GO/GN3637. Guidance on Defective On-Train Equipment. Rail Industry Guidance Note for GO/RT3437. Published by: RSSB

GN Published by: Copyright 2015 Rail Safety and Standards Board Limited GO/GN3637 Guidance on Defective On-Train Equipment Issue Two September 2015 Rail Industry Guidance Note for GO/RT3437

Issue record Issue Date Comments One September 2013 Original document, the contents of this document were transferred from GO/RC3537 issue 5 and amended to reflect changes to GO/RT3437 and to GE/RT8000 Rule Book module TW5. Two September 2015 Amendments made to align with changes to GE/RT8000 Rule Book module TW5. Superseded documents The following Railway Group documents are superseded, either in whole or in part as indicated: Superseded documents GO/GN3637 Issue one Guidance on Defective On-Train Equipment Sections superseded All Date when sections are superseded 05 December 2015 Supply The authoritative version of this document is available at www.rgsonline.co.uk. Enquiries on this document can be forwarded to enquirydesk@rssb.co.uk. Page 2 of 30

Contents Section Description Page Part 1 Introduction 4 G 1.1 Purpose of this document 4 G 1.2 The structure of this document 4 G 1.3 Copyright 4 G 1.4 Approval and authorisation of this document 4 Part 2 5 G 2.1 Responsibilities of infrastructure managers 5 G 2.2 Responsibilities of railway undertakings 6 Appendices Appendix A List of on-train equipment for inclusion in DOTE contingency plans 11 Appendix B List of on-train equipment to be considered for inclusion in DOTE contingency plans 24 References 30 Page 3 of 30

Part 1 Introduction G 1.1 G 1.1.1 G 1.2 G 1.2.1 G 1.2.2 G 1.2.3 G 1.3 G 1.3.1 G 1.3.2 G 1.3.3 G 1.4 G 1.4.1 Purpose of this document This document gives guidance on interpreting the requirements of Railway Group Standard GO/RT3437. It does not constitute a recommended method of meeting any set of mandatory requirements. The structure of this document All requirements from Railway Group Standard GO/RT3437 are reproduced with a grey background in this document. Guidance is provided as a series of sequentially numbered clauses prefixed G immediately below the greyed text to which it relates. Specific responsibilities and compliance requirements are laid down in the Railway Group Standard itself. Copyright Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law. members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited. In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group Standards may be reproduced. Approval and authorisation of this document The content of this document was approved by TOM Standards Committee on (proposed 28 July 2015). G 1.4.2 This document was authorised by on (proposed 30 July 2015). Page 4 of 30

Part 2 G 2.1 G 2.1.1 Guidance on Defective On-Train Equipment (DOTE) Responsibilities of infrastructure managers Extract from GO/RT3437 Section 2.1.1 Review of DOTE contingency plans 2.1.1.1 Infrastructure managers shall review and, if appropriate, comment, on all draft DOTE contingency plans submitted to them by railway undertakings. When an infrastructure manager is reviewing draft DOTE contingency plans, it should check that the following items are covered: a) All items of on-train equipment listed in Appendix A of GO/RT3437, and relevant to the railway undertaking, have been identified. b) Any items of on-train equipment listed in Appendix B of GO/RT3437 that the railway undertaking has decided to include. c) There are statements that identify all locations on routes used by the railway undertaking concerned, at which: i) A defective train or vehicle can be turned, re-marshalled or replaced. ii) iii) iv) A defective train or vehicle can be examined by a rolling stock technician. The defective on-train equipment can be repaired or replaced. The train or vehicle can be taken out of service. d) All maintenance depots used by the railway undertaking, and the items of equipment that can be repaired or replaced at each depot, are specified. e) All stations that are suitable for the detraining of passengers are identified (see also G 2.2.4). f) There are procedures that are designed to control any identified risks. g) There is consistency with the contents of the Sectional Appendix (where relevant). h) The procedures in the plan comply with the requirements of GO/RT3437 and, where they do not follow the additional guidance in this document, there is appropriate and sufficient evidence that the alternative arrangements will control risk to an equivalent or lower level. G 2.1.2 An infrastructure manager may, following their review of a DOTE contingency plan, decide that it can accept the contents without further comment. The infrastructure manager should inform the railway undertaking(s) concerned if this is the case. Extract from GO/RT3437 Section 2.1.2 Advising railway undertakings of changes to facilities 2.1.2.1 Infrastructure managers shall inform railway undertakings of any changes to facilities, either temporary or permanent, that will affect the detraining of passengers at stations identified in a published DOTE contingency plan. G 2.1.3 Changes to facilities should include, but not be limited to, the factors shown as G 2.2.4.2 of this guidance note. Page 5 of 30

