1 Introduction and Industry Context

In the UK, rolling stock cannot be placed into passenger service without following robust, legally mandated processes to attain the appropriate level of approvals and authorisations. To attain an Approval to place into Service (APIS) the trains have to be demonstrated to be compliant with specified industry standards, compatible with the infrastructure and, able to be safely operated. The rolling stock approvals/assurance processes require verification and validation by independent statutory bodies such as a Notified Body (NoBo), Designated Body (DeBo) or Assessment Body (AsBo), each accredited by a national authority and competent in assessing compliance to standards and management of risk.

Large railway construction Programmes usually include a new or modified rolling stock Project and in this context the industry processes used for the approval and authorisation of the new or modified rolling stock are not always understood by the wider Programme. This can lead to over complication when the Programme’s assurance requirements are defined.

This paper sets out to provide an awareness of the approvals/assurance processes mandated for rolling stock in the UK. It is hoped that the details contained herein will help in defining how such existing rolling stock approvals processes can most effectively fit into the Programme’s railway level assurance cases. This should help in specifying a more appropriate level of assurance from the rolling stock project at the inception of the Programme with more reliance on the outputs from the rolling stock approvals process rather than inputs to it.

Note that this paper is based on regulations for mainline operations (e.g. the EU Interoperability regulations) that were in place before the UK left the EU.

2 Rolling Stock Approvals

In the UK, the rail industry must comply with the requirements of the Railway and Other Guided Transport Systems (Safety) Regulations (ROGS) which sits alongside the European Interoperability Directive 2008/57/EC.

The Safety Authority for the UK is the Office of Rail and Road (ORR) which is the independent safety and economic regulator for the rail industry and responsible for the enforcement of the Regulations.

An interoperability authorisation from the ORR provides confirmation that, new, upgraded or renewed railway subsystems, including rolling stock, meet the essential requirements and comply with all relevant and applicable legal requirements, including Technical Specifications for Interoperability (TSIs), Notified National Technical Rules (NNTR) and application of Common Safety Methods (CSM) for risk control where appropriate.

In order to operate in the UK, Rolling Stock must be meet all essential requirements set out in the standards and ROGS legislation. This is demonstrated by showing that the rolling stock is:

Compliant to all applicable standards i.e the Technical Specifications for Interoperability TSIs and Notified National Technical Rules (NNTRs) specific to national infrastructure

Compatible with the infrastructure and other sub systems for the routes on which the rolling stock will operate

Safe to operate on the railways in accordance with ROGS

2.1 Compliance

The essential requirements are formulated from the applicable TSIs and NNTRs. In the UK the NNTRs include Railway Group Standards. Compliance to TSIs is independently verified by a Notified Body (NoBo) and compliance to NNTRs is independently verified by a Designated Body (DeBo).

A NoBo is an independent third party appointed by the Strategic Rail Authority, the Secretary of State or another European Union Member State which meets the criteria of competence, integrity and independence as set out in the Interoperability Directive. A DeBo is an independent third party appointed by the Secretary of State to assess and verify conformity of Projects with Notified National Technical Rules (NNTRs) in the UK.

The identification and capture of applicable technical requirements for a rolling stock Project are reviewed and agreed with the NoBo and/or DeBo at the start. These bodies also subsequently examine the design (the ‘design type’), examples of the as-built trains, (the ‘production type’) and review the validation and verification (V&V) activities to be undertaken by the manufacturer to check that they are adequate and appropriate and that they have been carried out correctly.

The NoBo/DeBo produce a Technical File, which comprises of verification reports and other evidence supplied by the manufacturer demonstrating technical compliance. The Technical File also contains a ‘maintenance description file’, which describes the manufacturer’s recommended maintenance regime that should be applied to the rolling stock to maintain compliance when in service  and a ‘maintenance design justification file’, which sets out the basis for the selection of maintenance tasks and periodicities.

The NoBo/DeBo also audit the supplier’s quality management system (QMS) in relation to the production of the trains and their subsystems and, ensure that the QMS is being applied in a consistent manner.

The NoBo/DeBo produce Intermediate Statements of Verification (ISVs) for interim phases of the project (e.g. for testing on the infrastructure, operation without passengers) and, finally a Certificate of Verification to confirm that their assessment is complete for operation with passengers.

For compliance with requirements that fall outside of TSIs or NNTRs, the Project must define how this compliance will be demonstrated and verified and agree this with the ORR.

2.2 Compatibility

Where all interfacing railway subsystems are designed and built to be compliant with the TSIs, a compatibility assessment can be undertaken by the NoBo as part of their verification assessment. Where this is not the case, an alternative process must be followed to assure technical compatibility.

For operation on Network Rail’s ‘legacy’ infrastructure not built to TSIs, Railway Group Standard GE/RT8270 Assessment of Compatibility of Rolling Stock and Infrastructure, details the technical consultation process that must be followed before the rolling stock is accepted for operation. This requires collaboration between all the stakeholders i.e. manufacturer, operator and infrastructure managers.

