FRA 2012 0075 0002 - Attachment - 1

Port Authority Trans-Hudson
Digicode® PSP
(Redacted)
DATE
6/18/2012
Submitted in fulfillment of 49 CFR Part 236, Subpart H, § 236.907

PATH Digicode® PSP
REVISION HISTORY
Date Revision Description

04/25/12 1.0 Formal submission.
05/25/12 2.0 Revised in response to FRA comments:
 Section 6 – added note regarding maintenance and inspections
for rail break prevention and detection.
 Added appendix D-1 (Alstom PSP).
06/18/12 3.0 Revised in response to FRA comments:
 Removed Software Configuration Management Plan – this
document is not required in the PSP.
2 of 80
PATH Digicode® PSP
Table of Contents
1 Introduction ......................................................................................................................................................... 6
1.1 PATH OVERVIEW .............................................................................................................................................. 6
1.2 SCOPE ................................................................................................................................................................ 6
1.3 PATH PSP OVERVIEW....................................................................................................................................... 6
1.3.1 Manufacturer’s Reference Documentation............................................................................................... 6
1.3.2 Document Organization ........................................................................................................................... 6
1.4 ABBREVIATIONS, ACRONYMS AND DEFINITIONS ............................................................................................... 7
1.4.1 Abbreviations and Acronyms ................................................................................................................... 7
2 Applicable Documents ........................................................................................................................................ 9
2.1 REFERENCED DOCUMENTS................................................................................................................................. 9
2.2 ALSTOM PRODUCT DOCUMENTS ........................................................................................................................ 9
3 Digicode® Product Description [§ 236.907 (a) (1)]......................................................................................... 10
3.1 PURPOSE .......................................................................................................................................................... 10
3.2 APPLICATION ................................................................................................................................................... 10
3.3 MAINTENANCE ................................................................................................................................................. 11
3.4 CONFIGURATION MANAGEMENT...................................................................................................................... 11
3.5 PRODUCT DESCRIPTION ................................................................................................................................... 11
4 PATH Operation [§ 236.907 (a) (2)] ................................................................................................................ 13
5 Operational Concept Description [§ 236.907 (a) (3)] ..................................................................................... 15
6 Safety Requirements [§ 236.907 (a) (4)] .......................................................................................................... 16
7 Safety Architecture [§ 236.907 (a) (5)] ............................................................................................................ 17
8 Hazard Log [§ 236.907 (a) (6)] ......................................................................................................................... 18
9 Risk Assessment [§ 236.907 (a) (7)].................................................................................................................. 19
10 Hazard Mitigation Analysis [§ 236.907 (a) (8)] ............................................................................................... 20
11 Safety Assessment Verification and Validation Process [§ 236.907 (a) (9)] ................................................. 21
12 Safety Assurance Concepts [§ 236.907 (a) (10)] .............................................................................................. 22
13 Human Factors Analysis [§ 236.907 (a) (11)] .................................................................................................. 23
14 Training [§ 236.907 (a) (12)]............................................................................................................................. 24
15 Test Procedures and Test Equipment [§ 236.907 (a) (13)]............................................................................. 25
16 Applicability of Subparts A – G [§ 236.907 (a) (14)] ...................................................................................... 26
17 Security [§ 236.907 (a) (15)].............................................................................................................................. 27
18 Warnings and Warning Labels [§ 236.907 (a) (16)] ....................................................................................... 28
19 Initial Implementation Testing [§ 236.907 (a) (17)]........................................................................................ 29
20 Post Implementation Testing and Record Retention [§ 236.907 (a) (18)] .................................................... 30
21 Safety Critical Assumptions [§ 236.907 (a) (19)] ............................................................................................ 31
22 Incremental and Predefined Changes [§ 236.907 (a)(20)] ............................................................................. 32
3 of 80
PATH Digicode® PSP
23 Communication of Hazards [§ 236.907 (d)] .................................................................................................... 33

23.1 CONTRACTUAL ARRANGEMENTS [§ 236.907 (D) (1)] ....................................................................................... 33
23.2 RAILROAD’S PROCEDURE [§ 236.907 (D) (2)] .................................................................................................. 33
23.3 CONFIGURATION/REVISION MANAGEMENT [§ 236.907 (D) (3)] ....................................................................... 33
23.4 PRODUCT SUPPLIER’S NOTIFICATION [§ 236.907 (D) (4)] ................................................................................ 33
APPENDIX A – FRA TEST – PATH TEST PROCEDURE ................................................................................. 34
APPENDIX B – PATH Hazard Log ........................................................................................................................ 36
APPENDIX B-1 PATH Hazards .............................................................................................................................. 37
APPENDIX B-2 PATH Digicode® Application Conditions .................................................................................. 38
APPENDIX C – PATH DOCUMENTS ................................................................................................................... 39
APPENDIX C-1 PATH Form ST-1 .......................................................................................................................... 40
APPENDIX C-2 PATH Book of Rules ..................................................................................................................... 41
APPENDIX C-3 – PATH Procedure for Receipt of Notification .......................................................................... 42
APPENDIX D – Product Manufacturer Documentation ....................................................................................... 43
APPENDIX D-1 Smartway Digital Track Circuit PSP .......................................................................................... 55
APPENDIX D-2 SDTC Generic Product Safety Case ............................................................................................ 56
APPENDIX D-3 SDTC Safety and V&V Plan ........................................................................................................ 57
APPENDIX D-4 SDTC Subsystem Requirements Specification ........................................................................... 58
APPENDIX D-5 SDTC Architecture Description................................................................................................... 59
APPENDIX D-6 SDTC Architecture Verification Report ..................................................................................... 60
APPENDIX D-7 SDTC Hardware Validation Report............................................................................................ 61
APPENDIX D-8 SDTC Validation Report .............................................................................................................. 62
APPENDIX D-9 SDTC Installation Manual ........................................................................................................... 63
APPENDIX D-10 SDTC Test and Commissioning Manual................................................................................... 64
APPENDIX D-11 SDTC Maintenance Manual ...................................................................................................... 65
APPENDIX D-12 SDTC Implementation Manual ................................................................................................. 66
APPENDIX D-13 SDTC Applications Conditions .................................................................................................. 67
APPENDIX D-14 SDTC Qualification Test Description (AREMA standard) ..................................................... 68
APPENDIX D-15 SDTC Qualification Test Report (AREMA standard) ............................................................ 69
APPENDIX D-16 SDTC Type Test Report ............................................................................................................. 70
APPENDIX D-17 SDTC Extra Test Type Test Report .......................................................................................... 71
APPENDIX D-18 Train Stop Testing Report ......................................................................................................... 72
APPENDIX D-19 iVPI Interface Test Report ......................................................................................................... 73
APPENDIX D-20 Vital Relay Interface Test Report .............................................................................................. 74
APPENDIX D-21 120 VAC Operation Test Report ............................................................................................... 75
APPENDIX E-Training Material ............................................................................................................................. 76
APPENDIX E-1 Installation Training ..................................................................................................................... 77
4 of 80
PATH Digicode® PSP
APPENDIX E-2 Testing and Commissioning Training ......................................................................................... 78

APPENDIX E-3 Maintenance Training .................................................................................................................. 79
APPENDIX F – ISA Report...................................................................................................................................... 80
5 of 80
PATH Digicode® PSP
1 Introduction
The Port Authority Trans Hudson Corporation (PATH) is upgrading some of its track circuits
with Digicode® microprocessor based track circuits. The Digicode® Track circuits are
functional replacements for the existing PATH track circuits. PATH provides this Product
Safety Plan (PSP) in accordance with CFR236 Subpart H, to request permission for deployment
of the Digicode® track circuit to be placed into service in the locations identified in section 3.2.
1.1 PATH Overview
PATH provides passenger service between New Jersey and New York; further information can
be found in section 4.
1.2 Scope
The Digicode® product has been chosen by PATH as a functional replacement for existing, older
technology track circuits. The existing product was experiencing end of life obsolescence issues
and parts were becoming difficult to procure. The selection of the Digicode® product provides
for less maintenance, due to electronic components, higher reliability and lower overall operating
costs.
This PSP is for the Digicode® Track Circuits to be installed on the PATH system.
1.3 PATH PSP Overview
The PATH Digicode® PSP presents the relevant data for deployment of Digicode® track circuits
on the PATH Railroad. It further provides sufficient product manufacturer reference documents
to support the design.
1.3.1 Manufacturer’s Reference Documentation

The Digicode® product manufacturer, Alstom, reference documentation is included in Appendix
D. Some reference material, due to its proprietary information, is not provided, but is available
for on-site review at Alstom’s facility. PATH instructed the Independent Safety Assessor (ISA)
to conduct a review of this material; their report forms Appendix F of this PSP.
1.3.2 Document Organization

The organization of PATH’s PSP for Digicode® is as follows:
 Section 1 describes the general system overview, and scope of the document.
 Section 2 lists applicable documents that are referenced.
 Section 3 provides a complete description of the product as required by 236.907 (a) (1).
 Section 4 provides a description of the PATH operation as required by 236.907 (a) (2).
 Section 5 provides an operational concept description as required by 236.907 (a) (3).
 Section 6 provides the list of safety requirements as required by 236.907 (a) (4).
 Section 7 provides the product safety architecture as required by 236.907 (a) (5).
 Section 8 describes the hazard log as required by 236.907 (a) (6).
 Section 9 describes the risk assessment as required by 236.907 (a) (7).
6 of 80
PATH Digicode® PSP
 Section 10 provides a hazard mitigation analysis as required by 236.907 (a) (8).

 Section 11 describes the safety assessment and verification and validation process as required
by 236.907 (a) (9).
 Section 12 describes the safety assurance concepts as required by 236.907 (a) (10).
 Section 13 describes the human factors analysis as required by 236.907 (a) (11).
 Section 14 describes the training as required by 236.907 (a) (12).
 Section 15 describes the test procedures and test equipment as required by 236.907 (a) (13).
 Section 16 provides an analysis of the applicability of subparts A-G as required by 236.907
(a) (14).
 Section 17 describes security measures as required by 236.907 (a) (15).
 Section 18 describes all warning label as required by 236.907 (a) (16).
 Section 19 describes all initial implementation testing as required by 236.907 (a) (17).
 Section 20 describes all post implementation testing and record retention as required by
236.907 (a) (18).
 Section 21 describes any safety critical assumptions as required by 236.907 (a) (19).
 Section 22 describes all incremental and predefined changes as required by 236.907 (a) (20).
 Section 23 describes how safety related hazards are communicated.
 Appendix A FRA Test.
 Appendix B contains the Hazard Analysis for the Digicode application installed at PATH.
 Appendix C contains the PATH Documents.
 Appendix D contains the Manufacturers reference documentation.
 Appendix E contains the Digicode® training presentations.
 Appendix F contains the ISA Report.
1.4 Abbreviations, Acronyms and Definitions
This section includes definitions of all terms, abbreviations, and acronyms required to properly
interpret this PSP.
1.4.1 Abbreviations and Acronyms

The following is a list of abbreviations and acronyms that are used in this PSP:
Acronym Meaning
ATC Automatic Train Control

CBTC Communications Based Train Control
CDRL Contract Document Requirement List
CFR Code of Federal Regulation
DAJV Daidone – Aldridge Joint Venture
FRA Federal Railroad Administration
7 of 80
PATH Digicode® PSP
Acronym Meaning
iVPI Latest evolution of Alstom’s Vital Processor Interlocking
IRG Invensys Rail Group
ISA Independent Safety Assessor
MTBF Mean Time Between Failure
MTTHE Mean Time To Hazardous Event
PANYNJ Port Authority New York New Jersey
PATH Port Authority Trans-Hudson
PHA Preliminary Hazard Analysis
PSP Product Safety Plan
RSPP Railroad Safety Program
SDTC Smartway Digital Track Circuit
TC Track Circuit
V&V Verification and Validation
8 of 80
PATH Digicode® PSP
2 Applicable Documents
This section provides a complete list of all the documents and other sources referenced in the
PSP.
2.1 Referenced Documents
A. Federal Railroad Administration (FRA) Rules and Regulations - 49 CFR 236 Subpart H.
B. PATH Book of Rules. Rev. 01/01/2000
C. PATH Railroad Safety Program Plan (RSPP) Rev. 2
D. PATH Signal Training Program
2.2 Alstom Product Documents
The following documents are provided by the Product Manufacturer in support of the design:
[D-1] Smartway Digital Track Circuit PSP Rev. 2.2
[D-2] SDTC Generic Product Safety Case Rev. 9
[D-3] SDTC Safety and V&V Plan Rev. 3
[D-4] SDTC Subsystem Requirements Specification Rev. 5
[D-5] SDTC Architecture Description Rev. 5
[D-6] SDTC Architecture Verification Report Rev.4
[D-7] SDTC Hardware Validation Report Rev.4
[D-8] SDTC Validation Report Rev.4
[D-9] SDTC Installation Manual Rev.9
[D-10] SDTC Test and Commissioning Manual Rev.9
[D-11] SDTC Maintenance Manual Rev.12
[D-12] SDTC Implementation Manual Rev.5
[D-13] SDTC Application Conditions Rev.7
[D-14] SDTC Qualification Test Description (AREMA standard) Rev.1
[D-15] SDTC Qualification Test Report (AREMA standard) Rev.1
[D-16] SDTC Type Test Report Rev.3
[D-17] SDTC Extra Test Type Test Report Rev.1
[D-18] SDTC Train Stop Testing Report Rev.1
[D-19] SDTC iVPI Interface Test Report Rev.C
[D-20] SDTC Vital Relay Interface Test Report Rev.C
[D-21] SDTC 120 VAC Operation Test Report Rev.A
9 of 80
PATH Digicode® PSP
3 Digicode® Product Description [§ 236.907 (a) (1)]

The Digicode® track circuit is part of Alstom’s Smartway Digital Track Circuit (SDTC) product
line and has never been used in the US. Alstom has provided a document entitled ‘Product
Safety Plan (PSP) Alstom’s SDTC Product Line’. This document is provided as part of this PSP
and is referenced throughout this document (reference D-1). The Alstom document will also
reference numerous other documents to be supplied or made available (as defined in the
referenced document) to support the safety case.
3.1 Purpose
The Digicode® track circuit will be used on PATH for the purpose of train detection and broken
rail detection. The complete product description consistent with its application on PATH is
provided in sections 3 of the Smartway Digital Track Circuit PSP document included as
Appendix D-1.
Note: Track to train communication features will not be used, and the diagnostic system will not
be installed; the only connection to the interlocking will be a single output wire not energized for
occupied or energized for vacant.
3.2 Application
As part of the PATH Automatic Train Control (ATC) Project, PATH engineering is supported by
technical consultants and an Independent Safety Assessor (ISA). They are reviewing all design,
testing, commissioning and training aspects of the Digicode® implementation into the existing
signal system and into the new system. FRA approval of this PSP is required prior to installation
on revenue track.
PATH
PATH
(Safety & Security)
PROJECT Independent Safety

MANAGEMENT Assessor
SUPPORT/INTERFACE
PS&C
Car Equipment
Transportation
W&S
PM Logistics Team
PROGRAM MANAGEMENT
SERVICES WORKING GROUPS SIEMENS TEAM
(CH2M-Hill – Technical Consultants)
Program Management Team

Located at PATH JSQ
Figure 3-1 PATH ATC Project Team
10 of 80
PATH Digicode® PSP
Digicode® Track circuits are planned for use in and between interlocking except for the area
from Exchange Place through World Trade Center (WTC) (inclusive) where the contractor is
allowed to keep the existing power frequency post 9/11/2001 track circuit equipment.
3.3 Maintenance
Maintenance of the Digicode® equipment will be performed by PATH’s maintenance staff. This
work shall be conducted in accordance with PATH’s Book of Rules’ Roadway Worker
Protection principles titled “Rules for the Protection of Employees in Track Areas”.
Maintenance training of PATH employees will be in accordance with section 14.
3.4 Configuration Management
PATH Power, Signals and Communications division maintains the current train control
equipment configuration with a library of as-built drawings in the field and office, supported by
manufacturer’s manuals, training, and software configuration records. Equipment tests are
performed and documented according to FRA requirements.
3.5 Product Description
SDTC is an electronic track circuit in the DIGICODE® family that realizes the following safety
functions when connected to a Track Circuit (TC):
 Train detection, and
 Broken rail detection.
Digicode® SDTC provides an indication of the Clear or Occupied state of the Track Circuit to
the remainder of the train control system. In case of a detected broken rail SDTC provides the
occupied indication. The SDTC product is divided into two parts:
1. The Processing Unit that are housed in the Train Control Room (Technical Signaling Room)
2. The Field Circuits that are located adjacent to the trackway, where the track circuit signal is
transmitted and received.
The Processing Unit realizes the following main functions:
 Generation and transmission of the audio-frequency signal towards Field Circuits;
 Reception of the audio-frequency signal coming from Field Circuits;
 Generation of the occupied/clear indication towards interlocking system, and
 Generation of diagnostics data towards diagnostic system (this will not be permanently
installed at PATH).
The Field Circuits include:

 Impedance Bonds (also called Electric Joints) located at the two extremities of the track
circuit and at the end of diverted branches;
11 of 80
PATH Digicode® PSP
 Tuning Units located at the two extremities of the track circuit and at the end of diverted
branches, and
 Connection Cables connecting the Technical Room and the track circuit Tuning Units.
12 of 80
PATH Digicode® PSP
4 PATH Operation [§ 236.907 (a) (2)]

Opened in 1908 as the Hudson and Manhattan Railroad, a privately owned corporation, PATH
acquired control in 1962 and is a rail subsidiary of The Port Authority of New York and New
Jersey (PANYNJ).
The PATH rapid transit network consists of 43 track miles, including yard tracks (13.8 route
miles), with portions both in tunnels and on the surface. The network provides a crucial rail link
between New Jersey and New York, providing passenger service 24 hours a day, 365 days a year
from terminal stations at Newark, Journal Square and Hoboken in New Jersey and at 33rd Street
and WTC in New York.
PATH currently transports an average of 235,000 passengers daily, with ridership expected to
continue to increase due to anticipated growth in regional residential, commercial and business
development. PATH transported an average of 258,000 passengers daily prior to September 11,
2001. Service is currently provided via a fleet of 327 PA-2, PA-3 and PA-4 railcars, which are
currently being replaced by a new fleet of PA-5 vehicles. PATH operates over two lift bridges.
One is the Dock Lift Bridge over the Passaic River, and the other is the Hackensack River Lift
Bridge.
PATH’s primary vehicle maintenance facility is Harrison Yard, other maintenance and car
storage facilities include A-, B-, C- and D-Yards (along with Running Repair Shop) at Journal
Square, and the South Street Yard west of Newark Station. PATH’s primary Signal Maintenance
shop is located in C Yard at Journal Square.
As illustrated in Figure 4-1, PATH has 13 stations in both New Jersey and New York, and
currently stops for passengers at every station (i.e., no shuttles or direct service).
PATH operates its system currently using routes and colors defined as follows:
A. Monday through Friday: 6AM - 11PM:
1. Newark - WTC (Red).
2. Hoboken - WTC (Green).
3. Hoboken – 33rd Street (Blue).
4. Journal Square - 33rd Street (Yellow).
B. Monday through Friday: 11PM – 6AM; and all day on Saturday, Sunday and Holidays:
1. Newark - WTC (Red).
2. Journal Square – 33rd Street via Hoboken (Blue/Yellow).
These four routes during normal revenue service hours are operated on interweaved headways to
minimize interference between trains in the Caissons and Grove-Junction interlocking areas.
PATH service operates on a 35-minute schedule during overnight hours. This allows essential
track, signal and station maintenance to be performed. The 35-minute schedule allows trains to
operate in both directions using the same tunnel or track. Most PATH maintenance occurs during
these hours to minimize the impact upon revenue service.
13 of 80
PATH Digicode® PSP
Figure 4-1: PATH Route Map
PATH does not carry hazardous material. PATH Rule 104 (in Appendix C-2) includes
authorized operating speeds.
14 of 80
PATH Digicode® PSP
5 Operational Concept Description [§ 236.907 (a) (3)]

A summary of the operational concept of the Digicode® track circuit product is in section 4.3
Appendix D-1. As applied on the PATH system the Digicode® track circuit will interface to the
existing train control system via conventional vital relays and later to the new CBTC system via
wiring to the vital inputs of the iVPI equipment.
The SDTC feed (transmitter) end of the track circuit will inject into the rails a digital code on an
audio frequency signal. If the rails are shunted by a train, or if the rails are electrically open
(broken), no signal will appear at the receiver end of the track circuit.
The receiver end of the track circuit will check any signal received for the correct frequency and
code, and will indicate that the track circuit is un-occupied only if the correct frequency and code
are received. There are six frequencies to select from. In areas with two adjacent tracks, three of
the six frequencies will be dedicated to each track; eliminating the possibility that signals from
one track can be incorrectly leaked to the other.
The three codes will be alternated in each track circuit using each frequency. With this
configuration track circuits having a particular frequency are separated by track circuits of
different frequencies, and the nearest track circuits with the same frequency will have different
codes, effectively separating track circuits with the same frequency and code by two different
configuration factors, in addition to attenuation from distance. The SDTC track circuits will
generally not be separated by insulated joint except at home signals.
By comparison, the existing PATH track circuits have electromechanical relays that check that
the received steady energy AC signal is the correct phase and frequency, with each track circuit
having one of only two phases, and only one frequency for all track circuits within a large
territory.
15 of 80
PATH Digicode® PSP
6 Safety Requirements [§ 236.907 (a) (4)]

The Digicode® track circuit on PATH will fulfill the following safety requirements:
 Train detection, the safety requirements of the track circuit are to only indicate
unoccupied or clear when there is no train present between the transmitter and the
receiver, and
 Broken rail detection. The track circuit, however, cannot determine: rail cracks; partial
rail breaks; rail breaks shunted by splice bars or guard rail or plates, and may not detect
rail breaks that occur within the S or O bond area.
NOTES: The existing power frequency track circuits used by PATH exhibit the same constraints
with regard to detecting broken rail. The bond area in the existing circuits is typically
smaller.
PATH maintains and inspects its tracks to prevent and detect the occurrence of rail
breaks.
The Digicode® safety requirements are summarized in section 4.4 of Appendix D-1.
PATH Engineering, PATH’s Consultants, and PATH’s ISA have thoroughly reviewed and
analyzed the product safety requirements for form, fit and function for the PATH application and
concur with the safety case presented.
16 of 80
PATH Digicode® PSP
7 Safety Architecture [§ 236.907 (a) (5)]

The safety architecture of the Digicode® track circuit, included as Appendix D-5 and its
application on the PATH system includes the Digicode® product and its interface to the existing
train control system. Upon initial installation the Digicode® track circuit will replace existing
power frequency track circuits. The Digicode® track circuit will interface to the existing train
control system via vital relays. The contacts of the vital relays will provide the same
functionality as the contacts of the vital track relays used in the existing train control system.
As the ATC project progresses, the existing train control system will be replaced by processor
based controllers (iVPI). The safety of the iVPI system is the subject of another PSP which will
show that the track circuit occupancy interface from Digicode® is handled in a safe manner.
Safety features and configuration are discussed in “Operational Concept Description” above, and
details of the safety architecture of the Digicode® product are summarized in section 4.5 of
Appendix D-1.
17 of 80
PATH Digicode® PSP
8 Hazard Log [§ 236.907 (a) (6)]

PATH’s hazard log items relating to the Digicode® track circuit are shown in Appendix B1.
18 of 80
PATH Digicode® PSP
9 Risk Assessment [§ 236.907 (a) (7)]

The Mean Time To Hazardous Event (MTTHE) calculation for the Digicode® equipment is
provided by Alstom.
Section 4.7 of Appendix D-1 summarizes the product specific risk assessment performed by
Alstom.
19 of 80
PATH Digicode® PSP
10 Hazard Mitigation Analysis [§ 236.907 (a) (8)]
The hazard mitigations are presented in Appendix B1 – Hazard Log. The RSPP, in section 4.3,
presents the safety precedence for mitigations as follows:
 Design to eliminate hazards;
 Design to control hazards;
 Use safety devices;
 Use warning devices, and
 Implement special procedures.
Appendix B2 – Application Conditions presents confirmation that the site specific design and
installation of the Digicode® Product has addressed the directions of the product manufacturer.
20 of 80
PATH Digicode® PSP
11 Safety Assessment Verification and Validation Process [§ 236.907 (a) (9)]

PATH’s approach to Verification and Validation (V&V) is presented in section 5 of PATH’s
RSPP.
Alstom’s specific V&V activities applied to the Digicode® product and the corresponding
results are summarized in section 4.9 of Appendix D-1 and included in Appendix D-3.
21 of 80
PATH Digicode® PSP
12 Safety Assurance Concepts [§ 236.907 (a) (10)]

The Digicode® track circuit product uses intrinsic fail safe hardware. The Safety Assurance
Concepts document is summarized in section 4.10 of Appendix D-1.
22 of 80
PATH Digicode® PSP
13 Human Factors Analysis [§ 236.907 (a) (11)]

The Digicode® track circuit has no direct human machine interface that is used in normal
operation. The status of the track circuit (occupied or vacant) is displayed on model boards at
the control center, which is manned 24/7/365, and at local control panels which are frequently
un-manned.
Interaction between personnel and the Digicode® product occurs during maintenance. The
Digicode® equipment includes built in self diagnostics. A temporary diagnostics board will also
be used to troubleshoot some track circuit problems. Maintainers will also have other tools to
further the diagnosis and correction of problems.
23 of 80
PATH Digicode® PSP
14 Training [§ 236.907 (a) (12)]

Only trained, qualified and authorized PATH maintenance personnel will be permitted to
maintain the Digicode® equipment. These personnel are supervised when performing
maintenance. PATH maintains training records for all employees. Manufacturer’s manuals and
training documentation will remain continuously available to field supervision.
For training specific to the Digicode® equipment, please refer to section 4.12 of Appendix D-1.
The training as defined in section 4.12 will be provided to all PATH personnel involved with
Digicode®. This will include Signal Supervisor, Maintainer I, Maintainer II, Signal Engineering
and Management staff. This training plan will be integrated into the track circuit portion of the
PATH Signal Training Program, which is used for all new hire trainees and for required refresher
training of existing employees.
The PATH Signal Training Program consists of 10 individual modules, with 137 total class
sessions, 34 of which are conducted in the field. In the existing PATH training program, both
classroom instruction and ‘hands on’ field sessions are provided to allow the employee to
become familiar with the product operation, application theory, and by hands-on experience with
equipment set up, adjustments, maintenance, and troubleshooting. See Appendix E-1 through E-
3.
PATH has received draft manuals and training material for Digicode® SDTS; the training
material will be made specific to the PATH applications of the Digicode® SDTS product.
Training results will be documented in accordance with FRA requirements and PATH practices.
24 of 80
PATH Digicode® PSP
15 Test Procedures and Test Equipment [§ 236.907 (a) (13)]

PATH requires that the Digicode® track circuits be tested and maintained in accordance with the
manufacturer’s procedures and FRA requirements. PATH will incorporate the procedures as
described in the Alstom Digicode® manuals into the existing PATH maintenance test procedure
documents, expanding upon them, where necessary, to reflect PATH maintenance needs or FRA
requirements. The following procedures support the Digicode® Track Circuits:
 SDTC Installation Manual – included as Appendix D-9;
 SDTC Test & Commissioning Manual – included as Appendix D-10;
 SDTC Maintenance Manual – included as Appendix D-11;
 SDTC Implementation Manual – included as Appendix D-12, and
 SDTC Application Conditions – included as Appendix D-13.
PATH has received these draft manuals and training material for Digicode® SDTS; the training
material will be made specific to the PATH applications of the Digicode® SDTS product.
Track circuits are maintained by trained, qualified and authorized PATH maintenance employees
and all equipment is tested for correct functionality prior to it being returned to service. With the
track circuits, PATH is being provided with all of the necessary test and repair equipment
needed. PATH will be supplementing this supply with additional equipment to meet the needs of
repair personnel.
25 of 80
PATH Digicode® PSP
16 Applicability of Subparts A – G [§ 236.907 (a) (14)]

Refer to section 4.14 of Appendix D-1. All requirements defined in Subparts A- G at the track
circuit application level will be complied with. In addition to the descriptions in section 4.14 of
Appendix D-1, the following Subparts A – G sections pertaining to track circuits are pertinent for
the implementation of Digicode® on PATH;
 236.51 Track circuit requirements:
The SDTC/Digicode® track circuit’s vital output will be OFF (indicating occupancy) if a
mechanical interruption (break) of the rail or track circuit cabling occurs. Because the
SDTC/Digicode® track circuit uses shaped wires (called “S” bonds and “O” bonds) to
form Impedance Bond (also called Electrical Joint), some broken rail sections within the
boundaries of the wire bond may go undetected.
 236.54 Minimum length of track circuit:
There will be no Digicode® track circuits on PATH whose length is less than the inner
wheel base of the PA5 vehicles.
 236.55 Dead section: maximum length:
There will be no Digicode® track circuits on PATH with a dead of section 35 feet or
greater, which is less than the outer wheelbase of PA5 vehicles (39.8’).
 236.57 Shunt and fouling wires:
All Digicode® track circuit installations will comply.
 236.58 Turnout fouling section:
 236.59 Insulated rail joints:
 236.60 Switch shunting circuit: use restricted:
NOTE: No switch shunting circuits will be employed on PATH.
26 of 80
PATH Digicode® PSP
17 Security [§ 236.907 (a) (15)]

