSB

5 List of Tables Table 1: Q_NVDRIVER_ADHES 11 Table 2: V_NVSHUNT 13 Table 3: V_NVSTFF 13 Table 4: V_NVONSIGHT 14 Table 5: V_NVSUPOVTRP 14 Table 6: V_NVUNFIT 17 Table 7: V_NVLIMSUPERV 18 Table 8: V_NVREL 19 Table 9: D_NVROLL 20 Table 10: V_NVALLOWOVTRP 22 Table 11: D_NVOVTRP 23 Table 12: T_NVOVTRP 24 Table 13: M_NVDERUN 26 Table 14: M_NVCONTACT 27 Table 15: T_NVCONTACT 27 Table 16: D_NVPOTRP 29 Table 17: D_NVSTFF 31 Table 18: Q_NVLOCACC 32 Table 19: Q_NVGUIPERM 40 Table 20: Q_NVSBFBPERM 41 Table 21: Q_NVINHSMICPERM 43 Table 22: A_NVMAXREDADH1/2/3 45 Table 23: Q_NVSRBKTRG 49 Table 24: Q_NVSBTSMPERM 50 Table 25: Q_NVEMRRLS 50 Table 26: M_NVEBCL 52 Table 27: M_NVAVADH 54 RSSB Page 5 of 74

6 Uncontrolled when printed Table 28: V_NVKVINT 56 Table 29: Q_NVKVINTSET 56 Table 30: M_NVKVINT 57 Table 31: A_NVP12 59 Table 32: A_NVP23 60 Table 33: Comparison of how A_NVP12, A_NVP23, Kv_int_x_a and Kv_int_x_b affects the outcome (all values are in relative terms) 62 Table 34: L_NVKRINT 63 Table 35: M_NVKRINT 64 Table 36: M_NVKTINT 66 Page 6 of 74 RSSB

7 Part 1 Purpose and Introduction 1.1 Purpose This document is a standard on, for members of RSSB to use if they so choose This document contains requirements for a process to determine or revise European Rail Traffic Management System (ERTMS) / European Train Control System (ETCS) National Values within a set Guidance is provided as a series of sequentially numbered clauses prefixed G immediately below each requirement. Where there is no guidance, this is stated The process set out in this document is applicable to ETCS fitted infrastructure irrespective of whether or not ERTMS-fitted trains operate on that infrastructure , determined in accordance with the process set out in this document, describes asset characteristics that are relevant to compatibility between ERTMS-fitted trains and trackside infrastructure This standard is applicable to all three ETCS Baselines legal at the time of publication: Baseline 2, Baseline 3 Maintenance Release 1, and Baseline 3 Release 2, as specified in the Control Command and Signalling Technical Specification for Interoperability (CCS TSI) Details on all the are set out in the Appendix. 1.2 Context are parameters in the ETCS system, described in ERTMS subset-026, Systems Requirements Specification (SRS) A set of applies to a National Area. A National Area is a geographic region and does not necessarily align to political borders. National in this context means determined at the national level, not necessarily applying throughout a whole nation The values are set as part of the infrastructure design to configure the behaviour of an ERTMS/ETCS application to be compatible with the operational and technical practices of a particular geographic region, for example, the maximum speeds permitted under different modes of operation National Values are configured by the infrastructure manager (IM) and coded within the trackside infrastructure, that is, Eurobalises and Radio Block Centres (RBCs). The values are sent to trains operating in the geographic region to which they apply and they cause the ETCS onboard to function in a way consistent with the infrastructure The SRS describes the National Values and details the range of values, it also specifies a default value for the ETCS onboard to use when the National Values for the geographic region that it is operating in are not available. This information is replicated in the Appendix Because the are part of the trackside design, an IM needs to determine a set of values that are suitable for a geographic region. By the nature of National Values, this will affect the performance of ETCS fitted trains operating on that infrastructure. Therefore, it is considered advantageous to have an industry-agreed method of proposing, evaluating, agreeing and making available new sets, or revising existing sets, of National Values. This standard fulfils that purpose. RSSB Page 7 of 74

8 Uncontrolled when printed This standard requires the IM who is introducing or revising the National Values to engage in consultation with neighbouring IMs and RUs who may be affected by the new National Values. The objective is to achieve harmonised operational practices across geographic regions This standard does not recommend specific values as National Values, but it does provide information to assist in determining a set of values, or evaluating the impact of a set of values In determining or revising a set of values, an IM will need to apply its own processes to manage safety and this will need to consider trains operating with the default set of values when the correct set for the geographic region is not available. Processes such as the Common Safety Method for Risk Evaluation and Assessment (CSM RA) will likely apply and the guidance in this standard will support these processes The CCS TSI requires that ETCS onboard equipment is compatible with any specific value of a National Value within the permitted range; once placed into service it is possible that the train may receive any permitted value of National Value during its lifetime. 1.3 Application of this document Compliance requirements and dates have not been specified since these will be the subject of internal procedures or contract conditions The Standards Manual and the Railway Group Standards (RGS) Code do not currently provide a formal process for deviating from a (RIS). However, a member of RSSB, having adopted a RIS and wishing to deviate from its requirements, may request a Standards Committee to provide opinions and comments on their proposed alternative to the requirement in the RIS. Requests for opinions and comments should be submitted to RSSB by to proposals.deviation@rssb.co.uk. When formulating a request, consideration should be given to the advice set out in the Guidance to applicants and members of Standards Committee on deviation applications, available from RSSB s website. 1.4 Health and safety responsibilities Users of documents published by RSSB are reminded of the need to consider their own responsibilities to ensure health and safety at work and their own duties under health and safety legislation. RSSB does not warrant that compliance with all or any documents published by RSSB as sufficient in itself to ensure safe systems of work or operation or to satisfy such responsibilities or duties. 1.5 Structure of this document This document sets out a series of requirements that are sequentially numbered This document also sets out the rationale for the requirement. The rationale explains why the requirement is needed and its purpose. Rationale clauses are prefixed by the letter 'G' Where relevant, guidance supporting the requirement is also set out in this document by a series of sequentially numbered clauses and is identified by the letter 'G'. 1.6 Approval and Authorisation The content of this document was approved by the Control Command and Signalling Standards Committee on 13 April This document was authorised by RSSB on 26 July Page 8 of 74 RSSB

9 Part 2 Requirements for 2.1 Proposal of a set of For a National Area under its responsibility, the IM shall propose a set of values of ERTMS/ETCS National Values, including the rationale for the determination of each value. Rationale G As are part of CCS trackside, the IM is responsible for deriving a set of to enable trains to operate acceptably. Guidance G Appendix A of this document gives guidance on determining the. G This requirement allows the IM to propose more than one set of within a National Area as there are operational situations where the provision of a different set of ERTMS/ ETCS National Values can provide safety or performance benefits. Examples of these operational situations include, but are not limited to: a) Changing the setting of M_NVCONTACT during data radio failures, or b) Adjusting a mode related ceiling speed on the approach to the border with another NID_C area, or c) Increasing the reverse movement limit for trains such as rail grinders or snow ploughs. G Where more than one set of can be applied within a National Area, the risks of trains having differing operational constraints have to be managed. G The values for the ERTMS/ETCS parameter NID_C, which define National Areas, are limited. When determining a set of, if the set has the same values as other National Areas which are under the responsibility of the same IM, consideration should be given to extending the National Area, instead of creating a new National Area. National Areas do not necessarily have to share a common boundary. G Complexity in operational rules and the potential of ETCS intervention are reduced if the set of is the same in bordering National Areas. 2.2 Consultation on the proposed The IM proposing any set of shall consult with all affected IMs and railway undertakings (RUs) about the proposed values. Rationale G Affected RUs and IMs are consulted to check that the impact on safety and performance is acceptable. Guidance G Affected IMs are those that have National Areas that border the National Area for which a set of values is being proposed. RSSB Page 9 of 74

10 Uncontrolled when printed G Affected IMs can also include those that have similar sets of. In order to avoid increasing the number of National Areas, an existing National Area which has a similar set of values can be extended (see G ). G Affected RUs include those that have track access agreements for the National Area. G Some continue to have an effect on ERTMS/ETCS fitted trains in areas that are not fitted with ERTMS/ETCS trackside equipment. Normally, when operating on lines not fitted with ERTMS/ETCS trackside equipment, ERTMS/ETCS fitted trains use the last set of ERTMS/ETCS National Values received. Affected IMs and RUs should take this into account when assessing the impact of a proposed set of. G Appendix A of this document gives guidance to affected IMs and RUs on assessing the impact of the proposed set of. 2.3 Consultation response on the proposed Affected IMs and RUs shall respond, explaining their opinions in relation to the proposed ERTMS/ ETCS National Values, in a timely manner. Rationale G Timely receipt of comments from affected IMs and RUs will enable optimisation of the proposed set of to be achieved. 2.4 Optimising National Values The IM proposing a set of values of shall determine an optimal set of values for a National Area, taking into consideration the responses from the affected IMs and RUs. Guidance G Appendix A of this document gives guidance on the factors to be considered when determining the optimal. 2.5 Publishing National Values The IM proposing a set of shall publish the new or revised ERTMS/ETCS National Values for the affected National Area. Rationale G When national values are created or revised it is important that those affected are advised in a timely manner by the IM proposing the change, in order that they can prepare for the impact of the change, if required. Page 10 of 74 RSSB

11 Appendices Appendix A A.1 Introduction A.1.1 This document does not set out. A.1.2 Research project T093 was conducted between 2003 and 2004, on behalf of the National ERTMS Programme. T093 specifically covered for Baseline 2, some of which is also applicable to Baseline 3. Each description of will indicate the applicable ERTMS/ETCS subset. A.1.3 During the development of this document, reports from the ERTMS national programme Braking Aspect Working Group were used as an input to derive guidance on the brake related ERTMS/ETCS National Values, as defined in Baseline 3. A.1.4 This appendix provides general guidance. For application in a specific National Area, consideration should be given to the characteristics of the particular area when determining the suitability of any individual value. A.1.5 Default values are applied only if are not available or there is a mismatch between the values onboard and the country or region identifier (NID_C) read from a balise group when compared to the corresponding identifier stored onboard. A.1.6 The set of is stored by the ERTMS/ETCS onboard equipment, even when the ERTMS/ETCS onboard equipment is switched off (NP), and re-used when powered on. A.1.7 When assessing the impact of values on driving behaviour, RUs will need to consider the information presented on the driver machine interface (DMI). A.1.8 The are set out in the following properties' tables and address Baseline 2 and Baseline 3 variables, as appropriate. A.2 Q_NVDRIVER_ADHES A.2.1 Summary Subset-026 values Subset-026 Default value Q_NVDRIVER_ADHES - Qualifier for the modification of trackside adhesion factor by driver 0 - Not allowed ; 1 - Allowed Not allowed Resolution Either 0 or 1 ETCS Baseline Baseline 2 Baseline 3 Used in modes UN, SR, OS, FS and SH UN, SN, SR, OS, FS, LS and SH Used in levels 0, 1, 2 and 3 0, NTC, 1, 2 and 3 Table 1: Q_NVDRIVER_ADHES RSSB Page 11 of 74