It must be demonstrated that no additional unmanaged risks will be imported onto the railway by the new rolling stock. As a minimum, the compatibility assessment must cover:

• gauging (safe clearance to the infrastructure),
• electro-magnetic compatibility,
• door operation,
• train-infrastructure systems (Automatic Warning System, Train Protection and Warning System; Automatic Power Control, Automatic Train Protection, European Train Control System),
• Power (network capacity, overhead line equipment/pantographs, conductor rail/shoegear),
• Wheel/rail Interface (contact patch energy, vehicle/track impact),
• Operational matters (signal sighting, ability to platform the train, stepping distances, train dispatch etc),
• Coupling compatibility with existing trains and assistance arrangements, Adverse weather performance,
• Braking curves (full service and emergency applications) and acceleration curves (attainable speed),
• Interface with depot facilities

The output from the GE/RT8270 process is a Network Rail Summary of Rolling Stock/Infrastructure Compatibility which defines on which routes the new or modified rolling stock can operate and any restrictions that apply.  This process is outside the scope of the NoBo, but within the scope of the ORR’s decision on whether to authorise a vehicle.

For routes that are not TSI compliant or not managed by NR, the Project must define how this compatibility will be assessed and agree this process with the ORR and the relevant Infrastructure Manager (IM).

2.3 Safe to Operate

Under ROGS, the Duty Holders for the UK railways are the Train Operators (TOCs) and the Infrastructure Managers (IMs). Between them they ensure that the railways operate safely. This paper focuses on the role of the TOCs only.

ROGS requires Train Operators to develop safety management systems (SMS) to manage the risks associated with their activities and to meet specific criteria. The SMS must cover and maintain compliance with TSIs, NNTRs and control of risk assessed through the Common Safety Methods (CSM) and other conditions where these apply. CSM is described in more detail below.

Trains cannot operate in the UK unless the operator holds a Safety Certificate. The ORR also check compliance with CSM when they process applications for safety certificates. As well as safety regulations that apply only to the rail industry, general health and safety laws also apply to rail operations in the UK. The Health and Safety at Work Act and the Management of Health & Safety at Work Regulations include general duties to manage safety, assess risks, co-operate with other duty holders, and make sure staff are trained and have the necessary skills, knowledge and experience.

ROGS has also introduced the concept of an ‘entity in charge of maintenance’ (ECM). An ECM is a competent person or organisation that is responsible for the safe maintenance of rolling stock. Rolling stock can only be placed into service by a TOC if the vehicle has an ECM assigned to it and that person or organisation is registered as the ECM in the National Vehicle Register.

In many, but not all cases, the rolling stock manufacturer also fulfils the role of the ECM.

The output from these processes is the issue of a Safety Certificate from the ORR to the TOC.

2.4 Common Safety Method

The Common Safety Method (CSM) regulations require that a standardised form of risk assessment is undertaken when a significant change is made to the railway, such as introducing a new design of rolling stock. The CSM-RA risk management processes are intended to complement Project requirements related to technical compliance and compatibility.

The main phases of the risk management processes start with the  preparation of a System Definition which should provide the key details of the system that is being changed, its interfaces with other railway systems and how it is being used.  A systematic and structured hazard identification process is employed to identify all reasonably foreseeable hazards associated with its use, and to determine the most appropriate means of eliminating or controlling the risks.

The CSM RA requires an independent assessment of how the risk management process has been applied and the effectiveness of the risk control measures. An accredited, competent assessment body (AsBo) carries out this assessment.

The safety assessment report that is produced by the AsBo is submitted to the ORR with the Technical File.

3 Overview of approvals and assurance

As set out in the sections above, under UK legislation, any rolling stock approved and authorised to operate will have been through a set of prescribed and robust safety related processes.

In summary, there is independent, evidence based, verification by accredited competent bodies such as the NoBo, DeBo and AsBo and by Duty Holder operators and infrastructure managers, that new or modified rolling stock is compliant with technical standards, is compatible with the interfacing infrastructure, and has been assessed for safe operation with all risks arising from operation appropriately managed or controlled.

The certification issued by the NoBo/DeBo can be relied upon as satisfactory evidence of compliance with the essential requirements covered by TSIs and NNTRs. The Safety Assessment report produced by the AsBo can also be relied upon as evidence that a robust risk assessment and management process has been followed.

Ultimately the ORR will satisfy itself, via the Technical File, that the correct mandated processes have been followed and that evidence and declarations from the accredited bodies supports an authorisation from the ORR to put the rolling stock into use.

Separately, the ORR will have assessed the operator and relevant infrastructure managers’ safety management systems for suitability of the safe introduction of new rolling stock and controls relating to operation, maintenance and technical changes.

4 Major Programme Assurance Requirements

At the start of a major railway Programme, which includes new or modified rolling stock, consideration should be given to, not only to defining the rolling stock technical requirements, but also to how compliance with those requirements will be appropriately evidenced, and how that evidence will be used in the Programme’s railway level assurance process.