The Digicode® equipment is housed in the train control rooms or bungalows and along the right
of way. The equipment rooms are locked, alarmed, indicated to the Control Office, and
accessible only by authorized PATH Signal employees. The equipment along the right of way
will be in locked boxes and accessible only by PATH Signal employees. If the incorrect modules
are inserted, the track circuit will fail and an alarm will be displayed in the Control Office.
There is no programming or reprogramming capability associated with the Digicode® product,
so cyber security is not an issue.
27 of 80
PATH Digicode® PSP
18 Warnings and Warning Labels [§ 236.907 (a) (16)]

The maintenance manuals will contain appropriate warnings to inform maintenance staff of any
hazards. PATH Maintenance provided training as described in section 14 of this document will
ensure awareness, understanding and compliance with all Digicode® warnings and labels.
Refer to section 4.16 of Appendix D-1 for the description of how warnings and warning labels
will be provided to ensure safety during the installation, operation and maintenance of the
Digicode® product.
28 of 80
PATH Digicode® PSP
19 Initial Implementation Testing [§ 236.907 (a) (17)]

Testing and commissioning of the Digicode® track circuits will be performed by PATH Signal
Engineers and Maintenance staff. The installation and test of the Digicode® track circuits will
be completed in accordance with applicable Alstom manuals and all required verification tests
will be completed and documented. Prior to being placed into service PATH (including its ISA)
will approve each type of application, including its interface to the existing and future train
control systems. Each application will be tested per 236.56 using the PATH test form in
Appendix C-1.
Testing and maintenance will continue throughout the product life cycle, as is the case today
with the existing track circuits. Tests will be conducted annually and whenever it is necessary to
adjust or repair the track circuit. In addition Appendix D-1 describes the safety validation of all
safety functions provided by the Digicode® track circuit.
29 of 80
PATH Digicode® PSP
20 Post Implementation Testing and Record Retention [§ 236.907 (a) (18)]

Periodic testing of the track circuit as required by §236.56 will be completed and documented in
accordance with the existing PATH maintenance test procedure document PATH form ST-1,
which appears in Appendix C-1. Tests will be conducted annually and whenever it is necessary
to adjust or repair the track circuit.
Digicode® SDTC test records will be retained by PATH Power, Signals, and Communications
Division by the Signal Maintenance Supervisor, similar to existing test records including existing
track circuit tests.
30 of 80
PATH Digicode® PSP
21 Safety Critical Assumptions [§ 236.907 (a) (19)]

Each of the assumptions and backups are similar to those for the existing track circuits at PATH.
Assumption Backup
Failures of the product - In track circuits shorter than a train length less a car, a train
will be safe-side failure moving through a track circuit falsely showing block clear will
(product never falsely trip when the train enters the advance (correctly operating) track
indicates a clear block). circuit.
- In track circuits in approach to grade-time one signals, the grade
time signal will not clear, identifying the failure after the first
train passes.
- In locations East of Journal Square, color tracking will be lost,
providing continuous visual indication of a failure.
- Train movements are continuously monitored in the control
center, and the improper operation of an unslotted track circuit
operation would be reported to signal maintenance forces. This
is in accordance with PATH rule 283, included in Appendix C-2.
Safe side failure of the - Trains will pass signals on established z-by procedures, covered
product between by PATH rule 253. Safety is maintained through these
interlockings (product procedures. The rule is included in Appendix C of this
falsely indicates an document. PATH has a limited number of key-by signals,
occupied block). similar procedures for these signals is covered by PATH rule
254, also included in Appendix C-2.
Safe side failure of the - Trains will pass signals on established z-by procedures, covered
product at an by PATH rules 218 and 101. Safety is maintained through these
interlocking (product procedures. The rules are included in Appendix C-2 of this
falsely indicates an document.
occupied block).
- Switch movements, if required, will be done with trained signal
personnel in the field protecting train movements, governed by
PATH rule 279 (f). PATH rule 279 is included in Appendix C-2.
31 of 80
PATH Digicode® PSP
22 Incremental and Predefined Changes [§ 236.907 (a)(20)]
There are no predefined changes for Digicode.
32 of 80
PATH Digicode® PSP
23 Communication of Hazards [§ 236.907 (d)]

The following sections provide details for the hazard communication process related to the
Digicode® Product.
23.1 Contractual Arrangements [§ 236.907 (d) (1)]
Beyond a product warranty, PATH has no contractual arrangement with Alstom.
Alstom is updating its PSP to address how it will notify PATH of any safety concern related to
the Digicode® Product.
23.2 Railroad’s Procedure [§ 236.907 (d) (2)]
PATH’s procedure for handling supplier notification of change/concern regarding safety critical
equipment is included as Appendix C-3.
23.3 Configuration/Revision Management [§ 236.907 (d) (3)]
Alstom, as the product provider, must perform configuration management of its base product and
ensure that any Alstom recommended changes do not introduce any hazards, or compromise any
safety critical hazard mitigation.
PATH maintains configuration management of its railroad and shall not perform any changes to
the base product without implicit instruction from Alstom. Changes will only proceed with
assurance from Alstom that the change does not compromise safety.
23.4 Product Supplier’s Notification [§ 236.907 (d) (4)]
Beyond a product warranty, PATH has no contractual arrangement with Alstom.
PATH will follow its procedure, Appendix C-3, upon receipt of notification of any safety
concern regarding the Digicode® product.
33 of 80
PATH Digicode® PSP
APPENDIX A – FRA TEST – PATH TEST PROCEDURE
34 of 80
PATH Digicode® PSP
Port Authority Trans – Hudson Corporation

Power, Signals and Communications Division
Signal Section
Standard Instructions For Making Tests of Signal Apparatus
Track Circuit Test

FRA Rule No. 236.56
Purpose:
To insure that (a) track relays are not over-energized, (b) that the polarity of adjoining track
circuits are in accordance with track plans, (c) that the track circuits are adjusted to shunt at the
maximum voltage.
Frequency:
Test II – When placed in service and once a year thereafter.
Signal Repair – When modified or disarranged.
Responsibility:
 Signal Testman II
 Signal Repairman I
Method:
Voltage: Read track voltage at the terminals and compare the voltage readings with previously
recorded value on the track data sheet. Arrange for immediate correction where voltage is high.
Polarity: Check case wiring diagram for proper polarity for track circuit energy. Place jumper
across rails (IJ) to test operation of track relay to the de-energized position. (Where applicable –
does not apply to Digicode® Track circuits)
Shunt Sensitivity: Standard test shunt of 0.06 ohms applied any place in the track circuit must
cause the track relay or indication to assume the de-energized position. Test shunt must be
applied at the all relay or receiver, the center and the transformer or transmitter ends of the track
circuit.
Turnouts:
Each turnout that has three (3) fouling section(s), which shall be shunt tested. Place the 0.06 ohm
shunt in the center of the fouling section and verify that the track de-energizes.
The above tests should only be performed when there are no trains approaching or on the control
overlap of signals affected, as this test will cause signals to fluctuate.
Reporting:
PATH form ST-1
35 of 80
PATH Digicode® PSP
APPENDIX B – PATH Hazard Log

1. Appendix B-1 – PATH Hazards.
2. Appendix B-2 – PATH Digicode® Application Conditions.
36 of 80
PATH Digicode® PSP
APPENDIX B-1 PATH Hazards
37 of 80
Haz 01 Alstom AC.2
ID Exported
Hazard Description Collision
Hazard Cause Train stops in “non-shunting area” and presence is not detected; train is
not protected by red signal.
Hazard Effect Death/System Loss
Hazard Mishap Following train is not prevented from entering occupied track and
collides with train in “non-shunting area.”
Mitigations 1. With a 0.06 Ohm resistance, there is no gap in the shunting area.
2. Non‐shunting area (worse case if above mentioned resistance is not
met) is 7.2m (23 ft) in length ‐ the outer wheelbase of PA5 vehicles is
39.8’, hence a car cannot rest solely within the non‐shunting area so
will be detected.
3. PATH trains operate in 7‐car consists (~340 ft, first wheel first car –
last wheel last car); a train will not fit into a non‐shunting area.
4. All PATH trains are equipped with service and emergency brakes.
5. All PATH trains are maintained in accordance with FRA regulations (24
hr and 92 day periodic inspection).
6. PA4 work trains have a separate handle for braking called the “Brake
Handle.” If the brake handle is in any position other than full service
and the Master Controller handle is released (not pushed down), it
will spring up and an emergency brake application will be applied.
This is the “Dead Man” feature.
7. All PATH trains are equipped with headlights, with high beams; train
engineer can see obstacles in front of train.
8. All PATH trains are equipped with taillights to provide location
information.
9. Train engineers receive training (this includes mandatory yearly
refresher and three year recertification).
10. PATH train crews are subject to mandatory random drug testing.
Haz 02 Alstom AC.15
ID Exported
Hazard Description Electrocution
Hazard Cause Touch potential on racks/cabinets.
Hazard Effect Death
Hazard Mishap Worker contacts equipment operating voltage while maintaining the
track circuits.
Mitigations 1. Equipment cabinets and racks to be grounded.
2. PATH personnel to follow Occupational Health and Safety for
electrical energy (Lock‐Out/Tag‐Out).
3. PATH personnel provided Personal Protective Equipment.
4. PATH personnel provided training.
Haz 03 Alstom N/A PATH Specific Hazard

ID Exported
Hazard Description Electrocution
Hazard Cause Third Rail Voltage
Hazard Effect Death
Hazard Mishap Worker contacts third rail while inspecting track circuits at the track
level.
Mitigations 1. PATH personnel to follow Occupational Health and Safety for
electrical energy (Lock‐Out/Tag‐Out).
2. PATH personnel provided Personal Protective Equipment.
NOTE: This hazard is the same as the existing product.

Haz 04 Alstom N/A PATH Specific Hazard
ID Exported
Hazard Cause Train infringes on work zone
Hazard Effect Death
Hazard Mishap Worker is struck by train while inspecting track circuits at the track
level.
Mitigations 1. PATH Book of Rules include Roadway Worker Protection
2. PATH personnel provided Personal Protective Equipment
(visibility).
5. All PATH trains are maintained in accordance with FRA regulations
(24 hr and 92 day periodic inspection).
6. Monthly wayside inspection and gauging of trip stops.
7. All PATH trains, including work trains, are equipped with trip
cocks.
8. PA4 work trains have a separate handle for braking called the
“Brake Handle.” If the brake handle is in any position other than
full service and the Master Controller handle is released (not
pushed down), it will spring up and an emergency brake
application will be applied. This is the “Dead Man” feature.
9. All PATH trains are equipped with headlights, with high beams;
train engineer can see obstacles in front of train.
10. All PATH trains are equipped with taillights to provide location
information.

Haz 05 Alstom AC.14
ID Exported
Hazard Cause Tampering with track circuit equipment causes track circuit to falsely
indicate “un-occupied.”
Hazard Effect Death/System Loss
Hazard Mishap Following train is not prevented from entering occupied track and
collides with train in a track circuit that is falsely indicating unoccupied.
Mitigations 1. Track Circuit Equipment is located in locked bungalows.
2. Bungalows are equipped with intrusion detection.
3. Wayside cabinets are locked.
4. Only authorized personnel are permitted to maintain the track circuit
equipment.
5. Personnel receive training.
7. All PATH trains are maintained in accordance with FRA regulations (24
hr and 92 day periodic inspection).
8. PA4 work trains have a separate handle for braking called the “Brake
Handle.” If the brake handle is in any position other than full service
and the Master Controller handle is released (not pushed down), it
will spring up and an emergency brake application will be applied.
This is the “Dead Man” feature.
9. All PATH trains are equipped with headlights, with high beams; train
engineer can see obstacles in front of train.

PATH Digicode® PSP
APPENDIX B-2 PATH Digicode® Application Conditions
38 of 80
The Digicode® Equipment will be installed in accordance with the procedures and
recommendations provided by the Original Equipment Manufacturer, Alstom. This
information is contained within Appendix D of PATH’s Digicode® PSP.
The Exported Application Conditions (AC) that Alstom has indicated could lead to a safety
concern are presented hereunder with confirmation that the direction will be implemented
during installation, test & commissioning and maintenance.
ID # Application Condition Installation
AC.2 The Technical Application Conditions PATH track circuit shunting sensitivity is
are: 0.06 ohms. At 0.06 ohms there is no
detection gap in the electric joint. Shunting
Maximum shunt resistance outside
variation is taken into account when
Tuning Zone: 0.5 Ohm.
positioning signals and trip stops.
Inside the Tuning Zone the train
Please refer to:
detection maximum shunt resistance
degrades; therefore the signalling  Appendix D-12 SDTC
design rules (e.g. light signal Implementation Manual section 5.4.
positioning, ATP braking curve,
fouling switch, etc.) shall consider the
Tuning Zone as a “not shunting area”.
The Tuning zone is defined as 3.6 m
before and 3.6 m after the centre of the
Impedance Bond (also called
Electrical Joint) (the length of the EJ is
fixed equal to 7.2 m).
AC.7 The power supply line that feds the All track circuits will operate from 110 VAC
Indoor Equipment shall be protected protected by circuit breaker.
against short circuits, overloads and
current leakage to the earth circuit
(optional), using:
• A circuit breaker with the
mentioned characteristics (e.g. 20A
with no more than 10 SDTC
connected to a single interrupter) and
correct cable sections shall be used in
order to assure the protection from
short circuits and therefore the
protection from fire (e.g. due to high
temperatures of supply cables).
• The protection with a single
interrupter of more than one SDTC is
allowed. In this case the supply cable
sections and the interrupter current
rating shall be chosen to have the
supply shut off in case of short circuit
of a SDTC equipment.
• A circuit breaker is also needed to
cut off the 110V SDTC power supply,
when required by maintenance
operation (to protect operator from
electrocution).
AC.11 The SDTC configuration could be All track circuits jumpers will be verified
carried out by the adequate setting of and configuration verified and tested prior
the jumpers available on the MODEM to commissioning by Invensys and PATH
Boards and on the other boards. engineers per manuals in appendix D.
The setting of such jumpers is Please refer to:
described by the related procedures
provided by the T&C Manual the  Appendix D-9 SDTC Installation
adjustment and the tuning of the Manual;
output voltage and of the frequency  Appendix D-10 SDTC Testing and
shall be carried out accordingly to the Commissioning Manual, and
procedures described in the
Installation and User and  Appendix D-11 SDTC Maintenance
Maintenance Manuals. Manual.
These documents shall be strictly

respected during the installation and
the commissioning phases of the
SDTC products.
AC.12 In order to ensure: All track circuits will have the frequency
and code settings verified prior to
 the correct frequency and code commissioning by Invensys and PATH
setting; engineers per manuals in Appendix D.
 the correct disposal of devices Please refer to:
in the rack and the correct
racks wiring;  Appendix D-12 SDTC
Implementation Manual, and
It is mandatory that the instructions,
the procedures and the constraints  Appendix D-10 SDTC Testing and
provided by Implementation Manual Commissioning Manual.
shall be strictly respected.
It is remarked that adjacent Track
Circuits shall have different values of
Code and Frequency (see Figure 8 and
Figure 9 Appendix D-1).
AC.13 The safe and correct functioning of Track circuits will be commissioned and
the SDTC products is affected by the tested by Invensys and PATH engineers in
correct execution of the Installation, strict accordance with the supplied product
Commissioning and Maintenance manuals in appendix D.
operations, so that it is mandatory
Please refer to:
that the instructions, the procedures
and the constraints provided by  Appendix D-10 SDTC Testing and
Installation, Commissioning and
Maintenance Manuals shall be strictly Commissioning Manual.
respected.
Ongoing maintenance will follow:
 Appendix D-11 SDTC Maintenance

Manual, and
 The PATH FRA test procedures in

Appendix A.
AC.14 The installation of SDTC equipments All track circuit equipment is housed in
shall foresee the adoption of technical locked rooms, bungalows or cases and only
measures in order to protect them accessible by PATH personnel as described
against the sabotage and vandalism in section 17 of PATH’s Digicode® PSP.
acts.
In particular, the Indoor Equipments
shall be installed into locales with
restricted access and the Outdoor
Equipments (Tuning Units) shall be
installed within cases that could be
opened only using tools and
instruments.
AC.15 All metallic parts of Processing Units Appropriate connections to ground will be
and Field Equipment shall be verified for each installation by Invensys
permanently connected to the earth. and PATH engineers.
At least during Maintenance phases,
all cable shields shall be connected to Please refer to:
the earth.
 Appendix D-9 SDTC Installation
Manual, section 9.2, and
 Appendix D-12 SDTC

Implementation Manual.
AC.18 The following constraints are related All relay interfaces will use the Safetran
to Vital Relay interfacing with input #400500 biased neutral relay or equivalent
resistance of 1600 : with jumper P14 on RT board removed and
coils connected in series.
 IXL Output in case of Clear
Track Circuit: from 24 to 30 V The Safetran relay has been verified to meet
DC; the safety requirements, see report:
 IXL Output in case of
Occupied Track Circuit: < 2V  Appendix D-20 SDTC Digicode
DC; Vital Relay Interface Test Report.
IXL Output without load: < 30V DC.

The following constraints are related
to US Vital Relay interfacing (Safetran
#400500 biased neutral type,
equivalent to the ALSTOM A62-125
type):
series coils connection shall be used
(500 Ohm);
Jumper P14, on RT board, shall be
removed.
AC.19 The following constraints are related Interface to iVPI will be with P14 on RT
to an Interlocking interface with ZLC board removed.
system (400 equivalent):
iVPI inputs have been proven to be
IXL Output in case of Clear TC: from
compatible per report:
11 to 19 VDC with P14 jumper
installed;
 Appendix D-19 SDTC Digicode
IXL Output in case of Clear TC: from iVPI Interface Test Report.
9 to 15 VDC with P14 jumper not
installed;
IXL Output in case of Occupied Track
Circuit: < 2V DC;
IXL Output without load: < 30V DC.
The following constraints are related
to iVPI vital input port interfacing:
Both single iVPI vital input port and
two ports in parallel connection is
allowed;
Jumper P14, on RT board, shall be
removed.
AC.20 SDTC provides the occupancy Applicable track circuit applications will
indication on output, with the include consideration of the worst case 2.2
following timing constraints: second occupied transition (BL2
Configuration).
In case of shunted Track Circuit,
occupation delay less than 0.2 s
Please refer to:
In case of invalid coded message
 Appendix D-13 SDTC Application
received from Track Circuit,
Conditions section 2.4
occupation delay less than 2.2 s, with
400 bit/s rate (BL2 configuration)
In case of invalid coded message
received from Track Circuit,
occupation delay less than 3.8 s, with
200 bit/s rate (BL3 configuration)
SDTC provides the clearing indication
on output, with the following timing
constraints:
Clearing delay (not safety) less than 2
s with 400 bit/s rate (BL2
configuration);
Clearing delay (not safety) less than
3.5 s with 200 bit/s rate (BL3
configuration);
Clearing delay (safety) greater than
1.7 s with 400 bit/s rate(BL2
configuration);
Clearing delay (safety) greater than 3
s with 200 bit/s rate (BL3
configuration);
Accordingly, minimal TC length shall
be defined. TC length depends on
both train speed and train length:
TC length shall ensure the train
presence on the shorter TC for at least
the maximum value of the occupation
delay, at the maximum train speed.
All TC lengths that are safety related
shall be dimensioned taking into
account the maximum TC occupation
delay.
AC.22 In case of use of Impedance Bonds, Impedance bonds, if used, will be a

the following constraints shall be minimum of 34 feet from the S bond and
applied about the distance between spaced at least 700 m (2300 feet) apart.
two impedance bonds:
the Impedance Bonds shall be spaced
not less than 700 m one each other, so
no double impedance bond
connection shall be made inside one
track circuit, only one is permitted;
for regularity reasons, the distance
between the Impedance Bond direct
connection and the centre of “S” bond
should be greater than or equal to 10
m (using the IB type LS300A for
Metro applications)
AC.23 The central point of a Terminal Joint The terminal joint central point will not be
can be connected to additional earth connected to ground on PATH.
conductor only if no other connection
to earth are present within the same
Track Circuit. The same restriction is
valid for the short circuit joints.
AC.24 SDTC and low frequency TC can Filter box will not be used on PATH.
operate in parallel using the Filter Box
devices. Low frequency track circuits will not be
overlaid on the Digicode track circuits.
All the specific instructions included
in the Installation Manual shall be
followed.
AC.25 SDTC and low frequency TC can Filter box will not be used on PATH.
operate in parallel using the Filter Box
devices. Low frequency track circuits will not be
overlaid on the Digicode track circuits.
All the specific instructions included
in the Installation Manual shall be
followed.
AC.26 In case of coexistence of SDTC and This configuration is not used on PATH .
low frequency TC (ref. Figure 10 in
Appendix D-1):
the maximum length of Diverted
Branch in a series connection shall be
less than or equal to 36 m.
Accordingly, trains shorter than 36 m
shall not to be used;
The maximum length of Main Branch
shall be less than or equal to 250 m
with one diverted branch;
The maximum length of Main Branch
shall be less than or equal to 150 m
with 2 diverted branch;
Cable length between SER and TU
shall be less than or equal to 2 km;
The broken rail detection function is
provided only for the series connected
rail and not for the other rail.
AC.27 In presence of a double track, the up Cross-bonds are not directly connected to
and down lines shall be never the track on PATH.
connected by direct cross-bonds. In
this case the connection is allowed
only by the use of Impedance Bonds.
PATH Digicode® PSP
APPENDIX C – PATH DOCUMENTS

1. Appendix C-1 - PATH Form ST-1.
2. Appendix C-2 - PATH Book of Rules.
3. Appendix C-3 – PATH Procedure for Receipt of Notification.
39 of 80
PATH Digicode® PSP
APPENDIX C-1 PATH Form ST-1
40 of 80
Port Authority Trans – Hudson Corporation
Signal Division
Signal Testman Inspection Report
FRA Rule 236.56
Track Circuit Test
Location: Date:
Track No. Track Polarity Shunt Shunt Track
Voltage at Test at Test at Test at Condition Date
Relay IJ Relay Feed (Wet / Remarks Taken
End end Dry)
If inspection and test shows polarity to be proper, mark OK in polarity column.

Otherwise indicate defect
Signal Testman (print) __________________________________
Signature ____________________________________________
Test Form: ST 1 Rev. 1 8/25/04

PATH Digicode® PSP
APPENDIX C-2 PATH Book of Rules
41 of 80
PORT AUTHORITY
TRANS-HUDSON CORPORATION
BOOK OF RULES
Amended Through 1/1/00

CONTENTS
Page
Disclaimer ........................................................................iii
Definitions.........................................................................1
General Rules of Conduct ...............................................11
Speeds ............................................................................29
Signal Rules
Visible Signals.................................................................33
Train Signals ...................................................................34
Audible Signals ...............................................................34
Fixed Signals...................................................................36
Automatic Block Signal System ......................................53
Blind Automatic Train Stop Rules ..................................54
Interlocking Rules ...........................................................54
Movement of Trains ........................................................59
Movement By Train Orders .............................................67
Movement by Verbal Authority........................................70
Movement by Absolute Block..........................................70
Rules For The Protection of Employees
in Track areas................................................................71
Rules for the Use of Radio and
Telephone Systems .........................................................90
Requirements of the
Hours of Service Law....................................................91
Duties and Responsibilities
Transportation Division ...........................................94
Signal Division ......................................................106
Electrical, Power &
Communications Division .....................................107
Car Equipment Division.........................................108
Way & Structures Division ....................................109
Illustrations
Fixed Signals ...........................................................38
Protection for Unobstructed Track
Diagram 1 ...............................................................77
Diagram 2 ...............................................................78
Protection for Obstructed Track
Diagram 3 ...............................................................79
Diagram 4 ...............................................................80
Diagram 5 ...............................................................81
Protection for Out of Service Track
Diagram 6 ...............................................................85
Diagram 7 ...............................................................86
Appendix I
Harassment Policy ................................................110
Appendix II
Accident Reporting Policy.....................................113
Appendix III
Path On-Track Safety Program .............................115
ii
IN THE FOLLOWING DOCUMENT YOU WILL SEE
THE WORDS HE, HIM AND HIS IN REFERENCE TO
THE DUTIES AND RESPONSIBILITIES OF PATH’S
EMPLOYEES AND AGENTS. THOSE IDENTIFIERS
ARE INCLUDED IN THE INTEREST OF BREVITY, ARE
NOT MEANT TO BE PREJUDICIAL TO EITHER
GENDER, AND SHOULD BE TAKEN TO MEAN HE,
HIM, HIS, SHE OR HER(S).
DISCLAIMER
The rules, provisions and position descriptions

contained herein are provided for the notification and
advisement of all employees. They should not be, and
are not to be, considered the terms of any contract
agreement between PATH and its employees.
iii
DEFINITIONS AND ACCEPTED ABBREVIATIONS
Absolute Block - A block that must not be occupied
by more than one train.
“A” Car - Rail car equipped with an Engineer’s cab.
Adjacent Tracks - Two or more tracks with track
centerlines spaced less than 25 feet apart.
Alternate Door Opening Sign - An illuminated sign
on the platform similar in appearance to a starting
arrow pointing upward ( ↑ ) that indicates that

light, but containing two arrows. An illuminated
doors on that side of the train shall be opened first.
platform ( ← or → ) indicates that doors on that

A horizontal illuminated arrow pointing at the opposite
opposite side of the train shall be opened first.