12 Uncontrolled when printed A The ERTMS/ETCS onboard braking model can be modified to take into account low adhesion by extending the calculated braking distance based on the maximum rate of deceleration set by ERTMS/ETCS National Value, A_NVMAXREDADH. This can be selected either: a) As commanded by trackside, or b) By the driver, if permitted, using the low adhesion function via the slippery rail ON/OFF control on the DMI. A Q_NVDRIVER_ADHES specifies whether the driver is allowed to select the use of the modified braking model. Irrespective of the Q_NVDRIVER_ADHES value, the trackside can command the ERTMS/ ETCS onboard equipment to modify the adhesion factor (as set out in Subset-026 and RSSB-ERTMS-OC). A.2.2 Safety considerations A ERTMS/ETCS can be configured to increase the calculated braking distance in low adhesion areas using the low adhesion functionality. Whether this functionality is used or not, is outside the scope of this document. If this functionality is used, it is possible to allow the driver to switch it on or off using the Slippery Rail controls on the ERTMS/ETCS DMI, that is, to either increase the calculated braking distance or revert to the normal braking distance. A The effect on the braking curves of switching the low adhesion function on is dependent on the values of A_NVMAXREDADH1/2/3 (see also A.19 A_NVMAXREDADH1, A_NVMAXREDADH2, A_NVMAXREDADH3 on page 45). If A_NVMAXREDAD1/2/3 are set to any of the three special values and the low adhesion function is switched on, the Slippery Rail indication will be displayed on the ERTMS/ETCS DMI, but the braking curves are not modified. In practice, adhesion varies widely across the infrastructure with both location and time. This variation is significant, even in areas where the adhesion is acknowledged to be low, and the modifications imposed on the braking curves if A_NVMAXREDADH1/2/3 are not set to the special values cannot be guaranteed to accurately reflect the actual braking conditions. A Regardless of whether the low adhesion function is switched on by the driver or commanded by the ERTMS/ETCS trackside, the information presented on the DMI may lead a driver to falsely believe that by following the information on the DMI the train can always be stopped before the end of its movement authority in any low adhesion condition. That said, where a driver becomes aware of low adhesion conditions (which may well be very localised), this potentially safety-critical information should be utilised as quickly and as widely as possible. On this basis, it could be appropriate to allow a driver to use the adhesion factor as an aid to driving the train more cautiously regardless of whether the braking curve is modified or not. A.2.3 Performance considerations A Applying a limiting deceleration factor, ERTMS/ETCS National Value A_NVMAXREDADH, has the effect of extending the braking distance calculated by the ERTMS/ETCS onboard equipment, which increases journey times; hence increases headway times and therefore reduces the line capacity. A.2.4 Discussion A A factor that may influence on whether to allow drivers to toggle the low adhesion function may be the ownership of responsibility in deciding where/when to apply the low adhesion function, or not to apply it at all. Regardless of who owns the responsibility to toggle the low adhesion function, there will still be a requirement for drivers to modify their behaviour in response to the available adhesion if safety and optimum performance are to be achieved. This is especially true when stopping a train where the stop is not supervised by ERTMS/ETCS, for example at station stops. A The advantages of permitting drivers to switch on/off the low adhesion function include: a) Allowing immediate local responses to patches of low adhesion. b) Providing a reminder to drivers of the need to take into account adhesion conditions in their behaviour where the reminder is not provided by the trackside. A The disadvantages include: Page 12 of 74 RSSB

13 a) The additional driver training required in determining the conditions under which this Slippery Rail function should be used. b) The possible misunderstandings by drivers on the limitations of the low adhesion function, with the potential for driving behaviour which is inappropriate for the conditions. c) Incorrect use of this function, either leaving it switched on when not required with consequential performance implications, or failing to switch it on in low adhesion conditions, thus missing the opportunity to reduce risk. d) Additional workload for the driver. A Further details on the setting of A_NVMAXREDADH are set out in A.19 A_NVMAXREDADH1, A_NVMAXREDADH2, A_NVMAXREDADH3 on page 45. There are other parameters, set out in section of Subset-026, that affect the ETCS braking model. While these have some similarities with other variables in this document, these are not part of the set and are outside the scope of this document. A.3 V_NVSHUNT, V_NVSTFF, V_NVONSIGHT, V_NVSUPOVTRP A.3.1 Summary A The four following are all related to mode speed limits and are therefore considered together in this section. Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVSHUNT - Shunting mode (permitted) speed limit 0 km/h 600 km/h 30 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes SH SH Used in levels 0, 1, 2 and 3 0, NTC, 1, 2 and 3 Table 2: V_NVSHUNT A V_NVSHUNT specifies a maximum speed to which the train is supervised when the ERTMS/ETCS onboard equipment is operating in the SH mode (see also RSSB-ERTMS-OC). When providing a movement authority with SH mode profile, the trackside also has the possibility of overriding the ERTMS/ETCS National Value via the V_MAMODE parameter within the mode profile packet. Subset-026 Minimum value Subset-026 Maximum value V_NVSTFF - Staff Responsible mode (permitted) speed limit 0 km/h 600 km/h RSSB Page 13 of 74

14 Uncontrolled when printed Subset-026 Default value Resolution V_NVSTFF - Staff Responsible mode (permitted) speed limit 40 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes SR SR Used in levels 1, 2 and 3 1, 2 and 3 Table 3: V_NVSTFF A V_NVSTFF specifies a mode-related speed restriction applicable to trains operating in SR mode. Other speed restrictions can also be supervised while in SR mode, as set out in Subset-026 section 4.5. Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVONSIGHT - On Sight mode (permitted) speed limit 0 km/h 600 km/h 30 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes OS OS Used in levels 1, 2 and 3 1, 2 and 3 Table 4: V_NVONSIGHT A V_NVONSIGHT specifies a mode-related speed restriction applicable to trains operating in OS mode. Other speed restrictions are also supervised while in OS mode. When providing a movement authority with OS mode profile, the trackside also has the possibility of overriding the ERTMS/ETCS National Value via the V_MAMODE parameter within the mode profile packet. Subset-026 Minimum value Subset-026 Maximum value V_NVSUPOVTRP - Permitted speed limit to be supervised when the 'override EoA' function is active 0 km/h 600 km/h Page 14 of 74 RSSB

15 Subset-026 Default value Resolution V_NVSUPOVTRP - Permitted speed limit to be supervised when the 'override EoA' function is active 30 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes SR, SH, SN, SE and UN SR, SH and UN Used in levels 0, STM, 1, 2 and 3 0, 1, 2 and 3 Table 5: V_NVSUPOVTRP A V_NVSUPOVTRP specifies the ceiling speed to which the train is supervised while the override function is active. Closely related to this national variable are D_NVOVTRP and T_NVOVTRP. A.3.2 Safety considerations A V_NVSHUNT - While the ERTMS/ETCS onboard equipment is operating in SH, only ceiling speed supervision is provided, with no distance supervision. In addition, there is no guarantee regarding the state of occupancy of the section in which the train is moving and, unlike FS or OS, SH does not necessarily provide any assurance of route protection from the interlocking. Inherently, shunting is an activity that is likely to involve movements up to other vehicles or within a possession. The responsibility for avoiding collisions (with vehicles, buffer stops or people on the track) resides with the person controlling the movement and the driver, and their compliance with appropriate working practices is crucial. In SH mode, the train needs to be controlled to stop short of an obstruction or at the end of the movement authority. The value for V_NVSHUNT should be set low enough to enable observation of the line so that the train can be stopped safely and short of any obstruction. A V_NVSTFF - When the ERTMS/ETCS onboard equipment is in SR, the ERTMS/ETCS onboard equipment has insufficient information to fully supervise the train movement. The driver is responsible for not exceeding the distance which the train is authorised to move, which will be marked by an ETCS stop marker. For example, it may be that the line ahead is occupied by another train or obstructed by some other obstacle, the Radio Block Centre (RBC) is unable to determine the location of the train or whether the train is the only train in the section (especially at start of mission). The value for V_NVSTFF should be set low enough to enable the driver to observe the line so that the train can be stopped safely and short of any obstruction. Otherwise there is the potential for a tripped train to exceed the overrun distance available. A Setting V_NVSTFF to be high would increase performance, but the distance which a train could travel in SR is limited by D_NVSTFF, see section (A.13 D_NVSTFF on page 31). Having a high V_NVSTFF and a short D_NVSTFF may not be an ideal combination as drivers may interpret a high speed to mean they have a longer distance to cover, which may not be the case. Trains operating in SR mode will be tripped by balise message Stop if in Staff Responsible. If a train is tripped while travelling close to a high ceiling speed, it will stop further beyond the trip location compared with a train that is limited to a lower ceiling speed. A V_NVONSIGHT - While the ERTMS/ETCS onboard equipment is operating in OS, the train receives a lesser degree of protection in comparison with FS. In particular, no guarantee regarding the occupation status of the sections through which the train is authorised to proceed is provided. Therefore, the primary protection against collision with obstacles resides with the driver of the train. From a safety perspective the value for V_NVONSIGHT should be set at a very low speed so that, by default, trains would travel at speeds from which they could stop within any sighting distance that would be encountered. RSSB Page 15 of 74

16 Uncontrolled when printed A V_NVSUPOVTRP - While the override function is active, the level of protection provided to a train by ERTMS/ETCS is reduced, because the event that would otherwise cause a train trip will not trip the train. In particular, the system will not enforce compliance with signals at danger in Level 1 and, similarly, the movement of trains without a movement authority in Level 2 will not be prevented. Consequently, the ERTMS/ETCS system does not provide any guarantee to the driver of a train with an active override that the track sections through which they are driving are unoccupied, nor that the points are set appropriately. The driver takes responsibility for the safety of their train (which may be in conjunction with the signaller if a written order has been issued) and the primary protection against collision and derailment is provided by the driver (this applies while override procedure is active, see Subset-026, section 5.8.4, and while operating in SR or SH). In order to ensure that the train can stop if any obstacle or inappropriately set points are encountered, the speed of the train should always be low enough that it can be stopped within sighting distance. A V_NVSHUNT, V_NVSTFF, V_NVONSIGHT and V_NVSUPOVTRP are maximum supervised speeds, they are not necessarily target or line speeds. A.3.3 Performance considerations A The actual impact on performance made by the value of V_NVONSIGHT depends upon the difference between it and the line speed. From a performance perspective, the optimum value is the largest speed within the constraint of safety. This is true for V_NVSTFF, V_NVSHUNT and V_NVSUPOVTRP. A If the value of V_NVSUPOVTRP is greater than or equal to that of V_NVSHUNT, V_NVSTFF and V_NVUNFIT it will have no impact on performance, as these would be used to derive the ceiling speed to which the train is supervised instead. A If permitted by operational rules, the driver can adjust the value of the SR ceiling speed supervision, irrespective of the value of V_NVSTFF. A.3.4 Discussion A V_NVSHUNT, V_NVSTFF, V_NVONSIGHT and V_NVSUPOVTRP are ceiling speeds and not target speeds, and drivers should be trained to concentrate on driving at a speed appropriate to the conditions and activity. The value of V_NVSHUNT, V_NVSTFF, and V_NVONSIGHT can be shown on the DMI as the 'Basic Speed Hook' in their respective mode, but only when the driver toggles it on, as the default setting is off (not displayed). A In SH or OS mode, the trackside has the capability to send a Movement Authority to the ETCS onboard, which contains the SH or OS mode profile, along with a V_MAMODE; when accepted, speed proposed by V_MAMODE will override V_NVSHUNT or V_NVONSIGHT. This also applies to V_ NVLIMSUPERV see section A on page 19. A Safety and operational considerations suggest that the value for all four parameters is the maximum speed from which any train could be brought to a standstill within the available sighting distance. However, the available sighting distance differs between locations, weather and, potentially, varies with time. Driving at an appropriate speed remains the driver's responsibility; ETCS provides a mechanism to reduce the risk associated with overspeed through the selection of appropriate values for V_NVSHUNT, V_NVSTFF, V_NVONSIGHT and V_NVSUPOVTRP. A The risk for the four speeds may be different, depending on the circumstances in which the mode is applied. Independent risk assessments should be taken for each speed. The specific values used would depend upon the specific circumstance within the National Area. The DMI only displays the maximum supervised speed in OS and SR on request from the driver. A If different values for the respective speed variables are used, the trackside application design should consider the implications of a different value for V_NVSTFF compared to V_NVONSIGHT when a train is running in SR and transitions to OS as a precursor to FS. If V_NVSTFF has a higher value than V_NVONSIGHT, an intervention could result (this is also true if the driver has selected an SR speed value greater than V_NVONSIGHT). Page 16 of 74 RSSB

