Command, controlling and signalling

Strategic Risk Chapter

3. Compliance expectations

Why compliance matters

Command, control and signalling systems are safety-critical because they directly control train movements and prevent conflicting routes. Failures in these systems, particularly signalling wrong-side failures, can have catastrophic consequences. Although such events are rare, their potential severity means that risks must be prevented so far as is reasonably practicable.

Compliance expectations therefore focus on ensuring that railway organisations maintain the integrity of their signalling and train control systems throughout their lifecycle, and that failures, incidents and precursors are identified, investigated and addressed effectively. The quality of dutyholder investigations into signalling incidents is critical to understanding root causes and preventing low-frequency, high-consequence events.

Why compliance in signalling is critical. Signalling failures, particularly wrong-side failures, are low frequency but can have catastrophic consequences. Robust investigation of incidents and precursors is essential, and system integrity must be maintained as technology and operations change.

The legal and regulatory basis

Railway organisations are required to manage the risks associated with signalling and train control systems through their own safety management systems. This includes duties under the Health and Safety at Work etc. Act 1974, The Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS), and The Railway Safety Regulations 1999 (RSR), including Regulation 3 relating to train protection. ORR’s role is to provide assurance that these arrangements are effective and, where necessary, to promote and enforce improvements to secure safe outcomes.

ORR expects signalling systems to be designed, installed, tested, operated, maintained and renewed in a way that ensures continued system integrity. Whether a signalling system is newly designed or part of a renewal or enhancement, appropriate steps must be taken to ensure optimal safety and software integrity. ORR undertakes this through its formal role in authorising equipment into service and, where necessary, through the use of enforcement powers.

Cyber security is also a key element of system integrity. Dutyholders are expected to address cyber security risks in the specification, design, procurement and operation of command, control and signalling systems.

When compliance must be demonstrated

Compliance must be demonstrated throughout the lifecycle of signalling and train control systems and whenever changes are made that could affect safety. This includes:

  • the introduction of new signalling or train control systems;
  • renewals, enhancements or upgrades to existing systems;
  • changes to rolling stock, operating rules or speed profiles;
  • transitions from legacy to digital or automated systems; and
  • organisational or operational changes, such as the move to centralised control in Railway Operating Centres
  • following incidents, failures or identified precursors

Where incidents or failures occur, including signalling wrong-side failures, dutyholders must ensure that investigations are thorough and that identified risks are addressed effectively. Exemptions – defined by The Railway Safety Regulations 1999 – relating to train protection systems, such as TPWS, must be kept under review and confirmed as valid when changes are made to infrastructure or operations.

ORR’s expectations of dutyholders

Dutyholders are expected to:

Maintain the integrity of signalling and train control systems in service. Ensure that signalling incidents and precursors, including wrong-side signalling failures, are identified, reported and investigated to a high standard. Manage transitional risks when moving from legacy systems to newer technologies, including through effective co-operation with other industry parties. Ensure that software, data and system interfaces are correctly specified, tested and assured throughout the system lifecycle. Manage human performance risks, including workload, competence and situational awareness, particularly where operating models or control arrangements change. Ensure that appropriate contingency, redundancy and resilience arrangements are in place to avoid single points of failure affecting large areas of the network. Take opportunities, when renewing or enhancing signalling systems, to improve related safety risks, such as those affecting level crossings or track worker protection.

ORR expects to be engaged early in the development of new or significantly modified signalling schemes so that safety can be influenced at the design stage, rather than relying solely on end-of-process authorisation.