Aspect - The appearance of a fixed signal viewed
from the direction of an approaching train. (e.g.
green light)
Automatic Block Signal System - A series of track
sections or blocks governed by block signals actuated
by trains and controlling the spacing of trains.
Automatic Block Signal - A fixed signal at the
entrance of a block or track section to govern the
movement of approaching trains using that block.
They will be identified by a number, plus the letter
Z or K.
Automatic Train Dispatcher - System to automati-
cally dispatch trains on a predetermined schedule.
Automatic Train Stop - A device consisting of an
arm which engages the tripper valve on a rail car
causing a full emergency application of the brakes if
a train fails to stop prior to a signal indicating STOP.
Ballast - Sized rock or concrete placed on the
roadbed to support the track structure, the ties and
rail, and to hold the track in line and surface. It also
distributes the load, provides drainage and resists
plant growth.
Ballast Car - A car used for spreading ballast.
BDA - Blocking Device Applied
BDR - Blocking Device Removed
Block - A length of track of defined limits, the use of
which by trains is governed by block signals.
1
Blocking Device - A lever, ring or other device that
prevents the operation of a switch or signal.
Bridging - The condition that occurs when a rail car
becomes a conducting element between an ener-
gized section and a de-energized section of third rail.
Bumper Post Signal - A fixed signal indicating the
limit of train movements at the end of a track. It
consists of a red light.
“C” Car - Rail car without an Engineer’s cab.
Clearance - The amount of space or distance
required to allow a train or other vehicle to pass
without obstruction. See PATH Track Manual for
specific clearance requirements.
Collector Train - A train operated without customers
for the collection of revenue at stations.
Consist - The cars coupled together to make up a
train, e.g. an eight car consist.
Contact Rail - See third rail
Contact Shoe - Device which conducts electrical
current from the third rail to the train.
Control Center - The central location from which
PATH operations are controlled.
Controlled Track - Track upon which the Trainmaster
controls all movements.
Construction Inspector - A Port Authority Engineering
Department employee typically assigned to a contract
who is the Employee-in-Charge at a worksite when
a contractor is performing work for PATH.
Crossover - A set of switches and crossing frogs
that connect one track with another, allowing rail
vehicles to move between tracks.
Current of Traffic - The movement of trains on a
main track in one direction.
Derail - A track safety device designed to guide a car
off the rails at a selected spot as a means of protec-
tion against collisions or other accidents.
Dynamic Envelope - The volume of space occupied
by a train, including the contact shoes.
Effective Securing Device - A device used to
2
prevent the operation of a manually operated switch
or derail that is vandal resistant, tamper resistant and
designed to be applied, secured, uniquely tagged
and removed only by the class, craft or group of
employees for whom protection is being provided.
Engine - A unit or combination of units propelled by
any form of energy (i.e. diesel or power rail) used for
maintenance or other purposes.
Employee-in-Charge (EIC) - Person designated to
supervise or monitor the work of a group of
employees and to provide for their on-track protection.
This includes conducting a job briefing each day prior
to the start of work, the establishment of Working
Limits and the assignment of Watchmen and Flagmen.
Established Direction of Traffic - The direction set
up by traffic levers or traffic circuits on a main track
signaled for operation of trains in both directions.
Exclusive Track Occupancy - A method of establish-
ing Working Limits on a controlled track in which the
movement authority is withheld or restricted by the
Trainmaster and authorized by the Employee
In Charge.
Extra Train - A train not authorized by the normal
and published schedule but operated under the
authority of the Trainmaster. May also be designated
as Passenger Extra, Work Train, Collector Train,
Gap Train, Light Train, Shop Train, Test Train or
Scraper Train.
Fixed Signal - A signal located at a fixed position
adjacent to a designated track, indicating a condition
affecting the movement of a train on that track.
Flagging - Any means of visible communication
through the use of colored flags or lights, hand sig-
nals, white disc, lamps, and flashlights. Any form of
visible or audible communication, such as radios,
intercoms and/or whistles, used to convey informa-
tion from the front of a train to an Engineer not in
the head car.
Flagman - Person whose sole responsibility is to
either allow or restrict the movement of trains
through a work site to provide on-track protection
for roadway workers. The Flagman also warns the
3
Gang Watchman, if the latter is present, of an
approaching train.
Foul Time - A method of establishing Working
Limits on controlled track. The Trainmaster notifies
the requesting employee that no trains will operate
within a specific segment of controlled track during
a specific time period. Foul time shall remain in
effect until the employee to whom the foul time was
issued has returned the track to the Trainmaster.
Fouling - A track is fouled (obstructed) when a person
or equipment could be struck by a moving train or
on-track equipment or is within four feet of the field
side of the near running rail. Benchwalls, safety
niches and other designated safety zones within the
tunnel system are exempted from the four foot criteria.
Frog - A track device, part of a turnout, located at the
intersection of two running rails, which permits the
wheels of a rail vehicle to cross the intersecting rail.
Gang Watchman - See Watchman.
Gap Train - A train operated to replace or augment a
regular schedule or portion thereof.
Hi-Rail Vehicle - A self-propelled vehicle that may
travel on rails and highway roads.
Inaccessible Track - A method of establishing
working limits by preventing access to non-
controlled track.
Indication (Conductor’s) - Light located on the oper-
ating master door controller that is illuminated after
the doors are closed and locked. A secondary light
is located on the bulkhead between the cars of a
Conductor’s operating position.
Indication (Engineer’s) - Light in Engineer’s cab
which, when illuminated, assures all doors are
closed, locked and permits power to be applied to
the controller.
Indication (Signal) - The information conveyed by a
signal aspect (e.g., proceed).
Individual Train Detection - The procedure that may
be used by a qualified Lone Worker as on-track
protection.
4
Insulated Joint (IJ) - A non conducting rail joint
used to isolate signal blocks or sections. IJ’s are
normally located adjacent to fixed signals.
Interlocking - An arrangement of signals and signal
appliances installed at various locations where it is
necessary to route trains from one track to another,
at drawbridges, and at various “holding” locations
throughout the system. They are so designed that
no conflicting or opposing movements can be made.
An interlocking may be controlled locally or remote-
ly from a distant location. Interlocking limits are the
tracks between the opposing home signals of an
interlocking.
Interlocking Signal - A fixed signal at the entrance
of a route to govern trains entering and using that
route. It will be identified by a plate showing both
the signal’s number and letters which will include
the letter “X”.
Lamp - Flashlight or other lighted instrument.
Light Train - A train operated without customers.
Lone Worker - An individual employee who is not
being provided on-track protection by another
employee, is not a member of a gang and is not
engaged in a common task with another employee.
Main Line Track - A track extending between
stations over which trains are operated by schedule
and controlled by fixed signals. Main line tracks are
designated by a letter (e.g. “Track H”).
Maximum Permissible Speed - The maximum
speed at which a train may operate on a section of
track when no other restrictions apply.
Movable Bridge - That section of a structure bridging
a navigable waterway so designed that it may be raised
to permit passage of river traffic on the waterway.
MPH - Miles Per Hour - used with a numeral to
indicate the speed of a train.
Non-Controlled Track - Track upon which trains are
permitted to move without receiving authorization
from the Trainmaster.
Non-Shunting Equipment - Any track vehicle that
does not properly shunt signal circuits at all times. A
5
series of vehicles, whether coupled or operating as a
single movement, is considered the same as a
non-shunting vehicle if any vehicle included is
non-shunting.
Obstructed Track - A section of track where employees
are performing work and cannot readily leave the
track in a safe condition and get to a place of safety
to avoid an oncoming train, or a track which is not
physically capable of permitting the safe movement
of a train due to the condition of the track or the
presence of equipment or materials.
On-Track Safety - The state of freedom from the
danger of being struck by a moving railroad train, or
other equipment, provided by operating and safety
rules that govern track occupancy by personnel,
trains and on-track equipment.
Operating Car - Car from which the train is being
operated by the Engineer.
Passenger Alert - A push button switch located in
passenger rail cars to permit customers to alert the
train crew of a problem. When activated, lights are
illuminated in the operating cab of the train and on
the interior and exterior of the affected car.
Pilot - A qualified employee assigned to a self-pro-
pelled vehicle when the driver or operator is not
qualified on the physical characteristics or operating
rules of the system.
Qualified Employee - An employee of PATH, the
Port Authority or of a contractor to PATH who has
successfully completed all required training for his
job and has been authorized to perform the duties of
a particular position or function.
Reduce Speed Sign - A sign having black numerals
on a yellow background indicating the maximum
operating speed to be observed in the section of
track beyond the sign.
Regular Train - A train authorized by schedule.
Repeater Signal - A fixed signal, which repeats the
aspect of the actual fixed signal, located in a position
that it may be more readily seen by an approaching
train where the visibility of the signal is impeded.
6
Resume Speed Sign - A sign with the letter “R” on
a green background indicating the train may proceed
at the maximum permissible speed after passing the
sign.
Roadway Maintenance Machine - Powered equip-
ment which is being used on or near track for main-
tenance, repair, construction or inspection of track,
bridges, roadway or signal, communication or elec-
tric traction systems.
Roadway Work Group - A gang of two or more
Roadway Workers engaged in a common task.
Roadway Worker - A PATH employee, PA employee or
employee of a contractor to PATH whose duties
include inspection, construction, maintenance
or repair of track, bridges, roadway, signal and
communication systems, electric traction systems,
roadway facilities or roadway maintenance machines
on or near track with the potential of fouling a track
and employees responsible for on-track protection.
Route - A series of switches and signals which
establishes a course of travel for a train. (See also,
Interlocking)
Route Indicator - An illuminated device used in
conjunction with an interlocking signal to indicate a
left or right hand route.
Running Rail - The rail upon which the wheels of the
train rest.
Running Schedule - The document which contains
the departure and arrival times of all scheduled
trains at PATH. Also known as Table R.
Run Through - Passing a signal at STOP and/or
traveling past a trailing point switch set in the wrong
position.
Rusty Rail - A condition on the rail which prevents
the signal track circuit from shunting due to oxidation.
Scraper Train - A train operated without customers
for the purpose of removing snow or ice from the
power rail and tracks.
Shoe - see Contact Shoe
7
Shop Track - A track located within the Harrison Car
Maintenance Facility or the Running Repair Shop.
Shop Train - A train operated without customers to a
repair point and whose consist may include one or
more defective cars.
Shunt - An electrical condition caused by the wheels
of a car on the track which indicates track occupancy.
Signal (Sig.) - Wayside device used to safely
control the movements of trains.
Single Track Operation - The movement of trains
alternately in both directions on the same track.
Single Track Operating Schedule - A document
which authorizes the movements of trains against
the normal Current of Traffic with proper signals.
Speed Marker - A sign which indicates the
maximum permissible speed in a track section,
using miles per hour.
Speed Zone Marker - A “T” sign which indicates the
beginning of time control for a speed control signal.
Speed Control Signal - A fixed signal so arranged
that it will act as a speed control device through the
use of a timer to delay the signal ahead from clear-
ing. If all other conditions are favorable and the
speed of the approaching train is in accordance with
the posted speed, a speed control signal will clear to
an aspect more favorable than stop as the train
approaches.
Station Dwell - The amount of time included in the
running schedule to account for the loading and
unloading of customers at a station.
Starting Lights - An illuminated yellow sign with the
legend “DEPARTING” placed horizontally over the
station platform. When the sign flashes, it indicates
the train is about to depart, when the light remains
on steady, it is an indication to the Conductor to
close the doors and depart.
Station - A designated place at which trains may
stop to receive or discharge customers.
Station Stop Markers - A series of numerals at
stations that are normally located on the 3rd rail
protection board. These markers are to be used as a
8
guide by Engineers in stopping their trains so that
the doors of all cars will be platformed correctly.
The numerals correspond to the number of cars in
the train.
Switch (Sw.) - A track structure, part of a turnout,
designed to move a train from one track to another,
normally operated remotely as part of an interlocking.
Table “R” - See Running Schedule.
Third Rail - The rail which provides traction power
for the operation of a train. Also known as a power
rail or contact rail.
Third Rail Side Incline - An electrified extension
along the side of the third rail which allows the
contact shoe to ride up onto the third rail at switch
locations. These extensions project out beyond the
protection board and are fastened on an angle to the
third rail by bolts and clamps.
Track Indicator - An illuminated device used in
conjunction with an interlocking signal to indicate
the track to which the train will be routed.
Train - One or more rail cars, coupled together,
displaying proper front and rear lights and has a
crew and destination.
Train Length Indicators - A series of numerals on
tunnel walls which indicate that a train with like
number of cars is clear of the interlocking. When
accompanied by an “R”, it will indicate a train with
like number of cars may resume speed.
Train Orders - An authorization used to identify limits
of work rights and for providing authorization for
movement of equipment to those work limits. Train
orders must be written using the prescribed form.
Train Stop Hook - A device used to secure a
non-functioning automatic train stop arm in a clear
position.
Train to Wayside Radio - System or instrument that
transmits oral messages between people. PATH
Channels include: R1, R2, R3, R4.
Turnout - An arrangement of a switch and a frog
which permits a train or other rail vehicle to be
transferred from one track to another.
9
Unobstructed Track - A track where employees are
performing work but can readily leave the track in a
safe condition and find an area of safe clearance to
avoid oncoming trains.
Verbal Authority - Permission received from the
Trainmaster over a taped communications device in
lieu of a written train order during special operations,
loss of signal control or other abnormal conditions.
Watchman - Person designated at a worksite to warn
the work gang of an approaching train and who can
communicate with the Engineer of an approaching
train.
Working Limits - A segment of track with definite
boundaries established upon which trains and main-
tenance equipment may move only as authorized by the
Employee in Charge of the defined segment of track.
Working Limits may be established through Exclusive
Use of Track, Foul Time, Train Coordination or
Inaccessible Track.
Work Train - One or more non-passenger cars for
the purpose of supporting construction or mainte-
nance work activity on PATH.
Yard - A system of tracks provided for the making
up of trains, storing of rail cars and other purposes.
Yard Movements - Movements within a yard, also
known as a drill, or between a yard and terminal that
need not be authorized by schedule or train order but
are subject to prescribed signals and regulations.
10
GENERAL RULES OF CONDUCT
A. Required Books and Notices

Employees while on duty must have a copy of the
following in their possession or at an accessible
location for checking by a supervisor upon
demand:
1. Book of Rules
2. Any books or manuals required by their craft.
3. Any notices and forms required to perform
their duties correctly on any given day.
B. Rules and Special Instructions
1. Employees are required to know and obey al gen-
eral rules, and also those rules and special instruc-
tions, including General Notices, applicable to
their respective occupations. If in doubt as to their
meaning or application, employees must ask a
supervisor for an explanation.
2. Ignorance of the rules, regulations, and special
instructions will not be accepted as an excuse for
neglect or omission of duty.
3. Special instructions that conflict with these Rules
and Regulations must be obeyed while they remain
in force.
4. Employees whose duties require them to be
familiar with the Book of Rules must pass an
examination within six months after entering
service and must be re-familiarized or re-exam-
ined at least once every three years, or at more fre-
quent intervals where required by law or by proper
authority.
C. Bulletin Boards and Notices
1. Every employee must examine bulletin boards
before going on duty to make certain they are
familiar with all effective bulletins and notices.
Unauthorized removal of any notice posted on a
bulletin board is prohibited and will be cause for
disciplinary action.
2. Supervisors are responsible for the posting and
removing of notices on the required bulletin
boards at the locations within their responsibility.
11
They are also responsible for ensuring that
employees in their charge have all the necessary
information needed to carry out their duties.
D. Attention to Duties
1. Employees must devote themselves exclusively to
PATH service while on duty, render every assis-
tance in their power in carrying out rules and spe-
cial instructions, and report to the proper official
any violation thereof.
2. Participation in any unauthorized activity while on
duty or while on PATH property which may inter-
fere with the performance of the work of any
employee is prohibited. Employees must not per-
mit employment or activities not connected with
PATH to prevent them from performing their nor-
mal duties for PATH, or cause them to be in viola-
tion of the Hours of Service Law.
3. Employees of PATH who are not covered by a col-
lective bargaining agreement are not permitted to
engage in outside employment without prior writ-
ten permission of the General Manager. For further
information, employees should consult AP20-1.04
(3/95). Employees covered by a collective bar-
gaining agreement should refer to their respective
contracts regarding this matter.
4. Employees shall, while on duty, perform all tasks
assigned or directed to them by proper authority.
5. Employees must perform the basic functions of
their position in an acceptable manner and must
conduct themselves so as not to waste the assets
of PATH in order to retain their employment.
6. Individual or repeated violations of the Book of
Rules will not be tolerated and may be subject to
discipline, up to and including termination.
7. Employees whose job description requires a valid
motor vehicle operator’s license have the respon-
sibility to immediately inform their division
Superintendent if their driver’s license is no longer
valid for any reason.
Motor vehicle operator license abstracts are
requested from the states of residence and
12
verified by PATH on an annual basis. If an employ-
ee has had a suspension or revocation and the
employee has not promptly reported this to PATH
management, the employee will be subject to dis-
ciplinary action. In the event an employee’s job
description does not require a motor vehicle oper-
ator’s license, and the employee has occasion to
operate a Port Authority vehicle, it is the responsi-
bility of the employee to inform his supervisor of the
status of his/her driver’s license.
E. Prohibited Conduct
1. To enter or remain in the service, employees must
be of good character and must not act with indiffer-
ence or neglect, or commit a dishonest,
immoral, illegal, violent, insubordinate, disruptive,
destructive or reckless act. They must conduct
themselves at all times, whether on or off PATH
property, in such a manner as to not bring dis-
credit upon PATH.
Fighting between/among employees shall not be
tolerated under any circumstances.
2. Harassment in the workplace is prohibited. Any
employee(s) who engages in harassment on the
basis of race, sex, religion, age, national origin or
disability shall be subject to discipline, up to and
including dismissal from service.
Sexual harassment includes, but is not limited
to, creation or perception of a hostile work
environment, unwelcome sexual advances,
requests for sexual favors, and other verbal. and
physical conduct of a sexual nature.
Pictures, writings and other graphic images that
could cause others to feel sexually harassed are
strictly prohibited.
Any employee who is the victim of sexual harass-
ment or witnesses an act or acts of sexual harass-
ment should contact the Manager, Port Authority
Office of Equal Opportunity (212-435-5556). All
such communications shall be kept in strictest
confidence and investigated promptly.
The PATH harassment policy is located in
Appendix I.
13
3. The unauthorized use of televisions, radio sets,
tape or CD players, electronic games, or reading of
newspapers, books, or magazines by employees
while on duty is prohibited.
4. Employees shall not sleep nor give the appearance
of sleeping while on duty. Lying down or assum-
ing a reclining position, with eyes closed, or eyes
covered or concealed, will be considered sleeping.
5. The use of profane or indecent language in the
transaction of business with customers or fellow
employees is prohibited.
6. Employees are prohibited from having firearms or
other deadly weapons, including knives with a
blade in excess of three inches (unless such knife
is required in the performance of their duties),
in their possession while on duty or on PATH
property.
7. Employees, while performing service, must not
absent themselves from duty, exchange duties or
substitute others in their place without proper
authority. When scheduled to be relieved, they
must remain until properly relieved, unless other-
wise directed by supervision.
8. Employees must not deface or damage equip-
ment, furniture, advertising posters on walls or in
cars, advertising walls, car windows, vending
machines, or other PATH property, and must
immediately report to PATH Police or the
Trainmaster such actions conducted by other
employees, customers or individuals.
9. Employees are prohibited from loafing and/or
lounging in cars or at stations.
10. Gambling or making bets while on duty or while
on PATH property is prohibited.
11. Employees, except in the performance of their
duty, are strictly prohibited from talking to the
Engineer while he is operating a train. Engineers
may not permit unauthorized individuals to enter
their operating cab.
12. Employees must not occupy seats on trains to the
exclusion of customers.
14
13. Employees wearing work clothes that may soil car
seats must not occupy seats other than on work
train cars.
14. Employees must not ride in any Engineer’s cab
except in the performance of their duties.
15. Employees of PATH who are not covered by a
collective bargaining agreement are not permitted
to use their official authority or influence for the
purpose of interfering with a partisan election or a
nomination for office, or affecting the result
thereof. They are not permitted to directly or
indirectly induce or counsel other employees to
make any political contribution, and are not
permitted to actively participate in partisan
campaigns. For definitions of terms as well as for
permitted political activities and examples of
prohibited political activities, employees are
advised to consult PAI 20-1.07 or AP20-2.03
(2/95).
16. Solicitation while on duty or on PATH property is
prohibited.
17. PATH property may not be sold or otherwise
conveyed to any employee, or member of the
employee’s immediate family, even after its
retirement. Employees must not knowingly
purchase, or in any way obtain such retired
property, even after it has been sold.
F. Treatment of Customers
1. The traveling public must be treated with courtesy
and consideration. Employees must not engage in
disputes or quarrels with customers and under
no circumstance may an employee strike a
customer.
2. All employees shall attend to reasonable requests
from customers quickly and accurately, avoiding
unnecessary inconvenience to the customer.
3. Should the conduct of a customer be such as to
threaten the safety of persons in the cars or
stations, or should a customer use abusive or
vulgar language or conduct themselves in an
obscene or indecent manner offensive to other
15
customers, they may be ejected from cars or
stations if they continue their threatening or offen-
sive behavior after being requested to stop. Police
assistance should be requested. Customers must
not be forcibly ejected, however, except by PATH
Police or City Police.
4. A child or person of such feeble mental or
physical condition as to be unable to care for him-
self must not be ejected.
5. Employees must not cause the arrest of a
customer without instruction of a supervisor
except in cases of extreme emergency or when a
customer is committing a violent or criminal
act that threatens the safety of customers or
employees. In such cases, care must be taken to
have the arrest made in the city where the offense
was committed.
6. When an arrest is made in cars or stations,
employees must obtain the names of as many
witnesses as possible, and must also try to have
the individual against whom the offense was
committed make the complaint to the arresting
officer.
Employees must, as soon as possible, make a full
report of all the facts in the case to their supervisor.
7. When individuals appear to be under the influence
of intoxicants or narcotics to such an extent as to
be unable to care for themselves, their fares
should not be accepted. Their entrance to the sta-
tion platform or train should be prevented, if pos-
sible, by immediately calling for the assistance of
PATH Police.
G. Drugs and Alcohol
1. The possession or use of intoxicants or narcotics
by employees while on duty is prohibited. No
employee shall present themselves for or perform
any service for PATH while under the influence of
intoxicants or narcotics.
2. An employee shall refuse to permit another
employee who is apparently unfit for duty to
relieve them or perform any service for PATH. In
such case, the employee, must notify his/her
16
supervisor or other appropriate authority
immediately.
3. Employees shall be subject to medical tests for the
presence of drugs and/or intoxicants during, but
not limited to, the following circumstances: annu-
al or special medical fitness examinations, return
to duty examinations, post accident and post inci-
dent reasonable suspicion medical examination or
government mandated drug and alcohol testing.
4. Employees who are subject to a drug or alcohol
test for any reason, and who test positive for the
presence of a controlled or dangerous substance
or an intoxicant, the presence of which cannot be
explained as a medical necessity, shall be subject
to discipline.
H. Smoking
Smoking at PATH is prohibited except for those
areas designated as a smoking area (exact loca-
tions where smoking is permitted may be found in
the GENERAL NOTICE regarding the smoking pol-
icy at PATH).
I. Employee Pass
1. An employee losing his Pass must report it at
once to PATH.
2. Employees must use their Pass in the appropriate
Pass reader to obtain access through the fare con-
trol line. They must not use their pass to release
the turnstile for persons other than themselves,
unless authorized. This rule must also be
observed by those members of the employees’
families who meet the criteria to receive free
transportation.
3. Employees shall not use their Pass to obtain
reduced or free transportation on any other
carrier.
4. Cocking the turnstiles to permit passage without
the payment of fare is forbidden and employees
observing such action should immediately notify
the PATH Police Unit.
17
J. Attendance
1. Employees must maintain a satisfactory atten-
dance record. PATH has the discretion in estab-
lishing the length of time an employee may be
absent due to injury or illness before disciplinary
action is taken.
2. If an employee is disabled due to accident or
illness, or if unavoidably delayed, the employee
must report by telephone to the person
designated by their Division that he will be late or
unable to cover his assignment and the reason
therefore. This must be done in time to permit
PATH to fill his position if necessary.
3. Unexplained or unauthorized absences, repeated
or excessive absenteeism, lateness or making a
false report of injury or illness will be cause for
4. Employees are responsible for notifying their
supervisors of their scheduled medical appoint-
ments or any changes thereto. Employees must
also hand carry written notification of their
medical disposition, as determined by the Office
of Medical Services, to the person designated by
their Division.
5. Employees returning from periods of absence
must advise their supervisor sufficiently in
advance to prevent their vacancy from being filled
by another employee.
6. Employees who are found fit to return from
periods of absence that are related to illness or
injury must return to work on the date noted as
fit for duty. Failure to report for duty will be
cause for disciplinary action.
7. Employees must maintain satisfactory performance
and attendance records in order to participate in
Promotional Evaluations. Further, promotion or
appointment from a Final Notice Eligibility
Roster is subject to an evaluation of medical
fit-ness by the Office of Medical Services,
continued satisfactory performance and
attendance and any other condition stated in the
final notice. Employees who do not satify these
18
conditions will forfeit their eligibility for such
promotion or appointment.
8. PATH’s Hand-Key Recognition system is designed
to monitor an employee’s presence on property.
This system is also used to verify attendance and
hours worked for purposes of pay.
All employees are required to use the Hand-Key
Recognition System, or any other system whether
alone or in concert, to report on property at the
beginning of the work tour and report off property
at the end of the work tour.
K. Employees’ Address
1. Employees must at all times keep their supervisor
informed of the correct address where US Mail will
reach them and the correct phone number where
they may be contacted. In all instances where
notice to an employee is required, notice by any
written verifiable instrument to the last address of
the employee, as indicated by PATH records will
be deemed proper notice.
2. Any change of address, phone number, or status
must be reported to the employee’s Division
Administrator immediately. In such cases, only
written notification to the Division is considered
proper notice. Failure to do so can result in
3. Employees subject to call must keep their Division
office notified where they can be reached during
hours when they are available.
L. Employee Appearance
Employees on duty must be neat and clean in
appearance, Uniformed employees must wear the
prescribed uniform and badge. The uniform must
fit correctly and be kept pressed and clean.
M. Miscellaneous
1. Should an employee be served with a summons
or subpoena to report to any court or officer, he
must notify his immediate supervisor at once. No
employee should accept a summons or subpoena
for PATH unless specifically instructed to do so.
19
2. All articles found on PATH property must be turned
in promptly to the Train Dispatcher/Terminal
Supervisor at the nearest terminal or to the PATH
Police Desk at Journal Square. A proper receipt
must be issued.
3. Employees handling, collecting or disbursing
moneys or refunds belonging to PATH must do so
in a manner that will prevent loss. They will be
held strictly accountable for such funds and any
irregularities or shortage may result in discipline
and/or prosecution under the law.
4. Property furnished by PATH for use by employees
must be returned immediately upon demand to
their supervisor or to the proper officer upon leav-
ing PATH service. PATH reserves the right to with-
hold from wages due, the value of any property
not returned.
5. Inquiries from News media should be referred to
an immediate supervisor.
6. Relatives of PATH and Port Authority employees
shall not be given preference or special consid-
eration in the conduct of recruitment, filling
promotional opportunities, compensation or
working conditions and responsibilities. PATH
will be guided by Port Authority policy AP20-
1.13 in pursuing this policy.
7. Employees are required to disclose all relation-
ships with other employees at the time of hire, or
when such occur subsequent to hire, to their
Division Superintendent.
8. In the course of any investigation, inquiry or
other proceeding where it could reasonably be
construed that such relationship could
compromise their integrity, employees must
report any relationship to subjects or principals
involved to their Superintendent and exclude
themselves from any involvement in same.
N. Safety Rules
1. Employees must know and comply with all PATH
Safety Rules, the PATH Emergency Preparedness
Plan and the specific safety rules of their Division
or occupation.
20
2. The safety of customers and employees is, at all
times, to be considered of first importance. All
employees are required to exercise constant care
to prevent injury to themselves and other persons
as well as damage to property. In all cases of
doubt they must take the safe course.
3. Employees shall utilize safe work practices to
avoid injury to themselves and others.
4. Tools, materials, machines, chairs or other
devices that are provided for employees’ use must
be inspected by the employee prior to use to
ensure that they are in proper working condition.
Defective equipment must be reported to the
supervisor/foreman.
5. Employees must report at once any unsafe work
condition that may endanger themselves or
others.
6. Employees must use the proper safety equipment
while performing their duties. Dust masks,
respirators, goggles, hearing protection, rubber
and cloth gloves, flashlights, disposable suits, res-
pirators and other personal protective
equipment are provided, and must be worn for
prescribed work efforts. Failure to do so will result
in disciplinary action.
Reflective safety vests are to be worn at all times
when walking or working on or adjacent to track.
Maintenance employees are required to wear
hard-hats at all times except in locker rooms,
office areas, vehicles and designated walkways
and areas. Transportation Division employees
are required to wear hard-hats while working
around maintenance equipment or within construc-
tion areas. Hard-hats must not be defaced or be
punctured as this will impair the dielectric and
impact protection that the hard-hat provides.
Maintenance personnel and contractors are
required to wear protective eyewear while on duty
except in locker rooms, office areas, vehicles and
designated areas. Specific jobs require additional
eye protection such as goggles, face shields
and/or welding lenses. Prescription glasses
21
meet the requirements for safety glasses in non-
hazardous environments.
Maintenance employees and all Engineers,
Engineers/Switching, Conductors, Yard
Supervisors, Coin Room staff, Passenger
Information Agents and all Field Supervisory
staff are required to wear steel toed safety shoes
that meet ANSI Standard Z41 for impact and
compression and are Electrical Hazard approved.
7. All contractors to PATH are required to wear the
proper safety equipment and follow PATH’s safety
rules while working at PATH.
8. Employees shall not wear any apparel or items
which will limit or restrict hearing or movement
while on or about in-service tracks other than
approved and prescribed safety equipment.
9. In the case of an injury to an employee while on
duty, the employee must notify his Supervisor
immediately following the injury, but no later than
the end of the work tour.
If necessary, promptly obtain first aid or medical
assistance for all injuries. As soon as possible
thereafter, the injured employee must complete
Part I of Form TH-360 PATH Employee
Occupational Injury Report.
The immediate Supervisor, upon notification of an
employee injury, will render all practical assistance
to the employee, determine the circumstances of
the incident, and complete Part II of Form TH-360
PATH Employee Occupational Injury Report.
10. To prevent customers from being injured by put-
ting heads or arms out of windows, Conductors
and Engineers must keep cab doors and sash win-
dows locked when not in use. In addition, the
vestibule doors on both ends of each train in serv-
ice must be locked.
Employees shall keep their heads and bodies with-
in the dynamic envelope of moving cars, locomo-
tive and maintenance equipment unless their job
specifically requires otherwise. In that case,
extreme caution must be used and clearances
must be checked beforehand.
22
11. Employees must not board or get off a moving
train. Employees must use prescribed handholds
and footholds when climbing on or off cars,
locomotive and maintenance equipment.
12. Employees are prohibited from climbing upon,
riding upon or working upon the top or roof of any
passenger car or work car except cars placed in
shop or yard tracks, and authorized by the Shop
Foreman.
13. Immediately upon becoming aware of a potentially
dangerous or unsafe condition on or about PATH
trains or property, employees must notify their
supervisor, the Trainmaster and/or the PATH
Police Desk by the most available means of
communication.
14. Employees must notify the Trainmaster promptly of
any condition that might interfere with the safe
movement of trains. This includes the safe
operation of railroads adjacent to PATH. They must
notify the Communications Agent promptly of any
defect noted in stations, track or any other structure
or of any potentially unsafe condition.
15. Employees must observe passing trains for
defects and proper display of headlights and
markers. The observation of any defect and/or
improper display of headlights and markers shall
promptly be reported to the train crew and the
Trainmaster.
16. All employees are required to immediately report
trespassers on PATH property.
17. Operating crews are required to report any
employees in the track area that they have not
been previously advised of.
18. Employees shall not enter track areas without
prior authorization from the Trainmaster.
19. Walking on or crossing tracks is prohibited except
in the discharge of duty. Employees who are
authorized to walk or work in track areas must
comply with “RULES FOR THE PROTECTION OF
EMPLOYEES IN TRACK AREAS” and provide
themselves with all required safety equipment
and lights and must know the visible and audible
23
signal codes. Employees who are working on
active track must utilize the appropriate form of
protection to ensure their on-track safety. Upon
the approach of a train, they must first make sure
of their position, clearance and foothold and then
give the “proceed” signal to the approaching train.
After a train has passed, they must be sure the
track to the rear of the train is clear. They must
familiarize themselves with locations where there
is no clearance and must receive foul time before
entering.
20. Employees must not cross the tracks immediately
after a train has passed. Employees must first look
in both directions for approaching trains before
crossing tracks. When crossing tracks in front of or
behind standing equipment, allow at least 25
feet to cross safely.
21. Employees must expect movement on any track,
in any direction, at any time. They must identify an
available place of safety at all times.
22. When necessary to cross over the third rail,
employees must avoid the area of the third rail
side incline.
23. Employees engaged in making repairs on or
about cars must protect themselves against
movement of the cars by the use of blue signals
as described in “RULES FOR THE PROTECTION
OF EMPLOYEES IN TRACK AREAS.”
24. Any injury to a customer, however slight, must be
reported immediately to the PATH Police Desk,
Extension 6078, and the Trainmaster, Extension
6552.
Employees must render promptly all practical
medical assistance, and obtain names of
witnesses.
A report of all accidents and unusual occurrences
must be made immediately to the employee’s
supervisor. As soon as possible thereafter, Form
TH-2526A, Unusual Occurrence Report, must be
completed and submitted to the employee’s super-
visor. Form TH-2526A, Unusual Occurrence
Report, are available in Supervisor’s offices and all
Dispatcher’s booths.
24
25. Employees must immediately notify the
Trainmaster of any fire on or adjacent to PATH
property.
26. Employees must be familiar with the location of
fire extinguishers and their use. Where appropriate,
employees should take appropriate action to put
out incipient fires before they spread.
27. Employees must report expended fire extinguishers
to the Communications Agent.
28. Commanding officers of a municipal fire
department, or municipal police officers are
authorized to stop trains from passing a fire
near the track to ensure the safety of trains and
customers.
Commanding officers of the municipal fire depart-
ment or municipal police officers are authorized to
order power removal.
Whenever employees are notified by a
commanding officer of the municipal fire
department or a municipal police officer to stop
trains from passing a certain point or to remove
power, they must immediately notify the
Trainmaster.
29. Employees must learn the use of the Emergency
Power Alarm System (Gamewell) and location of
the Gamewell boxes to be able to operate them in
case emergency power removal is required.
30. Activation of the Emergency Power Alarm System
(Gamewell) immediately removes power from the
power rail in that track section and sends an alarm
to the Power Director. The system operates as fol-
lows:
TO OPERATE: Open box door, pull down lever as
far as it will go and then release. This will
remove the power from the power rail in that
section and send in an alarm. The gearbox
makes a whirring sound in operation.
Employees, after sending in this alarm, must
immediately contact the Trainmaster, giving
their name and badge number and explaining
the nature of the trouble.
25
31. When power has been removed from the power
rail as a result of activating the Emergency Power
Alarm System, and after the obstruction with
power rail has been cleared, the employee who
activated the alarm, or his authorized representa-
tive, may order power restored, upon properly
identifying themselves by name and badge num-
ber to the Trainmaster. The employee ordering
power restored will be held responsible for know-
ing personally that conditions do not exist where-
by risk will be incurred to life or property when the
electricity is restored to the Power Rail. The
employee who originally removed the power is
solely responsible for restoration unless this
authority has been transferred to a relieving
employee, in which case the Trainmaster and
Power Director must be so notified.
Employees who are not qualified or are unable to
determine when it is safe to restore power must so
advise the Trainmaster and be relieved by a quali-
fied employee.
32. Employees must take every precaution to protect
themselves and others from electric shock. The
power rail and all contact shoes on cars are to be
considered live at all times and employees must
avoid coming in contact with them. Employees are
particularly cautioned against permitting anything
to fall upon or strike the power rail and cause
injury to themselves or others. No article shall be
placed or hung in such a way as it could come in
contact with the power rail.
When practical, employees are to perform
maintenance on de-energized equipment. When it
is necessary to work on energized equipment, the
employee must implement appropriate safety
precautions and notifications as established by his
division.
33. When new employees are required to work near
energized equipment, experienced employees
must identify the potential hazard and utilize
appropriate measures to minimize any potential
hazard, and remain at the site until work is com-
plete.
26
34. Caution must be used when moving jumpered
trains from yard to shop to prevent electrical
bridging from yard to shop power sources.
Jumpers should be removed before they are
placed inside the Harrison Car Maintenance
Facility if they can cause bridging.
35. When jumper cables are used on any train, pre-
caution must be taken against bridging gaps in the
power system.
36. Employees working on or about track switches
must not put their hands or feet between switch
points and stock rails or switch housings until the
switch has been taken out of service and securely
clamped so that it cannot be moved by the inter-
locking tower. The employee must notify the
Trainmaster in advance of such work and receive
his approval to remove the switch from service.
The employee who removed the switch from serv-
ice is solely responsible to restore the switch to
service unless the authority to restore the switch
to service has been transferred to a relieving
employee and the Trainmaster has been so notified.
37. Power rail switches or breakers must neither be
opened nor closed except by order of the Power
Director, who must notify the Trainmaster before
power is either removed or restored, except dur-
ing emergencies.
38. Employees must not remove or tamper with
machine guards.
39. Bridge Worker Safety. Work that is to be per-
formed on bridges and viaducts that are twelve
feet or more above ground or water surface and
that are not provided with railings and walkways,
or work that is outside of the walkways or railings,
must be performed utilizing a personal fall arrest
system or safety net system.
40. Employees performing work in confined spaces,
as identified by their supervisor/foreman, must
monitor the work environment prior to entry. If a
hazardous environment is present, the employee
must follow prescribed confined space rules as
described in the PATH Confined Space Manual.
27
41. Employees must label all secondary containers
with the correct contents and all conditions and
precautions for use of the product including phys-
ical and health hazards.
42. Ladder Safety. Employees working on ladders on
station platforms or other areas adjacent to active
track shall be provided with adequate protection.
Work within three feet of the platform edge, or
greater if the work could foul the track, shall be
protected by a watchman whose sole duty is to
warn of an approaching train. Straight or exten-
sion ladders shall be tied off or footed by another
employee.
Where practical, banner guard, cones and/or sig-
nage stating “Caution - Men Working” shall be used
to isolate the worksite from passenger move-
ment. Notification to and coordination with the
Trainmaster shall be made prior to the initiation of
any work described within this rule.
28
SPEEDS
101. Restricted Speed - Proceed not exceeding

