Taking Safe Decisions Worked Example
Provision of Signal
Post Telephones when
adopting GSM-R
Summary:
This worked example describes the removal
of a risk control which is no longer providing
a significant safety benefit, and where
several iterations of the risk assessment
and monitoring processes may be required
to reach a decision. It also illustrates the
complexities of decisions involving multiple
organisations.
with operations becoming significantly less reliant
on these where GSM-R is installed and is fully
operational. Such telephones may however provide
a useful back-up to GSM-R in the event of GSM-R
failure, but their upkeep and maintenance also incurs
significant on-going costs for the industry.
An Infrastructure Manager (IM) undertakes a resignalling project in an area covered by GSM-R and
wishes to assess whether they should continue to
provide SPTs in the area from a safety point of view.
Key learning points
This worked example illustrates that:
• Framing can influence the decision: it is often
more constructive to frame the decision as
whether a control needs to be provided rather
than whether it can be removed to avoid loss
aversion.
• It is important to seek stakeholder consultation,
involvement and agreement in the early stages of
scoping and assessing the change.
• Assumptions underpinning the risk assessment
need to be verified.
• Previous work can be reused and built upon to
prevent unnecessary re-working.
1. Origin of review
GSM-R voice and data radio has been fitted across
the UK railway network, meeting the requirement
of the Railway Interoperability Regulations. The
initiative raises a number of strategic questions for
continued use of existing train control equipment,
including Signal Post Telephones (SPTs).
The main purpose of voice radio systems between
train drivers and signallers is to provide an effective
means of communication to support the safe
and efficient movement of trains and the general
operation of the railway. Where fitted, GSM-R
forms the primary means of supporting such
communication. Although no longer mandatory,
SPTs continue to exist across the railway network,
www.rssb.co.uk
1
2. Analysing and selecting options
The IM accesses previous RSSB research as a
starting point to analyse available options.
Prior to the introduction of GSM-R, RSSB had
commissioned consultants to advise on the
optimisation of communications following the
introduction of GSM-R, and the role of SPTs. The
RSSB analysis was initially undertaken to determine
whether, from a safety perspective, it is necessary
to provide SPTs, given installation and operation
of GSM-R. The aim was also to provide IMs with
a basis for decision making on future projects
regarding whether to continue to provide SPTs.
The quantified risk assessment within this RSSB
analysis indicated that not providing SPTs
created some additional risk to train drivers and
passengers associated with the potential for loss
of communications in safety critical situations.
However, for some locations this additional risk was
offset by a reduction in the risk associated with train
drivers alighting from the train to the trackside to use
the SPTs less frequently.
Overall, the RSSB analysis had concluded that
providing SPTs would result in a net safety benefit
for train drivers of approximately 0.18 FWI/year
nationwide but would incur significant maintenance
Factors to consider
costs. The cost-benefit ratio of around 28
supported the case for not providing the SPTs,
overall. It was however recognised that the costs
and benefits of SPTs vary from one location to
another and that therefore there may be some SPTs
where the benefits exceed the maintenance costs
and, from a cost-benefit perspective, it would be
reasonably practicable to provide SPTs in these
circumstances.
On the basis of this analysis the IM decides that the
selective provision of the SPTs should be assessed
on a location by location basis for the project with
explicit risk estimation, using the RSSB assessment
tool – the Fixed Lineside Telephony Assessment Tool
(FLAT) - together with industry guidance.
Site-specific data is entered into FLAT to determine
whether there is a safety benefit and/or financial
saving from the provision of each particular SPT.
This analysis concludes that the majority of the SPTs
are not required to make the system acceptably safe
when operating under GSM-R, assuming that drivers
can resort to the use of company mobile phones
for back-up. On the basis of the analysis therefore,
the IM concludes that it is reasonably practicable to
provide SPTs protecting signals and junctions, but
not in other locations.