G 2.2 G 2.2.1 G 2.2.1.1 G 2.2.1.2 G 2.2.1.3 G 2.2.1.4 G 2.2.1.5 Responsibilities of railway undertakings Production of contingency plans Extract from GO/RT3437 Section 2.2.1 Requirement for the production of a contingency plan for defective on-train equipment 2.2.1.1 Railway undertakings shall produce and publish a DOTE contingency plan that describes the actions to be taken when any item of on-train equipment, as listed in Appendix A of this document, becomes defective and gives due consideration to the inclusion of the items listed in Appendix B. Each railway undertaking should arrange for a competent person(s), with a suitable knowledge of that undertaking's train operation, to produce their DOTE contingency plan. The DOTE contingency plan should describe the action to be taken when a defect is found on a train or vehicle about to enter service, or when on-train equipment becomes defective on any train or vehicle which is in service. The DOTE contingency plan should provide detailed instructions to train operators controllers and others responsible for its implementation, about the action to be taken when any item of on-train equipment specified in the plan and operated by the railway undertaking is reported as defective. These should accurately supplement the working instructions in the Rule Book, which determine the precise instructions to be given to drivers and others in each case (see G 2.2.2). Appendix A of this document lists those items of on-train equipment which have a clear interface and, therefore are within the scope of GO/RT3437. However, railway undertakings should include in their DOTE contingency plans, any additional items of ontrain equipment fitted only to specific rolling stock fleets. Appendix B provides a list of ontrain equipment that railway undertakings should consider for inclusion in their DOTE contingency plan, according to their operational circumstances. This document provides specific guidance in respect of all items of on-train equipment listed in both appendices of GO/RT3437. The following options have been provided to support railway undertakings determine, as part of their contingency plans, how best to manage trains that are found to have defective on-train equipment whilst in service: a) For the train or vehicles to proceed only as far as the next available location. b) For the train or vehicles to complete the journey it is currently on and then be allowed to make one further non-passenger journey to a maintenance depot. c) For the train or vehicles to complete its journeys for the remainder of the day provided its final journey of the day ends at a maintenance depot. G 2.2.1.6 G 2.2.1.7 G 2.2.1.8 G 2.2.1.9 The DOTE contingency plan should identify all items of on-train equipment that can be repaired or replaced on all classes of rolling stock using each maintenance depot, including main works, used by the railway undertaking. The DOTE contingency plan should state the location to which a train or vehicle, which has been permitted to enter service with defective on-train equipment, or on which ontrain equipment has become defective when in service, should proceed. When drafting DOTE contingency plans, consideration should be given to likely traffic levels. For certain on-train equipment defects, it would be consistent with a risk-based contingency plan for different arrangements to be in place on those lines identified as lightly used, as opposed to densely trafficked commuter lines. The recommendations for managing specific equipment defects set out in Appendices A and B give examples of when such differences might be applicable. The DOTE contingency plan should aim to minimise the effect on network performance of a train remaining stationary for a prolonged period. Page 6 of 30

G 2.2.2 G 2.2.2.1 G 2.2.2.2 G 2.2.3 G 2.2.3.1 DOTE contingency plans instructions to staff The Rule Book, GE/RT8000, sets out the circumstances when trains or vehicles are permitted to enter service with defective on-train equipment and sets out the measures that should be applied in such cases. It also sets out the measures that should be applied when on-train equipment becomes defective on a train or vehicle which is in service. In some situations there may be a range of measures which can be taken. The Rule Book informs drivers that they must obtain instructions about arrangements for dealing with the train or vehicle. It should be noted that not all items of on-train equipment listed in the appendices of GO/RT3437 have related requirements in the Rule Book. Some equipment, such as Automatic Train Protection (ATP), do not have a Rule Book entry as this equipment is not in general use and is applicable to certain rolling stock types only and in certain areas. Where this is the case, the specific guidance will refer users to the alternative source of such information (such as Sectional Appendices). Use of competent people in the resolution of DOTE situations For some items of defective on-train equipment, a competent person may be used to: a) Accompany the driver in the cab, as a mitigating measure when the defect affects incab indications of signals (e.g. Automatic Warning System (AWS), Train Protection and Warning System (TPWS)) or forward visibility from the cab (the windscreen), or to monitor driver alertness (Drivers Safety Device (DSD), vigilance device). b) Travel elsewhere in the train, such as the cab of the rear (empty) unit after operation of the emergency bypass switch (EBS) following a brake defect or in passenger accommodation after failure of the passenger communication apparatus (PCA) or door-related defects. G 2.2.3.2 G 2.2.3.3 G 2.2.3.4 G 2.2.3.5 G 2.2.4 G 2.2.4.1 G 2.2.4.2 Use of a competent person in the driving cab should be limited to allowing a train to reach a location where other controls, such as reforming the train, can be applied as soon as is reasonably practicable after a defect is discovered. The likelihood of driver distraction increases the longer the competent person remains in the cab. DOTE contingency plans should identify the approximate journey times for which a competent person could be used, to enable those responsible for implementing plans to have clear guidance as to the limits on such working. The railway undertaking should check that the competent person accompanying the driver has the necessary route knowledge. When the role of the competent person requires the observation of signals (for example, defective AWS, TPWS or obscured windscreen), route knowledge should be sufficient to enable the competent person to identify, and interpret correctly, the signals and other indicators applicable to the train, particularly when the route includes complex layouts. Where the defective equipment relates to driver alertness, the competent person only needs to know how to stop the train if the driver becomes incapacitated, but it would be advantageous for them to be aware what response is required to in-cab warnings, such as AWS. Where the primary purpose of a competent person is to reassure or provide information to passengers, they may remain in place for the remainder of the journey, or the day. GE/RT8000 module TW5 sets out the defective on-train equipment that require a competent person to be used, and the operational consequences of using (or not using) a competent person. GE/RT8000 also sets out the duties of a competent person for the types of failure it includes. Railway undertakings should be aware that other documents, such as Sectional Appendices and Local Instructions, may also provide specific instructions according to the type of equipment and geographical circumstances. Determining what is a suitable station The DOTE contingency plan should identify, if necessary, the suitable stations at which passengers in any train or vehicle with defective on-train equipment should be detrained. In determining the suitability of a station for detraining passengers, the following factors should be taken into account: Page 7 of 30