17 A.4 V_NVUNFIT A.4.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVUNFIT - Unfitted mode (permitted) speed limit 0 km/h 600 km/h 100 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes UN UN Used in levels 0 0 Table 6: V_NVUNFIT A V_NVUNFIT specifies a ceiling speed to which the train is supervised while the ERTMS/ETCS onboard equipment is in UN; other speed restrictions might also be supervised while in UN (see subset-026 section 4.5). A Unfitted mode is used to allow train movements in areas either: a) That are equipped neither with ERTMS/ETCS trackside equipment nor with a national train control system(s), or b) That are equipped with ERTMS/ETCS trackside equipment and/or a national train control system(s), but operation under their supervision is currently not possible. A The Class 158s and 97s that operate in Level 2 on the Cambrian Line are ETCS Baseline 2 and have been configured to operate in Level 0 UN elsewhere. A.4.2 Safety considerations A When an ERTMS/ETCS fitted train is operating in UN in Baseline 3, it is driven with no trackside train protection system, including Class B systems such as AWS/TPWS; whereas in Baseline 2, UN can be used in conjunction with these national train protection systems to control overspeed and/or enforce movement authorities. A In UN mode in Baseline 3 the safe movement of a train is reliant on operational procedures. The best contribution to safety that ERTMS/ETCS can make is to supervise the train speed to the value that is permitted under the procedures applicable while operating with no train protection system. A For Baseline 2 trains, V_NVUNFIT is not providing a safety function, as this is provided by Class B systems. V_NVUNFIT therefore has to be set to accommodate the highest permissible speed in the National Area. A A TSR sent by a balise group will override V_NVUNFIT and reduce the speed of the train in UN mode, to cope with specific situations such as engineering works. RSSB Page 17 of 74

18 A.4.3 Performance considerations A From a performance perspective, the optimum value, in Baseline 3, for the parameter V_NVUNFIT is a value that allows the train to move at a speed that is permitted by operational procedures while there is no train protection system. A In Baseline 2, because UN can be used in conjunction with Class B systems, V_NVUNFIT should be set at the highest permissible speed in the National Area. A.4.4 Discussion A The UN mode has different applications depending on whether Baseline 2 or 3 is implemented at the trackside. When setting V_NVUNFIT the IM has to consider the available train protection system(s) and the level of protection that it provides. In the absence of protection systems, V_NVUNFIT has to be set low enough to enable drivers to control the train to a safe stop. A.5 V_NVLIMSUPERV A.5.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVLIMSUPERV - Limited Supervision mode (permitted) speed limit 0 km/h 600 km/h 100 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A LS Used in levels N/A Level 1, 2 and 3 Table 7: V_NVLIMSUPERV A V_ NVLIMSUPERV specifies a mode-related speed restriction applicable to trains operating in LS mode. Other speed restrictions are also supervised while in LS mode. When providing a movement authority with LS mode profile, the trackside also has the possibility of overriding the ERTMS/ETCS National Value via the V_MAMODE parameter within the mode profile packet. A.5.2 Safety considerations A When an ERTMS/ETCS fitted train is operating in LS, some signalling information for the driver comes from sources other than ERTMS/ETCS. A V_NVLIMSUPERV may be different to the line speed. Drivers may misinterpret V_NVLIMSUPERV as the line speed. Safe operation depends on some form of signalling system that is independent of ERTMS/ ETCS and on the associated operational practices. For example, safe operation may depend on the driver obeying lineside signals and line speed restriction indicators, possibly supported by warning and / or protection systems. A.5.3 Performance considerations A From a performance perspective, the optimum value for the parameter V_NVLIMSUPERV is the least restrictive one. Page 18 of 74 RSSB

19 A.5.4 Discussion A Whatever the maximum allowed speed values apply for Class-B trackside signalling systems, that maximum speed could be also the value for V_NVLIMSUPERV. Given that ERTMS/ETCS fitted trains will be expected to operate without restriction on these other systems at today's speeds, the value of V_NVLIMSUPERV should not be less than the maximum allowed for those systems. A In LS mode, the trackside has the capability to send Movement Authorities to the ERTMS/ETCS onboard. The speed variable V_MAMODE parameter when sent together with the relevant MA replaces the ERTMS/ETCS National Value for V_NVLIMSUPERV. This also applies to V_NVSHUNT or V_NVONSIGHT (see section A on page 16). A.6 V_NVREL A.6.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVREL - Release Speed (permitted) speed limit 0 km/h 600 km/h 40 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes FS, OS and LS FS, OS and LS Used in levels Levels 1, 2 and 3 Levels 1, 2 and 3 Table 8: V_NVREL A V_NVREL specifies the ERTMS/ETCS National Value of the release speed. V_NVREL is only used when commanded from the trackside. In general, a release speed can be used where a close approach to the End of Authority (EoA) is required. A.6.2 Safety considerations A Where V_NVREL is used as the release speed, the train is only guaranteed to stop before reaching the supervised location in the event of a train trip when an appropriately restrictive value is used. The value should be such that the fitted train with the poorest deceleration is able to stop within the distance that separates the EoA and supervised location, at the location on the infrastructure where this distance is shortest and the down-hill gradient is steepest. A When setting V_NVREL, how a driver interprets the release speed may need to be considered. A release speed which satisfies A on page 19, but is still relatively high, could be mistakenly interpreted by the driver as an MA extension, leading to the train passing the EoA and being tripped, resulting in secondary hazards such as passenger slips, trips and falls or traction and braking shocks. A.6.3 Performance considerations A In general, the larger the value of the release speed used, the lower the impact on performance, as a driver will be able to make an approach to the EoA/LoA at a higher speed. However, the faster the approach to the EoA/LoA, the more likely a train trip is. Train trips will have a significant impact upon operational performance, as recovery action will be required. The highest release speed that allows a train RSSB Page 19 of 74

20 Uncontrolled when printed to make reasonable progress towards the EoA/LoA, while being sufficiently low to reduce the likelihood of a train trip occurring, is probably the optimum value from the perspective of performance. A.6.4 Discussion A V_NVREL is relevant if the ERTMS/ETCS trackside instructs the ERTMS/ETCS onboard to use the ERTMS/ETCS National Value when approaching an EoA, or on expiry of a section timer. It is also possible for the trackside to define a value to be used by the ETCS on-board as the release speed or to instruct the ETCS on-board to calculate its release speed for the on-board to use when approaching an EoA. A V_NVREL is set by the IM to control the likelihood of passing the SvL at location(s) where V_NVREL is not superseded by release speed values calculated by ETCS onboard or one that is associated with a particular danger point. When setting the value for V_NVREL, the IM should consider reduced adhesion or degraded mode of the rolling stock. A Setting V_NVREL to be very low might be difficult from a drivability point of view on specific train types. A.7 D_NVROLL A.7.1 Summary Subset-026 Minimum values Subset-026 Maximum values Subset-026 Default value Resolution D_NVROLL - Roll away distance limit 0 cm km or 2 m 10 cm, 1 m, or 10 m depends on Q_SCALE ETCS Baseline Baseline 2 Baseline 3 Used in modes FS, OS, PT, RV, SB, SH, SR, UN FS, OS, PT, RV, SB, SH, SR, UN Used in levels 0, 1, 2 and 3 0, 1, 2 and 3 Table 9: D_NVROLL A D_NVROLL defines the maximum distance that a train can travel before the ETCS onboard initiates a brake command as part of the Roll Away Protection, Reverse Movement Protection, or Standstill Supervision functions, see Subset-026 section , , A.7.2 Safety considerations A The movement of a train in an unexpected direction (or an unexpected train movement) represents a potential hazard. A potential hazard could arise, for example, where a train has been stopped near to a set of points, at a platform to allow passenger movement, near another train, near buffer stops or in the vicinity of trackside workers. A No value of D_NVROLL can ensure roll away protection, reverse movement protection, or standstill protection is effective. Even a zero D_NVROLL value could allow some movement if the measurement of movement is subject to non-zero error. Page 20 of 74 RSSB

