Railway Signalling System

Rationale: European regulatory mandate (TSI CCS) requires ETCS deployment on TEN-T corridors. However, the transition period demands dual signalling (lineside + cab) because the entire fleet cannot be retrofitted simultaneously. The system must therefore provide both modalities concurrently without degrading safety or capacity for either traffic type.

Rationale: Fundamental safety requirement deriving from CENELEC EN 50129 safety case obligations and UK Railway Group Standard GK/RT0045. The 10^-9/h THR aligns with SIL 4 for catastrophic hazards (head-on collision, side collision at junctions). This is the primary raison d'etre of the signalling system — without guaranteed train separation, no safe railway operation is possible.

Rationale: Maintenance staffing levels are constrained by the infrastructure manager's budget and recruitment pipeline. 6 technicians per 100 route-km reflects current UK Network Rail norms. The 2-hour MTTR ensures that degraded-mode operation (which typically halves capacity) does not persist across peak traffic periods.

Rationale: Level crossing collisions are the single largest category of railway fatalities in Europe. The 20-second minimum warning time is derived from road user clearance time calculations per Railway Group Standard RT/E/S/11200, accounting for a 60m road vehicle clearing the crossing at 5 km/h. Below 20 seconds, road users cannot reliably clear the danger zone.

Rationale: Capacity requirement driven by the infrastructure manager's timetable planning. The 2-minute headway is typical of high-capacity mainline corridors (e.g., UK East Coast or West Coast Main Line). Below this headway, signalling becomes the bottleneck and timetable paths are lost. The 30 trains/hour/direction target derives from franchise commitments and passenger demand forecasts.

Rationale: Railway operators face severe financial penalties for service disruption. 99.99% availability (52 minutes downtime per year maximum) is the standard for UK mainline signalling renewals. The single-failure containment requirement prevents common-cause failures from cascading across the controlled area, which would strand hundreds of trains simultaneously.

Rationale: Trackside equipment is exposed to extreme conditions: sub-zero winter temperatures (especially in Scandinavian or Scottish deployments), solar heating of equipment cases to +70°C in summer, traction return current EMI up to 2000A at 50Hz, and continuous weather exposure. EN 50121-4 is the railway-specific EMC standard that ensures signalling equipment is neither disrupted by nor disrupts traction and communications equipment.

Rationale: Direct derivation from STK-NEEDS-OPS-001. The 10^-9/h THR is allocated to the interlocking function because wrong-side signal failures (showing a proceed aspect when the route is not safe) are the primary hazard mechanism. EN 50129 requires this to be demonstrated through a combination of hardware reliability analysis (failure modes), software safety integrity (EN 50128 SIL 4 process), and systematic capability assessment.

Rationale: Derives from 99.99% availability requirement. Single-failure tolerance is achieved through 2oo2 or 2oo3 voting architectures in the interlocking and hot-standby in the RBC. The 500ms failover bound ensures that train detection continuity is maintained — track circuits that lose processing for >2s may falsely indicate clear when a train is present (rail voltage recovery artefact).

Rationale: Derives from STK-NEEDS-OPS-001. Train detection is the primary input to the interlocking — if a track section falsely shows clear when occupied, the interlocking may set a conflicting route. The 30kg minimum axle load covers all known rail vehicles including lightweight engineering trolleys. The 10^-9/h THR matches the interlocking allocation because a false-clear detection is functionally equivalent to an interlocking wrong-side failure.

Rationale: Derives from STK-NEEDS-CON-005. The 2-second latency ensures ETCS-fitted trains receive updated MAs before they reach their current end-of-authority at line speed, preventing unnecessary emergency braking. The 1-metre EOA accuracy is required because ETCS supervised braking curves use the EOA as the zero-speed target point — larger errors could permit overrun into an occupied section or force unnecessarily early braking.

Rationale: Direct derivation from STK-NEEDS-OPS-006. The approach detection point must be calculated from the maximum approach speed (160 km/h = 44.4 m/s) plus the full protection sequence time (typically 27-32s for half-barrier). At 160 km/h, the approach detection point is approximately 2.3 km from the crossing. Timing margins must account for track circuit pick-up delay (<1s) and barrier descent time (8-12s).

Rationale: UK Railway Group Standard GK/RT0045 and RSSB mandate AWS/TPWS at all controlled signals regardless of ETCS fitment. During the ETCS transition period, the fleet will include non-ETCS-fitted trains that rely exclusively on lineside signalling with AWS/TPWS as the final safety net against SPAD. Even for ETCS-fitted trains, AWS/TPWS provides an independent overlay protection layer. Removing AWS/TPWS prematurely would expose non-fitted trains to unmitigated SPAD risk. The 99.9% reliability target is per Railway Safety Principles and Guidance Part 2 Section E.

Rationale: UK Railway Group Standard GK/RT0045 mandates AWS/TPWS at all controlled signals regardless of ETCS fitment. During the ETCS transition period non-ETCS-fitted trains rely exclusively on lineside signalling with AWS/TPWS as the final safety net against SPAD. The 99.9 percent reliability target aligns with Railway Safety Principles and Guidance Part 2 Section E.

Rationale: Total CBI or RBC failure, while rare with design target MTBF greater than 50000 hours, must be planned for because it leaves trains without movement authority or signal protection. UK Rule Book Module TW1 defines degraded operating procedures including pilotman working and verbal authorisation that require the signalling system to release control of track sections individually. The 60-second transition time prevents trains approaching signals at danger without updated information. The 4 trains per hour floor is the minimum operational capacity that avoids route-wide cancellation during peak hours, derived from Network Rail operational resilience standards.

Rationale: Total CBI or RBC failure must be planned for because it leaves trains without movement authority. UK Rule Book Module TW1 defines degraded operating procedures including pilotman working and verbal authorisation. The 60-second transition time prevents trains approaching signals at danger without updated information. The 4 trains per hour floor avoids route-wide cancellation during peak hours per Network Rail operational resilience standards.

Rationale: RAIB investigations require comprehensive event timelines across all signalling subsystems, not just ETCS. CBI interlocking decisions, point movements, track circuit occupancies, signal aspect changes, and operator actions must all be correlated during incident investigation. The 6-month retention aligns with Railways Accident Investigation and Reporting Regulations 2005. The 4-hour accessibility requirement reflects RAIB standard evidence preservation protocols.

Rationale: Temporary speed restrictions are imposed daily across the UK network for track maintenance and infrastructure condition. TSRs must propagate to both lineside signals via reduced approach aspects per Railway Group Standard RT/E/S/11201 and ETCS movement authorities via SUBSET-026 speed profile to protect both fitted and non-fitted trains. Without integrated TSR management, speed restrictions require manual signaller intervention for every affected train, increasing workload and error risk.

Rationale: Derives from the 2-minute headway requirement. Signal aspect update latency directly affects following-train braking distance calculations and thus minimum headway. At 500ms, the delay contribution to headway is negligible (<50m at 200km/h). At >2s, headway calculations must add a full signal section, potentially increasing minimum headway beyond the 2-minute target.