12MPH, prepared to stop short of train, obstruction or
switch not properly lined and to look out for broken
rail. A speed that will permit stopping within one-half
range of vision.
102. Yard Speed - A speed that will permit stopping
within one-half range of vision but will not exceed 5
MPH on tracks with a derail which enter the shop
building at Harrison Yard, will not exceed 8 MPH on
the Harrison Yard Loop Track and in Journal Square
Yards and will not exceed 12MPH on all other tracks in
Harrison Yard and in South Street Yard.
103. Pit Speed - After a full stop at the doorway, Pit
Speed is, in the Running Repair Building not greater
than 3 MPH and in the Harrison Car Maintenance
Facility, not greater than 5 MPH.
104. Maximum Speed - The speed for a given section
of track at which a train may operate when any part of
the train is occupying that section and no other restric-
tions apply.
Tunnel From To MPH
A 33rd St. 182Z 12
182Z 166Z 40
166Z 164Z 25
164Z 158AZ 12
158AZ 148Z 30
148Z 142Z 15
142Z 138Z 12
138Z 136Z 25
136Z 128Z 40
128Z 126Z 25
126Z 120Z 40
120Z R28X 20
R28X 110Z 15
110Z R4X 25
R4X Hoboken 8
29
Tunnel From To MPH
B Hoboken 101Z 8
101Z L20X 20
L20X 111Z 8
111Z 117Z 15
117Z 129Z 40
129Z 135Z 15
135Z 143Z 12
143Z 149AZ 30
149AZ 163Z 12
163Z 171Z 30
171Z R4X 40
R4Z 33rd St. 12
Tunnel From To MPH
C R28X LA30X 15
LA30X 209Z 8
Tunnel From To MPH
D R24X 502Z 8
502Z 115Z 15
Tunnel From To MPH
E WTC 246Z 12
246Z 234Z 40
234Z 222Z 20
222Z 214Z 40
214Z 210Z 30
210Z R24X 25
(To 33rd) 206Z R24X 8
(To Hob) R24X 110Z 20
Tunnel From To MPH
F L20X L30X 40
L30X 213Z 25
213Z 215Z 30
215Z L32X 40
L32X RA28X 25
RA28X 233Z 20
233Z 249Z 40
249Z WTC 12
30
Tunnel From To MPH
G L24X 300Z 8
300Z LA20X 30
LA20X 312Z 12
312Z L32X 40
Track From To MPH
G L32X R14X 15
R14X 733Z 25
733Z L30X 55
L30X L4X 35
L4X 785Z 30
785Z 787Z 15
787Z Block 12
Track From To MPH
H Block 786K 12
786K R2X 15
R2X 780Z 30
780Z 770Z 40
770Z R12X 55
R12X R26X 30
R26X R46X 20
R46X 720Z 40
Tunnel From To MPH
H 720Z 377Z 40
377Z 381Z 20
381Z 385Z 12
385Z 389Z 20
389Z R26X 30
R26X 233Z 8
Tunnel From To MPH
J 387Z 401Z 12
401Z 222Z 20
Tunnel From To MPH
K L32X 400Z 12
400Z 310Z 20
Track From To MPH
M R18X RA112X 30
31
Track From To MPH
N L62X L30X 20
Track From To MPH
S R26X R48X 20
R48X RB60X 40
Track From To MPH
P L6X R16X 30
Track From To MPH
#1 RA112X LA128X 20
HarrYrd LA112X LC120X 35 (track testing only)
32
SIGNAL RULES
VISIBLE SIGNALS
150. Employees whose duties may require them to
give signals, must provide themselves with the proper
equipment, keep the equipment in good order and
ready for immediate use. Flags of the prescribed color
must be used in daylight and lights of the prescribed
color must be used in the tunnels and at night or when
outside light may be inadequate to easily distinguish
flag colors.
151. Visible Signals are those signals that may be
given by hand, flag or flashlight. Color indications that
may be used are:
(a) Red Stop.
(b) Yellow Proceed at reduced speed.
(c) Green Resume Normal Speed.
(d) Blue For use when working on cars.
(e) White For hand signals. Flashing white
indicates personnel in track area.
Specific uses are described in “RULES FOR PRO-
TECTION OF EMPLOYEES IN TRACK AREAS.”
152. In giving visible signals by hand, flag or flash-
light, it must be done clearly so that no misunder-
standing can result from imperfect signals.
HAND, FLAG AND FLASHLIGHT SIGNALS must be
performed in the following manner:
(a) Swung at right angle to track. Stop.
(b) Raised and lowered vertically Proceed.
(c) Swung vertically in a circle at half Back Up.
arm’s length at right angle to track.
153. All employees walking or working on or adjacent
to tracks must signal to approaching trains by using
hand, flag or light signals as per Rule 152. If no action is
required by the Engineer, the employee must signal
the Engineer to proceed.
The Engineer must acknowledge the employee’s
signal by blowing the horn in accordance with Rule
156(b) and may also flash the bright lights. The
employee must notify the Trainmaster immediately if
the Engineer fails to acknowledge his presence.
33
Engineers must promptly obey stop signals given by
any employee, even though such signals may seem
unnecessary. When in doubt as to the meaning of a
signal, or in the absence of a signal, they must stop,
ascertain the cause, and if an improper signal is
shown, they must report the fact to the Trainmaster
immediately.
Any object waved violently by anyone on or near the
track is a signal to stop.
TRAIN SIGNALS
154. Headlights must be displayed in the bright posi-
tion at the front of every train at all times when oper-
ating outside the tunnels. They will be displayed in the
dim position as follows:
(1) In Tunnels.
(2) Approaching Stations; Except entering “H”
platform Newark;
(3) On two or more tracks when approaching a
train in the opposite direction;
(4) Approaching fixed signals when the view of
the signal is improved thereby.
When so equipped, locomotives will also use ditch
lights when bright lights are required.
155. Destination lights must be displayed to the
front of trains as follows
Left Cab
Trains Between Side Side
Newark - World Trade Center Red Red
Hoboken - World Trade Center Green Green
Hoboken - 33rd Street Blue Blue
Journal Square - 33rd Street Yellow Yellow
Journal Square - Hoboken - 33rd Yellow Blue
All non-passenger trains will not display destination
lights or signs on the head end nor any side signs.
AUDIBLE SIGNALS
Note: The signals prescribed are illustrated by “o”
for short sounds; “_” for long sounds.
34
156. Train Whistle Signals
A continuous blast of the train whistle is an
emergency signal for Conductor to pull emergency
cord and apply hand brakes on train.
Sound Indication
(a) _ Apply brakes. STOP.
(b) _ _ Release brakes. PROCEED.
Acknowledgment of hand, flag or
lamp signal to STOP or PROCEED.
(c) o o o To be sounded by Engineer as an
acknowledgment of hand, flag or
lamp signal to BACK UP, before
starting the back up movement.
(d) _ _ _ When train is entering station,
call for Car Inspector.
(e) _ _ _ _ Call for signal.
(f) _ _ _ _ _ When train is entering station,
call for police.
(g) _ _ o _ Approaching locations where work
men are on or about the tracks, at
whistle markers, approaching stations
where train will not stop and exiting
tunnel portals.
(h) _ o When running against traffic, use
when approaching stations, prior to
any use of 156 (g), entering onto an
against track, entering blind curves
when workers may be present.
Engineers must not use the whistle unnecessarily,
but must sound warning signals as soon as it
appears to them that a person on or near the track
or station platform is not taking the proper precau-
tions for safety.
If a locomotive is equipped with an engine bell, it
must be sounded:
1) When the equipment is about to move.
2) When moving inside a shop building.
3) When passing a station in place of the horn.
4) When approaching workers in the track area.
35
157. Buzzer Signals (onboard communication
system used between Conductor and Engineer)
Sound Indication
(a) _ STOP at once.
(b) _ _ Start.
(c) o o o When standing - Back up.
(d) _ _ _ When running - Stop at next
station or employee stop.
(e) _ _ _ _ For air-brake test - Apply or
release brakes.
(f) o _ o Conductor to contact Engineer.
Train crews must ensure that the buzzer system is
functioning prior to leaving an initial terminal. If the
buzzer system is not working, a functioning alter-
nate system must be used.
158. Interlocking Whistle Signals
Sound Indication
(a) _ All movements within interlocking
limits - STOP immediately.
(b) o o Resume normal movement after
receiving the proper signal or
permission of Tower Operator
(c) _ _ _ Call for Car Inspector.
(d) _ _ _ _ Call for Signal Repairman.
(e) o o o o o Call for Trackman or Power
Rail Maintainer.
FIXED SIGNALS
Fixed Signals are divided into three classes.
200. (a) Interlocking Signals govern the movement
of trains through interlocking territory.
(b) Automatic Block Signals govern the move-
ments of trains running in the established direction of
traffic on main tracks.
(c) Miscellaneous Signals give information of
various kinds to Engineers in the operation of their
train. (i.e. Train Order, High Water, etc.)
201. Signal aspects shall be shown by the color of
lights, flashing of lights, or any combination thereof.
They may be identified by number plate, letter plate,
or any combination thereof.
36
202. Fixed signals, except repeater signals, are
located either directly above or on the right hand side
of the track.
Repeater signals are generally located on the left side
of the track for visibility. They are identified by “REP”
in place of the X or Z and may have flashing aspects
where they could be confused for a signal on an
adjacent track. In tunnels not equipped with automatic
block signals in reverse direction, they may also be
placed in advance of an interlocking and identified by a
“D” (Distance) in place of the X.
203. Fixed signals do not dispense with the need to
obey other signals that may be of a more restrictive
nature (i.e. flag or lamp).
In the event of a conflict between fixed and other
signals, the Engineer will be governed by the most
restrictive indication.
204. A signal imperfectly displayed or the absence of
a signal at a place where a signal is usually shown
must be regarded as the most restrictive indication
that can be given by that signal and must be reported
promptly to the Trainmaster.
When there is sufficient illumination of a light signal to
determine the indication of the signal, it will govern.
37
RULE
205
206
38
RULE
207
208
39
RULE
209
210
40
RULE
211
212
41
RULE
213
214
42
RULE
215
216
43
RULE
217
218
44
RULE
219
220
45
RULE
221
222
223
46
RULE
224
225
47
RULE
226
227
228
48
RULE
229
49
RULE 229 (Sheet 2 of 2)
DISTANCES FROM APPROACH SPEED SIGNS

TO SPEED LIMIT AND STOP SIGNS
Speed in mph Distance between

Reduce signs in feet
From To (Level Grade)
55 40 500
55 30 700
55 20 850
55 15 900
55 8 1000
55 stop 1000
40 30 250
40 20 400
40 15 450
40 8 500
40 stop 550
30 20 150
30 15 200
30 8 300
30 stop 300
20 15 50
20 8 100
20 stop 150
15 8 50
15 stop 100
Distances should be increased for

down-grades by:
1% grade = 10% distance

50
RULE
230
231
51
RULE
232
SHUNT
NO
SHUNT
Name: Shunt Indicator

“Shunt” Indication: when illuminated, vehicle shunts
signal circuits “No Shunt” Indication: When illuminated,
vehicle does not shunt signal circuits.
Allows Engineer acting as Pilot to confirm whether

vehicle activates signals.
52
AUTOMATIC BLOCK SIGNAL SYSTEM
251. Automatic Block Signals govern the movement
of trains operating on main tracks with the current of
traffic.
252. All Automatic Block Signals display a “Z” or “K”
underneath the signal number, and their most restric-
tive indication is STOP and PROCEED (Rule 219).
253. To pass an Automatic Block Signal, equipped
with the letter “Z”, at STOP and PROCEED position,
the Engineer must first receive permission from the
Trainmaster. After receiving permission, the Engineer
must stop the front end of the head car in line with the
face of the signal to clear the Automatic Train Stop.
The train may then proceed at restricted speed to the
next signal.
If the Stop Arm fails to clear, it must be forced down
by the Conductor and secured by hook. This fact
must be reported promptly to the Trainmaster.
254. To pass an Automatic Block Signal designated by
the letter “K” at the STOP and PROCEED position, and
after receiving permission from the Trainmaster, the
Conductor must insert a key in the key release box and
turn it to the right, holding it until the Stop Arm clears.
The train may then proceed at restricted speed to the
next signal.
If the Stop Arm fails to clear, it must be forced down
by the Conductor and secured by hook. This fact must
be reported promptly to the Trainmaster.
255. At Automatic Signals located opposite interlock-
ing signals governing train movements in the opposite
direction, it may be necessary to force down and hook
both tripper arms. This fact must be reported prompt-
ly to the Trainmaster, and tripper arms must be
unhooked after train passes.
256. A train must not reverse its direction within the
limits of a block, nor re-enter a block after having
passed beyond its limits, without the verbal permis-
sion of the Trainmaster. The Trainmaster must not give
permission for such movements when a train has
been authorized to move, or is already moving from
the next interlocking in the rear toward where the
movement is to be made until he has communicated
53
with the approaching train and is assured it has
stopped.
257. Trains must stop clear of Automatic Block Signals
indicating STOP and PROCEED. After coming to a full
stop, they may proceed after receiving permission
from the Trainmaster, in accordance with Rules 253
or 254. If a train fails to stop short of a STOP and
PROCEED signal and is tripped by an Automatic Train
Stop, the tripper valve on the cars may be reset at
once by the Engineer and the train may proceed
at Restricted Speed to the next signal. The Engineer
and Conductor must immediately report the incident
to the Trainmaster by radio, or by telephone on arrival
at the next terminal.
BLIND AUTOMATIC TRAIN STOP RULES

260. A Blind Automatic Train stop is an automatic train
stop not associated with a fixed signal. Its
operating push-button is equipped with two blue lights
to indicate when the stop arm is in the clear position.
261. A Blind Automatic Train stop governs the
movement of trains at entrances to shop doors.
262. To pass a Blind Automatic Train Stop at the STOP
position, Engineer must press the push-button
associated with the blind automatic train stop, holding
it until the Stop Arm clears and the blue lights
associated with the push-button illuminate. The train
may then proceed at Pit Speed. If the stop fails to clear,
it must be forced down and secured by hook. This fact
must be reported promptly to the Trainmaster.
INTERLOCKING RULES
275. Interlocking signals are the fixed signals of an
interlocking. They govern train movements over
routes within an interlocking. Interlocking signals are
normally designated by use of the letter “X” on their
number plates.
276. When a proceed signal has been displayed for an
approaching train, the signal must not be taken away
unless some emergency is discovered that might
endanger the safety of the train. If it becomes neces-
sary to change any route for which the signals have
54
been cleared for an approaching train, switches must not
be changed nor signals cleared for any conflicting
route until the train has stopped.
277. If a train approaching a junction finds the route
improperly set, the Engineer must stop the train and
notify the Tower Operator or Control Center by radio or
telephone. If an error has been made in routing, it will
then be corrected, or the train will be instructed to pro-
ceed on the route displayed. This rule will not apply to
trains that have been notified in advance that they are
being detoured.
278. Trains must stop clear of interlocking signals indi-
cating STOP. A train must not pass an Interlocking Stop
Signal (Rule 219) except when authorized by
Rule 279.
279. When an interlocking signal cannot be cleared
for any reason, the Tower Operator must report that
fact to the Trainmaster immediately. The Trainmaster
will arrange with the Signal Supervisor to dispatch a
Signal Repairman to the location promptly.
To pass an interlocking signal in the Stop position,
the train crew must receive Verbal Authority from
the Trainmaster. Permission must not be given until
the train has come to a complete stop. The following
steps are to be complied with issuing permission:
a. The Trainmaster shall ensure that all switches
are properly aligned and that no conflicting
move has been authorized.
b. The Trainmaster will give permission to pass a
Stop Signal in the following manner:
Example:
“Newark 5:00AM to World Trade Center may pass
signal R28X in the stop position according to rule
279, the Tower Operator’s name is ______, my
name is ______, time 5:20AM”
The receiving Engineer or Conductor must confirm
that he/she has received the information and repeat
the time and wait until the Trainmaster has con-
firmed it before moving.
c. After permission has been confirmed, the
Conductor will secure the Automatic Train
55
Stop, and after the train has passed, release
that Automatic Train Stop unless otherwise
instructed. The train will proceed at
“Restricted” speed until all cars have cleared
the interlocking and then resume posted
speed unless otherwise directed.
Conductors are reminded that the reverse
Automatic Train Stop may also have to be
secured and released.
d. At movable bridges the Trainmaster shall not
authorize the passing of a Stop Signal until
the bridge has been inspected by a Signal
Division Employee. When permission is
received, the train shall proceed at a speed not
to exceed four (4) MPH until clear of the
bridge interlocking.
e. Once the Trainmaster has given permission to
a train to pass an interlocking signal at stop,
the Tower Operator must not attempt to oper-
ate any switch or signal lever or pushbuttons
until he is assured that the movement of the
train has been completed, and is so instruct-
ed by the Trainmaster.
f. Upon arrival of the Signal Repairman, if the
failure cannot be promptly corrected, the
switches involved in the route to be used will
be clamped in the desired position after which
the Trainmaster may give permission to a train
to pass an interlocking signal at stop.
g. If it becomes necessary to issue permission
to pass an interlocking signal at stop over an
extended period, the Trainmaster may desig-
nate a qualified employee at the location to
issue permission.
280. If a STOP signal (Rule 220) is disregarded, the
Tower Operator must make every effort to stop the
train by the use of the interlocking whistle and radio.
The fact that the signal was disregarded must be
reported immediately to the Trainmaster. The Engineer
will be relieved at the next available location.
281. When a train is tripped by an automatic train
stop at an interlocking STOP signal, the tripper valves
on the cars may be reset at once by the Engineer. The
56
Trainmaster must be notified promptly and the train
must not move in either direction, except as directed by
the Trainmaster.
282. Interlocking signals located at diverging points
indicate the route which is established. This indication
may be in the form of the relationship of color lights in
a signal or of illuminated numerals or letter “L” or “R”
displayed.
283. The Interlocking Control Machine must be operat-
ed carefully and only by those charged with that duty
and as directed by the Rules. If any irregularity affect-
ing their operation is detected, the signals must be dis-
played in their most restrictive indication until repairs
have been made. Defects must be reported promptly
to the Trainmaster, the Signal Supervisor and the Train
Dispatcher/Terminal Supervisor.
284. If there is a derailment, if a switch is run through,
or if any damage occurs to the track or interlocking
plant, the involved signals must be restored so as to
display the STOP indication and no train or switching
movement permitted until all parts of the interlocking
plant and track liable to consequent damage have been
examined and certified by qualified personnel to be in
a safe condition.
285. When switches or signals are undergoing
repairs, signals must not be displayed for any move-
ments which may be affected by such repairs until it
has been ascertained from the Signal Repairman that
the switches are properly set for such movements.
286. If necessary to disconnect any switch, it must be
clamped and blocked before any train is permitted to
pass over it.
287. Alterations or additions to an interlocking plant
must not be made unless properly authorized by the
Superintendent of Signals or his designee. Such alter-
ations must be reported to the Trainmaster and/or
Superintendent of Transportation.
288. The lever operating an interlocking control
machine must not be moved when any portion of the
train is standing on or occupying the previous block,
approaching the interlocking.
57
289. When the head of a rail in a track circuit is cov-
ered with rust, sand or any other material which
may interfere with proper shunting of circuits and
which cannot be immediately cleared, the Signal
Repairman must immediately notify the Tower
Operator and Trainmaster verbally, following up in
writing, that such track circuit cannot be depended
upon for locking a specified switch and that track
indication lights involved must not be accepted as
indicating that these track sections are clear. Under
such conditions, train movements must be made
under Absolute Block rules.
Such levers or pushbuttons must be secured by
blocking devices at all times, except during lever or
push-button operation, and a rusty rail sign must be
attached.
Blocking devices must not be removed nor controls
operated until it is known that train movements are
clear of switch.
290. A reverse movement within the limits of an
interlocking must not be made without a proper
interlocking signal, except by verbal permission of
the Train Dispatcher/Terminal Supervisor or the
Trainmaster. The Tower Operator must not display
such a route without permission from the Train
Dispatcher/Terminal Supervisor or the Trainmaster,
who must take necessary measures to protect the
movement.
291. Movements may be made against the current of
traffic to clear the interlocking for switching purposes
only, by proper interlocking signal, and only after hav-
ing the Train Dispatcher/Terminal Supervisor clearly
communicate the planned move to the Engineer. The
Train Dispatcher/Terminal Supervisor must not
authorize such a move without permission from the
Trainmaster, who must take necessary measures to
protect the movement in accordance with Rule 256.
58
MOVEMENT OF TRAINS
300. The Running Schedule, (Table “R”) is the authori-
ty for the movement of regular trains. The Engineer
and Conductor are both responsible for operating in
accordance with the running schedule.
301. Where two main tracks are in service, trains will
operate with the normal current of traffic.
302.On main tracks, trains may be operated against the
normal current of traffic upon display of proper fixed
signal indication, plus verbal authority from the
Trainmaster, or in accordance with a PATH Single
Track Operating Schedule.
When single track operation is to be in effect for
an extended period of time, the Trainmaster will
issue a Single Track Operating Schedule to
all affected employees.
When a PATH Single Track Operating Schedule is in
effect, each Engineer, Conductor, Tower Operator and
Maintenance Supervisor must receive, sign for and
keep a copy of the schedule in their possession.
303. Extra trains may be authorized by verbal
permission of the Trainmaster, or by a Train
Dispatcher/Terminal Supervisor with the approval of
the Trainmaster.
304. When Starting Lights are lit continuously, the
Conductor will close doors as soon as it is safe to do
so. When all side doors are closed and locked, the
Engineer will receive a signal indication in his cab,
upon which he may proceed.
Should the Starting Lights not be displayed at the
scheduled departure time, the Conductor shall notify
the Train Dispatcher/Terminal Supervisor at that termi-
nal. In the absence of a Train Dispatcher, the
Trainmaster shall be notified.
If the Conductor has been informed that the Starting
Lights are not functioning, then the train will depart
according to the Running Schedule unless instructed
otherwise.
305. A train carrying customers must not leave a termi-
nal in advance of its scheduled time unless the
starting lights so indicate, or when authorized by the
Trainmaster or Train Dispatcher/Terminal Supervisor.
59
306. Conductors and Engineers are both responsible
for the safety of their trains, and under conditions not
provided for by the rules, must take every precaution
for their protection. In all cases of doubt or uncertainty
the safe course must be taken.
307. Trains which do not stop at stations must not
exceed 15 MPH passing the platforms and must
sound whistle or bell as required by Rule 156.
308. Should a train part (uncouple), the Conductor
must promptly apply hand brakes on the rear section
and notify the Trainmaster. The front section must be
moved back and added (recoupled) to the rear section.
If it is not possible to recouple the two sections, then
the rear section must be coupled to the following train
and the head section will proceed to its regular desti-
nation, unless otherwise ordered by the Trainmaster.
309. When a train becomes disabled between sta-
tions, the following train, on instructions from the
Trainmaster, will couple and push it slowly to the next
station where customers should be requested to dis-
embark and take the next following train. The disabled
train will be immediately helped to the nearest termi-
nal, unless otherwise instructed.
Should the forward car of a train become inoperative
requiring the Engineer to operate from other than the
head car, the Conductor must be stationed in the
Engineer’s cab of the first car of the train and from
there, observe signal indications in advance and relay
signal information to the Engineer by means of the
intercom, public address, radio or buzzer system. He
must sound the whistle as required by Rule 156. If the
whistle in the head car does not function, he will also
relay the order to sound the whistle to the Engineer as
appropriate.
No train may move with passengers aboard if more
than 50% of the brakes are cut-out. No train with cut-
out braking may exceed 20 MPH when moved.
Passengers must be discharged at the next station
when this condition occurs. If the head or rear car has
its brakes cut-out, the Conductor must be positioned
in that car and passengers are not permitted in that car.
310. The crew must promptly notify the Trainmaster
or Train Dispatcher/Terminal Supervisor by radio or
60
telephone in case of defects or conditions in the cars
that interfere with the safe operation of trains. When
necessary, the Conductor will, if instructed by
Trainmaster or Train Dispatcher/Terminal Supervisor,
discharge all their customers at the next station,
advising them to take the next train.
311. In case of a delay or interruption of train service,
customers expect, and are to be informed as to the
nature, cause and probable extent of the delay. If the
delay or interruption becomes extended, an announce-
ment is to be rebroadcast at frequent intervals, with
updated information when available, and the
Conductor will walk through the train to assure that all
customers are aware of the situation.
When trains carrying customers are stopped in a
block between stations and there is no immediate
indication of the resumption of train movement,
the Conductor will contact the Trainmaster for
information and instructions and will then inform the
customers. Conductors must not permit customers
to leave cars to walk to a station or emergency exit
except during an extreme emergency or when
directed to do so by the Trainmaster.
312. Should the train crew be directed to evacuate the
train, the crew will remove the stairway and platform
from the Emergency Closet behind the Engineer’s cab
and put it in place to assist customers moving from
the car to the track.
Procedure For Evacuation
1) Determine exit route and receive permission
from the Trainmaster.
2) Apply all hand brakes and confirm power
removal prior to departing train.
3) Install stairs from train to track level.
4) In tunnels, Engineer leads customers from train
to station or emergency exit as directed by the
Trainmaster.
In outside areas, Engineer leads customers from
train to an area of safety or station as directed by the
Trainmaster.
5) Conductor remains on the train and assures all
customers have been evacuated, and follows the last
customer to an area of safety.
61
313. Whenever a train is delayed at a station platform
due to a stoppage ahead, the Conductor will leave the
train doors open to permit any customers who desire
to leave the train to do so. If the car doors have been
closed and the “proceed” signal passed forward
before it is realized that there is a stoppage ahead, the
Conductor must inform the Engineer before opening
the car doors.
314. When resuming train movements after delays of
consequence, Engineers must proceed cautiously and
be alert to the possibility of one or more customers
having gained access to tracks for the purpose of
walking to the station or emergency exit.
315. If power is removed from the power rail while
the train is stopped, Engineers must apply brakes in
full service. If the main reservoir gauge indicates a
drop of air pressure to 90 lbs., the Engineer will
make an emergency application of the brakes and
contact the Conductor to set the hand brakes.
Conductors must at once set hand brakes as tightly
as possible and must not release them until power
has been restored and air compressors have fully
recharged the train. Engineers must not make any
effort to move the train until the Conductor reports
all hand brakes are released.
316. Whenever a train is left standing unattended for
any reason, sufficient hand brakes will be applied to
prevent unwanted movement. Engineers should
fully release air brakes to test that hand brakes are
sufficient. Work train Engineers will test hand
brakes in this manner before removing power.
Hand brakes must be applied first to protect against
movement toward main tracks or, when not practical,
on the downgrade end of the equipment.
Whenever a hand brake is applied, it must be set as
tightly as possible.
If power is removed from the power rail for an
extended or undetermined length of time, the Train
Dispatcher/Terminal Supervisor will instruct staff to
ensure that hand brakes are properly applied on all
cars being stored.
When putting cars in service that have been stand-
ing in locations where hand brakes may have been
62
applied, the train must be charged and air pressures
observed before releasing hand brakes, which must
then be checked to be sure all are released before
movement. If an air test is required before move-
ment, it will also be completed before hand brakes
are released.
317. In moving up to couple to other cars or in
moving up to another car or cars, Engineers or
Engineers/ Switching must come to a full stop at least
ten feet from the standing car or cars, then proceed
with caution using special care to avoid injuring
customers or employees or damaging equipment.
318. Engineers when moving up to bumping blocks
will approach them not exceeding 8 MPH having their
train under control, operating in a manner such that they
are prepared to stop short of the bumping block
or at the appropriate car stop marker.
319. Engineers before leaving their originating
terminal, or when changing operating positions,
must observe that proper pressures are indicated
with the brake valve handle in Full Service (charge)
position as listed in the Operating Instruction
Manual for that equipment.
An air test and standing brake test will be performed
prior to departing a terminal when the train is first “put
in” to service or the consist has changed.
A running test of the brakes must be made as soon as
possible each time an operating position is established
on all trains and yard movements. Conductors and
Engineers must be assured that they have a working
buzzer system or a functioning alternative.
320. Engineers must keep brakes applied on their
trains while standing in a station. The controller must
be left in the OFF position during station dwell while
there is no indication.
321. Engineers must stop their trains at stations at the
proper stop markers. Should a train be stopped short
of or over-run a station, the Engineer must notify the
Trainmaster immediately and must not move his train
until he receives a signal from the Conductor. He must
also operate the door over-ride to prevent the doors
from opening.
63
If necessary to move a train back, the Engineer
must, with the permission of the Trainmaster, go to
the operating cab at other end of train and move it
back, as provided in Rule 256 or Rule 290.
322. Whenever the Engineer leaves the operating cab,
he must take the reverser key with him and close the
cab door and sash window.
323.Whenever there is a sudden application of a train’s
braking system, and the cause can not be immediately
determined: the Engineer will shut off the controller at
once, contact the Control Center immediately, and
attempt to recharge the system. If the train recharges,
the Engineer will proceed with the permission of the
Trainmaster. The Conductor will ascertain that the
Engineer did not make the brake application. Upon
notification that the brake application was not made
from the control compartment, and the Engineer is
unable to re-charge the system, the Conductor will begin
to check all emergency brake valves to determine if any
have been operated.
If an emergency valve has been employed to stop the
train, the Conductor will investigate the reason that the
valve has been activated and advise the Trainmaster of
the situation so appropriate action can be initiated;
e.g., police response, medical assistance, etc.
324. Engineers observing any failure of the door indica-
tion light in their cab will notify the Trainmaster and the
Conductor who will arrange to operate using
buzzer signals.
325. In the event of a door signal indication system
failure after the train doors have been closed and pre-
venting the train from proceeding, the Conductor must
be assured all doors are closed and locked and, upon
such assurance, will give a proceed signal to Engineer
using the buzzer system to communicate.
326. At stations where customers are unloaded from
one side of the train and loaded from the other,
Conductors must leave doors on the unloading side
open until the doors to the loading side have been
opened, otherwise the Engineer may get a proceed
signal in his cab.
64
327. Should a train start when there is a door open,
the Conductor must immediately pull the emergency
valve cord and stop the train.
328. If a door is not operating properly, in addition to
other door regulations, Conductor will place the door
motor switch in the “off” position, make sure door is
closed and locked and, upon such assurance, place
the switch in the “cut-out” position. The Conductor
should then notify the Train Dispatcher/Terminal
Supervisor and also fill out a car defect report.
329. Each car is equipped with a Conductor’s
emergency valve. This valve is equipped with a
handle that gives control of the brakes to the Conductor.
The pulling of this handle opens the valve and
applies the brakes in emergency. This control of the
brake is given to the Conductor for the sole purpose
of preventing accidents and they must not use this
emergency feature except for that purpose. As soon
as the emergency brake application has served its
purpose, the valve must be reset by hand. The
Engineer can then release the brakes in the usual
manner and proceed. Whenever a Conductor uses
the emergency valve, a report must be made to the
Trainmaster immediately.
330. Should the air brakes become ineffective, the
Engineer must notify the Conductor at once and the
Conductor must promptly open the Conductor’s emer-
gency valve. Hand brakes must then be applied to stop
the train and hold the train at the stopped position and
the Trainmaster must be notified immediately.
331. All occurrences or conditions which are likely to
affect electric operation, i.e. arcing, flashing of the
third rail, must be reported immediately to the
Trainmaster.
332. Engineers observing water in the track area will
report as soon as possible to the Trainmaster. If water
level is up to top of running rail, the Engineer must
stop before proceeding through the water and call the
Trainmaster for further instructions.
333. Upon the receipt of a passenger alert indication,
the Engineer will immediately notify the Trainmaster
and the Conductor, who will proceed through the train
and determine the cause. The Engineer will continue to
65
the next station where he will hold until further
instructed. The Conductor will advise the Trainmaster
of the reason for the alarm and any action that needs
to be taken.
334. When operating a Locomotive, sand must not be
used over switches or rail lubricators. Excessive use of
sand is prohibited.
335. Hi-Rail Vehicles and PATH self-propelled
vehicles may not shunt when moving along PATH
tracks. Pilots assigned to these vehicles and Tower
Operators must be governed by the rules for
Movement By Absolute Block.
336. Cars or trains operating on yard or shop tracks
must proceed expecting to find them occupied.
337. Unless otherwise directed by the Train
Dispatcher/Terminal Supervisor or Yard Supervisor,
cars must not be left standing on yard tracks to foul
adjoining tracks.
338. When moving cars into shop tracks, they must
come to a full stop before entering the shop building.
339. In Harrison Shop and Yard, where movements of
cars without operative air brakes or motive power are
required, the following rules will be observed:
• One dead car, or car without operative
brakes, is to be picked up by at least two live
cars with operative brakes.
• Two dead cars, or cars without operative air
brakes, are to be picked up by at least four
live cars with operative air brakes.
• Three dead cars, or cars without operative
air brakes, are to be picked up by at least five
live cars with operative air brakes. No more
than three dead cars (except by a locomo-
tive), or cars without operative brakes are to
be picked up except under orders from the
Superintendent of Transportation.
The Yard Supervisor must inform Engineers/Switching
when these conditions exist.
The term “picked up” is defined to mean a coupling of
cars. When the car or cars being picked up will not
have the air brakes in service, an electric portion of the
couplers must be retrieved at the coupling location.
66
Under these conditions, the Engineer or
Engineer/Switching should operate in a forward
direction from the front cab of the first car permitting
such operation, and extreme caution must be used.
When operating longer than normal consists (more
than 8 cars), Engineers and Engineers/Switching will
conduct a running brake test before approaching a
forward train, work site, bumping block, or other
device to ensure a complete stop can be made.
Engineers and Engineers/Switching must operate
such consists with caution at reduced speeds to
permit them to stop safely.
Engineers and Engineers/Switching are responsible
to insure that yard trains can be stopped safely.
MOVEMENT BY TRAIN ORDERS