21 A The smaller the D_NVROLL value used, the shorter the distance that a train will move and the lower the speed attained, before the brakes are commanded. Thus, while collisions could still occur, the consequences associated with a collision would be limited. A Train brake failure might cause a train to roll away, but in these circumstances ETCS protection might be ineffective as it could be relying on applying protection through the defective braking system. A In a situation where a rolling train moves into a position where it could foul other train movements on the infrastructure, its speed has less relevance than its specific location. In general, even in this situation, low values of D_NVROLL of the order of small numbers of metres will present low levels of risk, as some tolerance is incorporated into the design of the signalling infrastructure. A In the case of coupling / uncoupling movements (see A on page 21), the value of D_NVROLL is not considered to have an impact on the safety of personnel involved in supporting coupling and uncoupling, as the rules controlling this activity expressly forbid staff from going between the vehicles during 'ease-up' movements unless they are absolutely sure that the vehicles cannot move. A.7.3 Performance considerations A The use of a small value for D_NVROLL could result in emergency brake applications being made in response to small movements with no potential impact on safety or in response to an odometry error. In that event, depending upon the implementation of the train's braking system, the driver might not be able to release the brake and move the train for some time even after acknowledging the application. This could introduce a significant impact on performance. A In addition, the use of too small a value of D_NVROLL could introduce operational difficulties in situations where the stationary locomotive of a freight train attempts to commence an uphill movement. It is possible that, in this case, the locomotive may be dragged downhill by the weight of the train as the train's brakes are released and before it has the opportunity to develop sufficient power and traction to move in the desired direction. This downhill movement would result in the train's brakes being applied if the downhill movement of the locomotive exceeded the value of D_NVROLL. A A non-zero value of D_NVROLL can be exploited to facilitate coupling and uncoupling operations in SB, thus avoiding the need for start of mission activities. This might have operational advantages in cases where the driving cabs being used to support the coupling or uncoupling movement are not those that the train will be driven from immediately before or after the coupling / uncoupling movement. A.7.4 Discussion A The value for D_NVROLL from both the safety and performance perspectives is one that is small enough to restrict the risk presented by inappropriate train movement to an acceptable level, while being large enough to reduce instances of undesired brake application to an acceptable level. A In general, specifying a low value for D_NVROLL would ensure that, in most such cases, collisions between trains caused by roll away or unexpected train movements would be avoided or would occur at very low speeds. However, setting the value too low may potentially cause problems where a level of roll back is inevitable, for example, where a heavy freight train is undertaking a hill start on a rising gradient. A RSSB document ERTMS National Values-D_NVROLL records previous research carried out on the selection of the value for D_NVROLL. A Train management systems independent of ERTMS/ETCS may provide similar roll away, standstill and reverse movement protection. The parameters that configure these existing systems may help inform the process of the selection of the value of D_NVROLL. There may be implications on train operation if the train management systems independent to ERTMS/ETCS use different values. A In practice, for low values of D_NVROLL, roll away, reverse movement and, in particular, standstill protection will be limited by the precision and sensitivity of the odometry system. RSSB Page 21 of 74

22 Uncontrolled when printed A.8 V_NVALLOWOVTRP A.8.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution V_NVALLOWOVTRP - Maximum speed limit allowing the driver to select the 'override EoA' function 0 km/h 600 km/h 0 km/h 5 km/h ETCS Baseline Baseline 2 Baseline 3 Used in modes FS, OS, PT, SB, SE, SH, SN, SR, UN FS, LS, OS, PT, SB, SH, SN, SR, UN Used in levels 0, STM, 1, 2 and 3 0, NTC, 1, 2 and 3 Table 10: V_NVALLOWOVTRP A V_NVALLOWOVTRP specifies the maximum train speed above which the driver's request for initiation of the train trip override function will be rejected. A An override may be required where, for example: Either: a) In Level 2, a train is stopped without an (MA) and no MA extension can be received (for example, after having received an emergency message, or after a train trip). b) In Level 2, a train is stopped at the border between two adjacent RBCs (for example, the interface between RBCs is unavailable). c) In Level 2, a train is stopped after having passed the border between two adjacent RBCs (for example, the connection to the accepting RBC cannot be established). d) In Level 2, the RBC is unable to give a permission to run (for example, lost connection with the interlocking). e) In Level 1, a signal cannot show a proceed aspect (for example, signal failure, route cannot be set). Or: a) In Level 1, a train is stopped without an MA (for example, after the MA has been shortened due to a time out). b) In Level 0, Level STM, or Level NTC when transitioning into a Level 1 or Level 2 area and an MA is not available. A Override procedure avoids a train trip, for example, when passing an EoA and when passing a balise group containing the following message(s): a) Transmitting 'stop in SR'. b) Not contained in the list of expected balises in SR. c) Transmitting 'stop in SH'. d) Not contained in the list of expected balises in SH. e) Overpassing the SR distance (see also D_NVSTFF). Page 22 of 74 RSSB

23 A The trainborne equipment does not permit a request for an override if the train speed is greater than the value of the parameter V_NVALLOWOVTRP. Activation of the override places the train in SR, unless the train is in SH, in which case its mode will not change (see also Subset-026 section Mode Transitions) or unless the train is in SN or UN, in which case the train remains in SN or UN until a transition border is passed when it then switches to SR. A.8.2 Safety considerations A While the override is active, responsibility for the subsequent movement of the train past the point where, otherwise, the train would have tripped, rests with the driver. In order to discharge this responsibility, the driver has to establish the reason why the override is required and the conditions that apply. ERTMS/ ETCS specifications assume that a driver would only request such an override once, and after having been provided with the required information. A If the driver requests override on the move, the driver may mistakenly proceed beyond the intended limit of the movement, which may result in harm. A.8.3 Performance considerations A From a performance perspective, the optimum value is one that places no additional restriction on the movement of a train. In practice, it is anticipated that the request for an override would be made from a position close to the location where the train trip would otherwise occur (certainly within D_NVOVTRP) where the permitted speed would be low in any case, in anticipation of the requirement to stop. A.8.4 Discussion A It is unusual for a train to need to request an override unless it is stationary, although it is possible that a higher speed could be tolerated, particularly for certain degraded mode operations such as working by pilotman or for operation of trains in engineering possessions. A It may be difficult for the driver to judge where to select override while the train is travelling at speed, and being within the distance (D_NVOVTRP) and time (T_NVOVTRP) windows during which override remains available. Therefore, the driver may request override too early causing the override to expire too early, resulting in the train being tripped. A Possible values could be determined using a similar logic as for the values of V_NVSHUNT, V_NVONSIGHT, V_NVSUPOVTRP and V_NVSTFF (see A.3 V_NVSHUNT, V_NVSTFF, V_NVONSIGHT, V_NVSUPOVTRP on page 13). This could apply in the case of working in possessions or temporary block working. A Generally, it is probable that a request for an override will be made when the train is at standstill, irrespective of the value of V_NVALLOWTRP (requesting an override might require a written order for which the train should be at standstill). A.9 D_NVOVTRP, T_NVOVTRP A.9.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution D_NVOVTRP - Maximum distance for overriding the train trip 0 cm km 200 m 10 cm, 1 m or 10 m depending on Q_SCALE RSSB Page 23 of 74

24 Uncontrolled when printed D_NVOVTRP - Maximum distance for overriding the train trip ETCS Baseline Baseline 2 Baseline 3 Used in modes SE, SH,SN, SR and UN SH, SN, SR and UN Used in levels 0, STM, 1, 2 and 3 0, NTC, 1, 2 and 3 Table 11: D_NVOVTRP A D_NVOVTRP defines the maximum distance for which the train trip function may be disabled after the override function has been invoked. Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution T_NVOVTRP - Maximum time for overriding the train trip 0 s 255 s 60 s 1 s ETCS Baseline Baseline 2 Baseline 3 Used in modes SH, SN, SR and UN SH, SN, SR and UN Used in levels 0, STM, 1, 2 and 3 0, NTC, 1, 2 and 3 Table 12: T_NVOVTRP A T_NVOVTRP is an ERTMS/ETCS National Value that specifies the maximum time that the train may travel with the train trip function disabled after the override function has been invoked. A The override function remains active until (the full list of events which terminate override function is set out in SRS ): a) Time T_NVOVTRP since the override function was activated has expired; or b) The train has travelled a distance D_NVOVTRP from where the override function was activated; or c) A trip event is overridden; or d) A further MA has been given to the train to pass beyond the location where it would have tripped the train if override was not activated. A Both parameters are closely related to V_NVSUPOVTRP, which defines the maximum speed at which the train is permitted to travel while the train trip function is disabled after the override function has been invoked. This parameter was set out in A.3 V_NVSHUNT, V_NVSTFF, V_NVONSIGHT, V_NVSUPOVTRP on page 13. A.9.2 Safety considerations A The train trip function provides a safety control to bring a train to a stand before a point of conflict. The inhibition of the trip function overrides this safety control and therefore has potentially Page 24 of 74 RSSB

25 adverse safety implications if it is active when it should not be. The inhibition of the train trip function therefore should be kept to as short a period as possible, commensurate with the achievement of the operational activity for which the override was requested. A Consequently, the preferred value of D_NVOVTRP is one that restricts the override as closely as possible to that specific location where the train trip would otherwise occur. In principle, passing the point at which the train trip would occur should terminate the override. In practice, in Level 1 or Level 2, there could be failure modes whereby, for example, a balise that is expected to enforce a train trip, for some reason may not. For this reason, from a safety perspective, the optimum values of D_NVOVTRP and T_NVOVTRP are ones that are as small as possible, commensurate with the achievement of the operational requirement in support of which the override has been requested. A Consideration is needed on the safety implications of enabling trains to proceed with the train trip function inhibited, and the rules, restrictions and training that will be needed to fully mitigate that risk (while the override is active, the train will not respond to train trips). A.9.3 Performance considerations A Although these two are closely associated with one another, D_NVOVTRP is considered to be the dominant factor when setting the values. After setting D_NVOVTRP, T_NVOVTRP can then be set by considering the time needed for a slow accelerating train setting off from rest to cover a distance of D_NVOVTRP. The aim is to decrease the probability of a slow accelerating train from being tripped because T_NVOVTRP expires before the train reaches the point where the override is required. A As set out above, the inhibition of the train trip function has safety implications and therefore should be kept to as short a distance and time as possible, commensurate with the achievement of the operational activity for which the override was requested. A The value of T_NVOVTRP would have a significant impact upon performance if it is too small to allow the train to reach the point where no disruptive performance impact can occur. If it is too small, then either an unwanted train trip will occur or it will be necessary to invoke the override function again. Potentially, either event is disruptive. A From a performance perspective, the values used for both parameters should be large enough to ensure that no problems occur in practice; any further increase in the value confers no benefit. However, there are safety considerations of providing the ability for a train to proceed with the train trip function inhibited. A.9.4 Discussion A As set out above, when considering the train trip function and its override, location and distance are more relevant than time and duration. A The preferred value of D_NVOVTRP is one that restricts the override as closely as possible to that specific location where the train trip would otherwise occur. A Significant performance impact would be experienced where T_NVOVTRP presented a driver with insufficient time to commence the movement and pass the tripping location before the override function timed out. A It is therefore proposed that the extent of the override be limited by selection of the appropriate value of D_NVOVTRP, and that T_NVOVTRP should be given a value that ensures that it has the minimum restrictive impact on performance. RSSB Page 25 of 74

26 Uncontrolled when printed A.10 M_NVDERUN A.10.1 Summary Subset-026 values Subset-026 Default value Resolution M_NVDERUN - Enter of Driver ID permitted while running 0 - no; 1 - yes 1 - yes N/A ETCS Baseline Baseline 2 Baseline 3 Used in modes FS, NL, OS, SR, SB, UN, PT, SE and SN FS, LS, NL, OS, SR, SB, UN, PT, SN and SH Used in levels Levels 0, STM, 1, 2 and 3 Levels 0, STM, 1, 2 and 3 Table 13: M_NVDERUN A M_NVDERUN specifies whether a driver ID can be entered into the DMI while the train is moving. A The driver ID is a number of up to eight digits, which is entered and validated as a part of the ERTMS/ETCS start of mission procedure. This procedure is invoked when the driving desk is opened. A If the parameter M_NVDERUN has the value 'yes', then it is possible to change the driver ID when the train is moving; if the value is 'no', then it is possible to change the driver ID only while the train is stationary. A.10.2 Safety considerations A The purpose of the driver ID is not, primarily, a safety related one. Therefore, if there is a mismatch between the identity of a driver and the driver ID held by the ERTMS/ETCS onboard equipment, then the consequences are not safety critical. Entering a driver ID while the train is moving carries with it a level of risk, because this data entry task could distract the driver from the primary function of driving the train. A.10.3 Performance considerations A The impact on performance of not allowing a driver to enter the driver ID while the train is moving depends upon the action that is expected of the driver when the discrepancy arises. The impact could be significant if the driver is required to bring the train to a standstill at the earliest safe opportunity and to enter the correct driver ID. This could result from driver relief in traffic at an intermediate station where rapid changeovers are required. A.10.4 Discussion A There are situations in which it would be undesirable for the driver to enter the driver ID while the train is in motion. This could be mitigated by the application of operational procedures, professional driving policies or other associated governance methods. This is done in some cases, with instructions and training for entering alphanumerical data into equipment such as train management systems or train radio systems. If permitted by M_NVDERUN, the driver decides when it is appropriate to enter the driver ID while on the move. Page 26 of 74 RSSB