a) The potential number of passengers involved. b) The means of control and maintaining the safety of the detrained passengers. c) The ability to allow a train to remain at the station until alternative transport has been arranged for passengers or staff (where this is the position, that fact should be clearly stated). d) Provision of facilities for people with disabilities. e) Waiting facilities, for example, the provision of refreshments or toilet facilities. f) Ratio of available staff to the number of passengers being detrained. g) Communication facilities, for example, the coverage for mobile telephones or provision of public telephones. G 2.2.4.3 G 2.2.5 G 2.2.5.1 G 2.2.6 G 2.2.6.1 As part of the process for drafting a DOTE contingency plan, prior to submitting a draft copy to the infrastructure manager responsible for managing the network, the railway undertaking should liaise, discuss and, if possible, reach an agreement with the infrastructure manager responsible for the management of the selected station involved, that it is suitable for use as proposed. Requirement for the distribution of draft and published DOTE contingency plans Extract from GO/RT3437 Section 2.2.2 Requirement for the distribution of draft and published DOTE contingency plans 2.2.2.1 Railway undertakings shall distribute a copy of their respective DOTE contingency plan, in draft when they are in development, and in final published format to the following: a) The infrastructure manager responsible for the mainline railway. b) Infrastructure managers responsible for stations where a DOTE contingency plan states that passenger detrainments are permitted. c) Other railway undertakings affected by the operation of a DOTE contingency plan. No guidance is provided for this requirement. Requirement to monitor and amend a published DOTE contingency plan Extract from GO/RT3437 Section 2.2.3 Requirement to monitor and amend a published DOTE contingency plan 2.2.3.1 Railway undertakings shall monitor the effectiveness of a published DOTE contingency plan in order to identify any shortcomings. 2.2.3.2 Railway undertakings shall amend and update their published plan if required as a result of DOTE contingency plan monitoring. Railway undertakings will have developed and published contingency plans that specifically deal with what will happen in case of a train that has defective on-train equipment. Once the plans have been published, there is a need to make sure that they continue to work efficiently and correctly as intended. For this purpose, joint monitoring of the effectiveness of published DOTE contingency plans should include the following: a) A review of the application of the DOTE contingency plan; this should crossreference the user application instructions as outlined in GE/RT8000 Rule Book, module TW5, as well as any other relevant source publication (such as Sectional Appendices or Local Instructions). b) A joint assessment of on the day amendments to a DOTE contingency plan. Page 8 of 30

G 2.2.7 G 2.2.7.1 Dealing with exceptional circumstances Where a railway undertaking finds that it is not possible to follow the agreed, published DOTE contingency plan due to exceptional circumstances, the railway undertaking and the infrastructure manager should discuss, resolve and document alternative arrangements. Exceptional circumstances may include: a) Where the train involved is the first train off a branch line in the morning or the last train at night. b) Equipment becoming defective where it is not possible to make alternative transport arrangements for the passengers affected special operating conditions may have to be applied in such circumstances, such as speed restrictions or arranging with the signaller for blocking or clearing of signals as appropriate. c) Where public disorder may result in a higher level of risk than if the train had been allowed to continue in service. d) Temporary changes to the status of elements of the published DOTE contingency plan, for example unforeseen reduction of staff at a station defined in the plan as suitable. e) Where crowding in trains or on stations is at such a level it is likely to create a serious safety incident. G 2.2.7.2 G 2.2.7.3 G 2.2.7.4 G 2.2.8 Exceptional weather conditions are likely to affect the assumptions about alternative transport arrangements that were used to compile the DOTE contingency plan. The likely effects of weather on alternative transport arrangements should be considered as part of the contingency arrangements. In all of the above circumstances, the balance of risk between continuing in service with the defect and the consequences of cancelling or reducing the capacity of trains, should be taken into account and fully documented. Alternative arrangements should not be applied to trains which have defective AWS, ERTMS, TPWS or ATP. Requirement to review DOTE contingency plans Extract from GO/RT3437 Section 2.2.4 Requirement to review DOTE contingency plan 2.2.4.1 Railway undertakings shall review their published DOTE contingency plan whenever the following occur: a) Changes are made to routes over which they operate. b) Changes to the train service pattern or the level of train service are made that affect a published DOTE contingency plan. c) Changes are made to their rolling stock fleet. d) Removals, modifications, additions and/or withdrawals are made to on-train equipment. e) Changes are made to the rolling stock maintenance arrangements that affect a published DOTE contingency plan. f) Changes are made to facilities, either temporary or permanent, at stations identified for the detraining of passengers in a published DOTE contingency plan. G 2.2.8.1 g) After an issue arising from an application of the DOTE contingency plan. No guidance is provided for this requirement. Page 9 of 30