400. Train Orders will be issued for the following
reasons:
a) For movement of work trains, self-propelled
vehicles and Hi-Rail Vehicles to work sites.
b) To identify the limits of work rights of any
work equipment.
Train Orders will be written and issued by authority
of the Superintendent of Transportation. They must
be brief and clear, on the prescribed forms when
applicable, and without erasure or alteration.
401. Train Orders must contain the following informa-
tion at a minimum:
a) Date and Train Order number
b) Identification of the train or vehicle
c) Persons to whom the order is to be
addressed
d) Present location of equipment
e) Route to destination, specifying tunnel or
track letters when operating against the
normal current of traffic.
f) Limits of work rights
g) Special protective measures, if any
402. Train orders must be numbered consecutively,
each day, beginning at Midnight.
403. Train orders must be addressed to those who are
to execute them, naming the place at which each is to
67
receive his copy. Orders for a train must be addressed
to the Conductor and Engineer. A copy must be pre-
pared for each employee addressed. Orders addressed
to a Tower Operator or Supervisor restricting the move-
ment of trains must be accepted by Conductors and
Engineers the same as if it was addressed to them.
404. A copy of each Train Order must be maintained in
a book provided for the purpose in the Control Center
and include the recorded time, by whom repeated and
the Trainmaster’s initials. These records must be made
at once and never from memory. Verbal changes
to Train Orders must be made over a taped
communication device and must be repeated correctly
and noted on the written order.
405. In preparing train orders, regular trains will be
designated by schedule and number of Operating Car,
such as: Nwk 7:07 Operating Car 875. Extra trains will
be designated by operating car number and directions,
such as: 7:15 Journal Square Gap to World Trade
Center Operating Car 865.
In transmitting Train Orders, names of stations and
numerals in the body of the order must first be
plainly pronounced.
406. A Train Order to be sent to two or more locations
must be transmitted simultaneously to as many of
them as practical.
407. “Complete” must not be given to a Train Order
for delivery to a train until the order has been repeat-
ed correctly by all parties addressed.
If the means of communication fails before an order
has been repeated, the order is of no effect and must
be treated as if it had not been sent.
408. An employee must not repeat or accept a time
“complete” of a Train Order for a train which has
passed beyond his jurisdiction.
409. When issuing a Train Order by telephone or radio
to a train, the Trainmaster or other employee involved,
must transmit to the Conductor or other employee
addressed, the complete Train Order, except that he
will not give the “time complete” until the employee
receiving the order has repeated it correctly. The order
must be recorded by the employee transmitting it and
he must show the name of the person to whom deliv-
ered and the time on the order.
68
• Written Train Orders shall be read back to the
Trainmaster and a Time Complete issued.
Written Train Orders may be amended ver-
bally by the Trainmaster over the Train/way-
side Radio.
• Verbal Authority may be issued for all other
movements of trains with proper signals and
when moving a train against the established
direction of traffic.
410. For delivery of a Train Order directly to a train,
the employee who is to make the delivery must
arrange with the Tower Operator to display a STOP
indication on the interlocking signal where the order
is to be delivered. This signal must remain at STOP
until assurance is received that the order has been
delivered.
411. Train Orders, once in effect, continue so until ful-
filled, superseded or annulled.
412. Train Orders issued for a regular or extra train
become void when such train is annulled.
413. When a Conductor and/or Engineer are relieved,
all Train Orders held must be delivered to the relieving
Conductor and/or Engineer who must compare them
before proceeding.
414. Train Orders must be written or verbally trans-
mitted over taped communications devices.
415. Written Train Orders will be used for Work
Trains, self propelled and Hi-Rail Vehicles. These
orders constitute authority to move to a work site and
to identify those work rights, but does NOT authorize
movement though any interlocking in those work
rights (this does not pertain to interlockings that are
out of service). Fixed signals at each interlocking will
govern movement through interlockings. Each Order
will be numbered consecutively starting at midnight
and addressed to both the Engineer and Conductor
EXAMPLE
Flat 27 and motors, run extra from Journal Square
to Signal R4X in Tunnel “H”. Crossover to Tunnel
“G” and run against traffic from Grove Street to
Hoboken in Tunnels G, K, F, B. Load men and
69
material and run extra to 33rd St. Run extra to
Signal 130Z in Tunnel “A”. Work extra between
Signal 130Z and Flat 21 in Tunnel “A”. Protect
against movements of Flat 21, who has rights
between your Flat and Signal R28X in Tunnel “A”.
Call for orders not later than 5:15 AM.
MOVEMENT BY VERBAL AUTHORITY

416.Verbal authority to permit a movement against the
established direction of traffic will be issued as
follows:
a) Issue a hold at the controlling point and
identify the last train moving with the current
of traffic.
b) In reverse order, the Trainmaster may begin
to move trains against the established
direction of traffic.
417. Verbal authority may also be issued by the
Trainmaster in a similar manner in the assisting of a
disabled train.
418. Whenever verbal authority is used, it must be
fully understood and acknowledged by the individuals
receiving the authorization.
419. Tower Operators must place Blocking Devices
after receiving a “hold” to prevent the use of those
levers or buttons that may conflict with the “hold.”
Blocking devices must also be used on the appropri-
ate levers or buttons when taking tracks or switches
“out of service.” Whenever Blocking devices are
applied or removed, the information must be recorded
on the “Record of Blocking Device Protection” form.
MOVEMENT BY ABSOLUTE BLOCK

420. Trains operating without Pilot Valve or Automatic
Train Stop protection in the head car must not enter
any block protected by a fixed signal displaying an
aspect more restrictive than “Permissive” without per-
mission from the Trainmaster. The Trainmaster must
not give permission until assured that the block is
clear of other equipment.
421. When moving equipment that does not
properly shunt signal circuits for any reason, trains
70
following must be held at interlockings until the
non-shunting equipment ahead has called clear of
the next interlocking.
422. Tower Operators must attempt to set a route
through interlockings for non-shunting equipment.
Once set, the affected buttons or levers must not be
operated further until the equipment is reported
clear of the interlocking.
423. Pilots on non-shunting equipment must report
each time their equipment leaves Interlocking Limits.
RULES FOR THE PROTECTION OF EMPLOYEES

IN TRACK AREAS
500. No employee may enter a track area except in the
performance of duty. Employees must request and
receive permission from the Trainmaster prior to
entering the track area. Upon clearing the track area,
employees are required to report clear. When track
work limits are established, permission will come from
the Employee In Charge. The Trainmaster will record
each instance that a track is taken out of service.
Once the Trainmaster has given permission to enter
or work in a track area, he may not allow any train or
maintenance equipment to move against traffic into
the area without permission of the Employee In
Charge.
The Trainmaster will notify trains en route of the pres-
ence of the work gang or lone worker. The Trainmaster
will also notify the Train Dispatcher/Terminal
Supervisors, who will notify train crews that have not
departed their terminals. Upon notification that
workers are clear of the track, the Trainmaster will like-
wise notify train crews en route and Train
Dispatcher/Terminal Supervisors.
501. Employees in the track area must take every pre-
caution to protect themselves and others working with
them. They are required to understand the type of on-
track protection that is in place. They are required to
understand and follow all procedures contained in the
PATH On-Track Safety Program. They have the right to
challenge, in good faith, any directive that would vio-
late an On-Track Safety or Operating Rule.
71
All employees assigned to work in track areas must
be trained and qualified on PATH flagging rules and
procedures. Employee qualification cards must be
presented on demand by any Employee In Charge,
PATH Supervisor or FRA representative.
Employees are not permitted to enter, move through

or work in “No Clearance” areas unless the track is
taken out of service in accordance with Rule 504.
Employees will be considered “adjacent” to track
when they are within ten feet of the near running
rail. Employees who work adjacent to live tracks
shall provide adjacent track protection.
502. Flags and/or lamps and portable train stops,

when used, will be placed in the following manner:
• Green and yellow flags/lamps are to be
placed on the side of the approaching
Engineer’s cab, 2 feet to the right of the rail-
road tie and 4 feet high. Flags/lamps must
not be placed in such a manner as to
obscure other signals.
• Red flags/lamps are to be placed between
the running rails.
• Portable train stops will be clamped to the
outside of the running rail on the side
opposite the approaching Engineer’s cab.
503. Distances given by the diagrams in this section
for the placement of red and yellow flags/lamps are the
recommended minimum distances and will be
increased as conditions require due to visibility or track
conditions that would increase a train’s stopping dis-
tance in order to maintain adequate advance warning.
Adequate advance warning is such that an Engineer
operating a train at the maximum authorized speed
has sufficient distance to bring the train to a stop
before reaching the work site.
504. When it is necessary to remove a track from
service due to an emergency, unexpected event or in
the case of a quick repair or other reason of short
duration, the Trainmaster may issue Foul Time to an
employee by holding all trains clear of the defined
area of track until the employee reports clear of the
track area and releases foul time.
72
The employee receiving Foul Time must repeat the
track letter or number, track limit and time limit back
to the Trainmaster.
Rules for Lone Workers in the Track Area

505. Before beginning work, the Lone worker must
fill out Form TH-4649, Lone Worker Individual Train
Detection Statement of On Track Safety and must
confer with his supervisor, or other designated
employee, to receive instructions and inform of his
itinerary.
506. The Lone Worker may not foul any track except
under the following conditions:
• The individual must have clear vision of
approaching trains moving at authorized
speed on that track for a sufficient distance
that he may move to a previously determined
place of safety not less than 15 seconds
before the train would reach his location.
• The place of safety may not be on another
active track.
• The ability of the lone worker to hear and
see approaching trains is not impaired by
background noise, power operated tools or
roadway maintenance machines, lights, pre-
cipitation, fog, passing trains or any other
physical condition.
• The Lone Worker may only engage in
inspection or minor correction activity that
does not interfere with his ability to main-
tain a vigilant lookout for and detect the
approach of trains from either direction.
• A Lone Worker may not work in any active
interlocking.
507. If any condition interferes with a Lone Worker’s
ability to work as per Rule 506, he must remain clear
of the track until the condition is remedied or until he
has established working limits on the track according
to Rule 504.
73
Rules for Work Groups
508. All work groups must have a designated
Employee In Charge of Worker Protection. The
Employee In Charge is responsible for providing
worker on-track safety. The Employee In Charge must
conduct a job briefing prior to starting any work that will
foul a track. The job briefing must include a descrip-
tion of all protection on working and adjacent tracks
and must identify Gang Watchmen and/or Flagmen. All
workers must acknowledge that they understand the
on-track protection.
Each Watchman or Flagman must be equipped with
the necessary equipment to post the appropriate
flags/lamps and portable train stops. They must
have spare bulbs and batteries and, when appropri-
ate, 4 ft. poles for posting yellow and green
flags/lamps. Watchmen will carry a radio when
required.
509. All work groups on or adjacent to track in serv-
ice must have at least one Gang Watchman designat-
ed by The Employee In Charge. The Employee In
Charge may also act as Watchman in a gang of up to
4 people in accordance with Rule 510. If an adjacent
track is to be used in both directions and a single
Watchman is protecting it, he must be able to comply
with Rule 510 in both directions.
510.The Watchman must be in a position to observe
both the work gang and approaching trains and must
give warning in adequate time to clear all workers to a
safe location not less than 15 seconds before a train,
moving at maximum authorized speed, will reach the
location. Warning must be given in a distinctive and
clear manner.
Watchmen and Flagmen must give their entire atten-
tion to watching for trains and signaling to trains in
accordance with Rules 150, 151 and 152. They are
prohibited from performing, even momentarily,
other duties. They may not leave their post until
properly relieved. They must be identified to all
members of the work gang by the Employee In
Charge.
74
No condition may exist that would interfere with the
Watchman’s or Flagman’s ability to hear and see
approaching trains and alert the work gang.
511. On the approach of a train, the Watchman shall
provide train approach warning to workers verbally, or
by sounding a whistle or air horn and raising a white
disk or lamp above his head as appropriate for the
working conditions.
When the gang is clear of the tracks, he will signal
the train by hand or flashlight to proceed. The
Engineer must acknowledge the signal according to
Rule 156 (b).
If the gang does not clear the track promptly, the
Watchman must immediately signal the train to stop
by hand, flag or flashlight.
The gang shall not return to work until the
Watchman has signaled to the work gang that it is
safe to return to work. When the watchman is using
a white disk, the signal shall be by holding the disk
or lamp at arm’s length away from his body (arm
parallel to the ground) towards the work area.
512. When work has been completed or suspended,
or a track is returned to service, the Employee In
Charge must take the following steps:
• He must insure that all workers, tools and
materials are clear of the track area.
• He must advise the Trainmaster of any
restrictions on the movement of trains
through the area.
• If a restriction is placed on the track, he
must see that signs are placed in accor-
dance with Rule 228.
• He must see that flags placed for protection
are removed in proper order.
• He must advise the Trainmaster that all men
and materials are clear and the track is in
service.
513. All trains or roadway maintenance machines
moving within working limits will move at Restricted
Speed unless, except on inaccessible track, the
Employee In Charge authorizes a higher speed.
75
Roadway maintenance machines shall operate in
accordance with the Maximum Speed Table.
Rules for Minor Work on or Adjacent to