27 A.11 M_NVCONTACT, T_NVCONTACT A.11.1 Summary M_NVCONTACT - Onboard reaction when T_NVCONTACT expires Subset-026 Values 00 - Train trip; 01 - Service brake application; 10 - No reaction; 11 - Spare Subset-026 Default value Resolution 10 - No reaction N/A ETCS Baseline Baseline 2 Baseline 3 Used in modes FS and OS FS, OS, and LS Used in levels 2 and 3 2 and 3 Table 14: M_NVCONTACT A M_NVCONTACT defines the action that is to be taken if the ETRMS/ETCS onboard equipment remains out of contact with the RBC equipment for a period defined by T_NVCONTACT. Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value T_NVCONTACT - Maximum time without new 'safe' message. 0 s 254 s or Resolution 1 s (between 0 s and 254 s) ETCS Baseline Baseline 2 Baseline 3 Used in modes FS and OS FS, OS, and LS Used in levels Levels 2 and 3 Levels 2 and 3 Table 15: T_NVCONTACT A T_NVCONTACT defines the critical time for which the ERTMS/ETCS onboard equipment can remain out of contact with the RBC before the ERTMS/ETCS onboard equipment takes the action defined by M_NVCONTACT. A.11.2 Safety considerations A While the ERTMS/ETCS onboard equipment is out of communication with the RBC, it is not possible for the ERTMS/ETCS onboard equipment to receive and respond to a safety-critical ERTMS/ ETCS message, for example, an emergency stop command. If the value of the parameter M_NVCONTACT is 'No RSSB Page 27 of 74

28 Uncontrolled when printed reaction', then any train that is out of communication with the RBC equipment is able to continue until it reaches the end of its MA or until communication is re-established, no matter how long these take. A From a safety perspective this may be suboptimal, but the actual impact on safety will depend upon the frequency and extent of radio gaps, holes or interruptions, the extent of movement authority typically maintained ahead of trains, and the topography and features of the route. Another critical factor is the probability that a safety-related need will arise to withdraw or reduce any movement authority once it has been provided. A In a system based on radio communication, relatively frequent confirmation that it is still safe to proceed is a possibility in most locations. However, there could be safety implications requiring locationspecific assessment, where a train may be brought to a stand in an unsuitable location or may be caused to decelerate rapidly. A From a safety perspective, the smaller the value of T_NVCONTACT the better, because the exposure to the risk from not being able to implement an ETCS emergency stop will be shorter. The shortest practicable time should not be less than the minimum period between the receipt of two consecutive trackside messages, as this will result in the reaction defined by M_NVCONTACT. A.11.3 Performance considerations A From a performance perspective, the optimum value of the parameter M_NVCONTACT is 'No reaction', because this allows the train to continue to the end of the currently held movement authority, even if the ERTMS/ETCS onboard equipment is out of contact with the RBC equipment. If, as set out above, the value 'No reaction' is undesirable, the use of the value 'Service brake' has less of a performance impact than that of 'Train trip' because the receipt of a new message before the train is at a stand will release the brakes and allow the train to continue. A From a performance perspective, the optimum value of T_NVCONTACT is the largest possible value, because this will make railway operation more tolerant of communication failures. The actual performance benefit arising from large values of T_NVCONTACT depends on, amongst other things, the extent of the movement authority that ERTMS/ETCS maintains ahead of trains. No additional performance benefit is achieved by using values of T_NVCONTACT greater than the time at which the movement authority is otherwise removed (for example, the time at which the train reaches the EoA/LoA or the time at which the MA times out, if at all). A At the other extreme, using a value of T_NVCONTACT that is less than the expected period between 'safe' messages might have a significant effect on performance, because the action defined by M_NVCONTACT would be implemented before the receipt of each such message. Performance might be especially adversely affected if M_NVCONTACT is 'Train trip' or 'Service brake'. A The values of T_NVCONTACT and M_NVCONTACT potentially affect the probability of operating in a degraded mode when recovering from the action specified by M_NVCONTACT. Degraded mode operation will have an impact on performance. A.11.4 Discussion A M_NVCONTACT and T_NVCONTACT are closely linked, and the impact of the value selected for each of them will depend, to some extent, upon the value of the other. The settings of these ERTMS/ETCS National Values may depend on the design of the railway s wider system and its operational concept. If the system has been designed to tolerate temporary unannounced radio holes/gaps/interruptions, and is supported by the operational concept and training, then it may be argued that no braking reaction is required, thus the consideration of the time element is irrelevant. A Using 'No reaction' value for M_NVCONTACT in implementations is generally based upon the assumption that the frequency of coincidental radio disruption and the need to withdraw or reduce MA held by the train will be very low. The following are factors for consideration when intending to use No reaction option for the parameter M_NVCONTACT: Page 28 of 74 RSSB

29 a) Depending upon the extent of the MA set ahead of the train and the extent of the radio disruption, the train may be allowed to proceed for a significant extent without the opportunity to affect its progress. b) Although, in case of Emergency Stops (see Subset-026 section 3.10), the ERTMS may not rely entirely on sending Emergency Stop messages but also on the use of the Global System for Mobile Communications - Railway (GSM-R) voice communication (Emergency calls), a common mode failure in the radio system or reception may lead to a loss of both data and voice communications. A The choice of the value ('Train trip', 'Service brake', 'No reaction') could differ for different categories of line, as there are marked differences between risks associated with high-speed main lines and rural routes, including the arrangements for recovering from the reaction defined by M_NVCONTACT. A In the case of an area with radio disturbance, the impact on performance depends on both the duration and the spatial extent of the disturbance. A potentially significant impact on performance arises where a localised failure, such as the failure of a radio mast, results in the creation of a 'radio-hole'. If the value of T_NVCONTACT is insufficient to allow a train to cross the 'hole', then the train is trapped until the failed equipment is repaired or the train is able to leave the 'hole' with the ERTMS/ETCS onboard equipment in an appropriate mode. A Regarding T_NVCONTACT, from a safety perspective, the smaller the value the better. However, the impact on performance is reduced as the value used increases. In the extreme, where the value of T_NVCONTACT exceeds the time likely to be required to reach the extent of the MA provided (or exceeds the extent time-out normally provided with MAs), there will be no impact on performance. A The reaction of the RBC and interlocking to a loss of contact should be considered. If both these assume that an MA once issued remains with the train until the train reports otherwise, then system integrity can be maintained. If either use time-out logic, then this might need to be replicated on the train. The value of T_NVCONTACT would be chosen such that: a) It is greater than the expected period between the ERTMS/ETCS onboard equipment receiving successive 'safety' messages. b) It is greater than the period required to recover from a radio drop-out. c) It is greater than the time required to cross 'radio holes' caused by failures of a single radio mast or a single base transceiver station. d) It is not significantly greater than the typical time required to reach the EoA/LoA. A The above is for un-planned radio holes/gaps/interruptions. In case of an area with inadequate radio coverage, the infrastructure can be designed so that a train can be instructed, via 'Packet Number 68: Track Condition' to stop supervising T_NVCONTACT for a defined geographical extent in order to allow a train to progress through a known radio hole. A V_NVREL is set by the IM to control the risk of passing the SvL at location(s) where V_NVREL is not superseded by release speed values calculated by ETCS onboard or one that is associated with a particular danger point. When setting the value for V_NVREL, the IM should consider reduced adhesion or degraded mode of the rolling stock. A.12 D_NVPOTRP A.12.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value D_NVPOTRP - Maximum distance for reversing in Post Trip mode 0 cm km 200 m RSSB Page 29 of 74

30 Uncontrolled when printed Resolution D_NVPOTRP - Maximum distance for reversing in Post Trip mode 10 cm, 1 m or 10 m depends on Q_SCALE ETCS Baseline Baseline 2 Baseline 3 Used in modes PT PT Used in levels Levels 1, 2 and 3 Levels 1, 2 and 3 Table 16: D_NVPOTRP A D_NVPOTRP specifies the maximum distance for which a train may reverse while the ERTMS/ ETCS onboard equipment is in PT. In PT, the ERTMS/ETCS onboard equipment allows train movement only in the reverse direction. If the distance travelled by the train exceeds that given by D_NVPOTRP, the ERTMS/ETCS onboard equipment initiates a service brake application so as to limit any further reverse movement. The train trip is inhibited during the reversing movement. A.12.2 Safety considerations A A train trip is used to try to maintain the safety of railway operation when a potentially dangerous situation has been detected. The use of the train trip is based on the assumption that, when the potential danger has been detected, stopping the train as quickly as possible minimises the probability that the potential danger will become an actual danger and / or reduces the consequence of such a danger. A There may be scenarios where the ability to move the train following a train trip may actually reduce the risk. For example, a train suffers low adhesion and passes a signal at danger and the onboard equipment invokes a train trip. Eventually, the train would come to rest at a position that cannot be controlled by the driver, possibly in the path of another train in a conflicting route. Such movements are always subject to authorisation by the signaller, in accordance with the Rule Book. A.12.3 Performance considerations A The only performance benefit offered by the parameter D_NVPOTRP is the ability to make a reversing movement more quickly following a train trip, because the movement can start without a change in operating mode, that is, the movement can be made while the ERTMS/ETCS onboard equipment is still in PT. A This performance benefit would be fully realised only if the value of D_NVPOTRP is sufficient for any train to complete the required reverse movement. If the distance that the train is required to reverse is greater than D_NVPOTRP, then the movement cannot be completed without invoking a (service) application of the brakes and, ultimately, without a mode change; such a situation is likely to negate the apparent advantage. A.12.4 Discussion A As set out in A.12.2 Safety considerations on page 30, train drivers are only permitted to reverse when authorised to do so by the signaller, in accordance with the Rule Book. A If reverse movement in PT mode is not permitted, that is, the national value is set to 0 m, any operational need for the train to reverse following a train trip would require a change in driving cab and completion of the Start of Mission procedure, or a mode change. Depending on the implementation, the mode change, for example to shunting mode, may additionally require authorisation by the signaller. A Permitting reversing in PT mode may deliver the operational flexibility to perform authorised reverse movements without requiring a mode change, but its use can only be controlled procedurally. There Page 30 of 74 RSSB