G 2.2.9 G 2.2.9.1 G 2.2.9.2 G 2.2.9.3 G 2.2.9.4 G 2.2.9.5 Reviews of published plans when circumstances change Any review should be a robust critique of the DOTE contingency plan and should result in an action plan being developed to improve the clarity and content of the plan and to address any identified deficiencies. The critique should be based upon the application of the DOTE contingency plan and involve those who have had to use it, regardless of which employer is involved, and as such should include infrastructure managers. When factors a) to f) of section 2.2.4.1 prompt a review of the DOTE contingency plan, the review should identify the effects of the change in operation or circumstance and any amendments that should be made to the plan. Any amendments to the plan should then be made in accordance with the normal process. Factor c) of 2.2.4.1 uses the term fleet ; this refers to changes to the classes of trains operated by the railway undertaking. For example, the introduction of a new class of traction into a railway undertaking s operations might cause changes to be made to DOTE plans. Factor d) of 2.2.4.1 refers to changes (such as technical updates and equipment modifications) that might be made to the classes of trains already being operated by the railway undertaking. Page 10 of 30

Appendix A List of on-train equipment for inclusion in DOTE contingency plans The content of this appendix is mandatory. The content of this appendix details the minimum list of on-train equipment for which DOTE contingency plans shall be produced (a cross reference to the corresponding sections of GE/RT8000 Rule Book Module TW5, unless otherwise shown, is provided): 1) Air suspension (Section 3) 2) Automatic Dropping Device (Module AC Section 12). 3) Automatic Train Protection (ATP) (not in the Rule Book). 4) Automatic Warning System (AWS) (Section 4) 5) Brake defects (Section 5) 6) Doors (external) general guidance (Section 6) 7) Door defects on passenger vehicles (Section 6) 8) Doors (external) defects in service at any location. Guidance specific to power operated doors (Section 6) 9) Doors (external) defects in service at any location. Guidance specific to central locking (Section 6) 10) Driver s Reminder Appliance (DRA)(Section 7) 11) Driver s Safety Device (DSD) (Section 8) 12) Driving cab windows - broken or obscured (Section 9) 13) Driving controls defective (Section 10) 14) Emergency Bypass Switch (EBS) (Section 11) 15) ERTMS Equipment (Section 12) 16) Headlights, marker lights and tail lamps (Section 14) 17) Hot axle boxes and activation of lineside hot axle box detectors (Section 15) 18) Lifeguards (Section 16) 19) Locked wheels / wheel flats / shifted tyres / dragging brakes (Section 26) 20) On-Train Data Recorder (OTDR) (Section 17) 21) Public Address system - DO trains (Section 18) 22) Sanding equipment to assist train braking (Section 19) 23) Selective Door Opening (Section 20) 24) Speedometer (Section 21) 25) Tilt Authorisation and Speed Supervision system (TASS) (tilting trains only) (Not in the Rule Book) 26) Track Circuit Actuators (TCA) (Section 22) 27) Traction Interlock Switch (TIS) - DO passenger trains (Section 23) 28) Traction Interlock Switch (TIS) - Other passenger trains (Section 23) 29) Train Protection and Warning System (TPWS) (Section 24) 30) Train radio equipment (Section 25) 31) Tripcocks (not in the Rule Book) 32) Vigilance equipment (Section 8) 33) Warning horn (Section 27) 34) Wheel Slide Protection (WSP) equipment (Section 28) Page 11 of 30

G A.1.1.1 G A.1.1.2 G A.1.1.3 G A.1.1.4 G A.1.2.1 G A.1.3.1 G A.1.4.1 G A.1.4.2 G A.1.4.3 Air Suspension Trains should not be permitted to enter service from a maintenance depot if the air suspension is not inflated on any bogie. Trains are permitted to enter service from other than a maintenance depot if the air suspension is not inflated on any bogie, but will be subject to any speed restrictions imposed by company instructions. If the air suspension becomes deflated on any vehicle when in service, the train may continue in service but will be subject to any speed restrictions imposed by company instructions. Consideration should be given to any gauge constraints applicable to vehicles with deflated air suspension on the routes the train will operate over. Automatic Dropping Device (ADD) If the Automatic Dropping Device becomes defective on a train in service, the train may complete its journeys for the remainder of the day provided its final journey ends at a maintenance depot. Any movement of the train should be in accordance with the Rule Book, GE/RT8000 module AC. Automatic Train Protection (ATP) If the Automatic Train Protection becomes defective on a train in service, the train should proceed only as far as the next available location. In the case of a passenger train, the passengers should be detrained at the first suitable station, after which the train should proceed only as far as the next available location. It should be noted that the instructions to train drivers and other staff involved in dealing with defective ATP equipment are published by Network Rail in the Sectional Appendices applicable to the routes on which ATP is installed and do not appear in the GE/RT8000 Rule Book. Automatic Warning System (AWS) A train should not be permitted to enter service from a maintenance depot if the AWS is defective, isolated or the seal is broken in any cab that is required to be driven from with AWS in operation. A train is permitted to enter service (but not passenger service) from other than a maintenance depot if the AWS is defective, isolated or the seal is broken in the cab to be driven from with AWS in operation, to travel to a maintenance depot. A train or traction unit on which the AWS is defective, isolated or the seal is broken on the isolating handle may be allowed to enter service from other than a maintenance depot as long as: a) The AWS will not be required to be used. b) It is a non-passenger train making a movement to a maintenance depot. G A.1.4.4 G A.1.4.5 G A.1.4.6 If the Automatic Warning System becomes defective on a train not fitted with ERTMS in service, and if operating over a line fitted with AWS, the train should proceed only as far as the next available location. In the case of a passenger train, the passengers should be detrained at the first suitable station, after which the train should proceed only as far as the next available location. If a train is operating on a line on which AWS is not fitted and the on train AWS equipment becomes defective, consideration should be given as to whether the train will at any point operate over a line fitted with AWS whilst the on train AWS equipment is defective. If the AWS becomes defective on a train in service, but ATP is available and operational, the train may continue its journey provided it remains in an ATP fitted area. Page 12 of 30