Unobstructed Track
514. The Employee In Charge will establish a work
area using Train Approach Warning by Watchman and
so note on his Track Occupancy Form. The form will
be read back to the Trainmaster for verification.
515. Employees performing inspections or minor
work without a fixed work site are not required to set
out flags/lamps in the performance of their duties,
however, they must be alert to the movement of trains
from either direction and must ensure that a safe
clearance area is available at all times.
516. All employees working in a fixed area on or adja-
cent to tracks will set out two yellow flags/lamps to
alert of their presence in the area as per Diagram #1.
A green flag/lamp will be set out the length of the
longest train past the work site. If the track is to be
used in both directions, flags/lamps will be set for both
directions as per Diagram #2.
517. The gang may not perform any work or cause
any condition that will obstruct the track or prevent the
track being cleared at least 15 seconds before any
train would reach that location.
518. Engineers observing two yellow flags displayed
on the right of their track must immediately reduce
speed to 15 MPH and sound the horn in accordance
with Rule 156(g) to acknowledge the approach to
workers in the track area. Normal speed may be
resumed when the operating cab passes a green flag.
519. Once work has stopped and the gang has cleared
the track, the Watchman will remove the yellow
flags/lamps before removing the green flag/lamp.
76
Diagram 1
77
Diagram 2
78
Rules for Major Work on In-Service
Obstructed Track
520. For major work on in-service, obstructed track,
the Employee In Charge must use Exclusive Track
Occupancy to establish work limits. A TH-4649, Track
Occupancy Form will be filled out upon receiving work
limits from the Trainmaster and will be read back to
him for verification.
521. In addition to an Employee In Charge and Gang
Watchmen, there will be designated at least one
Flagman to prevent trains from entering a work area
until an “All Clear” has been received from the
Watchman. The Gang Watchman will be stationed at a
suitable point between the Flagman and the work site
and will relay signals between the gang and Flagman.
See Diagrams #3 and #4.
522. Prior to the start of work, flagging protection
must be placed as follows:
• If train operations are in one direction only,
flagging protection will be in accordance with
Diagram #3.
• If train operations are in both directions,
flagging protection will be in accordance
with Diagram #4. A Flagman and Watchman
will be provided for each direction.
• Adjacent tracks will be flagged the same as
unobstructed work areas as per Diagram #5.
523. Engineers observing one yellow flag displayed to
the right of their track:
• Will sound the train whistle in accordance
with Rule 156 (g) and approach the Flagman
at 8 MPH. If the view ahead is obscured, the
Engineer must repeat sounding the horn
according to Rule 156 (g) until he observes
a hand signal from the Flagman.
• The Flagman will sound several long blasts
on the whistle/horn to warn the gang and
will give the approaching train a stop signal.
• The Engineer will acknowledge the stop sig-
nal in accordance with Rule 156 (b).
79
Diagram 3
80
Diagram 4
81
Diagram 5
82
• The Gang Watchman will ensure the track is
clear of workers and is unobstructed before
giving an “All Clear” signal to the Flagman.
• When the Flagman receives an “All Clear”
signal from the Gang Watchman, he will
remove the red flags and portable train stop
and give a “Proceed” signal to the Engineer.
• The Engineer will acknowledge the hand sig-
nal according to Rule 156 (b) and proceed at
8 MPH. Normal speed may be resumed
when the operating cab passes a green flag.
524. If it appears that an approaching train may not
stop before reaching the Flagman, the Flagman will
move to a position of safety, leave the red flags/lamps
in the center of the track and the portable train stop in
the tripping position and sound a succession of short
blasts on the whistle/horn to warn the gang that the
train did not stop at the flagging location.
525. Once work has stopped and the gang has cleared
the track, the Flagman will remove the red flags/lamps
and portable train stop, then the Watchman will
remove the yellow flag/lamp before removing the
green flag/lamp.
83
Work Gangs on an Out Of Service Track
526. The Employee In Charge must establish work lim-
its. Working limits can be established by Exclusive
Track Occupancy or by Train Coordination. Train
Coordination is used when a pilot or work train crew
member can provide a train order with work limits
established and a copy of the train order is given to the
Employee In Charge. The Employee In Charge must
read back the section regarding work limits to the
Trainmaster and fill out a Track Occupancy Form.
The crew member turning over his rights to an
Employee In Charge can not call for orders to leave
the work limits without the work limits being
returned to him by the Employee In Charge.
On track not controlled by the Trainmaster, the EIC
may also use Inaccessible Track.
527. When an out of service track section can be pro-
tected by interlocking signals, the Trainmaster will
instruct the appropriate Tower Operator to place a
blocking device on the lever or button that will prevent
a train from entering an out of service section. The
Tower Operator will fill out the “Blocking Device
Protection Form” whenever a blocking device is
applied or removed. When the out of service track is
protected by an interlocking signal that has an auto-
matic train stop associated with that signal, than a
portable train stop is not required.
528. Prior to the start of work, red flags/lamps and a
portable train stop must be placed at each entrance to
the working limits in one of the following manners
(See Diagrams #6 & #7):
• When not protected by Rule 527, working
limits will be established a sufficient distance
from the work area to prevent damage or
injury from a run-through.
• When working on out of service track with
power removed, the working limits must be
located at a power rail gap to prevent bridging.
529. Adjacent tracks will be protected for each direc-
tion of operation in the same manner as unobstructed
work areas as per Diagram #7 and Rule 510.
84
Diagram 6
85
Diagram 7
86
Removing traction power from a work site
(non-emergency)
530. The following procedure will be used to remove
power at a work site:
• The Employee In Charge will identify to the
Trainmaster the Power Railman or other
employee at the site who will coordinate the
removal of power.
• The Power Railman will place red flags/lamps
as per Rule 528.
• The Power Railman will request permission
from the Trainmaster to remove power on
the affected track.
• The Trainmaster assures that the affected
section is out of service and in compliance
with Rule 528.
• After receiving the Trainmaster’s permis-
sion, the Power Railman will contact the
Power Director and request the power be
removed from the affected section.
• The Power Director will request permission
from the Trainmaster to proceed with the
removal.
• Upon receipt of permission, the Power
Director may remove power and notify the
Power Railman that power is off. The Power
Railman must test and confirm power is off
and advise the Power Director.
• The Power Railman will advise the
Employee In Charge that the power has been
removed, tested and confirmed.
• The Trainmaster, Tower Operators and Train
Dispatcher/Terminal Supervisors will record
all power removals and restorations in the
appropriate log books.
531. The Trainmaster must know the location of all
trains on the system to ensure there is no bridging
between power sections. Special attention must be
exercised when operating trains with jumpers.
87
When train operations and work rights permit, the
Trainmaster will protect power off work areas addi-
tionally by having power removed from adjacent
power sections.
Procedure For Restoration Of Traction Power
532.When the Employee In Charge of a work site is
ready to restore power, he will notify the Power
Railman who removed the power to initiate the
restoration process:
• The Power Railman assures that all men and
material are clear of the power rail. He then
instructs the Employee In Charge that the
power rail should be considered live.
• The Power Railman calls the Power Director,
requesting the restoration of power to that
section.
• The Power Director requests approval from
the Trainmaster, stating the Power
Railman’s name and requested location.
• The Trainmaster ensures that the request is
valid and that no other work conflicts with
the restoration, then gives approval to the
Power Director.
• The Power Director restores power and
notifies the Power Railman of the restora-
tion.
• The Power Railman tests and confirms
power restoration and advises the Power
Director that power has been restored and
removes red flags/lamps and portable train
stops.
88
Rules For The Protection Of Employees
Working On Car Equipment
550.A blue flag or lamp must be displayed at one or
both ends of a car or train when workers are on, under
or between cars. A blue signal must be attached to the
controls of the head car of a train. When cars are thus
protected, they must not be coupled to or moved.
Only the workmen who display these signals are
authorized to remove them.
In emergency cases where blue flags or lamps are
not available, employees are prohibited from going
under or about service trains or cars without first
contacting the Engineer and establishing that he
must not move the equipment until released to him.
551. Blue signals must be placed on each track
accessing protected car equipment in one of the fol-
lowing manners:
• At the controlled switch leading to the track
and lined against entry. The Tower Operator
must be notified and a blocking device
applied to the switch lever and noted in the
appropriate log. The blocking device may
not be removed without permission of the
Employee In Charge.
• At a manual switch leading to the track and
lined against entry where an Effective
Securing Device has been applied.
• Not less than fifty feet in advance of the pro-
tected equipment on servicing tracks where
the speed limit is not greater than 5 MPH. A
derail with an Effective Securing Device will
be used in conjunction with the blue signal.
552. Other cars must not be placed on the same track
so as to obstruct the view of the blue signal without
first notifying the workers.
553. No train or rolling equipment may pass a blue
signal.
89
RULES FOR THE USE OF RADIO AND TELEPHONE
SYSTEMS
600.DEFINITION
A railroad radio communication system is one
employing radio for the transmission of information
between moving equipment and a fixed point,
between two or more fixed points and/or between
employees provided with portable radio equipment.
601. Radios are under the jurisdiction of the Federal
Communications Commission (FCC). PATH and its
employees are governed by the rules of the FCC and
can be held liable for violations of Federal Regulations.
602. Radio and telephone systems are used to facili-
tate communications in the conduct of transportation
and in the failure of such communications, other
means must be used to avoid delay and ensure safety.
603. Any employee shall permit inspection of the
radio equipment in his charge, and all FCC documents
pertaining thereto, by a duly accredited representative
of the FCC at any reasonable time.
604. All employees, except those specifically author-
ized to do so, are prohibited from making any techni-
cal adjustment to a railroad radio set. When a radio set
is not operating properly the fact must be reported to
the appropriate Supervisor, Train Dispatcher/Terminal
Supervisor or Trainmaster as soon as possible.
605. Employees must ensure being in communication
with proper persons and must not take action until
certain that all conversation concerning them has been
heard, understood, acknowledged and completed.
606. All verbal or written instructions affecting the
movement of trains, or involving equipment or track
conditions, must be read back by employees receiving
them.
607. Trains will be identified by departing terminal and
scheduled departure time in minutes. AM or PM
should not be considered (e.g. “PATH control, this is
Journal Square 47 - over”). When more than one serv-
ice is operated from a terminal, the name of the desti-
nation terminal will be added (e.g. “PATH Control, this
is Hoboken 59 to World Trade Center - over”). Other
90
details and examples of the proper wording of radio
messages and instructions covering who is authorized
to use train radios will be issued over the signature of
the Superintendent of Transportation.
608. No employee shall knowingly transmit any false
distress communication, any unnecessary, irrelevant
or unidentified communication nor utter any obscene,
indecent or profane language via radio.
609. A distress call will be preceded by the word
“Emergency” repeated three times. Such calls shall be
made only to cover initial reports of derailments,
washouts, fires, obstructions to tracks or other mat-
ters which could cause serious delays to traffic, dam-
age to property, injury to employees or the traveling
public and shall contain as much information as pos-
sible.
All employees shall give absolute priority to distress
communications and, except in answering or aiding,
shall refrain from sending any communications until
there is assurance that no interference will result to
the distress call.
610. No employee shall divulge or publish the exis-
tence, contents, purpose, effect or meaning of com-
munications (distress communications excluded)
except to the person for whom the communication is
intended, or to another employee of the railroad whose
duties may require knowledge of the communication.
The above applies to communications received
direct or any that may be intercepted.
611. All radio users must confine their communica-
tions to PATH business. Unnecessary or non-relevant
radio transmissions are prohibited.
Radio transmissions should be kept as brief as pos-
sible.
91
REQUIREMENTS OF THE HOURS OF
SERVICE LAW
700. Employees whose legal hours of service are
restricted by law must take action through the proper
officer to avoid excess periods of service. They must
keep an accurate log of their hours.
No employee engaged in train, engine or signal serv-
ice may be required or permitted to work in excess
of twelve (12) consecutive hours. After working a
full twelve consecutive hours, an employee must be
given at least ten (10) consecutive hours off duty
before being permitted to return to work.
No employee engaged in train, engine or signal
service may be required or permitted to continue on
duty or go on duty unless he has had at least eight
consecutive hours off duty within the preceding
twenty four hours.
When an employee’s work tour is broken or inter-
upted by a valid period of interim release (four (4)
hours or more at a designated terminal), he may
return to duty for the balance of the total 12 hours
work tour during a 24-hour period.
After completing the 12 hours of broken duty, or at
the end of the 24-hour period, whichever occurs
first, the employee may not be required or permitted
to continue on duty or to go on duty until he has had
at least 8 consecutive hours off duty.
The 24-hour period referred to in the above two
paragraphs shall begin upon the commencement of
a work tour by the employee immediately after his
having received an off-duty period of 8 or l0 hours
as appropriate.
Any such employee who may be ordered to report
for duty before his legal rest period has expired
must report the fact to the Trainmaster (train or
engine service) or Signal Supervisor (signal service)
before going on duty.
Any such employee when he has been on duty for 10
hours consecutively must notify the Trainmaster
(train or engine service) or Signal Supervisor (signal
service) as to when he will attain 12 hours.
92
In determining the number of hours an employee is
on duty, there shall be counted, in addition to the
time such employee is actually engaged in or con-
nected with the movement of any train, all time on
duty in other service performed for the common
carrier during the twenty-four hour period involved.
701. No Tower Operator, Train Dispatcher/Terminal
Supervisor, Trainmaster, or Assistant Trainmaster, or
other employee who by the use of the telephone, radio
or any other electrical or mechanical device dispatch-
es, reports, transmits, receives or delivers orders per-
taining to or affecting train movements shall be
required or permitted to be or remain on duty for more
than nine (9) hours, whether consecutive or in the
aggregate in any twenty-four hour period.
In determining the number of hours an employee is
on duty in such service, all time on duty in other
service performed for the carrier during the twenty-
four hour period involved shall be counted.
93
DUTIES AND RESPONSIBILITIES
TRANSPORTATION DIVISION
TRAINMASTER
800. The Trainmaster reports to and receives instruc-
tions from the Superintendent of Transportation and
the Coordinator of Rail Operations. The Trainmaster
supervises the operation of the railroad on his tour and
represents the Superintendent of Transportation
during his absence, performs duties as directed by the
Superintendent and issues such train orders as are
necessary over the signature of the Superintendent.
He must assure that all Rules and Regulations
concerning train operation are fully understood and
observed.
He must promptly report to the Superintendent all
violations of rules and anything that may come
under his observation which may interfere with the
prompt and safe operation of the railroad.
In case of accident or serious detention to trains, the
Trainmaster will assist in removing the cause as
described in the PATH Emergency Procedures
Manual. He must assure that every precaution is
taken to ensure the safety of employees, customers
and property.
CHIEF OPERATIONS EXAMINER AND ASSISTANT

TRAINMASTER/OPERATIONS EXAMINER
801. The Chief Operations Examiner and Assistant
Trainmaster/Operations Examiner report to and
receive instructions from the Superintendent of
Transportation Division and the Coordinator of Rail
Operations. They supervise the performance and
qualification of Transportation Division employees.
They are responsible for the development, coordina-
tion and implementation of qualification and training
programs for Transportation Division employees.
They see that train operations are in accordance with
established schedules and procedures and investi-
gate Book of Rules infractions. They investigate all
94
accidents involving train operations and report their
findings to the Superintendent of Transportation.
When working the Control Center, they will assist,
and perform the duties of, the Trainmaster under his
direct supervision.
TRAIN DISPATCHER/TERMINAL SUPERVISOR

802. Train Dispatcher/Terminal Supervisors report to
and receive instructions from the Trainmaster and
Assistant Trainmaster and Operations Examiners.
They may also receive instructions from the
Operations Analyst and the Yardmaster. They super-
vise the yard and stations where trains are made up,
the movement of trains through their terminal and the
employees assigned to their terminal. They are
responsible for the prompt and proper dispatch of
trains and for maintaining the on-time performance of
the PATH operating schedule. They must notify the
Trainmaster quickly of problems that may delay the
operating schedule.
They must see that all Transportation Division
employees within their terminal are fit for duty at the
prescribed time. Any unfit employee must not be
permitted to work and must be reported immediate-
ly to the Trainmaster.
They are responsible for maintaining the employee
bulletin boards within their terminal, for notifying
operating crews of all special circumstances and
restrictions, for proper distribution and mainte-
nance of employee pay checks and for the proper
handling of lost property.
TOWER OPERATORS
803. Tower Operators report to and receive instruc-
tions from the Trainmaster, Assistant Trainmaster,
Operations Examiners and Train Dispatchers/Terminal
Supervisors. They are in charge of the operation of the
interlocking machine and are responsible for the oper-
ation of switches and signals in their charge. They
must obey all orders of their superiors in relation to
the operation of switches and signals and the
movement of trains provided they do not conflict with
the rules.
95
They are required to be constantly on duty during
the hours assigned them. They must not leave their
posts until properly relieved, and those going off
duty must inform those taking their place regarding
unfinished business and the location of trains, as
well as any nonstandard alignment of signals and
switches. They must ensure the proper identification
of trains for the PATHVision system.
They must be alert to approaching trains at all times
and wherever possible they must see that interlock-
ing signals are displayed sufficiently in advance to
avoid delay.
They must not make or permit any unauthorized
repairs, alterations or additions to the plant.
Unauthorized persons must not be permitted to
enter Interlocking Towers.
Interlocking Towers and Control machines must be
kept in a clean and orderly condition and entirely
free from all matter not pertaining to the business of
the PATH Corporation.
They are required to complete all forms necessary to
record power removal & restoration and tracks
removed and returned to service.
YARDMASTER
804. The Yardmaster reports to and receives instruc-
tions from the Superintendent of Transportation and
the Coordinator of Rail Operations. The Yardmaster
supervises yard and terminal operations which affect
the efficient movement of trains to, from and within
car maintenance facilities. The Yardmaster coordi-
nates the number of cars required by Car Equipment
Division for routine repair and maintenance and for
special maintenance and repair programs to optimize
the number of cars available for peak period service.
ENGINEERS
805. Engineers report to and receive instructions
from the Trainmaster, Assistant Trainmaster,
Operations Examiners and Train Dispatcher/Terminal
Supervisors.
96
Engineers are under the orders of Conductors in
regard to general train movement between termi-
nals, but they must not obey any order that may
endanger the safety of the train or require a violation
of the rules.
Engineers are responsible for operating their trains
in compliance with the PATH operating schedule.
Engineers must exercise discretion, care and vigi-
lance in moving trains or cars, using necessary pre-
cautions to prevent damage to property and injuries
to persons and to avoid collisions and derailments.
Engineers must thoroughly understand the opera-
tion of the mechanical, electrical and airbrake equip-
ment on the cars and must be familiar with and fol-
low procedures contained in Operation Instruction
Manuals.
Engineers are required to carry the proper equip-
ment when operating trains, including brake handle,
reverser key, cutting key, flashlight and safety vest.
Engineers shall wear the proper uniform while on
duty and it shall be maintained to present a neat and
clean appearance.
Engineers must report promptly to the Conductor
any defect in the equipment and make a written
report on the prescribed form before completion of
their tour.
Engineers must be in their operating cab, ready to
proceed, no less than one minute before leaving
time. The Engineer’s cab door must be kept closed
while the train is in transit. Engineers must be
vigilant in the performance of their duties and are
not permitted to bring newspapers, magazines,
books, radios or other similar electronic devices, food,
beverage containers or other items into the
Engineer’s cab.
Engineers must not permit any person to ride in the
operating cab without written order from the
Superintendent of Transportation, except Operations
Examiners and Car Inspectors in the performance of
their duties or persons authorized to do so for the
purpose of learning the road.
97
Engineers are required to personally perform their
duties and under no circumstances will they allow
anyone to perform any of their duties except those
persons authorized to do so for the purpose of
learning the road.
Engineers must give their badge number to any cus-
tomer upon request without delay or argument.
Smoking is prohibited in the Engineer’s cab and any
other place on the train or in stations.
Engineers must make a complete report when so
ordered of any unusual occurrences to their train,
giving full particulars using the prescribed Unusual
Occurrence form. The report must be sent to the
Superintendent of Transportation before completion
of their tour.
Engineers must inspect their cab, including cab
seats, prior to operating their train.
Engineers must comply with Rules & Regulations of
the Federal Railroad Administration and PATH per-
taining to Qualifications for Locomotive Operators.
YARD SUPERVISOR AND ENGINEER/SWITCHING

806. Yard Supervisors and Engineers/Switching
report to and receive instructions from the
Trainmaster, Yardmaster, Assistant Trainmaster,
Operations Examiner and Train Dispatcher/Terminal
Supervisor.
They are under the supervision of the Train
Dispatcher/Terminal Supervisor at the point where
they are assigned to duty, and must obey all orders
in relation to the moving of cars given by the
Dispatcher or Supervisor in the Yard or at the point
at which they may be on duty.
When operating trains, they are governed by rules
for Engineers.
They must report to the Train Dispatcher or Yard
Supervisor on duty at the point to which they are
assigned and during the hours of duty must not
leave their posts without permission from the Train
Dispatcher or Yard Supervisor.
They must be familiar with and follow procedures
contained in Operating Instruction Manuals.
98
They must make a complete report when so ordered
of any unusual occurrence to their train, giving full
particulars and using the prescribed Unusual
Occurrence form. This report must be sent to the
Superintendent of Transportation before completion
of their tour.
No Engineer/Switching may attempt to couple cars
until he has first examined the coupling apparatus
and found that it is in proper condition. If any appli-
ance or part appears to be defective he must report
it to the proper authority. All electrical and air con-
nections are considered a part of the coupling appa-
ratus.
Yard Supervisors must see that the Engineers/
Switching under their supervision are fit for duty.
The Yard Supervisor is responsible for knowing that
the Engineers/Switching understand and obey the
rules that apply to them.
CONDUCTORS
807. Conductors report to and receive instructions
from the Trainmaster, Assistant Trainmaster,
Operations Examiners and Train Dispatcher/Terminal
Supervisor.
Conductors are responsible for the safety and prop-
er care of their trains, for the conduct of the crew
and for their attention to the rules. They must see
that their trains are kept on schedule time and that
the proper station stops are made.
Before leaving a terminal or yard, they must inform
their Engineer as to the number of cars in the train.
They must see that proper destination lights and
signs are displayed.
Conductors must see that all zone switches on their
train are set in proper position before leaving the ter-
minal. They must see that the front door of the first
car and the rear door of the last car are kept locked.
They will be responsible for the proper function of
heat, lights and air conditioning on their
train. Conductors must be familiar with and follow
procedures contained in Operating Instruction
Manuals. The normal Conductor’s operating posi-
tion is in the first and second car.
99
Conductors are required to personally perform their
duties and under no circumstances will they allow
anyone to perform any of their duties except per-
sons authorized to do so for the purpose of learn-
ing the road.
Conductors must be at their position on trains, ready
to proceed, no less than one minute before leaving
time.
Conductors shall wear the proper uniform while on
duty and it shall be maintained to present a neat and
clean appearance.
Conductors must not leave their posts while train is
in transit except in the performance of their duties.
They must have a flashlight and safety vest available
for emergency use.
Conductors must announce clearly and distinctly
over the public address system the destination of
the train and advise customers to please step back
and avoid the closing doors before closing the
doors at each station. The name of the next station
must be announced as soon as the train starts and
again when it arrives at the station.
Conductors finding articles on trains or in stations
must deliver them as promptly as possible to the
Train Dispatcher/Terminal Supervisor.
Conductors must give their badge number to any
customer upon request without delay or argument.
They must devote themselves exclusively to the per-
formance of their duties and are not permitted to
bring newspapers, books, magazines, radios, tape
and CD players, food, beverage containers or other
items onto the train. Conductors must promptly
notify the Trainmaster or Train Dispatcher/Terminal
Supervisor in case of defects in the cars that would
interfere with the safe operation of trains.
Conductors must not permit the playing of musical
instruments, the sale of newspapers or merchandise
or the soliciting of alms of any description on trains.
Smoking is not permitted on the train or in any sta-
tions.
Conductors will not permit passengers to eat and/or
drink on the train.
100
At stations where starting lights are used, they must
not close doors until the starting lights are lighted
(constant) unless assured the starting lights are out
of order.
Conductors must report dirty or unserviceable con-
ditions on their trains to the Trainmaster.
Conductors must not give orders to skip stations
except in case of emergency and must notify
Trainmaster en route or upon arrival at the next ter-
minal if they do so. Car doors must be opened
promptly when the train makes a station stop, but
not until it stops, and must be closed promptly when
customers are aboard. The Door Key must not be
inserted in the Master Door Controller except when
opening or closing the doors. In order to avoid an acci-
dent, extreme care and vigilance must be exercised
and reasonable opportunity given to all customers to
board and leave trains with safety. Car doors must
be opened at all station stops irrespective of whether
there are customers to leave or board the train.
Special care must be used to see that infirm or eld-
erly persons or persons with children are in safe
position before closing doors.
Should a customer be caught or held by a closing
door when train is not moving, Conductors must
prevent the train from starting (using the emergency
valve cord if necessary) until the customer is
released. Should such a condition not be known
until after the train is moving, the Conductor must
immediately pull emergency cord and bring train to
a stop, then release customer.
Conductors must remain at their operating position,
in position to observe the platform, while the train is
departing from stations so that they may take instant
action to prevent injuries to customers. Should an
employee wish to disembark from a train at any
point between stations, the Conductor must not
open the car door until the train has come to a full
stop and must not close the door to give the starting
signal until positively assured that the employee has
reached a position of safety.
Conductors must make a complete report of any
unusual occurrence to their trains, giving full partic-
101
ulars and detention if any, using the prescribed
Unusual Occurrence form. This report must be sent
to the Superintendent of Transportation before com-
pletion of their tour.
SUPERVISOR – TRANSPORTATION SERVICES

809. Under the overall direction and guidance of the
Superintendent of Transportation, the Supervisor-
Transportation Services is responsible for the
Passenger Services Section providing timely informa-
tion and assistance to passengers while monitoring
passenger and traffic conditions at all PATH stations.
The Supervisor-Transportation Services is responsi-
ble for the Revenue Collection Unit properly collect-
ing, securing, transporting, and accounting of PATH
revenues from the revenue collecting machines.
The Supervisor-Transportation Services is responsi-
ble for ensuring that the Assignment Coordinator
Section assigns staff, in accordance with the pre-
scribed union agreements, to cover vacant positions
that occur in the operations section.
STATION SUPERVISOR – PASSENGER SERVICES

810. Under the direction and guidance of the
Supervisor – Transportation Services, the incumbent
directly supervises the day to day activities of the
Passenger Communications and Services staff, insur-
ing that proper and timely information and assistance
is available to PATH patrons.
He/she is responsible for developing schedules for
emergency situations, special operations, training
programs, weekly assignments, semi-annual job
selections, and yearly vacation selections. He/she is
responsible for overseeing the ticket replacement
and refund process, including maintaining a data-
base associated with passenger losses, due to
equipment failures and or service disruptions.
He/she is responsible for overseeing the
Transportation Division’s absence control program,
including maintaining a database or monitoring
employee attendance. The incumbent also provides
operational input during project planning stages for
enhancing customer needs.
102
STATION SUPERVISOR – REVENUE
811. Under the direction of the Supervisor-
Transportation Services, the incumbent directly super-
vises the Passenger Services Section of the
Transportation Division, whose function is to provide
information and assistance to passengers and monitor
all station activities. In addition, working closely with
the Revenue Unit Supervisor, particular attention is
paid to fare collection, security and crowd control.
The incumbent is also responsible to prepare an
analysis of variances of fare collection machines and
investigates any discrepancies.
ASSISTANT STATION SUPERVISOR

812. Under the guidance of the Station Supervisors,
the Assistant Station Supervisor is directly responsible
for the overall coordination and administration of
PATH’s Revenue Reimbursement Program. Although
he/she will work under established guidelines, the
incumbent must exercise creativity and independent
judgment in order to maximize the effectiveness and
efficiency of the Reimbursement Program through the
creation and introduction of procedural or technologi-
cal improvement. In addition, the incumbent will also
assist in the supervision of the Passenger Services
section.
REVENUE UNIT SUPERVISOR AND

ASSISTANT REVENUE UNIT SUPERVISOR
813. The Revenue Unit Supervisor is responsible for
all coin room employees in their daily duties. The
incumbent supervises the collection of all PATH Fare
Revenues and the security of those revenues, including
the shipment of these Revenues to the bank for count-
ing. The Supervisor is responsible for making daily
short and long term decisions regarding the proper and
timely collection of PATH Revenues and the manpower
needed to accomplish this task.
The Assistant Revenue Unit Supervisor is responsi-
ble for the collection of all fare revenue for PATH and
the security of those revenues, including the deposit
of the revenue into the appropriate bank account.
103
The Assistant Revenue Unit Supervisor supervises
all Coin Room employees in their daily duties. The
incumbent makes daily short and long term deci-
sions regarding the proper and timely collection of
PATH Revenue and the manpower needed to accom-
plish this task.
SUPERVISING ASSIGNMENT COORDINATOR

AND ASSIGNMENT COORDINATOR
814. The Supervising Assignment Coordinator reports
to the Supervisor-Transportation Services and is
responsible for supervising all work performed by the
Assignment Coordinator’s office. The Supervising
Assignment Coordinator oversees the making of work
assignments and maintenance of manpower levels for
the various Transportation groups handled by the
Assignments section. Additionally, the Supervisor
coordinates with the Office of Medical Services insur-
ing that each member of the Transportation Division is
scheduled for Annual Medical examinations.
Bi-annual job selections are conducted by the
Supervising Assignment Coordinator for all crafts in
the Transportation Division.
Under the direct supervision of the Supervising
Assignment Coordinator, Assignment Coordinators
are the exclusive agents responsible for making job
assignments for the Trainmasters, Assistant
Trainmasters, Operations Examiners, Train
Dispatcher/Terminal Supervisors, Assignment
Coordinators, Passenger Information Agents,
Communication Agents, Supervising Communication
Agents, Yard Supervisors, Engineers,
Engineers/Switching, Conductors, and Tower
Operators. Additionally, Assignment Coordinators are
responsible for a broad range of administrative
functions.
ACCOUNTING CLERKS
815. Accounting Clerks report to and receive instruc-
tions from the Revenue Unit Supervisor and the
Assistant Revenue Unit Supervisors. They collect and
secure all revenues from PATH fare collection
equipment.
104
While performing their revenue servicing,
Accounting Clerks ensure adherence to all specified
policies and procedures.
SUPERVISING COMMUNICATIONS
AGENTS/COMMUNICATION AGENTS
816. Supervising Communications Agents (SCA’s)
report to and receive instructions from the Station
Supervisors. They supervise Communications Agents
in the John F. Hoban Control Center and Passenger
Information Agents at various PATH Stations.
Supervising Communications Agents and
Communications Agents are responsible for provid-
ing timely and informative PATH travel information
utilizing the wide range of communications equip-
ment, fare collection equipment and PATH-Vision
equipment located in the John F. Hoban Control
Center. They are responsible for the monitoring of
CCTV cameras of fare zones and key customer wait-
ing areas. They handle customer inquiries on
Passenger Assistance Telephones and public tele-
phones. Supervising Communication Agents answer
and direct calls made on PATH’s Emergency Backup
Telephone.
Communications Agents respond to and appropri-
ately handle customer inquiries related to the PATH
revenue collection system.
Communications Agents ensure that all customer
communications equipment is checked for proper
operation with inoperative equipment reported for
corrective action.
PASSENGER INFORMATION AGENTS

817. Passenger Information Agents (PIA’s) report to
and receive instructions from the Supervising
Communications Agents. PIA’s provide visible PATH
representation at PATH Terminals and Stations while
assisting customers traveling on PATH.
105
PIA’s check customer communications equipment
daily and report malfunctioning equipment for
corrective action.
SIGNAL DIVISION
SIGNAL SUPERVISORS
818. Signal Supervisors report to and receive instruc-
tions from the Superintendent, Signal Division, Senior
Signal Engineer, Chief Supervisor, Signal Maintenance
and the Chief Supervisor, Signal Construction. They
are responsible for the proper maintenance, construc-
tion, testing and repair of the signal system in accor-
dance with PATH and FRA standards.
They must be familiar with the rules and signals gov-
erning the movement of trains and are responsible
for knowing that employees under their jurisdiction
understand and obey the rules that apply to them.
They must be familiar with the FRA “Rules,
Standards and Instructions Governing Railroad
Signal and Train Control Systems,” and FRA “Hours
of Service” regulations.
They will be familiar with all practices of the move-
ment of trains and when working on or about the
track area, they will comply with the “RULES FOR
THE PROTECTION OF EMPLOYEES IN TRACK
AREAS”.
SIGNAL DIVISION EMPLOYEES

819. Signal Division employees report to and receive
instructions from the Superintendent, Signal Division,
Senior Signal Engineer, the Supervisor, Chief
Supervisor or such other supervisory employee of the
division.
They are responsible for inspection, maintenance
and proper operation of signal equipment assigned
to their care and must notify their Supervisor of all
equipment failure and the action taken to correct
conditions or restore service.
All work performed must conform to Signal Division
and FRA standards and procedures and no
unauthorized revisions to equipment or circuits
are permitted.
106
They must notify the Trainmaster when it is
necessary to work on equipment that affects train
operation or to remove equipment from service.
The Trainmaster must also be notified when such
repairs are completed or when equipment is
restored to service.
AREAS”.
ELECTRICAL, POWER & COMMUNICATIONS

DIVISION EMPLOYEES
820. Electrical, Power & Communications Division
employees report to and receive instructions from the
Superintendent, Electrical, Power & Communications
Division, the Foreman or such other supervisor within
their division.
They are responsible for inspection, maintenance and
proper operation of electrical and communi-
cation equipment assigned to their care and must notify
their Foreman of all equipment failures and the action
taken to correct conditions or restore service.
All work performed must conform to the Electrical,
Power & Communications Division standards and
procedures and no unauthorized revisions to equip-
ment or circuits are permitted. They must notify the
Trainmaster when it is necessary to work on equip-
ment that affects train operation or to remove equip-
ment from service. The Trainmaster must also be
notified when such repairs are completed or when
equipment is restored to service.
AREAS”.
107
CAR EQUIPMENT DIVISION EMPLOYEES
821. Car Equipment Division employees report to
and receive instructions from the Superintendent,
Car Equipment Division, the Foreman or such other
Supervisor of the Division as is directed by proper
authority.
They are responsible for inspecting, maintaining,
testing, cleaning and proper operation of car equip-
ment systems and components assigned to their
care and must inform their Foreman of all car equip-
ment failures and defects, and the action taken to
correct these conditions.
All work performed must conform to Car Equipment
Division standards and procedures and no unautho-
rized revisions or modifications to equipment or cir-
cuitry are permitted.
When it is necessary to work on equipment which
affects train operation, the Trainmaster must be
informed and as soon as possible thereafter, the
Foreman must also be notified. Upon completion of
repairs or restoration of train to service, the
Trainmaster and Foreman must be notified.
track area they will comply with the “RULES FOR
AREAS”.
WAY & STRUCTURES DIVISION EMPLOYEES

