Cross Acceptance of systems and equipment

CLIVE KESSELL

The lengthy time taken to get new projects, systems and equipment into service is something that gives many of us a sense of despair. It never used to be like that, so what has happened to make things so complicated and what can be done to speed things up?

Part of the problem is that legislation has been introduced at both UK and European levels that imposes a series of rigorous checks to ensure systems are safe, secure and reliable. From this, a whole industry has grown up to independently verify all of these checks and certify a general ‘fit for purpose’.

Is it all overkill and does it have significant cost implications that cause projects to be more expensive than they need be?

Two associated articles in this edition (RIA Conference and DfT Session) give a general concern as to the level of bureaucracy that has crept into the business of delivering successful projects.

To try and put some of this into context, Professor Rod Muttram recently delivered a lecture to the IRSE on the subject of Cross Acceptance. He attempted to explain how it can be a positive influence for the introduction of new technology, but he also set out how difficult it can be for all parties to buy into the whole process. So, what is Cross Acceptance?

The concept is that a system or product, which is successfully used in one country, should be capable of being used in another country without having to go through a full back-tobasics approval process. The process is not something new and the IRSE International Technical Committee first put forward a proposal for this as long ago as 1992, focussing mainly on safety validation but stopping short of giving a formal definition of cross acceptance and how it would be implemented.

Since then, the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) have set out some basic parameters as to how cross acceptance can be achieved. The issues can be logged as: » Specifying the functional requirements; » Compliance with international standards; » Separation of generic software from application software and between programmes and data – the system architecture; » Determination of which parts of a system are vital and how this is protected; » Whether systems can be designed to be carried out by contractors, railway engineers or both; » The need to have a validation plan.

From these have emerged EU standards EN50126 (environment), EN50128 (software) and EN50129

(systems) and Safety Integrity Levels (SIL) 1 to 4, which can also be controversial as to how they are applied to different elements of a system.

Software is very common in most railway equipment across all the engineering disciplines, but it is perhaps the biggest factor in persuading potential users that it is transferable without full revalidation.

The European dimension

The Safety Case dominates the end result. Quantifiable safety targets are embedded and are mandatory within the Technical Specifications for Interoperability (TSIs), which have emerged piecemeal, the main ones being: » TI 91/440 demanded that rail development separated infrastructure from train operation, at least in financial accounting. This would make it easier for international trains to cross borders to a common standard, as well as stimulating competition. » TI 96/48 required trans-

European high-speed lines to operate to a common train control system, so as to ensure the development of a single system for both infrastructure and cab equipment. The result of this has been ERTMS with its component parts of

ETCS, GSM-R and ETML.

The latter is the European

Traffic Management Layer, which never really got off the ground and reliance is put on proprietary Traffic

Management Systems.

Since high speed lines were

invariably new builds, legacy rules for operations and signalling did not feature, making compliance less of a problem. These lines do not have level crossings and those built prior to the ERTMS standard will eventually be converted. » TI 2001/16 covers interoperability of trans-

European conventional rail routes, thus imposing a standard on many lines equipped with previously developed national signalling systems and clearly much more difficult to implement and over a longer time frame. The intention is that significant signalling upgrades or renewals will require ERTMS to be fitted.

Subsequent Directives 2004/50 and 2007/32 have consolidated these three into newer versions, but with the crux of the requirements remaining the same. Implications for signalling

With a history of standards and specifications being different between countries and suppliers having products that are not compatible with each other, getting cross-acceptance in place is not an activity that comes naturally. Realisation has dawned that perpetuating existing signalling practices when replacement projects are planned is not a sensible way forward.

Now that ETCS has reached a maturity level and the industry is geared up to supplying ETCS products, new signalling solutions should now focus on the ERTMS standard and, indeed, it is mandatory for the routes described above. The decision is straightforward, but the limits of conformity are not ideal.

In the days when interoperability was being discussed, two possibilities existed: » The ‘white box’ product, whereby all equipment from all manufacturers would be totally compatible to allow interchangeability of products, regardless of who made it. Thus, a train with a

Siemens unit installed could be replaced with a unit from

Alstom if the first unit had failed. » The ‘black box’ solution, which only required

standardised interoperability across the ‘air gap’ between the train and the ground equipment via the GSM-R radio link. Thus, a failed ETCS unit on a train had to be replaced by a unit from the same manufacturer.

Taking account of the investment already made by the different manufacturers of ETCS products, and the cost of having to redesign everything, it was reluctantly accepted that the black box solution was the only practical way forward. This has stifled competition and owners of train fleets are effectively locked into the supplier of the initial chosen system.