Nature of the decision
Risk owner
Owned by one
organisation
Shared by many
organisations
Worst credible case
consequences
Insignificant
Multiple fatalities
Operational experience
Extensive
None
Technology
Mature
Novel
Complexity
Very simple
Highly complex
Ability to monitor and
act post change
Can identify problems
and resolve quickly
Difficult to monitor
and/or intervene
More likely to be catergorised as significant
Approach
for making
the
decision
More senior level decision taking
More consultation
More extensive and detailed analysis
More time to agree and implement the decision
Figure 2: Scoping the provision of all SPTs when adopting GSM-R for a re-signalling project
2
www.rssb.co.uk
The IM then consults with the Railway Undertakings
(RUs) operating over each line of route covered by
the re-signalling project, as well as the maintainers
of the SPTs. Although the RUs and maintainers
agree that the proposal is sensible, one of the RUs
is keen for the IM to continue to provide the majority
of the SPTs at this time as their drivers do not
have company mobiles. They are concerned that
there would not therefore be a backup for secure
communication to the signaller in the event of a
GSM-R failure as the GSM-R system has not yet
been proven as reliable in service.
They are also reluctant to take on the additional
cost of providing mobile phones when the reduced
provision of SPT does not provide them with cost
savings (as the IM current covers the associated
maintenance costs).
The IM finally decides to continue to provide SPTs
at locations where they offer a safety benefit until
the GSM-R system is more mature. However, those
SPTs which demonstrate explicitly obvious safety
related concerns will no longer be provided, namely:
mid-platform SPTs; SPTs with limited clearance to
an adjacent line; and a few others with very difficult
access.
3. Making a change
For those SPTs that will no longer be provided,
the IM expands the explicit risk estimation to
identify any further risk mitigations required for safe
implementation. This includes the FLAT assessment
for each SPT, as well a HAZID for the relevant SPTs
to identify the hazards, the mitigation measures
already in place and any additional controls that will
be required. Given the agreed scope of the change
is that only a limited number of SPTs will no longer
be provided, and that not providing these SPTs is in
line with the applicable standards, the change is not
considered significant.
Selection of
Risk Acceptance
Principle
CODES OF
PRACTICE
SIMILAR REFERENCE
SYSTEM
EXPLICIT RISK
ESTIMATION
Application of Codes
of Practice
Similarity Analysis with
Reference System(s)
Identification of Scenarios
& associated Safety
Measures
Safety Criteria
Qualitative
Quantitative
Figure 3: Risk acceptance principles selected
www.rssb.co.uk
3
The actions required for safe implementation of
the change include a briefing for all affected drivers
on the new communication system, the recovery
of redundant lineside SPTs by the IM, and making
public mobile phone coverage available in areas
where there are issues with GSM-R coverage. For
specific SPTs which cannot be completely removed
prior to the change in operations, it is deemed
sufficient to disconnect them and clearly label the
handset as no longer in service.
4. Monitoring safety
RU support is identified by the IM as the main issue
in reducing the provision of SPTs. Therefore the
IM decides to focus on addressing the issues that
the RUs raised before conducting further similar
assessments.
At the time of the project, GSM-R is not
demonstrating as high a level of reliability as had
initially been hoped in the original risk assessment,
highlighting the importance of reviewing the
underlying assumptions. A large proportion of
failures are due to the on board train equipment,
so new software is trialled to address this problem
and the stability of the cab radio is monitored
following its introduction. Further issues are also
identified around incorrect operation of the new
system but this is expected to improve over time as
understanding of the system increases.
In this case, although initial analysis supports not
providing SPTs, the IM retains most SPTs for the
time being due to lack of stakeholder support for
the proposal. This highlights both the importance
of stakeholder consultation, involvement and
agreement in the early stages of scoping and
assessing the change when there is a larger degree
of design flexibility, and problem framing to avoid
cognitive biases such as loss aversion and narrow
framing. Future risk assessment results will be
framed “if SPTs were not present would there be
a case for installing them?” rather than assessing
the case of removing SPTs, and will also consider
whether the savings from not maintaining SPTs can
be more effectively spent on other risk controls.
As the IM would however still like to reduce the
levels of SPT provision where the safety benefit
outweighs the impact of non-availability of
GSM-R, demonstrating the availability of voice
communications via GSM-R is identified by the IM as
the key issue for future review of SPT provision.
Having multiple stakeholders involved in the change
creates challenges. Although the removal of SPTs is
judged to provide benefits to the system as a whole,
the various costs and benefits are split between
different organisations. The savings from eliminating
the costs of maintaining the SPTs accrue to the
IM, but the RUs incur costs if they need to issue
company mobile phones to their drivers as a backup
system.
4
www.rssb.co.uk