G A.1.4.7 G A.1.5.1 G A.1.6.1 If a competent person is available to accompany the driver, the guidance contained at G 2.2.3 of this document should be used to determine how far the train can proceed and any movements should be made in accordance with the Rule Book module TW5. Brake defects If the automatic brake system becomes defective on a train in service, the train or vehicle should proceed in accordance with the instructions set out in the Rule Book, GE/RT8000 module TW5. Doors (external) general guidance The railway undertaking s staff should be provided with instructions and guidance for implementing their DOTE contingency plan in respect of external door defects. The instructions should address in particular: a) Where the only door in the train that gives access to, or egress from, accommodation for passengers with reduced mobility is defective. b) When a decision is required about placing the affected vehicle out of passenger use but allowing the train or unit to remain in service, or withdrawing the train or unit. G.A.1.6.2 G.A.1.6.3 G.A.1.6.4 Before a passenger train is permitted to enter service with more than two defective doors on one or both sides of the train, consideration should be given to the likely effect on station dwell times. If a door cannot be closed, module TW5 of the Rule Book states that the signaller should be told and instructions obtained. Appropriate actions in accordance with the Rule Book should be taken in situations where open doors (such as plug type) would cause a train or vehicle to become out of gauge when a train is worked forward with the defective door open. The DOTE contingency plan should take account of the operational impact of the train or unit not entering service as planned, for example: a) Cancellation of train services, especially the first and last advertised trains and infrequent services. b) Overcrowding of trains and station platforms and increased station dwell times. c) The planned diagram for the vehicle or unit before the defect can be repaired. d) Alternative access and egress available for passengers, in normal service and in emergencies (including for passengers with reduced mobility). G.A.1.6.5 G.A.1.6.6 G.A.1.6.7 The DOTE contingency plan should take account of the practicability of preventing passenger access to the vehicle if it remains in service. It is advisable that DOTE contingency arrangements plan for the affected vehicle to be taken out of service for repair within 24 hours of it entering service with the defective door. Though research into the risks from keeping a train in service (subject to the limitations indicated) shows that they are lower than the risks to passengers from cancelled or overcrowded trains caused by withdrawal of the affected unit, the risks increase if the train remains in service with defective doors longer than 24 hours. When doors are locked out of use, consideration should be given to the method of advising passengers that the emergency egress devices at the affected doors will still be operable (if this is the case). This information could be provided by the use of signs, public address announcements or by the provision of a member of staff at the affected doors. Page 13 of 30

G A.1.7.1 G A.1.7.2 Door defects on passenger vehicles A Door includes a pair of doors at the same door opening. The Rule Book GE/RT8000 requires the vehicle concerned to be placed out of public use if: a) all doors including those only available to the public for use as an emergency exit are defective on one or both sides of the vehicle and the nearest door on the next vehicle is also defective. b) a door only used as an emergency exit at the leading end of the first passenger vehicle or the trailing end of the last one. G.A.1.7.3 The Rule Book GE/RT8000 allows a vehicle to remain in public use with permission from operations control if the following doors are defective: a) all doors including those only available to the public for use as an emergency exit on one or both sides of the vehicle but the nearest door on the next vehicle is available for use. b) a door at the leading end of the first passenger-carrying vehicle. c) a trailing-end door of the last passenger-carrying vehicle. The following colours show: Yellow door Door out of use. Black door An emergency door that is out of use. Red coach Passengers cannot travel in this vehicle. Yellow coach Permission needed for passengers to use vehicles. Green coach Passengers can travel in this vehicle. Leading end door and Trailing end door defective All doors out of use on one vehicle nearest door on next vehicle available All doors out of use on one vehicle nearest door on next vehicle not available End doors out of use at a vehicle end with no gangway Page 14 of 30