The result is the emergence of a ‘Systems Market’, whereby the supplier is responsible for the whole system and not just products within it. The onus for satisfactory performance thus rests with the contractor, who has to ensure that the system is compatible with the country’s operating rules, including such things as level crossing requirements. This leads to considerable specialisation and increased costs.

Cross-acceptance challenges

If a system or product is to be cross accepted, the usage of the system in the new country must have significant synergies with the country of current usage. This can cover a multitude of factors: temperature range, vibration, power supply, definition of vital and non-vital and all other sub systems and components.

Then there is the software, where the development tends to follow an evolutionary path from the previous product rather than working from a generic specification.

In any case, if cross acceptance is to be achieved, full details of the software need to be provided and there is reluctance from the supplier community to share this level of information. Backward compatibility assurance to earlier variants of the system can be difficult and can result in expensive re-validation.

Barriers to cross acceptance

Across Europe, 27 different operating rules represent another challenge. If cross acceptance is to be achieved, some harmonisation has to happen, but getting motivation and approval for common rules is a fraught process.

The evidence is that cross acceptance should reduce cost and speed up deployment, but vested interest groups remain and may well resist the principal intentions. As has been mentioned, suppliers of signalling systems have a history of success by being different to competitors and it was a long time before even the ‘black box’ air gap interface was accepted as part of ERTMS interoperability. A change of mind set is required which might only come from a new generation of design and system engineers.

Equally, the safety-approval industry could see much of its work reduced if cross acceptance becomes a reality in terms of generic systems and products, leaving only the application element needing independent verification before commissioning.

Successes and failures

Asked whether cross acceptance is becoming a norm in Europe, the answer is – “not really”. There are examples where it has happened; the Bombardier CityFlo 650 control system that was developed initially for the Pittsburgh Metro was successfully migrated to Madrid Metro, using elements of cross acceptance and periods of shadow running. Regrettably, it failed to migrate to the LU sub-surface line resignalling project, mainly because of doubts over the maturity of the product and it not being possible to meet the LU legacy specifications.

Operating rules led to significant problems when trying to implement the Bombardier EbiLock R3 interlocking into the Horsham resignalling project (the scheme was eventually abandoned), the Siemens SIMIS-W interlocking at Portsmouth and the Ansaldo ACC system at Manchester South between Cheadle Hulme and Crewe. The latter was designed to turn signals ‘black’ if a failure occurred, where UK practice demands they go to red. Also, the brightness of the signal displays did not meet the UK specification.

Better results came from the American Harmon Vital Logic Controller as used on the Norwich Cromer line, the Bletchley–Bedford line and the Sheerness branch, but even with these, more validation was required than was originally thought necessary.

A significant success has been the adoption by Atkins of the GE (originally Harmon) ElectroLogIXS interlocking. Whilst Atkins is one of Network Rail’s nominated signalling system suppliers, it did not have its own solid-state interlocking. Negotiations to obtain and get approved the GE equipment proved successful with its first UK application being the Old Oak Common depot for Crossrail (Elizabeth line). It sounds small beer, but it is a huge site and the installation was awarded Innovation of the Year for 2020.

Since then, the interlocking has been deployed on the Shepperton branch as Phase 1 of the Feltham area resignalling, the Norwich-YarmouthLowestoft resignalling project and will be used on the rest of the Feltham project1. The approval process did involve some modifications to suit UK interfaces and was not cheap, but cross-acceptance principles made it easier.

The development in the UK of Automatic Train Operation (ATO) superimposed upon ETCS for the Thameslink central core is seen as something that could be cross accepted by other countries.

The GSM-R radio components are universally accepted across Europe but with the advent within five years of a new radio standard, the implications for cross acceptance will again emerge.

It could be worse!

Cross acceptance is regarded by some with considerable caution. There are hopeful signs, but software awareness and associated knowledge may be key to ongoing success. Changing software is complex and can lead to a lot of revalidation, even for the simplest of requirements. The supply industry should be capable of recognising that having a cross accepted product can be beneficial in the wider market.

Whilst the European situation has its challenges, it is simple when compared to what is going on in the USA. Following a number of serious train accidents, it was decreed that a system of Positive Train Control should be implemented on all railroads. There is no harmonised framework in America and railroads develop their own systems, with the result that four separate solutions exist across the country, depending on area and type of railroad, none of them being interoperable. The initial implementation dates were never realistic and the saga continues.

Whilst this article has focussed on signalling systems, cross acceptance is equally applicable to electrification, rolling stock and many civil engineering activities, where it is understood the same constraints exist.

Considerable progress has been made with rolling stock, and manufacturers now build trains to a standardised platform where gauging, EMC and such like are no longer a problem.

We all wait to see whether cross acceptance will become a norm in the years to come.