822. Way & Structures employees are responsible
for the proper and safe maintenance and inspection
of tracks, power rails, mechanical equipment and
other related structures assigned to them by the
Superintendent, Way & Structures Division and will
be familiar with all practices of the movement of
trains and when working on or about the track area
they will comply with the “RULES FOR THE PRO-
TECTION OF EMPLOYEES IN TRACK AREAS”. In
addition, division personnel manage and administer
various maintenance and janitorial contracts for the
maintenance and cleaning of the Journal Square
Transportation Center, Harrison Car Maintenance
Facility, as well as other field sites located on the
PATH rail system.
108
APPENDIX I
HARASSMENT POLICY
The Port Authority of New York and New Jersey and
PATH have a long-standing commitment to equal
employment opportunity which includes the
absolute prohibition of any and all acts of discrimi-
nation, harassment and/or retaliation on the part of
its employees on the basis of race, sex, color, reli-
gion, age, national origin, or disability. Title VII of the
Civil Rights Act of 1964 as amended, along with the
United States Constitution continues to serve as the
heart of our policy. During its most recent term, the
United States Supreme Court reaffirmed and broad-
ened the obligations of an employer under Title VII
with respect to sexual harassment.
As staff has been reminded over the years in prior
policy statements, the Equal Employment
Opportunity Commission (EEOC) guidelines provide
that “unwelcome sexual advances, requests for
sexual favors and other verbal and/or physical
conduct of a sexual nature” constitute sexual
harassment when:
• submission to such conduct is made, either
explicitly or implicitly, a term or condition of an
individual’s employment; or
• submission to or rejection of such conduct by an
individual is used as the basis for employment
decisions affecting such individual; or
• such conduct had the purpose or effect of
substantially interfering with an individual’s work
performance or creating an intimidating, hostile,
or offensive working environment.
In view of the recent Supreme Court decisions, it is
appropriate to remind staff that PATH prohibits all
conduct, which constitutes sexual harassment,
including, but not limited to:
Verbal, non-verbal, physical or other offensive con-
duct of a sexual nature, including unwelcome sexual
advances; unwanted physical contact; requests or
demands for sexual favors and/or for sexual acts.
109
Sexually oriented statements, including sexually
offensive comments; repeated sexual jokes and
innuendoes; unwanted flirtations, advances or
propositions; verbal abuse of a sexual nature;
graphic, verbal commentary about an individual’s
body, sexual prowess or sexual deficiencies;
suggestive, insulting, obscene or demeaning
comments or gestures; or visual and/or audio
presentation of sexual pictures or sexually-related
material in the workplace or in a work-related
context, including the use of Port Authority/PATH
authorized telephone lines, internet accounts, or
other technologies for such purposes.
This policy applies with equal force to employees at
all levels of the organization. PATH will not tolerate,
condone or allow sexual harassment whether
engaged in by senior staff, management, fellow
employees, supervisors, vendors or other non-
employees who conduct business with PATH. Every
employee must be treated with dignity and respect
regardless of race, sex, color, religion, age, national
origin, or disability. We expect all employees to act
in accordance with our stated commitment and to
bring any violations of this policy to our attention.
Staff who are found to be in violation of this policy
are subject to appropriate discipline, including termi-
nation.
While employees at all levels have an obligation to
refrain from engaging in acts of sexual harassment,
supervisory, management and senior staff members
have a particular obligation to monitor the work
environment to prevent sexual harassment and take
appropriate steps to promptly respond to incidents
which occur. A failure on part of any supervisory,
management or senior staff member to act in accor-
dance with this obligation will also result in disci-
pline up to and including termination.
If any employee feels that he or she is being
harassed, or if employment decisions are being
made for improper reasons, he or she should con-
tact the Port Authority’s Office of Equal Opportunity
located in the Human Resources Department (225
PAS; 10th floor; x2845), which continues to serve as the
central unit for processing complaints of discrimination,
110
harassment, and/or retaliation concerning race, sex,
color, religion, age, national origin, or disability.
PATH was asked, in coordination with the Office of
Equal Opportunity, to supplement this central
resource by establishing an appropriate avenue for
employees to pursue relief within PATH concerning
these highly sensitive issues. Accordingly, employ-
ees may also contact the PATH Operations Support
(JSTC-6; x6306).
Finally, employees are reminded that retaliation of any
kind against any employee who exercises their right to
take advantage of either this policy or their rights
secured by law is prohibited and will not be tolerated.
In this regard, PATH expressly prohibits retaliation
against any person because that person has made a
bona fide complaint about discriminatory policies or
practices, has filed a charge of discrimination,
cooperated/assisted with or provided information in
connection with an investigation, made a
determination on a complaint, participated in or
served as a witness in legal (administrative or court)
proceedings, or otherwise exercised rights in a manner
to effectuate the spirit of this policy and applicable laws.
PATH expects each and every employee to conduct
himself or herself in accordance with this policy.
111
APPENDIX II
ACCIDENT REPORTING POLICY

The mission of the Port Authority Trans-Hudson
Corporation (PATH) is to provide safe, reliable;
customer oriented rapid transit service. This is
achieved by a commitment to hold system safety to
the highest level. Accidents/Incidents, injuries and
occupational illnesses must be reported immediately
to the System Safety Unit for review, investigation and
the implementation of corrective action when appro-
priate.
Accurate and timely reporting of accidents/inci-
dents, injuries and occupational illness to the
System Safety Unit is required of all PATH Divisions.
This promotes the prompt identification of casual
factors and permits resolution of potential prob-
lems. Effective communication channels must be
maintained and include both telephonic and written
reports. As stated in the Safety Rules contained
within the PATH Book of Rules:
In the case of an injury to an employee while on
duty, however slight, the employee must notify his
Supervisor immediately following the injury, but no
later that the end of the work tour.
The immediate supervisor will render all practical
assistance to the employee, if necessary, promptly
obtain first aid or medical assistance for all injuries,
determine the circumstances of the incident, and
complete Part II of Form TH-360 PATH Employee
As soon as possible, the injured employee must
complete Part I of Form TH-360 PATH Employee
Harassment or intimidation of the employee to
under report or forego medical treatment is strictly
prohibited and will result in disciplinary action
against the individual committing the harassment or
intimidation. Any employee who believes that he/she
has been harassed or intimidated to under report or
forego medical treatment following an accident/
incident, injury or occupational illness must report
112
his/her complaint in writing to the Manager, Labor
Relations with a copy to the System Safety
Supervisor. All complaints will be reviewed to
determine if there was a violation of PATH’s Accident
Reporting Policy. PATH shall handle all complaints
in a confidential manner. PATH shall provide
“whistle blower” protection.
PATH may implement Corporate Policies, General
Notices and Rules including, but not limited to
Attendance Policy and Drug and Alcohol Testing.
These policies are not considered harassment, and
for the purpose of accident reporting, will not be
considered as evidence to support allegations to
this Policy.
The Federal Railroad Administration may impose civil
and/or criminal penalties upon any individual who
knowingly and willfully makes a false entry in a record
or report or who destroys, mutilates, changes or
falsifies such a record or report; or does not enter the
required specific facts and transactions in such a
record or report or makes or preserves such a record
or report in violation with this regulation.
If you have any questions regarding the Accident
Reporting Policy, please call the System Safety
Supervisor at (201) 216-6258.
113
APPENDIX III
PATH ON-TRACK SAFETY PROGRAM

This program describes the safety rules and
special instructions that have been developed to
protect PATH roadway workers from accidents and
casualties caused by moving rail cars, locomotives
or roadway maintenance machines. It conforms
to 49 CFR 214 Subpart C — Roadway Worker
Protection. Any questions regarding this program
should be directed to the PATH System Safety
Supervisor, at (201) 216-6258.
For the purposes of this program, roadway workers
are defined as PATH employee, a Port Authority
employee or the employee of a contractor to PATH,
whose duties included inspection, construction,
maintenance, or repair of track, bridges, roadway,
signal communication systems, electric traction
systems, roadway facilities, or roadway mainte-
nance machinery on or near track with the potential
of fouling a track, and employees responsible for
on-track protection.
On-track protection is defined as a state of freedom
from the danger of being struck by moving trains or
other railroad equipment. On-track protection is
provided by the Operating and Safety Rules that
govern track occupancy by employees, trains and
on-track equipment.
Roadway workers have the absolute right to challenge
in good faith whether the on-track safety procedures
that will be instituted at the job location comply with
PATH’s on-track safety rules and operating rules and
will provide positive protection to the employee. An
employee who challenges the on-track safety
procedures must be able to justify his concerns and
identify the safety and/or operating rules that are not
being followed.
The individual roadway worker is responsible for
following all PATH on-track safety rules. The
roadway worker shall not foul a track except when
necessary for the performance of duty. Each road-
way worker is responsible to ascertain that on-track
safety is being provided before fouling a track.
114
Varying levels of responsibility are accorded
to employees based upon their job function. The
varying job categories include:
ALL ROADWAY WORKERS

Before the start of work, all employees must
participate in a job briefing which is described
within the section on Employee in Charge. All
roadway workers:
• Must comply with the PATH Book of Rules, and
more specifically those rules pertaining to Signal
Rules numbered 150 -153, 156 and 157, and the
500 series rules (Rules For The Protection of
Employees In Track Areas) as well as those rules
and procedures contained within the PATH
On-Track Safety Program.
• Must not foul the track unless it is necessary to
perform your job.
• Before fouling a track, must:
Verify that on-track protection is in place.
Verbally acknowledge an understanding of the
on-track protection procedures that are in
place for that particular job.
Know which employee is responsible for the
provision of on-track protection.
• Must know that you have the absolute right to
challenge in good faith, any directive that would
violate an on-track Safety or Operating Rule (see
On-Track Protection Good Faith Challenge Form
and On-Track Good Faith Challenge Flow Chart). To
challenge such a directive one must:
Inform the Employee in Charge that the on-track
safety protection does not comply with either on-
track Safety or Operating Rules, and specifically
how the protection is insufficient.
Remain clear of the track until the challenge is
resolved.
• Must not perform any work that will interfere with
train operations on adjacent track without putting
into effect appropriate precautions.
115
• Must wear a safety vest when working on or
adjacent to tracks and utilize appropriate equip-
ment to maintain visibility.
• Must notify the Trainmaster prior to entering onto
the tracks and when you are clear of the tracks.
• When working on or around work trains or road-
way maintenance equipment:
Must understand the duties that each person
will perform, including operators, pilots and
on-track employees.
Must board and deboard the equipment
correctly, using approved handholds, steps
and/or ladders.
Must not get on or off moving equipment.
Must effectively communicate with the equip-
ment operator normal operating procedures,
the location of employees, identify the opera-
tor’s blind spots and ensure that appropriate
signals are used to warn when the equipment
will move.
FLAGMEN
The Flagman is responsible to either allow or restrict
the movement of trains through a work site so as to
provide on-track protection for roadway workers. The
Flagman is responsible to secure the proper flagging
equipment. Upon reporting for work each day, the
Flagman must consult with the Employee in Charge to
verify the details of the protection to be provided for
the roadway workers. The Flagman must also ensure
that the roadway workers have been instructed not to
foul the track without his permission. When the work-
ers request permission to foul the track, the Flagman
must obtain the permission of the Employee in Charge
prior to allowing the workers to foul the track.
If roadway workers fail to comply with the instructions
of the Flagman, he must make an immediate report to
the Employee in Charge. If an event occurs that would
interfere with the safe passage of trains or cause
injury to workers, the Flagman must take immediate
action to avert injury or damage to equipment.
116
WATCHMEN
The watchman is responsible to warn roadway work-
ers of approaching trains or other equipment. The
Employee in Charge must assign watchmen when the
work may foul track beyond the Working Limits. The
watchman must be located in such a position as to
have a clear view of approaching trains or equipment
and provide a distinct warning to the gang; the pitch
and sound level of the horn or whistle used by the
watchman must be able to be clearly heard by the
gang. Additional watchmen are required if the watch-
man does not have sufficient sight distance to clear
the gang at least 15 seconds before the train or equip-
ment could reach the worksite, or in the event that vis-
ibility is restricted by weather.
LONE WORKER
The lone worker is responsible for providing for his
on-track safety. Each lone worker shall communi-
cate at the beginning of his tour with a supervisor or
other designated employee to receive a job briefing
and to advise of his planned itinerary and the proce-
dures that he intends to use for on-track safety. If
several employees are working near each other but
are not engaged in a common task, each employee
is a lone worker.
EMPLOYEE IN CHARGE
The Employee in Charge is the person designated to
supervise or monitor the work of a group of
employees and to provide for their on-track protec-
tion. The Employee in Charge is responsible to provide
a job briefing to all employees whose duties require
them to foul a track. The job briefing shall take place
each day prior to the start of work. The job briefing
includes information on the way in which on-track
safety is to be provided and instruction on the on-track
safety procedures to be followed. At minimum the job
briefing shall include:
• A description of the on-track procedures to be
used and followed while the work is being per-
formed at that time and that location.
• A description of the on-track protection to be in
effect on all adjacent tracks that are not included
within the working limits (when required).
117
• Verbal acknowledgment by each employee that
they understand the on-track protection that will
be provided at the worksite.
All roadway workers must verbally acknowledge to the
Employee in Charge understanding of the on-track
safety procedures and instructions that were presented.
If at any time the on-track safety procedures change
during the work period, then the Employee in Charge
must notify all members of the roadway work group of
the changes. In an emergency the Employee in Charge
shall instruct all employees to clear the track and
remain clear until on-track protection is reestablished.
The Employee in Charge shall notify all employees
before the working limits are released for train
operation. The working limits shall not be released until
all affected employees have vacated the track or have
been given on-track protection by a watchman.
The Employee in Charge is responsible for the
establishment of Working Limits and the assign-
ment and supervision of watchmen and Flagmen. In
addition to the rules required of all Roadway
Workers, the Employee in Charge must comply with
the 400 series rules (Movement by Train Orders).
OPERATORS OF ROADWAY MAINTENANCE

MACHINES
Operators of roadway maintenance machines are
responsible for the safe operation of the on-track
equipment. The operator must be qualified to operate
the equipment and ensure that the operator’s manual
is available on the equipment for reference.
The operator must communicate with any
employee(s) working close to the equipment regarding
normal operating procedures, their location, the
operator’s blind spots and signals indicating that the
equipment is about to move. The operator must stay
15 feet away from employees who are working on
track in front of or behind the equipment unless the
work activity requires the employees to be closer to
the equipment and they understand the work to be
performed. The operator must space standing or
working equipment to prevent collisions. The operator
increases this distance when working where grades or
curves limit the sight distance or where the rail is wet,
icy or oily.
118
Specific safety precautions which must be in
place prior to the initiation of maintenance jobs
using roadway maintenance machines include:
• Issuance of safety procedures for the general
application and for the specific type of machine.
• Training and qualification of operators of roadway
maintenance machines to include instruction on
the safe operation of the machine as well as spe-
cific safety precautions to utilize with that
machine.
• Communication between machine operators and
roadway workers assigned to work near or on
roadway maintenance machines.
• Spacing between machines to prevent collisions.
• Space between machines and roadway workers
to prevent personal injury.
• Maximum working and travel speeds for machines
dependent upon weather, visibility and stopping
ability.
• Daily job briefings will include safety precautions
to be in place for work in proximity to roadway
maintenance equipment.
• Maintain copies of instructions for the safe opera-
tion of roadway maintenance machines with each
machine of sufficient size to permit this.
• Roadway maintenance equipment and its appurte-
nances must be kept clear of trains passing on
adjacent track. Where operating conditions permit
roadway maintenance machines to be less than
four feet from the rail of an adjacent track, proce-
dural instructions shall be issued to provide ade-
quate clearance between the roadway maintenance
equipment and passing trains.
Only the Mechanical Equipment Operator and per-
sons authorized for the proper operation of the
Roadway Maintenance Equipment will be permitted
to ride on the equipment. When two or more
employees are on roadway maintenance equipment,
one must be positioned to have the best possible
view to the rear. That employee must watch for over-
taking equipment or trains and must watch over any
equipment being towed. Employees riding on equip-
119
ment shall not ride on material, tools, or other items
loaded on a car, vehicle, trailer or equipment.
Employees may not stand on moving equipment
unless authorized, and must then be prepared for
sudden stops. If an employee must stand, ensure
that there is room within the end and side limits for
the employee to maintain a firm handhold and foot-
ing and keep clear of moving parts, controls and the
operator.
Operators of roadway maintenance equipment must
make sure that all persons riding on the equipment
understand the duties that each employee will per-
form. Each rider must be assigned a location. When
employees are getting on, getting off, or between
roadway maintenance equipment, disengage the
clutch or gears and set brakes to hold. Secure mov-
able work parts in the up or clear position before
moving. Always test the brakes immediately after
starting. Do not allow anyone to distract you or
interfere with your duties. Be sure to constantly look
out for obstructions or unsafe conditions in the
direction you are moving. If there are problems with
visibility, instruct another employee to serve as a
lookout. Be vigilant for persons near the equipment.
If they are too close, reduce the speed, sound the
horn and be prepared to stop. While descending a
steep grade, keep the clutch engaged and use low or
second gear to control the speed of the equipment.
Keep sufficient distance between equipment to
avoid collisions. Increase the distance between
equipment when the rail is wet, or when grades or
curves limit sight distance.
If the equipment is not continuously attended, utilize
the following precautions:
• Stop the engine and remove the ignition key.
• Engage the clutch or gears.
• Set the brakes to hold.
• Run a chain through one wheel and around a rail.
If the wheel is solid, run the chain around the
head end to the frame or other part that will not
allow the chain to slip off. Chock the wheels using
wooden chocks of sufficient size and strength to
prevent the equipment from rolling.
120
When operating equipment or track cars on track,
the operator will not exceed either the equipment
speed limitation, the track maximum speed or a
restricted speed order on the track, whichever is
lowest.
CONTRACTORS
Contractors are responsible for the on-track safety
of their employees and any required training for their
employees. Contractors must adopt PATH’s on-track
safety program.
Construction Contractors. Contractors are advised
through bid documents that they are required to
adopt PATH’s On-Track Safety Program. Contractors
are provided a copy of the program upon the award
of the contract. Contractors are required to submit
copies of their schedules, work plans, and proof of
employee training and qualification to the
Construction Engineer (Employee in Charge), to
demonstrate compliance with PATH’s On-Track
Safety Program. All Contractor employees shall
carry roadworker on-track safety qualification cards
which indicate the employee name, company, date
and type of qualification. PATH will supply on-track
safety qualification cards to the Contractor upon
receipt of proof of training. The on-track safety
qualification cards must be produced on demand to
the Construction Engineer, to any supervisory
official of PATH or an official of the FRA.
Contractors are advised that their work shall not foul
an adjacent track unless authorized to do so by the
Employee in Charge. Contractors shall stop work
activity while a train passes their work location on
adjacent track.
Port Authority employees or other contractors to
PATH must be qualified on the PATH On-Track Safety
Program. Prior to fouling the track they must receive
an orientation on the specific conditions and precau-
tions necessary to enter into the track area.
ON-TRACK SAFETY PROCEDURES

On-track safety is generally accomplished through
the establishment of Working Limits. Working
Limits govern a segment of track where definite
121
boundaries have been established, upon which
trains and maintenance equipment may move only
as authorized by the Employee in Charge of the
defined segment of track. Working Limits may be
established through:
• Exclusive Track Occupancy
• Foul Time
• Train Coordination
• Inaccessible Track
Working Limits may only be established or con-
trolled by a qualified Employee in Charge. All road-
way workers must be notified of any changes to the
Working Limits. The Employee in Charge of the
Working Limits must return the Working Limits to
the Trainmaster at the conclusion of the work.
In addition to the establishment of Working Limits,
on-track safety can also be achieved through:
• Train Approach Warning Provided By Watchman
• Lone Worker - Individual Train Detection
EXCLUSIVE TRACK OCCUPANCY

Exclusive Track Occupancy is a method of establishing
Working Limits on controlled track in which the
movement authority of trains and other equipment
is withheld by the Trainmaster. Either a Flagman, a
fixed signal that displays an aspect indicating stop,
or a milepost sign beyond which train movement is
prohibited, shall identify the limits of the Exclusive
track occupancy. Authority over the Working Limits
shall be granted to the Employee in Charge by the
Trainmaster or by the Employee in Charge causing
fixed signals at each entrance to the Working Limits
to display an aspect indicating STOP. At an
interlocking signal, if the signal is capable of
automatic mode, it must be changed to manual
mode and a blocking device applied. The
Trainmaster shall transmit the authority for
Exclusive Track Occupancy on a written document
or orally directly to the Employee in Charge. When
the authority for Exclusive Track Occupancy is trans-
mitted orally, the authority shall be written as it is
received by the Employee in Charge and repeated
back to the Trainmaster for verification. The
122
Employee in Charge must retain the written authority
for the duration of the job (see Exclusive Track
Occupancy Form and/or Rule 415). The Trainmaster
shall make a written record of all authorities issued to
establish exclusive track occupancy.
Movement of trains and roadway maintenance
machines within the Working Limits shall be made
only under the direction of the Employee in Charge
of the Working Limits. Such movements shall be at
a restricted speed unless the Employee in Charge of
the Working Limits has specifically authorized a
higher speed.
FOUL TIME
Foul time is a method of establishing Working Limits
on controlled track in which a roadway worker is
notified by the Trainmaster that no trains will
operate within a specific segment of track until the
roadway worker reports clear of the track. Foul time
may be given orally or in writing by the Trainmaster
only after he has withheld the authority of all trains to
move into or within the Working Limits during the foul
time period. Each roadway worker to whom foul time
is transmitted orally shall repeat the track
number or letter, track limits and time limits of the foul
time to the Trainmaster for verification before the foul
time is effective. The Trainmaster shall not permit the
movement of trains or other on-track equipment into
the Working Limits which are protected by foul time
until the roadway worker who was granted foul time
has reported clear of the track.
TRAIN COORDINATION
Train coordination is a method of establishing
Working Limits on controlled track, upon which a
train holds the exclusive authority to move, whereby
the crew of that train yields that authority to the
roadway worker. Train coordination can only be
used where one train holds the exclusive authority to
move. The Employee in Charge who establishes the
Working Limits through train coordination shall
communicate with the crew to establish:
123
• That the train is visible to the roadway worker who
is establishing the Working Limits.
• That the train is stopped.
• The train will be moved only as permitted by the
Employee in Charge for the duration of the
Working Limits.
• The crew of the train will not give up its
exclusive authority to move until the Working
Limits have been released to the crew by the
Employee in Charge of the Working Limits. The
procedure for train coordination is described in
Rule 526.
INACCESSIBLE TRACK
Inaccessible track is a method of establishing
Working Limits on non-controlled track by physically
preventing entry and movement of trains and
equipment. Track can be made inaccessible by:
• A Flagman with the instructions to hold all trains
and equipment clear of the Working Limits.
• A switch or derail aligned to prevent access to the
Working Limits and secured with an effective
securing device by the Employee in Charge of the
Working Limits.
• A discontinuity in the rail that prevents the
passage of trains or roadway maintenance
equipment into the Working Limits.
• Working Limits on controlled track that
connects directly with the inaccessible track,
established by the Employee in Charge of the
Working Limits on the inaccessible track.
• A remotely controlled switch aligned to
prevent access to the Working Limits and secured
by the tower operator by the application of a block-
ing device to that switch, and the Trainmaster has
notified the Employee in Charge that the protec-
tion has been applied, and that the blocking
device shall not be removed until permission to
do so has been granted by the Employee in
Charge.
Trains and roadway maintenance machines within
the Working Limits of inaccessible track shall move
124
only under the direction of the Employee in Charge
and shall move at restricted speed.
TRAIN APPROACH WARNING PROVIDED BY

WATCHMAN
The watchman assigned to provide train approach
warning shall be solely responsible to watch for the
approach of trains and communicating a warning to
roadway workers in a roadway work group who foul
any track that is not protected by established
Working Limits. The watchman must be able to
comply with Rule 510 on the track for which he is
responsible. In the instance of a workgang which is
composed of two individuals of equal rank, one of
the employees shall be designated as the Employee
in Charge. In this instance the Employee in Charge
may also act as the watchman, e.g. two track
inspectors or two signalmen working together.
The intent of these methods is to ensure that
on-track safety provisions have been provided for
roadway workgangs. This is achieved through a
combination of a job briefing prior to the start of
work and the establishment of working limits or
train approach warning. Roadworkers performing
large scale maintenance or construction work shall
also be provided with train approach warning for
movements on adjacent tracks that are not included
within the working limits.
INDIVIDUAL TRAIN DETECTION (Lone Worker)

This is the method for a lone worker to achieve
on-track safety by seeing approaching trains and
clearing up from the track before the train reaches
his position. Individual train detection can only be
used by an employee who has been trained, quali-
fied and designated to do so and only under the
conditions of Rules 506 and 507 including:
• The individual must have clear vision of approaching
trains moving at authorized speed on that track for
a sufficient distance that he may move to a previ-
ously determined place of safety not less than 15
seconds before the train would reach his location.
• The place of safety may not be on another active
track.
125
• The ability of the lone worker to hear and see
approaching trains is not impaired by background
noise, power operated tools or roadway mainte-
nance machines, lights, precipitation, fog, previ-
ously determined place of safety not less than 15
seconds before the train would reach his location.
• The place of safety may not be on another active
track.
• The ability of the lone worker to hear and see
approaching trains is not impaired by background
noise, power operated tools or roadway mainte-
nance machines, lights, precipitation, fog, pass-
ing trains or any other physical condition.
• The Lone worker may only engage in inspection
or minor correction activity that does not interfere
with his ability to maintain a vigilant lookout for
the detect the approach of trains from either
direction.
• The Lone worker may not work in any active inter-
locking.
• If any condition interferes with the Lone Workers
ability to work safely, he must remain clear of the
track until the condition is remedied or until work-
ing limits have been established.
Additional safety procedures and precaution to be in
place for the use individual train detection by the
lone worker include:
• The place of safety may not be on a track, unless
working limits are established on that track.
• The lone worker who uses individual train
detection for the provision of on-track safety may
not either occupy a position or perform any
activity that would interfere with his ability to
maintain a vigilant lookout for, and detect the
approach of a train moving in either direction.
• The lone worker shall complete a written
Statement of On-Track Safety (see Lone Worker
Individual Train Detection Statement of On-Track
Safety Form).
• The lone worker shall produce the Statement of
On-Track Safety upon request to a representative
of the Federal Railroad Administration or any
supervisory employee of PATH.
126
• The lone worker retains the absolute right to use
on-track safety procedures other than individual train
detection if he determines that it is necessary, and to
occupy a place of safety until such other form of
on-track safety can be established.
TRAINING AND QUALIFICATION

All roadway workers must receive training annually
in PATH’s on-track safety program and demonstrate
proficiency in on-track safety procedures applicable
to his responsibilities. Specific safety procedures
required for the performance of a particular job shall
be included within the daily job briefing.
Railroad employees other than roadway workers
who are associated with on-track safety procedures
and whose primary duties concern the movement
and protection of trains, shall be trains, shall be
trained and qualified in their responsibilities during
their annual training and qualification refresher.
Demonstrated proficiency shall mean a thorough
competence derived from training and practice.
Written or electronic records of each roadway
worker qualification shall be maintained. The record
shall include the name of the employee, the type of
qualification made, and the most recent date of
qualification.
All roadway workers shall receive training on the
following:
• Recognition of railroad tracks and understand the
dynamic envelope of a railcar.
• The functions and responsibilities of all employees
involved in on-track safety procedures.
• How to comply with on-track safety instructions
given by the Employee in Charge and the
Watchman.
• The type of signals given by the Watchman, and
the proper response upon receiving a train
approach warning.
• An overview of the hazards associated with work-
ing on or near railroad tracks, including a review
of on-track safety rules and procedures.
127
Watchman and Flagman shall also be trained and
qualified in:
• The detection and recognition of approaching
trains.
• Effective warning of roadway workers of the
approach of trains.
• Determination of the distance along the track at
which trains must be visible in order to provide
the prescribed warning time.
• The content and application of the Operating rules
governing proper stop signals to trains and hold-
ing trains clear of working limits.
Lone workers shall also be trained and qualified in:
• Individual train detection and the necessity for
prompt movement to a place of safety upon their
approach.
• Rules and procedures for individual train detection,
and establishment of working limits.
The training and qualification of roadway workers
who operate roadway maintenance machines shall
also include:
• Procedures to prevent a person from being struck
by the machine when the machine is in motion or
operation.
• Procedures to prevent any part of the machine
from being struck by a train or other equipment
on another track.
• Procedures to provide for stopping the machine
short of other machines or obstructions on the
track.
• Methods to determine safe operating procedures
for each machine that the operator is expected to
operate.
The training and qualification of the Employee in
Charge shall include:
• All of the on-track safety training and qualification
required of the roadway workers, watchmen and
flagmen.
• The content and application of the operating rules
pertaining to the establishment of Working Limits.
128
• The content and application of the rules pertaining
to the establishment of train approach warning.
• The relevant physical characteristics of the tracks,
tunnels and yards upon which the Employee in
Charge is qualified.
COMPLIANCE
All employees and contractors whose duties are
covered by the Roadway Workers rule must comply
with the requirements of PATH’s On-Track Safety
Program. The Employee in Charge shall enforce
compliance. Divisional supervisory staff shall
monitor their employees periodically to ensure
compliance, and shall maintain written records of
compliance checks. Operations Examiners shall
monitor PATH, Port Authority and Contractor staff
for compliance. System Safety shall conduct on-site
audits as well as audits of divisional record keeping
and monitoring activities to verify compliance with
PATH’s On-Track Safety Program.
129
130
On-Track Protection
Good Faith
Challenge Form
Name:
Badge No.:
Job Position:
Supervisor’s Name/Title:
Date and Time of Occurrence:
Work Location
Track and Mile Post:
On-Track Procedures
applied (or lacking) at
Work Location:
Safety or Operating
Rule not being complied
with (give # if known):
Reason for Challenge:
Other Employees with

information regarding
situation:
Signature:
Date:
Determination by Supervisor:
Foreman Date
INSTRUCTIONS: The employee making challenge shall complete

this form, sign and date it, give it to his foreman who shall document
his determination, sign and forward form to the supervisor.
131
LONE WORKER INDIVIDUAL TRAIN DETECTION
STATEMENT OF ON TRACK SAFETY
Name: Date: Time:
Track Number: From M.P. To: M.P.
Tunnel From Eng Sta To Eng Sta
Yard Track Number(s)
Instructions:
This form must be used by a Lone Worker when using
Individual Train Detection. Use the Book of Rules to
determine the maximum speed authorized in the area
you will be fouling. Place an X in the box adjacent to
this maximum authorized speed. Determine that you
have the required sight distance to clear the track in
15 seconds prior to the arrival of a train. You must
produce this form when requested by an FRA
Representative or PATH Supervisor, and retain it for
seven (7) days after use
Maximum Required Maximum Required