Emergency door at leading or trailing end out of use. G A.1.8.1 G A.1.8.2 G A.1.8.3 G A.1.9.1 G A.1.9.2 G A.1.10.1 G A.1.10.2 G A.1.10.3 G A.1.10.4 G A.1.11.1 Doors (external) defects in service at any location. Guidance specific to power operated doors If there is a failure of the door operating controls at all positions on a train with power operated doors, the guard should either release a train crew door, or use an emergency door release facility to release one door. If this is not possible, passengers should be detrained at the first suitable station and the train should proceed only as far as the next available location. The driver should report the circumstances to the signaller and act in accordance with the instructions given. If a door cannot be closed, module TW5 of the Rule Book states that the signaller should be told and instructions obtained. Appropriate actions in accordance with the Rule Book should be taken in situations where open doors (such as plug type) would cause a train or vehicle to become out of gauge when a train is worked forward with the defective door open. If there is a failure of a Door Key Switch (DKS) and the only other DKS is in the driving cab from which the train is being driven, the train may complete its journey. If the doors are to be operated by a guard they should not enter the driving cab to use the DKS until the train has come to a stand. Doors (external) defects in service at any location. Guidance specific to central locking If there is a failure of the door operating controls at all positions on a train with slam doors that are fitted with central locking, and it is practicable to release the emergency lock on one door, and to allow passengers to alight from or enter the train through that door, passengers should be detrained at the first suitable station and the train should proceed only as far as the next available location. On a train with slam doors fitted with central locking, if the central locking becomes defective on all doors of a vehicle, and it is practicable to place the vehicle out of use and transfer the passengers to another vehicle, the train may continue its journey. If this is not possible, passengers should be detrained at the first suitable station and the train should proceed only as far as the next available location. Driver s Reminder Appliance (DRA) A train should not be permitted to enter service from a maintenance depot if the DRA is defective in any cab that will be driven from with the DRA required to be used. A train is permitted to enter service, from a location other than a maintenance depot if the DRA is isolated in any cab that will be driven from with the DRA required to be in use. But arrangements should be made for the train to make its last journey to a maintenance depot. If the DRA becomes defective when it is in service, the train may continue normally, subject to the considerations at G A.1.10.4 of this document, but arrangements should be made for the train to make its last journey to a maintenance depot. DOTE contingency plans should consider, when determining how long a train may remain in service with a defective DRA, the likely number of occasions that trains will be stopped at signals and the extent to which drivers are reliant on its use. Driver s Safety Device (DSD) A train should not be permitted to enter service from a maintenance depot if the DSD is defective or isolated in any cab that is required to be used. Page 15 of 30

G A.1.11.2 G A.1.11.3 G A.1.11.4 G A.1.11.5 G A.1.11.6 G A.1.11.7 G A.1.11.8 G A.1.11.9 G A.1.11.10 G A.1.11.11 G A.1.12.1 G A.1.12.2 G A.1.12.3 A train is permitted to enter service (but not passenger service) from other than a maintenance depot if the DSD is defective or isolated in the cab to be used, to travel to a maintenance depot, provided AWS or TPWS are operative. If the DSD becomes defective on a train in service and AWS or TPWS are operative, the train should proceed only as far as the next available location. In the case of a passenger train, the passengers should be detrained at the first suitable station, after which the train should proceed only as far as the next available location subject to the limitations shown in GE/RT8000 module TW5. Details for dealing with a train on which the DSD is defective and either the AWS or TPWS are not operative are shown in GE/RT8000 module TW5. If the DSD becomes defective on a train in service and both AWS and TPWS are not operative, the train should not make any further movement until a competent person is provided. In the case of a passenger train, the passengers should be detrained at the first suitable station, after which the train should proceed only as far as the next available location. A train on which the DSD is defective or isolated in any cab that is required to be used and on which the AWS and TPWS are not operative, may be permitted to enter service (not passenger service) from other than a maintenance depot to travel to a maintenance depot, as long as a competent person is provided. A train on which the DSD is defective or isolated in any cab that is required to be used may enter passenger service, provided the routes over which it will operate are fitted with ATP and all cabs in which the train will be driven are fitted with ATP which is operable. A train in service on which the DSD is defective or isolated may continue its journey provided it remains in an ATP fitted area and the cab from which it is being driven is fitted with ATP which is operable. If the DSD becomes defective or isolated and the ERTMS is working correctly, the train can continue normally as long as it will only operate over a line on which ERTMS is in operation. Consideration should be taken for plans to be made should the train be required to leave a line on which ERTMS is in operation whilst the DSD is defective or isolated. If the DSD becomes defective or isolated and the ERTMS is not working correctly and required for use, the train should not make any further movement until a competent person is provided. Details for dealing with the train when a competent person is available to accompany the driver, including setting out the duties of the competent person, are shown in GE/RT8000 module TW5. Driving cab windows - broken or obscured A train should not be permitted to enter service from a maintenance depot if any cab window is broken or obscured and prevents the driver obtaining a clear view of the line ahead or train dispatch equipment. If a train is to enter service from other than a maintenance depot with a broken or obscured windscreen, appropriate action should be taken. This may include reducing the speed of the train. If the train cannot proceed safely the signaller should be informed and a competent person may be required to assist the driver. In the event of a report from a driver that the driving cab windscreen is broken or obscured, and the driver considers that the safe operation of the train will be affected, the driver s judgement, together with the availability of a competent person to accompany the driver, should be taken into account in determining how long the train may continue safely in service. Page 16 of 30