31 is no technical means to prevent a driver reversing a train in PT mode if the value is non-zero, only to limit the extent of the move through the implementation of the required value. A.13 D_NVSTFF A.13.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution D_NVSTFF - Maximum distance for running in Staff Responsible mode 0 cm km or 10 cm, 1 m or 10 m depends on Q_SCALE ETCS Baseline Baseline 2 Baseline 3 Used in modes SR SR Used in levels 1, 2 and 3 1, 2 and 3 Table 17: D_NVSTFF A D_NVSTFF specifies the maximum distance for travelling in SR in the absence of a distance received from the RBC or entered by the driver. A.13.2 Safety considerations A When the ERTMS/ETCS onboard equipment is in SR, the ERTMS/ETCS onboard equipment has insufficient information to fully supervise the train movement. The risk associated with movement in this mode is mitigated by the application of operational procedures and the supervision of the train to a ceiling speed (the ERTMS/ETCS National Value V_NVSTFF by default). A In practice, since the ERTMS/ETCS onboard equipment will leave SR as soon as conditions allow, there is no obvious safety risk associated with specifying a value for D_NVSTFF that exceeds that required to achieve the specific operational objective that is being addressed. Similarly, specifying a value that is insufficient to allow a train to achieve the specific operational objective has no direct safety impact since, once the train had been brought to a standstill, the distance that could be travelled could (and presumably would) be extended in any case. However, there could be safety implications due to the location where a train is brought to a stand or the way in which a train is brought to a stand, especially if this is as a result of rapid deceleration. A Depending on the specific circumstances, the ERTMS/ETCS onboard equipment might not be able to leave SR (for example, if it is due to GSM-R or RBC failure). Allowing the train to continue for long distances (for example, exceeding that required by the operational objective) without any means of intervention is a potential safety risk, particularly in conditions of limited visibility. The SR movement could be constrained in the trackside application design by placing balise groups containing 'Stop if in SR' information (ERTMS/ETCS packet 137) at key locations which could allow a higher value of D_NVSTFF. A.13.3 Performance considerations A While the onboard ERTMS/ETCS equipment is operating in SR it is constrained to travel below a ceiling speed that is: a) V_NVSTFF (by default); or RSSB Page 31 of 74

32 Uncontrolled when printed b) A value specified within the SR authorisation sent by the RBC (applies to Level 2 or Level 3 only); or c) A value entered by the driver (if permitted by operational rules). A Where this SR ceiling speed is significantly lower than the most restrictive speed limit that would otherwise be applied, there will be a significant performance impact associated with operating in SR, especially if it is expected that the train has to travel for a long distance. However, while D_NVSTFF specifies the maximum distance a train can progress in SR, the value of D_NVSTFF is not necessarily the limiting factor of the extent of the train's journey. A train will continue with its ERTMS/ETCS onboard equipment in SR until either the operational conditions ensure that it makes a transition to a more restrictive mode, or the maximum distance that it is allowed to progress in this mode is reached. In the latter case, it is anticipated that this maximum distance would be extended (either by the driver or by a message from the trackside) since operational recovery could not, in general, be achieved otherwise. A Thus, the specification of a value for D_NVSTFF that corresponds to a distance that exceeds that required to achieve the specific operational objective that is being addressed will introduce no adverse impact on performance. However, if the values specified correspond to a distance that is less than that required to achieve the specific operational objective, then, potentially, there could be a significant adverse impact on performance, as an extension to the maximum distance that can be travelled in this mode would be required. A.13.4 Discussion A The value of D_NVSTFF has little or no impact on safety, because the speed (with V_NVSTFF) and the distance (with D_NVSTFF) are limited through design application rules. The distance set by D_NVSTFF should be long enough to cover the distance which the train has to travel while supervision from the lineside signalling system is unavailable. With a short D_NVSTFF, the driver may need to keep reentering / revalidating SR to cover the same distance. In combination with ERTMS/ETCS National Value V_NVALLOWOVTRP, if the latter is set to permit selection of override on the move, then there are potential distraction issues at the time when the driver should be particularly vigilant. If V_NVALLOWOVTRP requires the selection of override to be undertaken at a stand, then there would be performance issues (see A.8 V_NVALLOWOVTRP on page 22). A The distance which a train can travel in SR, while not exceeding D_NVSTFF, is also limited through application rules for the use of the 'Stop if in SR' messages in balise groups placed strategically. The only impact on performance will be an adverse one in situations where the value corresponds to a distance that is less than that required to achieve the specific operational objective that is being addressed. A.14 Q_NVLOCACC A.14.1 Summary Subset-026 Minimum value Subset-026 Maximum value Subset-026 Default value Resolution Q_NVLOCACC - Default accuracy of the balise location 0 m 63 m 12 m 1 m ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A FS, LS and OS Page 32 of 74 RSSB

33 Q_NVLOCACC - Default accuracy of the balise location Used in levels N/A 1, 2 and 3 Table 18: Q_NVLOCACC A Q_NVLOCACC defines the accuracy of a balise location, and is used in the calculation of the confidence interval (maximum / minimum-safe-front-end of the train), when linking information, and therefore Q_LOCACC, is not available. A The ERTMS/ETCS onboard calculates a confidence interval, within which it assumes the train is located. The confidence interval takes account of worst case acceptable tolerances of the odometer subsystem and the expected location accuracy of the balise group from which the distance is measured, as shown in Figure 1 Confidence interval of a ETCS fitted train on page 33. Figure 1: Confidence interval of a ETCS fitted train A The maximum permissible over / under-reading amount is 5 m + 5% of distance travelled since the last reference point. A The confidence interval is the over-reading amount + the under-reading amount + 2 x Q_LOCACC. A The two parts of the confidence interval equation set out above, are to account for two types of inaccuracy: dynamic and static. The over-reading amount and under-reading amount is to account for the dynamic inaccuracy of the odometry system on the rolling stock; and the Q_LOCACC/Q_NVLOCACC is to account for the balise installation inaccuracy. A.14.2 Safety considerations A Q_NVLOCACC is only used when linking information is not available. If the value of Q_NVLOCACC is less than the permissible installation tolerance of a balise or the distance between duplicated balises in a balise group, then in situations where speed and distance supervision is based on the confidence interval calculated using Q_NVLOCACC, the train may be further along than the confidence interval suggests. The train may be further along by the difference between the actual installation tolerance or the distance between duplicated balises and the value of Q_NVLOCACC. A.14.3 Performance considerations A Assuming that the odometer system is operating within its specified tolerance, that is, within over / under-reading limits, a high value of location accuracy will unnecessarily increase the max-safe-frontend; the consequence of which would cause functions related to the train's location to execute sooner than RSSB Page 33 of 74

34 Uncontrolled when printed is necessary. For instance, it may place the braking location further from the EoA / target speed point, increasing the stopping distance in effect. Overall, this is a very minor impact as over / under-reading limits have a higher impact to the confidence interval. A.14.4 Discussion A As set out above, location accuracy is an important element in ERTMS/ETCS onboard functions where the train's location is required. However, the location accuracy provided within a set of ERTMS/ETCS National Values is essential only where location accuracy is not provided by linking information. Furthermore, the location accuracy element is most likely to be outweighed by the over / under-read element of the confidence interval. A As Q_NVLOCACC is applicable to all balise groups in a National Area, the IM should consider setting the value to the highest value for Q_LOCACC in the area, or to the higher of permitted balise installation tolerance or allowance for duplicated balises. A.15 Brake Related A.15.1 When an ETCS fitted train approaches a supervised target, it enters target speed monitoring (TSM) and it calculates relative locations where ETCS has to perform specific actions as part of its ATP functionality. These actions include displaying information to the driver, and issuing commands to the train's traction and braking systems if the driver does not react correctly. The following locations are calculated: a) Emergency Brake Deceleration (EBD) - the latest location from which, if the emergency brake is fully applied and if the braking rate as defined in the train data is achieved, the train will still be brought to a stop at the SvL. b) Emergency Brake Intervention (EBI) - the latest location at which the emergency brake has to be commanded for the train to follow the EBD curve. This curve takes into account the brake build-up time. c) Service Brake Deceleration (SBD) - the latest location from which, if the service brake is fully applied and if the braking rate as defined in the train data is achieved, the train will still be brought to a stop at the EoA. SBD is calculated whether or not the service brake command is available for use. d) Service Brake Intervention 1 (SBI_1) - this is calculated for an EoA and is the latest location at which the service brake has to be commanded for the train to follow the SBD curve to stop at the EoA. The curve takes into account the brake build-up time for the service brake. e) Service Brake Intervention 2 (SBI_2) - this is calculated for an EBD based target and is the latest location at which the service brake is commanded to avoid the train reaching the EBI location. f) Warning (W) - the location from which an intervention by the ERTMS/ETCS onboard is two seconds away at current speed. This is indicated to the driver via the DMI. g) Permitted (P) - the location from which an intervention by the ERTMS/ETCS onboard is four seconds away at current speed. This is indicated to the driver via the DMI. h) Indication (I) - the location from which the ERTMS/ETCS onboard would generate an additional visual cue on the DMI to inform that the start of the P curve is approaching. A.15.2 These locations and speeds are calculated by the ERTMS/ETCS onboard according to a regular processing cycle. Although only one value is calculated for each of the above location types in each processing cycle, a speed-distance curve can be extrapolated for each location type by assuming that the train travels at its estimated speed, and that the performance of the train behaves according to the braking model applied, that is, not affected by external factors. The above location types will be referred to as curves hereinafter. A.15.3 EBD and SBD curves are generated by the ERTMS/ETCS onboard when their respective target types are presented to it. Target types are listed in section of Subset 026. The ERTMS/ETCS onboard calculates EBI, SBI_2, W, P and I curves as offsets from the EBD curve; and SBI_1, W, P and I curves as offsets from the SBD curve. Where both EBD and SBD are generated, each of their offsets will be compared with their emergency or service brake counterparts, and the failsafe value will be applied where the Page 34 of 74 RSSB

35 counterpart curves overlap. For example, the P curve offset from EBD will be compared with the P curve offset from SBD, and the lower of the two speed values will be used to generate the resultant P curve. This is shown in the following chart. Figure 2: Chart demonstrating, by simplifying the curves as straight lines as an example, the shape of the resultant Permitted speed curve A.15.4 Figure 2 Chart demonstrating, by simplifying the curves as straight lines as an example, the shape of the resultant Permitted speed curve on page 35 uses the P curve as an example to illustrate where EBD deduced and SBD deduced curves overlap; the lower of the two will be used as the resultant P curve. A.15.5 ETCS Baseline 3 introduces a harmonised algorithm and method to compute ETCS braking curves and the associated information displayed to the drivers. In setting the National Values, the calculation of braking curves has to take into account the extreme braking capability parameters of rolling stock to apportion safety responsibility between trackside and rolling stock. The related to the calculation of braking curves are described in this section. A.15.6 The ERTMS/ETCS onboard derives the EBD and SBD from braking model(s). A braking model describes the rate of deceleration which the braking system could deliver (nominal brake rate) for different speed bands. The braking model is preloaded into the ERTMS/ETCS onboard for Gamma trains and derived onboard from train data through the use of a conversion model for Lambda trains. A.15.7 The rate of deceleration of any train is dependent upon the type and combination of brakes. ETCS onboard calculates the braking distance according to braking models, which describes the rate of deceleration at different speed bands. Gamma trains have predetermined speed dependent braking model(s) stored onboard; it is most suitable for trains with fixed, or limited variations of, consist and may include different combinations of special braking systems, including regenerative or magnetic shoe brakes. The braking model(s) describes a Gamma train s braking performance, derived through simulation or testing. These models are generated to account for the allowed variations in consist and different types and combinations of braking systems. For Gamma trains containing multiple braking models, only one braking model is applied at any one time for the selected consist and the status of the braking system. A.15.8 Lambda trains either do not have predetermined braking models stored in the ETCS onboard, or the available braking models are not applicable to its current configuration. Instead, the ETCS onboard applies the conversion model to convert input data (including the brake percentage (the Lambda value), train RSSB Page 35 of 74

