On my radio
Network Rail’s Justin Willett considers the risks around GSM-R
The need for drivers to get in touch with signallers directly—and vice versa—was demonstrated by the accident at Cowden on 15 October 1994, a collision that killed five people and injured 13 more. The signaller was aware that one train had passed a signal at danger. Had it existed, they could have used direct comms to alert the driver of that train, and the one it struck with such fatal consequences. Such systems, including Cab Secure Radio (CSR), and the National Radio Network (NRN), were later adopted and went on to prevent many accidents.
But all technology becomes outdated eventually. By 2010, CSR and NRN were starting to be replaced by the Global System for Mobile Communication– Railway, known to us all as GSM-R. You know as well as I do that new kit can fail just as old kit can. But then came an incident at Hitchin on 8 October 2013 that led us to change the rules about what to do when something does go wrong.
At around 20.40 that evening, a driver passed a signal at Hitchin station while using his CSR. The investigation found that he had not fully set the radio up, didn’t report the SPAD, and took his train on to destination. The driver was prosecuted by the ORR and received a 3-month suspended sentence and £500 fine.
ASLEF then wrote to all operators, pointing out that they would instruct drivers to run at a reduced speed (20 mph) if they experienced any loss of radio. Also, that no train would be driven into service with a radio fault. The ORR felt that this was disproportionate. But what would be better? To answer that question, the industry set up a GSM-R Failures Cross- Industry Working Group in 2014, with representatives from train operators, RSSB, ORR, and ASLEF. The group was tasked with finding the best and safest operational response to the various types of GSM-R failure, taking into account any knockon risk that might arise. For example, data demonstrates that disrupting services and imposing speed restrictions not only inconveniences passengers but also increases the incidence of SPADs, staff assaults, PTI incidents, and slips, trips and falls.
The group developed principles over approximately 14 months that were codified within Rule Book Module TW5 and a new Rail Industry Standard RIS-3780-TOM. These set out the safest operational response to the range of GSM-R failures.
For individual trains, the outcome was:
Trains with known failures should not enter service.
Trains already running which then suffer a GSM-R failure can stay in service for a maximum of 75 miles, after which the failure will need to be dealt with.
During network failures (REC call functionality not available) affecting approximately more than 10 kilometres (6 miles) train speed will be restricted to 100 mph, and reduced to 60 mph if the failure continues over 4 hours.
Clarity on what should be considered as system failures was codified within RIS-3780- TOM, as the risk model was significantly influenced by the railway emergency group call (REC) functionality remaining available. Therefore, the requirement within the Rail Industry Standards clarified ifthe on-board train radio cannot be registered for any reason, but displays GSM-R GB indicating that it is attached to the network, a railway undertaking shall consider the radio to be operative and capable of sending and receiving calls, including RECs. Therefore, no speed restriction or prevention from entering service is necessary. Registration provides enhanced features, and is not required for core functions of the radio to meet legislative compliance, such as REC functionality.
As this was a significant change, the outputs of the work were briefed to industry extensively. There was personal briefing to professional heads of operations and driver management teams. ASLEF also briefed all their health and safety reps. This was in addition to the normal industry briefings on rules and standards issue.
The same approach has subsequently been applied to a range of other on-train equipment failures and operational responses. With industry support, RSSB recently updated the ‘knock-on’ risk element through a research project on improving the quantification of risk arising from delays and disruption (T1344). It is currently updating its main Safety Risk Model.
So what happened on Friday 6 December 2024, when an unplanned outage of the headcode registration service within GSM-R occurred during a maintenance window between 00.01 and 05.00? It led to about 27,000 minutes’ delay, 44 service-affecting failures, and 552 cancellations across the country. The rules and standards actually permit trains to enter service without headcode registration where REC call functionality is still available. That did apply in this case, so most of that disruption could have been avoided, as could the disproportionate level of system risk. There’s a lesson there for us all, not least that it is not always safer to stop, as it can import risk in some situations. The rules have been developed to take all of this into account to guide us to the safest response overall.
RSSB is continuing to evaluate and clarify through rules and standards with amendments coming to you in June. Look out for the update to RIS-3780-TOM.
You can read Network Rail’s GSM-R case study here.
Read the case study