G A.1.12.4 G A.1.13.1 G A.1.13.2 G A.1.14.1 G A.1.14.2 G.A.1.14.3 G.A.1.14.4 G A.1.15.1 G A.1.15.2 G A.1.15.3 GE/RT8000 module TW5 sets out the duties of a competent person accompanying the driver when the cab windscreen is broken or obscured. Driving controls defective If the driving controls become defective in the leading cab the train should proceed only to the first location where it can clear the running line. It may be necessary for a competent person to be provided to assist with the movement. Emergency Bypass Switch (EBS) The Emergency Bypass Switch is a device operated by the driver to restore brake control following defects in the brake continuity on train formations with energise to release electric brake control (predominantly multiple-units). Once operated, other safety systems are isolated, e.g. the train brake system no longer has the function of brake (train) continuity detection (for train divisions) and passenger communication alarms may be disabled on certain fleets. As a consequence, it will not be possible to apply the emergency brake in any other driving cab than the one from which the train is being driven. A train should not be allowed to enter service from a maintenance depot if the EBS has been operated in any cab. A train can enter service (but not passenger service) with the EBS operated to travel to a maintenance depot for repair as long as permission has been given and the signaller has been informed. If the train is formed of more than one unit, a guard or competent person should be provided. If the EBS is operated whilst in passenger service and the train is formed of more than one multiple unit, if possible, all passengers should be transferred to the leading unit. A guard or competent person should travel in the rear unit. ERTMS Equipment A train or traction unit may not be permitted to enter service from a maintenance depot if the on-board ERTMS equipment is not working in any cab which is required to be driven from with ERTMS in operation. A train or traction unit on which ERTMS is not operative may be allowed to enter service from other than a maintenance depot as long as the ERTMS will not be required to be used. A train or traction unit may be allowed to enter service from other than a maintenance depot, where ERTMS is in operation, with ERTMS not working in a cab to be driven from over a line on which ERTMS is in operation as long as one of the following applies: a) On a line where lineside signals are provided, both AWS and TPWS are operating. b) On a line where lineside signals are not provided, to travel (not in passenger service) to a maintenance depot for repair. G.A.1.15.4 G.A.1.15.5 G.A.1.15.6 If ERTMS becomes defective when it should be in operation on a line fitted with lineside signals and AWS and TPWS are operating, the train may proceed obeying all lineside signals. If AWS and TPWS are not operating it will be necessary for the train to proceed but under degraded working conditions. If ERTMS becomes defective when it should be in operation and AWS and TPWS are not operating, it will be necessary for the signaller to authorise the driver to pass each end of authority without a movement authority in line with rule book module S5 passing a signal at danger or an end of authority (EOA) without a movement authority (MA). If an ERTMS failure occurs when required to be in operation over a line not fitted with lineside signage. Consideration would need to be given to extended journey times over the portion of line affected. Page 17 of 30

G A.1.16.1 G A.1.16.2 Headlights, marker lights and tail lamps A traction unit should not enter service from a maintenance depot if any headlight, tail lamp or marker light is not working on any vehicle that is required to be at the front or rear of a train. A train may enter service, from other than a maintenance depot, with a failed headlight as long as a portable headlight has been provided. G A.1.16.3 If the headlight completely fails when in service a train can proceed at reduced speed (20 mph/30km/h) until such point as a portable headlight can be provided, during this movement a white light is required to be displayed at the front of the train. Once the portable headlight has been fitted the train can proceed at a higher speed (75 mph/120 km/h). G A.1.16.4 G A.1.16.5 G A.1.16.6 G A.1.16.7 G A.1.17.1 G A.1.17.2 G A.1.17.3 G A.1.18.1 G A.1.18.2 G A.1.18.3 G A.1.19.1 A train can enter service with a defective tail lamp if it is fitted with two tail lamps and one is working, or a portable tail lamp is provided. If a built-in tail lamp becomes defective on a train in service resulting in no tail lamp being displayed, and a portable tail lamp is provided, the train may continue in service until its next scheduled visit to a maintenance depot. If a portable tail lamp is not available the train should proceed only as far as the next available location. If a train with two built-in tail lamps enters service with one lamp defective, the train may complete its journeys for the remainder of the day, provided that its final journey of the day ends at a maintenance depot. Hot axle boxes and activation of lineside hot axle box detectors A train, traction unit or vehicle should not be allowed to enter service with a hot axle box. If a hot axle box is detected by any means, and if the driver decides (in accordance with the Rule Book GE/RT8000 TW5) that the train may go forward for examination by a rolling stock technician, the train should proceed only as far as the next available location. The judgement of the rolling stock technician should form the basis of any decision regarding what further measures need to be applied, for example, detaching the affected vehicle. If the driver decides that the train may go forward only after examination by a rolling stock technician, the judgement of the rolling stock technician should be relied upon in determining what further measures need to be applied. Lifeguards A train should not be permitted to enter service with a loose or damaged lifeguard. A train should not be permitted to enter service with a missing lifeguard at the leading end of the train. If a lifeguard on a train or vehicle in service is loose or damaged, it may become a hazard to the infrastructure with the potential to cause derailment. The driver may decide, in accordance with the GE/RT8000 Rule Book TW5, that the train may proceed forward only after examination by a rolling stock technician. The judgement of the rolling stock technician should form the basis of any decision regarding what further measures need to be applied. Locked wheels / wheel flats / shifted tyres / dragging brakes In the event of locked wheels, wheel flats, shifted tyres or dragging brakes on a train or vehicle in service, and the driver decides that the train may proceed forward for examination by a rolling stock technician, the train should proceed only as far as the next available location. The judgement of the rolling stock technician should form the basis of any decision regarding what further measures need to be applied. Page 18 of 30