36 Uncontrolled when printed length, and brake position) to form a braking model that is similar in format to that of a Gamma train. Lambda trains are most suitable where the rolling stock type(s) and train formations including, for example, train length, weight and wagon types can be different for each mission. The variable formation of a Lambda train means that the braking performance cannot be preset. For more details, see (ERA_ERTMS_040026). A.15.9 A set of is assigned for a National Area; it can be set by the trackside by use of ETCS communication packet number 3. Within a set of some braking related values apply to Gamma trains, some to Lambda trains, and some to both. If a train does not have the set of associated with the National Area which it is in, it will use the default set of, as defined in subset-026 section A3.2. A A high-level schematic of the flow of information used in calculating the brake curves is shown in Figure 3 High level schematic diagram of the processing of braking curves on page 36. Figure 3: High level schematic diagram of the processing of braking curves Page 36 of 74 RSSB

37 A Braking models define theoretical characteristics of a train's braking system which should be achieved during a brake application. The braking related provide the capability to influence these theoretical braking characteristics and support the safety and performance requirements relevant to a particular National Area. A The schematic below shows the process of generating braking curves from braking models and. The that are involved are shown in green. RSSB Page 37 of 74

38 Uncontrolled when printed Figure 4: Schematic diagram of how braking curves are derived A Within a National Area there may be physical characteristics such as low wheel-rail adhesion that will increase the probability of a train exceeding its EoA/Supervised Location (SvL). There may also be characteristics of the scheme design, for example very short overlaps, that require a very low probability of trains exceeding their EoAs. can be set to influence the calculation of EBD such that the ERTMS/ETCS onboard applies a lower rate of deceleration than that defined by the braking Page 38 of 74 RSSB

39 model. Although a train's actual rate of deceleration during an application of the emergency brake does not necessarily follow the rate described by the EBD, a lower rate of EBD will request the train driver to start decelerating earlier. This enables a lighter brake application, with a higher probability of not exceeding the EoA/SvL when the train applies the emergency brakes. A A request for an earlier and lighter brake application potentially reduces the likelihood of passing the SvL but, conversely, with the calculated stopping distance extended, there may be adverse impacts on the performance of train services. A There are some safety and performance considerations that are common to the braking related including: Safety: a) The driver needs to take into account low adhesion conditions, as the braking related indication shown on the DMI may not be achievable at such locations. b) A braking related ERTMS/ETCS National Value which is set incorrectly may lower the probability of the train from stopping before an EoA/SvL under an application of the emergency brake. c) The use of a lower rate of deceleration in the calculation of the braking curves provides a margin for the driver to react to unexpected events. d) If wheel-slide does occur, a train has a higher probability of stopping before the EoA/SvL where longer stopping distances are available. Performance: a) A brake related ERTMS/ETCS National Value which is set incorrectly may cause the train to stop far in advance of the EoA/SvL when the emergency brake is applied. b) Brake related that are set to be overly restrictive, may request the train to be slowed down far in advance from where it is needed to decrease in speed. c) A low rate of deceleration may adversely impact performance, as the train will not be maximising its available braking effort in relation to track condition. d) Not all trains require an extended braking distance because some trains' braking systems are more suitable for adverse track conditions or scheme design rules applied within a National Area than others. e) Because are applied to all trains in the National Area, the braking related indications shown on the DMI may not reflect the optimum braking rate achievable by a specific train. f) Slow approach to an EoA/SvL may slow the release of routes. A The use of to influence brake curves is a 'one size fits all' solution. A National Area may consist of regions with different physical characteristics or scheme designs, and a single set of may not be appropriate for all regions. The set of ERTMS/ETCS National Values may be over-restrictive in some regions and not restrictive enough in others within the same National Area. In such a case, it may be appropriate to divide the National Area. A When an IM sets for a National Area, it has to consider the drivability of trains crossing boundaries between National Areas, as drivers may have to adapt their driving style for different sets of. A In setting values it is essential for IMs and RUs to cooperate to ensure that the braking ERTMS/ ETCS National Values and corresponding rolling stock braking parameters result in a network braking performance which supports safe drivability and timetable performance. Digital Railway has set up a Braking Aspects Working Group (BAWG) to develop a process and to propose values for use on the GB railway network. The following braking related National Values should be read in conjunction with the BAWG's proposed values and its associated rationales. A The following are common to Lambda and Gamma trains. RSSB Page 39 of 74

40 Uncontrolled when printed A.16 Q_NVGUIPERM A.16.1 Summary Subset-026 values Subset-026 Default value Resolution Q_NVGUIPERM - Permission to use the guidance curve 0 - No ; 1 - Yes No N/A ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A FS, LS, OS, SR and UN Used in levels N/A 0, 1, 2 and 3 Table 19: Q_NVGUIPERM A Q_NVGUIPERM is a qualifier to enable the display of the 'guidance curve' on the DMI. Q_NVGUIPERM is an ERTMS/ETCS National Value for IMs to override the GUI curve preference set by RUs. It does not force the GUI curve feature to be enabled on the rolling stock if it is disabled by the RU. A Subset-026 states that the purpose of the guidance curve (GUI curve) is 'to provide a comfortable way of braking for the driver, to avoid excessive wear of the brakes and to save traction energy'. A If the GUI curve is disabled, the hook on the DMI indicates the Permitted speed; if the GUI curve is enabled, the hook indicates the guidance curve. The GUI curve can never be higher than the P curve. A The guidance curve is derived from the applied braking model stored onboard, which usually produces a lower speed than Permitted speed curve at the same location. The ERTMS/ETCS onboard uses the lower of the two curves to determine the position of the hook if the GUI curve is enabled. The DMI enters into 'Over-speed status' if the train speed exceeds the speed indicated by the hook. By lowering the recommended travelling speed shown to the driver, the margin between the recommended speed to the 'Warning speed' has increased, giving the driver more time to react before the ERTMS/ETCS onboard intervenes with an application of service or emergency brake. A The DMI does not indicate whether the guidance curve or Permitted speed curve is being displayed. A With the GUI curve enabled, the DMI will request the driver to apply the brakes earlier than with the GUI curve disabled. The diagram shown in Figure 5 compares the braking profiles indicated by the hook. Page 40 of 74 RSSB

41 Figure 5: Comparison of where the 'hook' is shown if GUI curve is enabled. A.16.2 Safety considerations A With the GUI curve enabled, the hook indicates a speed that provides a greater margin between the hook and the warning speed, than if the GUI curve is disabled. This additional margin may lead drivers to incorrectly believe that the system is more tolerant to overspeed. A potential confusion for the driver could arise when the GUI curve's setting changes without the driver knowing. For example, when a train transits from a National Area where the GUI curve is disabled to one where the GUI curve is enabled, the driver may be driving below the speed indicated by the hook, but suddenly be presented with overspeed status under the new ERTMS/ETCS National Value. A.16.3 Performance considerations A The margin created by the GUI curve may cause the overall journey time to be longer, but could reduce the likelihood of an emergency brake intervention, which would be more disruptive to other train services. A The GUI curve from simulation or tests can be compared with current driving practice, to assess if the use of GUI curve degrades performance. The analysis may need to take into account that drivers may drive at a speed lower than the speed indicated by the hook. A.16.4 Discussion A RUs could also effectively disable the GUI curve by applying a higher 'A_brake_normal_service' brake rate, which will cause the ERTMS/ETCS onboard to select the lower original permitted speed as the displayed speed. A An effective use of the GUI curve could be in decreasing the risk from low adhesion, where longer braking distances may accommodate small amounts of slip / slide. A.17 Q_NVSBFBPERM A.17.1 Summary Subset-026 values Subset-026 Default value Q_NVSBFBPERM - Permission to use the service brake feedback 0 - No ; 1 - Yes No RSSB Page 41 of 74

42 Resolution Q_NVSBFBPERM - Permission to use the service brake feedback N/A ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A FS, LS and OS Used in levels N/A 1, 2 and 3 Table 20: Q_NVSBFBPERM A Q_SBFBPERM is a qualifier to enable the use of service brake feedback in the calculation of the SBI1 and SBI2 curves (see A.15.1 on page 34). This is only effective on trains where brake pressure feedback is provided, and where service brake command is implemented on the train. If the above conditions are satisfied, and the use of service brake feedback is enabled by the ERTMS/ETCS National Value then: a) When service braking effort begins to take effect, the service brake's build-up time constant is adjusted proportionally to its braking effort by the ERTMS/ETCS onboard, to reflect the shorter interval needed when further effort is required. b) The driver can observe the effect from the rate at which the 'hook' moves towards the target speed as the service brake is applied, shown in Figure 6 Comparison of the position of the 'hook' if Q_NVSBFBPERM is enabled on page 42. Figure 6: Comparison of the position of the 'hook' if Q_NVSBFBPERM is enabled A Q_NVSBFBPERM varies the service brake build-up time, which is a factor that alters the separation between braking curves SBI2 and EBI. The service brake build-up time is also altered by the Q_NVSBTSMPERM, which when set to NO, overrides Q_NVSBFBPERM and sets the service brake build-up time between those two curves as zero, that is, no separation between those two curves. A.17.2 Safety considerations A While good driving practice involves the use of the service brake, ERTMS/ETCS does not rely on the service brake to prevent trains from exceeding their speed and distance limits; it relies on the emergency brake. A With service brake feedback enabled, once the brake application has reached a defined level, the time parameters used in the calculation of the SBI1 and SBI2 curves become locked to fixed values. Page 42 of 74 RSSB