As explained in this paper, before trains are allowed to operate in the UK, they must have followed well defined processes as mandated by UK legislation, the application of, and evidence from, such processes being verified by independent, accredited bodies.

It is, therefore, reasonable to rely on certification from those bodies as satisfaction that essential requirements related to technical compliance with standards, compatibility with interfacing infrastructure and control of risk have been met. It should not be necessary for the Programme to scrutinise the same input evidence (for instance type-test reports) already considered by the accredited bodies,  pursuant to those bodies issuing their conformity certificates.

As a minimum these assurances should be considered by the Programme an appropriate ‘entry ticket’ for the rolling stock.

For interfaces with systems that are not compliant with the essential requirements set out in the UK legislation and related standards, or where there are no recognised standards in force, the ‘deltas’ from the recognised standards and legislation should be identified.

A system integrator should be nominated, and the appropriate level of assurance evidence (and who provides this) agreed for the ‘deltas’ early in the Programme lifecycle so that unambiguous testing and assurance requirements can be built into contracts for all the appropriate railway subsystems, including rolling stock.

5 Lessons learned

Having worked on a number of major railways Programmes, the author has noticed a general lack of understanding of the existing industry assurance processes for rolling stock, how those processes fit within the UK legislative framework, and the level of independent scrutiny undertaken by accredited bodies as part those processes.

Without this understanding, the wider Programme may assume that rolling stock assurance must follow the same assurance regime as that for other railway assets, where standards and levels of independent scrutiny of compliance are not as well defined nor enshrined in legislation. This misunderstanding can lead to demands for an inappropriate type or level of ‘input’ assurance evidence for scrutiny by the Programme, duplicating the validation work already done within the rolling stock Project, rather than relying on the ‘output’ from the Project’s validation processes.

In the experience of the author, examples of such Programme demands have included:

• Request to review type test reports that have already been validated by a NoBo or DeBo for the same operating environment,
• Requests to observe type testing that has already been done and verified,
• Requests to physically measure items or to visually inspect installations on the rolling stock when these have already been verified by a NoBo or DeBo as being compliant to standards,
• Not recognising the Safety Assessment reports issued by an AsBo,
• Not recognising the effectiveness of a competent and experienced rolling stock manufacturer’s quality system, including requirements management and, hazard identification and management, notwithstanding the accreditation of the quality process and the independent validation that it has been applied to the Project.

These requirements can lead to unnecessary additional work and cost.

Early in the Programme, focus should be concentrated on identification of rolling stock areas and interfaces that sit outside the scope of the legislative standards framework and hence the scope of the independent assurance bodies. For this, it is in the opinion of the author, it is important to have the timely appointment of a systems integrator to manage this activity.

6 In hindsight would you do anything differently?

Wider engagement with all stakeholders across the Programme at the start, to explain the existing rolling stock approvals processes mandated by UK legislation, including the role of the accredited approvals bodies.

Set up the railway level safety assurance structure early in the Programme and, define and agree how the functionality and safety requirements for rolling stock will be evidenced at the appropriate level of granularity in the railway level ‘safety case’. It should be acceptable to rely on outputs from the rolling stock approvals and authorisation processes set out in this paper, rather than scrutinising the inputs to those processes at Programme level.

Identify and appoint the Programme’s system integrator at the start and concentrate on the systems and rolling stock interfaces that do not comply with industry standards, or, for which no recognised standards exist. The integrator and the Project should agree the granularity of assurance needed in such cases early enough for bespoke evidence requirements to be built into rolling stock supply contracts.

Drive the definition and agreement of railway level assurance requirements by setting a related Programme milestone.

7 Conclusion

The processes to attain approvals for rolling stock to operate in the UK are well defined, enshrined in legislation, subject to independent verification, and well-practised. Outputs from these processes can be relied upon as part of a Programme’s railway level safety case, rather than submitting the same inputs for duplicated scrutiny by the Programme.

Focus should be put onto those areas where there are unique subsystems or bespoke interfaces which are out of the scope of established standards and the mandated independent verification processes. Identification of such areas, and agreement on the level of assurance evidence to be provided by a Project to feed into the Programme’s railway level safety case, should take place early on in the Programme’s lifecycle and under the control of a systems integrator.

Acknowledgements

I would like to thank Mr Phillip Clarke, Deputy Rolling Stock & Depot for his valued contribution to this paper and Mr Malcolm Venables, Principal Rolling Stock Engineer for his review of the contents.

References

[1]        The Railways and Other Guided Transport Systems (Safety) Regulations S.I. 2006 No. 599 as amended by S.I. 2011 No. 1860 as amended by S.I. 2013 No. 9501

[2]        The Railways (Interoperability) Regulations 2011 S.I. 2011 No. 3066 as amended by S.I. 2013 No. 3023

[3]        Approach to authorisations under the Railways (Interoperability) Regulations 2011 published by the ORR

[4]        Commission Implementing Regulation (EU) 402/2013 (the Regulation on a common safety method (CSM) for risk evaluation and assessment [or “the CSM RA”])