G A.1.19.2 G A.1.20.1 G A.1.20.2 G A.1.21.1 G A.1.21.2 GM/RT2466 Railway Wheelsets sets out requirements for railway wheelsets. On-Train Data Recorder (OTDR) A train may enter service from any location with a defective On-Train Data Recorder in the cab required to be used provided there is another data recorder on the train which is functioning correctly. The train may complete its journeys for the rest of the day. Railway undertakings should be aware that OTDRs other than the one located at the driving cab from where the train is being driven may not record the same range of drivers activities (such as AWS/TPWS). If the OTDR in a cab that is required to be used becomes defective on a train in service, the railway undertaking concerned should apply their contingency arrangements for this defect as if it had been found on entry into service. Public Address system - DO trains On DO (passenger) trains, the Public Address system (PA) provides a means of communication between the controlling signaller and passengers in the event of the driver becoming incapacitated. In the event of: a) A DO train entering service from other than a maintenance depot with a defective PA system in any vehicle. Or b) The PA system on a DO train becoming defective in any vehicle in service. The train may complete its journeys for the rest of the day as long as the passengers can be moved to a vehicle in which the PA is working and the affected vehicle placed out of passenger use. The final journey of the day should finish at a maintenance depot. G A.1.21.3 G A.1.22.1 G A.1.22.2 G A.1.22.3 G A.1.22.4 If a competent person, who has access to the affected vehicle(s), is available to provide safety information to passengers, the train may complete its journeys for the rest of the day, provided it completes its last journey at a maintenance depot. Sanding equipment to assist train braking A train should not be permitted to enter service from a maintenance depot if the sanding equipment is defective or the sand boxes are empty. A train is permitted to enter service from other than a maintenance depot if the sanding equipment is defective or the sand boxes are empty, except where the driver believes that there may be difficulty in stopping the train. In all circumstances, the train should end its final journey of the day at a location where the sand can be replaced, the sanding equipment repaired, or a maintenance depot. If sanding equipment that is used to assist train braking becomes defective on a train in service, or if the supply of sand is completely exhausted, the train should end its final journey of the day at a location where the sand can be replaced, the sanding equipment repaired, or a maintenance depot. If the driver believes that there may be difficulty in stopping the train if it was to continue in service, the train should proceed only as far as the next available location, if necessary at reduced speed. In the case of a passenger train, the train may proceed at reduced speed to the next available location to detrain passengers, or passengers should be detrained at the first suitable station, depending on the judgement of the driver. Page 19 of 30

G A.1.23.1 Selective Door Opening If the Selective Door Opening (SDO) facility, which is required to be used, becomes defective on a train in service or on a train entering service from other than a maintenance depot, the train may complete its journeys for the remainder of the day, provided that measures can be put in place to control the hazard to passengers of opening doors where there is no platform. Consideration should be given to the number of short platforms on the route, availability of public address systems and competent staff on trains and at stations, and the likelihood of local awareness of passengers of the hazard (for example daily commuters compared with infrequent travellers). Measures may include: a) Providing a competent person in the affected vehicle to prevent egress where there is no platform. b) Use of the Public Address system. c) Locking the affected door(s) out of use. d) Transferring passengers from the affected vehicle(s) and for the vestibule doors on the affected vehicle(s) to be locked. e) Reducing the length of the train. f) Changing the stopping pattern to avoid the short platforms. g) Redeploying the train to another route without short platforms. G A.1.23.2 G A.1.23.3 G A.1.24.1 G A.1.24.2 G A.1.24.3 G A.1.25.1 G A.1.25.2 G A.1.25.3 The train should end its final journey of the day at a maintenance depot. If alternative measures cannot be applied, passengers should be detrained at the first suitable station. Speedometer A train or traction unit should not be allowed to enter service unless there is a working speedometer in any driving cab which is required to be driven from. If no operative speedometer is available in any cab required to be used on a train in service, the train should proceed only as far as the next available location. An alternative speedometer might be provided by the Train Management System (TMS) or other systems. If the size of the display and location in the cab allows it to be viewed and read from the normal driving position, it can be considered as an operative speedometer. This information should be included in the working instructions for each class of traction unit or shown in the contingency plan. Tilt Authorisation and Speed Supervision system (TASS) (tilting trains only) The DOTE contingency plan should identify the hazards associated with Tilt Authorisation and Speed Supervision (TASS) systems becoming defective in service and the controls for those hazards. Provided that the train tilt system has failed in the tilt centred position ( right side failure), such controls might include allowing the train to run at permissible speed (not enhanced permissible speed - EPS), or confining the train to routes where there is no TASS lineside equipment. If the Speed Supervision system becomes defective when a train is in service, the train may complete its journeys for the remainder of the day provided its final journey ends at a maintenance depot. In such circumstances, the train may only proceed at permissible speed (not enhanced permissible speed). If the Tilt Authorisation system becomes defective when a train is in service then the train may complete its journeys for the remainder of the day provided its final journey ends at a maintenance depot. Page 20 of 30