43 Following the locking of these values, if the driver releases the service brake and then reapplies it, there is an increased risk of an emergency intervention as it may not be possible for the service brake to reapply in time. A.17.3 Performance considerations A The service brake feedback function provides the driver with information to better control the service brakes. Once the driver applies the service brake, the driver is better informed via the DMI with regards to when further application of the service brake has to be made. With less braking while the train is further from its target speed location, it does not have to lose speed unnecessarily. A.17.4 Discussion A The use of service brake feedback may extend the system boundary of the onboard signalling system depending on the brake pressure feedback. If the service brake feedback is enabled, given the impact of the brake pressure feedback gauge on the braking capability of the train, maintaining its accuracy is a key consideration in the maintenance regime. A.18 Q_NVINHSMICPERM A.18.1 Summary Subset-026 value Subset-026 Default value Resolution Q_NVINHSMICPERM - Permission to inhibit the compensation of the speed measurement inaccuracy 0 - No ; 1 - Yes No N/A ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A FS, LS, OS, SR and UN Used in levels N/A 0, 1, 2 and 3 Table 21: Q_NVINHSMICPERM A Q_NVINHSMICPERM allows the trackside to enable or inhibit the compensation for the speed measurement inaccuracy inherent in the ERTMS/ETCS odometry sub-system in the calculation of the EBI related supervision limits for target speed monitoring by the ERTMS/ETCS onboard. A The speed inaccuracy compensation adds a margin on top of the measured train speed, which in effect increases the braking distance by braking earlier towards a given SvL. The margin is one that is set within the ETCS specifications - Subset 041 defines the accuracy of speed known onboard to ±2 km/h for train speeds lower than 30 km/h, then increasing linearly up to ±12 km/h for train speeds of 500 km/h. A Q_NVINHSMICPERM qualifies the use of speed inaccuracy compensation as follows: a) A value of '0' enables the ERTMS/ETCS onboard to use speed inaccuracy compensation, by adding a speed dependent margin onto the speed measurements from the odometer system. Whereas, b) A value of '1' inhibits the ERTMS/ETCS onboard from using speed inaccuracy compensation, which instead uses speed measurements directly from the odometer system. A While speed inaccuracy compensation increases the train speed used for the calculation of emergency brake deceleration, it does not alter the measured speed which the driver reads on the DMI. RSSB Page 43 of 74

44 Uncontrolled when printed Figure 7: Comparison of the position of the 'hook' if Q_NVINHSMICPERM is enabled A The train speed derived from the odometry system, Vest, may be different from the actual speed of the train, Vactual, due to factors such as inaccuracies within the odometry system, or variations in wheel diameter. Vest being less than Vactual could be unsafe, as set out in the safety considerations section. The difference in braking curves with Q_NVINHSMICPERM enabled or disabled is shown in Figure 7. A.18.2 Safety considerations A This function mitigates the risk of a train not being able to stop before the SvL because of an underestimation of speed measurement by the ERTMS/ETCS onboard odometry sub-system, assuming that the level of error is within the tolerance specified within the TSI. If a train's actual speed is higher than that used by the system, the calculated emergency braking intervention point distance may be too short to stop the train before or at the SvL. Applying an additional margin to the measured speed may be a means of correcting an inaccurate speed measuring system which tends to under-measure. With other safety factors accounted for in the calculation of the emergency deceleration, the under-measured speed may not be a significant factor and thus may not need to be compensated. A.18.3 Performance considerations A Compensating for speed inaccuracy would place the calculated emergency brake intervention point further from the target. This in turn places the warning, permitted, and indication (not measured train speed) limits also further from the target. To avoid triggering any warning or intervention, the driver will have to apply the brakes earlier than if the speed inaccuracy Q_NVINHSMICPERM compensation is inhibited. Although the performance impact on the approach to each SvL is not great, as the speed compensation is relatively low, the combined effect of early braking to a number of SvLs along a route may be significant. A.18.4 Discussion A When deciding whether speed inaccuracy Q_NVINHSMICPERM compensation should be enabled or inhibited, the overall accuracy, and reliability of the speed measuring systems on different types of rolling stock should be considered. The IM and RU(s) should collaborate to determine whether the difference between the actual and measured speed warrants this compensation. If measured speed is systemically under-measured, an IM may set the ERTMS/ETCS National Value to '0' to apply speed compensation. Railway systems are designed such that minor discrepancies in precisions or accuracy in odometer measurements are tolerable. With the speed inaccuracy compensation being relatively low, the overall improvement to safety with speed inaccuracy compensation enabled is limited, but may have a notable impact on performance. For a train travelling at a speed of 160 km/h and reducing to a target speed of 0 km/h, the difference between stopping distances with speed inaccuracy compensation enabled or inhibited Page 44 of 74 RSSB

45 is approximately 60 m. There is a performance penalty when the stopping distance is extended because the train travels more slowly. A.19 A_NVMAXREDADH1, A_NVMAXREDADH2, A_NVMAXREDADH3 A.19.1 Summary A_NVMAXREDADH1, A_NVMAXREDADH2, A_NVMAXREDADH3 - Maximum deceleration under reduced adhesion conditions (1) (2) (3) Subset-026 Minimum value 0 m/s 2 Subset-026 Maximum value Baseline 3 Maintenance Release 1: 3.15 m/s 2 Baseline 3 Release 2: 3.00 m/s 2 Subset-026 Default value A_NVMAXREDADH1 = 1.0 m/s 2 Resolution 0.05 m/s 2 A_NVMAXREDADH2 = 0.7 m/s 2 A_NVMAXREDADH3 = 0.7 m/s 2 Special values for Baseline 3 Release 2 only: 61 - No maximum deceleration, display target information in CSM 62 - No maximum deceleration, display time to Indication in CSM 63 - No maximum deceleration, no additional display ETCS Baseline Baseline 2 Baseline 3 Used in modes N/A FS, LS, OS,SR and UN Used in levels N/A 0, 1, 2 and 3 Table 22: A_NVMAXREDADH1/2/3 A A_NVMAXREDADH defines the maximum emergency brake deceleration rate used for the braking calculation when the low adhesion function is active. For Baseline 3 Release 2, the range of maximum emergency brake deceleration rate is limited between 0 m/s 2 and 3.00 m/s 2, and there is the option of using special values instead. The special values allow the IM to specify the DMI to either display Target Information (TI) or Time To Indication (TTI) on the approach to a target speed and while still in Ceiling Speed Monitoring (CSM) state, or for no additional information to be shown. If one of these special values is selected, no maximum rate of deceleration is applied for the braking calculation if the low adhesion function is active. A For Baseline 3, where a maximum deceleration value is defined and when the low adhesion function is active, the A_NVMAXREDADH values only affect portions of the EBD curve where A_NVMAXREDADH delivers a lower rate of deceleration than the nominal brake rate of the train (see subset and ). As a result, the braking distance may be extended to accommodate the use of the lower rate of deceleration (A_NVMAXREDADH) for parts of the EBD curve, as RSSB Page 45 of 74

46 Uncontrolled when printed shown in Figure 8 Demonstration of how A_NVMAXREDADH derates EBD and increases braking distance on page 46. Figure 8: Demonstration of how A_NVMAXREDADH derates EBD and increases braking distance A There are three A_NVMAXREDADH to be set: A_NVMAXREDADH1, A_NVMAXREDADH2, and A_NVMAXREDADH3. Only one applies to a given train; the selection being dependent on the onboard brake setting. a) A_NVMAXREDADH1: 'Passenger train in P' with special / additional brakes. b) A_NVMAXREDADH2: 'Passenger train in P' without special / additional brakes. c) A_NVMAXREDADH3: 'Freight train in P' or 'Freight train in G'. A There are two ways to activate the ERTMS/ETCS reduced adhesion function. This can be either by an ETCS communication packet (Packet 71, via RBC, balise, or RIU); or activation by the driver through the DMI if activation via the DMI is not disabled by ERTMS/ETCS National Value Q_NVDRIVER_ADHES (A.2 Q_NVDRIVER_ADHES on page 11). The application of A_NVMAXREDADH1/2/3 is distinct from other because it can be activated at specific locations in a given National Area, on demand, where instructed by ETCS communication Packet 71, rather than being one permanently active setting for the whole of the National Area. The driver may activate the function via the DMI, or by the signaller sending the command via RBC in ERTMS level 2/3, or by balise/riu in ERTMS level 1. A Where a train is travelling in an area with ceiling speed supervision, and is approaching a target speed, the ERTMS/ETCS onboard calculates a permitted speed curve for the reduction. When the train reaches the location at which the permitted speed starts to decrease from the initial ceiling speed (the First indication location (di)) the hook on the DMI turns yellow and gradually lowers in accordance to the transition in speed. di is displayed on the DMI's planning area as the Indication Marker in the form of a horizontal yellow line, but its logarithmic scale may be difficult to read correctly, quickly. To address this, the IM has the option of enabling additional information on the DMI to assist drivers through the use of the special values. The options are either to display the distance based TI, or the time based TTI. A In the DMI simulation screenshots shown in Figure 9, the train is travelling in an area where the permissible speed is 80 km/h. A reduction in speed to 20 km/h is approximately 700 m ahead. The yellow horizontal bar is the Indication Marker; when it descends to the bottom of the planning area, the 'hook' on the speedometer turns yellow and gradually decreases from 80 km/h to 20 km/h. With TI selected (A_NVMAXREDADHx = 61), the TI on the far left will appear when the next Most Relevant Displayed Target is present. TI displays the distance between the train's current location to the beginning of the 20 km/h ceiling speed. This is intended to support the driver in determining where to begin the braking effort. Page 46 of 74 RSSB

47 Figure 9: DMI with TI initiated A With TTI selected (A_NVMAXREDADHx = 62), the TTI will be displayed when the train is 14 seconds, at estimated speed, from the di. The TTI appears on the top left of the DMI, and has a dark grey background and a white square that grows from the centre in 10 steps until it covers the dark grey square completely. Again, this is intended to support the driver in determining where to begin the braking effort. RSSB Page 47 of 74

48 Uncontrolled when printed Figure 10: DMI with TTI initiated A If the special value of 63 is assigned, neither a cap in the rate of deceleration in low adhesion situations, nor the use of TI or TTI will be available. A.19.2 Safety considerations A The use of A_NVMAXREDADH to constrain the highest rate of deceleration for the EBD, if the low adhesion function is active, provides benefits in safety when it is comparatively lower than the nominal rate. This effectively increases the stopping distance, prompting the driver to brake sooner and allowing lighter braking. A Using the rate of deceleration imposed by A_NVMAXREDADH does not guarantee that the train would stop before the SvL, because the value may not reflect the actual adhesion condition at a given location. Potentially, the indication of the low adhesion function being active may lead the driver to believe that following the permitted speed indication on the ERTMS/ETCS DMI will prevent the train overshooting the EoA/SvL. However, the longer braking distance imposed by A_NVMAXREDADH may decrease the likelihood of overshooting the EoA/SvL when a train experiences sliding due to low wheel-rail adhesion. A For Baseline 3 Release 2, if a maximum rate of deceleration is defined, the driver has only the Indication Marker in the planning area to forewarn of the latest location at which to start braking. This could result in the driver spending more time observing the DMI and, if the driver misses the cue or has inaccurately judged the location from the logarithmic scale, the descending hook may appear to start too suddenly and not leave the driver enough time to brake before warning or intervention limits are exceeded. A The use of TI/TTI forewarns the driver of the approach of a first Indication location, supporting the driver in determining where braking should commence. However, this means that associated modification of the braking curves when the low adhesion function is active cannot be used, and the driver is responsible for judging the local adhesion condition and braking accordingly. Page 48 of 74 RSSB