Authorized Sight Authorized Sight
Speed Distance Speed Distance
in MPH in Feet in MPH in Feet
5 110 35 770
10 220 40 880
15 330 45 990
20 440 50 1100
25 550 55 1210
30 660 60 1320
The Lone Worker has the absolute right to use On Track

Protection procedures other than Individual Train
Detection if deemed necessary and to occupy a place
of safety until another form of protection can be
established.
132
TH 4649/5-97 PATH
TRACK OCCUPANCY
Name
Badge No Date
Work Location:
Type of Protection:
ETO ■ TC ■ IT ■ TAWW ■
Exclusive Track Occupancy / Train Coordination / Inaccessible

Track Train Approach Warning Provided by Watchman
Time: O/S Returned
Work Limits
Power Removal: Y / N
Note: This form shall be retained by the employee for

seven (7) days after completion.
Remarks: (Employee in Charge)
133
PATH Digicode® PSP
APPENDIX C-3 – PATH Procedure for Receipt of Notification
42 of 80
PORT AUTHORITY TRANS-HUDSON CORPORATION (PATH)
POWER, SIGNALS & COMMUNICATIONS (PS&C) DIVISION
Response to Supplier Safety Notifications
1. Purpose.
a. This procedure defines the Response to Supplier Safety Notifications for
the PS&C Division. This relates to any safety-related notification from a
supplier of vital safety-critical signal and train control systems and
components.
2. Scope.
a. This procedure shall apply to all parties whose vital safety-critical signal
and train control systems and components are used on PATH and who
have an obligation to notify PATH as an end-user of its product(s).
3. General Definitions.
Authority or Port Authority - the Port Authority of New York and New Jersey.
PATH –the Port Authority Trans-Hudson Corporation.
Microprocessor-based – vital microprocessor hardware that contains software for
operating the signal and train control system.
Safety Notification – Any correspondence between a supplier and PATH related
to vital safety-critical signal and train control systems and components installed
on PATH that indicates a safety concern has been discovered.
Software Configuration/Management Control Plan –a plan designed to ensure that
the proper and intended software version for each specific site and location is
documented (mapped) and maintained through the life cycle of the system. The
plan shall further describe how the proper software configuration is to be
identified and confirmed in the event of replacement, modification, or
disarrangement of any part of the system.
Software/ Files/Programs –both vital firmware and vital application software.
Firmware shall mean vendor system software that is not changed by PATH.
Application software means software that can be modified by PATH that will
affect the operation of the system.
Third Party Vendors/Contractors/Suppliers –non-PATH entities providing
services and/or material to PATH.
4. Responsibilities.
a. Upon receipt of a supplier safety notification related to vital safety-critical
signal and train control systems and components installed on PATH, the
Superintendent, PS&C Division, or his designee, shall notify:
i. appropriate PS&C personnel
ii. Superintendent, Car Equipment Division
iii. Manager, System Safety and Environmental Management
PATH Response to Safety Notification 1

Revision 1, 02/22/2012
b. The Superintendent, PS&C Division, in consultation with the above listed
stakeholders, shall make a determination as to action to be taken, which
may include:
i. Creation and dissemination of a safety bulletin;
ii. Creation and dissemination of an operations bulletin;
iii. Maintenance action; and/or
iv. Removal from service of affected equipment.
5. Software Modifications
a. All software modifications shall be performed in strict adherence to
PATH’s Software Configuration/Management Control Plan.
b. All safety notification that requires modification to a software element
shall be recorded on a Software Verification Revision Form.
6. Hardware Modification
a. Any change to hardware shall be reviewed to ensure that any affected
parts are identified and that the following are performed:
i. Management of any affected stored parts, and
ii. Any necessary revision to manuals identified and communicated.
b. The modification of hardware shall be scheduled and conducted in a
structured manner so that configuration is maintained, including receipt of
repair/modification instructions, training, and receipt of adequate
replacement/spare parts.
7. Removal From Service

a. In rare cases, a safety bulletin may require the removal from service of
equipment. This should consider the following factors:
i. Quarantine of equipment to prevent usage;
ii. Degraded mode operation – manual vs. automatic; and/or
iii. Alternate service considerations.
8. Operations and Maintenance Manuals

a. Any operations and/or maintenance manual affected by a safety
notification shall be annotated or revised as appropriate.
9. Training
a. Any change that materially affects an operation or maintenance procedure
may require appropriate training of applicable personnel.
10. Testing
a. Any safety notification that affects vital safety-critical signal and train
control systems and components governed by an FRA-mandated test shall
not be finalized until such testing is successfully completed and recorded
on the appropriate form.

Revision 1, 02/22/2012
11. Notification Tracking
a. The Safety Notification Routing Form shall be completed for all safety
notifications related to vital safety-critical signal and train control systems
and components.
b. Upon completion of the associated work, the completed form shall be
signed and returned to the Superintendent, PS&C Division.

Revision 1, 02/22/2012
Safety Notification Routing Form
This form shall be used for all safety notifications related to vital safety-critical signal
and train control systems and components.
Originator: Superintendent, PS&C Division Safety Notification ID#

Supplier Name: Date:
Equipment affected: Mfg:
Division Concerned: Signal Design
Signal Maintenance
Signal Construction
Signal Shop
CED
System Safety
In Service Program Information (if applicable)

Program Revision #
Hardware Serial #
Reason for Change:
Description of Change:
Work Performed:
Response to Safety Notification has been completed:

Signature ______________________________ Date___________________
Other Comments:
Return to Superintendent, PS&C Division

Revision 1, 02/22/2012
PATH Digicode® PSP
APPENDIX D – Product Manufacturer Documentation

1. Table 1 - Alstom Documents included with this PSP.
2. Table 2 - Alstom Documents not included, but available for “on-site” review
at Alstom’s facility.
3. Table 3 - Cross reference for PATH PSP and related Alstom documents.
4. APPENDIX D1-D21 – Alstom reference documents.
43 of 80
PATH Digicode® PSP
Table 1 Manufacturer Documents included with PATH’s PSP

Document Title Document Number Rev. Appendix in PSP
1. Smartway Digital Track Circuit 7011194-2.0-D8-04-01 2.2 D-1
PSP
2. SDTC Generic Product Safety Case 49052DI9VV001 9 D-2
3. SDTC Safety and V&V Plan 490501D19VV001 3 D-3
4. SDTC Subsystem Requirements 490502D19SY001 5 D-4
Specification
5. SDTC Architecture Description 490371D19HW001 5 D-5
6. SDTC Architecture Verification 490501D19VV006 4 D-6
Report
7. SDTC Hardware Validation Report 490501D19VV008 4 D-7
8. SDTC Validation Report 490501D19VV010 4 D-8
9. SDTC Installation Manual X-HWE-A-UMM-0001 9 D-9
10. SDTC Test and Commissioning X-HWE-A-UMM-0002 9 D-10
Manual
11. SDTC Maintenance Manual X-HWE-A-UMM-0003 12 D-11
12. SDTC Implementation Manual X-HWE-A-UMM-0004 5 D-12
13. SDTC Application Conditions 315302DXXDG002 7 D-13
14. SDTC Qualification Test EETCS-ATC-DTC- 1 D-14
Description (AREMA standard) QTD-T
15. SDTC Qualification Test Report EETCS-ATC-DTC- 1 D-15
(AREMA standard) QTR-T
16. SDTC Type Test Report 490421D19TR0013 3 D-16
17. SDTC ExtraTest type Test Report 2049019-VAL-A-TDR- 1 D-17

0001
18. SDTC/Digicode Train Stop Testing 7011194-2.0-T-2-03-01 1 D-18

Report
19. SDTC Digicode – iVPI Interface 7011194-2.0-T-2-03-03 C D-19
Test Report
20. SDTC Digicode – Vital Relay 7011194-2.0-T-2-03-02 C D-20
Interface Test Report
21. SDTC Digicode – 120 VAC 7011194-2.0-T-2-03-04 A D-21
Operation Test Report
44 of 80
PATH Digicode® PSP
Table 2 Manufacturer Documents not Included in PSP – Available for On-Site Review
1. MML1 Project Quality Assurance Plan 315502YXXQP001
2. SDTC Documentation Plan 315503DXXPD001
3. SDTC Preliminary Hazard Analysis 490501D19VV002
4. SDTC Hazard Analysis 490501D19VV005
5. SDTC Hazard Log 490501D19VV009
6. SDTC Requirements Verification Report 490501D19VV003
7. SDTC RAM Analysis 490501D19VV004
8. SDTC Functional Test Report 490371D19VV002
9. SDTC Functional Test Plan X302DXXTP010
10. SDTC Type Test Plan X421SXXIS047
11. SDTC Hardware Technical Specification:
12. LIU Technical Specification 490371A19HW002
13. TX Technical Specification 490371A19HW001
14. MODEM Technical Specification 490371D19HW002
15. RX Technical Specification 490371D19HW003
16. Motherboard Technical Specification 490371D19HW004
17. RT Technical Specification 490371D19HW005
18. DIAG Technical Specification 490371D19HW006
19. Specifica Tecnica Cassetta di Sintonia 315302DXXST001
20. Specifica Tecnica Cassetta Filtri 315302DXXST002
21. MODEM Software specification 490371D19SW001
22. SDTC Schemes and Part List 315302DXXDG001
23. SDTC Boards Acceptance Test Specification 2049019-IND-S-TCF-0001
24. SDTC Factory Acceptance Test Specification 490371D19FT001
25. SDTC Hardware Safety Verification 490501D19VV007
26. SDTC (Filter Box) Hardware Safety Verification 315503ZXXRS001
27. SDTC (Vertical TU & Filter Box) Type Test Report 490421D19TR001
28. SDTC Safety & Design Review of 2005/04/04 (TX soft start) X503DXXST001 X
29. SDTC Safety & Design Review_HW modifications on SC_3 7431500-RSA-A-SYV-0001
30. SDTC - Interface Hazard Analysis 2049019-RSA-A-HAA-0001
45 of 80
PATH Digicode® PSP
Cross Reference Table Explanation

PATH relies on substantial product manufacturer documentation to provide the required detail in
support of their PSP; this documentation is contained within this Appendix D.
Appendix D contains two main manufacturer’s documents, the Smartway Digital Track Circuit
PSP, Appendix D-1, and the SDTC Generic Product Safety Case, Appendix D-2, and other
supporting analyses and manuals (Appendix D-3 thru D-21 as listed in table 1 of this Appendix
D).
PATH’s PSP generally refers to Alstom’s SDTC PSP - Appendix D-1, which frequently refers to
the SDTC Generic Product Safety Case – Appendix D-2.
The SDTC Generic Product Safety Case – Appendix D-2, frequently refers to supporting
documentation, some of which is included (Appendix D-3 thru D-21) in this Appendix D. Other
material may be referenced, but, due to its proprietary nature, is not included in this PSP; these
documents are available for review at Alstom’s facility.
This cross reference table provides the following information in five columns:
Column Heading Explanation
PATH PSP Section Section number in PATH’s PSP including the
CFR236 subparagraph that is being addressed.
Referencing Smartway Digital Track Circuit The particular subparagraph of the Alstom
PSP Section Appendix D-1 SDTC PSP that provides amplifying material
for the PATH PSP section.
Referencing SDTC Generic Product Safety The particular subparagraph of the Alstom
Case Section Appendix D-2 SDTC Generic Product Safety Case that
provides amplifying material for the applicable
Alstom SDTC PSP.
Additional Manufacturer Supporting
Documents:
Referencing Alstom Supporting Title of Alstom support document that the

Document SDTC Generic Product Safety Case is
referencing.
Included as PSP Appendix The Appendix number where this document is
located in PATH’s PSP.
NOTE: Alstom reference materials not contained in this PSP are generally, with the
exception of the hazard analyses, not shown in the cross reference table.
46 of 80
PATH Digicode® PSP
Table 3 Document Cross Reference Table
PATH PSP Section Referencing Referencing Additional Manufacturer Supporting

Smartway SDTC Generic Documents
Digital Track Product Safety
Circuit PSP Case Section
Section Referencing Alstom Included
Appendix D-2
Appendix D-1 Supporting Document as PSP
Appendix
1. 5 - Operational Concept Description § 4.3 4.3 SDTC Architecture Description D‐5
236.907 (a) (3)
SDTC Digicode – iVPI D‐19
SDTC Digicode – Vital Relay D‐20
SDTC Digicode – 120 VAC D‐21
SDTC Architecture Verification D‐6
Report
4.4 SDTC Safety and V&V Plan D‐3
SDTC Hazard Analysis (not N/A
included)
4.5 No external reference
(answered in Generic Product
Safety Case section indicated).
2. 6 - Safety Requirements § 236.907 (a) (4) 4.4 3.2 SDTC Safety and V&V Plan D‐3
47 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
3.6 SDTC Preliminary Hazard N/A
Analysis (not included)

3.9 SDTC Hazard Analysis (not N/A
included)
3. 7 - Safety Architecture § 236.907 (a) (5) 4.5 4 No external reference

4.3 SDTC Architecture Description D‐5
48 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
Report
included)
4. 8 - Hazard Log § 236.907 (a) (6) 4.6 3.5 SDTC Safety and V&V Plan D‐3
included)
5. 9 - Risk Assessment § 236.907 (a) (7) 4.7 3.2 SDTC Safety and V&V Plan D‐3
3.6 SDTC Preliminary Hazard N/A
Analysis (not included)
49 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
Report
included)
6. 10 - Hazard Mitigation Analysis § 4.8 3.2 SDTC Safety and V&V Plan D‐3
236.907 (a) (8)
included)
7. 11 - Safety Assessment Verification and 4.9 3.2 SDTC Safety and V&V Plan D‐3
Validation Process § 236.907 (a) (9)

included)
8. 12 - Safety Assurance Concepts § 4.10 4.2 No external reference
236.907 (a) (10) (answered in Generic Product
50 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
9. 13 - Human Factors Analysis § 236.907 4.11 4.3.2 SDTC Digicode – iVPI D‐19
(a) (11) Interface Test Report
4.6 SDTC Application Conditions D‐13
10. 14 - Training § 236.907 (a) (12) 4.12 4.4.6 SDTC Application Conditions D‐13
SDTC Installation Manual D‐9
SDTC Test and D‐10
Commissioning Manual
SDTC Maintenance Manual D‐11
SDTC Implementation Manual D‐12
11. 15 - Test Procedures and Test 4.13 4.4.6 SDTC Application Conditions D‐13
Equipment § 236.907 (a) (13)
51 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
12. 16 - Applicability of Subparts A – G § 4.14 All No external reference
13. 17 - Security § 236.907 (a) (15) 4.15 4.5.5 No external reference
14. 18 - Warnings and Warning Labels § 4.16 4.4.6 SDTC Application Conditions D‐13
236.907 (a) (16)
15. 19 - Initial Implementation Testing § 4.17 3.2 SDTC Safety and V&V Plan D‐3
236.907 (a) (17)

included)
16. 20 - Post Implementation Testing and 4.18 4.4.2 No external reference

Record Retention § 236.907 (a) (18) (answered in Generic Product
52 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
17. 21 - Safety Critical Assumptions § 4.19 3.9.4 No external reference
Report
included)
53 of 80
PATH Digicode® PSP

Appendix D-2
Appendix
18. 22 - Incremental and Predefined 4.20 2.18 No external reference
Changes § 236.907 (a)(20) (answered in Generic Product
54 of 80
PATH Digicode® PSP
APPENDIX D-1 Smartway Digital Track Circuit PSP
55 of 80
PATH CBTC Signal Project - ATC Project # 4600008007
Smartway Digital Track Circuit [SDTC]
PRODUCT SAFETY PLAN (PSP)

ALSTOM'S SDTC PRODUCT LINE
(CDRL 3.2b)
I
17
February
201 2 L Boileau P Hart S. Mettrick
Alstom Signaling Inc .

Date Established Checked Validated Approved
1025 John SI. West Henrietta, NY 14586
Confidentia lity Category Control Category
DISTRIBUTION Restricted Normal Controlled Not Controlled
ReI. Lang. N.Shts

7011194-2.0-08-04-01
2.2 en 66
Bel 67 20 1 ind A
-2-
REVISIONS
Auteur/ Date Page / Commentaires/

Author (dd month yyyy) Paragraph Comments
L. Boileau 23 Dec 2010 All Preliminary version 1.0 limited to PATH project review.
L. Boileau 04 Jan 2011 Preliminary version 1.1 updated according Jim Hoelscher
- All pages confidential
-1.1.1.1
- 1.2 Contractor / Supplier clarification
Correct typing error: ". not lim ited to... and add
-1 A
- 2, pg 10 confidential note
and 4,2 Correct PSP
Correct Track Circuit Scope
Version 1.1. limited to PATH project review.
L. Boileau 23 Feb 2011 Multiple Review and recommended updates from Alstom Site Safety Officer and
pages as Product Safety Assurance Engineer for V 1.0a
V1.0a
L. Boileau 07 April 2011 V1.0b Release V1.0b implementing PATH comments dated on 22 Fed
2011 with Alstom internal review:
- 1.2 - add a new section 1.2 "Limit of responsibility"
-1.3 and all
- Remove the "preliminary", "final" and other "executive"
considerations and add CORL reference.
- 1 and 2
- 1A, 1.6 - replace Railroad Safety Program Plan by PTC Safety Plan
and 3.2
- add section 6 and 7 Appendices A and B
A. SOTC Safety Reference Documents (confidentiality)
- 1.5 B. FRA-to-CENELEC Conformance Matrix
- 3 and all
_3.2 - Complete and correct acronyms
- 4.2 - Change, "Electric Joints" to, "Impedance Bonds."
- Change 'Points' to 'switch' and 'issue' to 'release'
- 4.5 and
3.1 - add clarification: « For generic SOTC operation refer to
section 3.1"
- add clarification about Safety Architecture & Safety Assurance

L. Boileau 08 April 2011 V1.0 Formal V1.0 implementing Alstom Safety Assessor comments:
- 4.19 - Update Application Conditions no. AC.2, AC.18, AC.19 and
AC.20. In particular the AC.2 specifies the "not shunting zone"
round the Electrical Joint.
- 4.17 and - update the safety validation and conclusion according to
5 validation reports
L. Boileau 15July2011 V1.1 Formal V1.1 implementing PATH comments PTH.SIE.01790.L
1.5 related to Abbreviation, term (Switch, Impedance Bond also
called electrical joint) and typing clarification (Figures 1, 2 and 3)
PATH - Smartway Digital Track Circuit < 7011194-2.0-08-04-01 >

Product Safety Plan Rev. 2.2
SOTC 17 February 2012
-3-
REVISIONS
Auteur/ Date Page / Commentaires/

Author (dd month yyyy) Paragraph Comments
L. Boileau (J. 1 November V2.0 V2.0 incorporating Invensys comments. Removed confidentiality
Balliet) 2011
statement from all pages. Changed PM to Mark Wiktorski
Removed interlocking reference and replaced with track

Section circuit/train detection reference
1.1
Updated drawing to change Point to Switch
Figure 3
Amended reference for SDTC Architecture Description [9] to
Section [10]
4.1,4.3
Removed Interlocking reference and replaced with Secondary

Train Detection System
Section
4.2 Updated per PATH comment 17,17.1, wording.
Section Removed VPI from Interpretation discussion

4.4
Section
4.9
L. Boileau 16 December V2.1 V2.1 :

2011 Section 3.4 TX board and Tar box rev B
Section 4.19. Updating Application Condition no. AC.20, and,
adding clarification for Application Condition when is Exported to
Application Design phase.
L. Boileau 17 February 2012 V2.2 V2.2
Provides answers and clarification according to FRA comments
received from PATH ref PTH.SIE.02682.L:
• CFR 236.907 (d)(1) Notification of users when safety
critical changes must be made refer to PSP section 13
• PSP section 16 : SDTC Warnings and Warning Labels:
clarification of use of Warning
• PSP section 19 : clarification of AC7
Com pleted by:
• CFR 236.907 (d)(3) clarification of safety validation of
changes refer to PSP section 17
• PSP section 19 : clarification of AC22
• Appendix A: correct reference of Installation Manual
and Vertical TU & Filter Box Type Test Report is not
submitted
PATH - Smartway Digital Track Circuit < 7011194-2.0-D8-04-01 >

SDTC 17 February 2012
-4-
TABLE OF CONTENT
1 PURPOSE AND SCOPE .................................................................................................... 6

1.1 Overview ........................................... ................................................................................. 6
1.2 Limit of Responsibility .......................................................................................................... 6
1.3 Planned PSP Deliverables .................................................................................................. 7
1.4 Document Overview ............................................................................................................ 7
1.5 Acronyms and Definitions .................................................................................................... 8
1.6 Applicable Documents ....................................................................................................... 10
1.7 PSP Document Organization ............................................................................................. 10
2 INTRODUCTION .............................................................................................................. 11
3 SDTC HIGH LEVEL OVERViEW ......................................................................................... 12
3.1 SDTC Foundation - DIGICODE Product Family ................................................................ 12
3.2 Safety Methodology for SDTC ........................................................................................... 17
3.3 SDTC Product Overview For PATH .................................................................................... 18
3.4 SDTC Product Structure: Identification of Hardware for PATH ........................................... 20
Processing Unit ...................................................................................................................................... 20
Track side equipment ............................................................................................................................ 23
3.5 SDTC Product Structure: Identification of Software ............................................................ 24
4 PSP SUBMITTAL DEFINITION BY 236H REQUIREMENT ...................................................... 25
4.1 SDTC System Description ................................................................................................. 26
4.2 General Railroad Operations ............................................................................................. 27
4.3 Concept of Operations ....................................................................................................... 28
4.4 Safety Requirements ......................................................................................................... 29
4.5 Safety Architecture ............................................................................................................. 30
4.6 Hazard Log ........................................................................................................................ 32
4.7 Risk Assessment ............................................................................................................... 33
4.8 Hazard Mitigation Analysis ................................................................................................. 34
4.9 SDTC Safety Verification ................................................................................................... 36
4.10 Safety Assurance Concepts ............................................................................................... 38
4.11 Human FactorsAnalysis .................................................................................................... 40
4.12 Safety Training ................................................................................................................... 41
4.13 Safety Procedures ............................................................................................................. 42
4.14 Part 236 A-G Compliance .................................................................................................. 44
4.15 Security ............................................................................................................................. 47
4.16 Warnings and Warning Labels ........................................................................................... 48
4.17 SDTC Safety Validation ..................................................................................................... 49
4.18 Post Implementation Testing and Monitoring ...................................................................... 51
4.19 Safety-Critical Assumptions and Fallback Operations ........................................................ 53
4.20 Incremental & Predefined Changes ................................................................................... 61

-5-
5 PROUCT SAFETY PLAN CONCLUSIONS ............................................................................ 63

6 ApPENDIX A SDrC SAFETY REFERENCE DOCUMENTS ..................................................... 64
7 ApPENDIX B - FRA-TO-CENELEC CONFORMANCE MATRIX ............................................ 66

-6-
11 PURPOSE AND SCOPE
1.1 Overview
The purpose of this document is to demonstrate that Alstom Signaling Inc's SDTC ® i.e. Smartway
Digital Track Circuit product line has been designed in a safe manner, and to support the
assessment that operation with SDTC is as safe as or safer than operation with previous types of
Track Circuit equipment. Provided within are the required elements of the Product Safety Plan (PSP)
as defined by 49 CFR Part 236 Subpart H, Standards for Development and Use of Processor-Based
Signal and Train Control Systems; Final Rule dated March 7, 2005.
This Product Safety Plan (PSP) describes the SDTC as a generic product designed to perform vital
train detection and rail continuity detection function for global freight, commuter and metro transit rail
applications. It is written with the intention of being compliant with the Positive Train Control Safety
Plan (PTCSP) of the Port Authority Trans Hudson (PATH) Rail Authority and to obtain an Approved
For Use status for the PATH ATC Project - Project # 4600008007. SDTC is being provided by
Alstom as an un-configured product to Invensys Rail Corporation who is responsible for full
configuration of the track circuit / train detection applications for the project.
This Product Safety Plan (PSP) provides the traceability between the requirement from 49 CFR Part
236 Subpart H and the SDTC Generic Product Safety Case.
1.2 Limit of Responsibility

It is assumed that PATH holds ultimate responsibility for the submittal of the full PSP view with
regard to the ATC project which includes a consortium of tiered suppliers at the project level and
lower level suppliers at the product level; Alstom, with its SDTC, is a member of the latter group of
suppliers.
Alstom is responsible as Provider of the Smartway Digital Track Circuit product. This responsibility
does not include:
1. activity of the full Secondary Train Detection System and applying the SDTC and Interlocking
products to the PATH signaling specification
2. activity for advanced ATC technology and full CBTC system to PATH
3. review of the other lower level PSPs that are applicable to the project and confirming
alignment with the PATH PTC Safety Plan (PTC SP)
Given the above discussion, Alstom is taking the position that as product supplier and without
detailed knowledge of the application, the PSP for the SDTC product will be constructed as that of a
generic standalone product.
PSP requirements associated with Railroad operations or otherwise "full system application" will be
addressed to the extent possible given this context. Responsibility for final disposition of individual
PSP requirements as it relates to an applied system view will be highlighted.

-7-
1.3 Planned PSP Deliverables
The PSP for the SDTC product (CDRL 3.2b) will consist of:
1. The PSP providing the SDTC product overview as applicable for use on PATH and
a. a review of each requirement indicated in §236.907 of 49 CFR Part 236 Subpart H
b. references to supporting evidence addressing each requirement providing the

reference to the SDTC Generic Product Safety Case and
c. a conclusion as to the level of adherence to each requirement
2. A series of Confidential Appendices including but not to limited to
a. A SDTC Generic Product Safety Case (referencing those attributes of SDTC relevant
to this PSP)
b. Applicable SDTC design, maintenance, verification and validation documents
c. Applicable documents from the Track Circuit safety analysis that describe the safety
assurance concepts, FMEAs, Fault Tree Analysis, etc. and description of safety
design methodologies used in SDTC
Note: For confidentiality and restriction of use refer to Appendix A, section 6.
1.4 Document Overview

The organization of this PSP consists of seven (7) main sections as follows:
Section 1 Defines the overall scope, PSP roles and provides general reference material for the
PSP Definition document
Section 2 Provides a general introduction to the PSP for the SDTC product
Section 3 Defines a general overview of the SDTC product (Train Detection and rail continuity
detection role in PATH context)
Section 4 Describes each part of the PSP as specified in 236H and defines the PATH PSP
documents intended to satisfy the stated requirements
Section 5 Provides a summary conclusion of the PSP
Section 6 Appendix A SDTC safety documentation supporting the PSP

Section 7 Appendix B - FRA-to-CENELEC Conformance Matrix

-8-
1.5 Acronyms and Definitions
This section shall include definitions of all terms, abbreviations, and acronyms required to properly
interpret this Product Safety Plan.
The following is a list of some abbreviations and acronyms that may be used in the PSP:
Acronym Meaning Acronym Meaning

ATC Automatic Train Control O&SHA Operation and Support Hazard Analysis
ATP Automatic Train Protection PATH Port Authority Trans Hudson
CAAPE Computer Aided Application Programming Environment PHA Preliminary Hazard Analysis
CBTC Communication Based Train Control PSP Product Safety Plan
CEDD-D Concentratore Elaboratore Dati di Diagnostica per PTC Positive Train Control
Digicode (Diagnostic system for Digicode product family) PTCSP Positive Train Control Safety Plan
CENELEC European Committee for Electrotechnical Standardization RAM Reliability Availability Maintenability
CFR Code of Federal Regulation RMS Solid-State Magnetic Relay (Rele Magneto Statico)
ConOps Concept of Operations Rit Delay Circuit (Ritardatore)
CTC Centralized Traffic Control RX Receiver
CPFSK Continuous Phase Frequency Shift Modulation RT Receiver Transmitter
Digicode Digital Coded Track Circuit: family of electronic SAC Safety Assurance Concept
Audio Frequency Track Circuit products manufactured SACEM French Acronym for Automatic Train Control
by ALSTOM Systeme d'Aide a la Conduite, a I'Exploilation et a la Maintenance
DTC Digital Track Circuit SCIL Safety Critical Items List (Hazard Log)
DOT Direction Of Travel SDTC Smartway Digital Track Circuit
EJ Electrical Joint (also called Impedance bond) SIL Safety Integrity Level (0, 1, 2 or 4 refer to CENELEC)
FFT Functional Fault Tree SIL2 Intermediate Safety Integrity Level: Safety Related
FMEA Failure Modes and Effects Analysis SIL4 Highest Safety Integrity Level: Vital/fail-safe Product
FRA Federal Railroad Administration SRS Systems Requirements Specification
FTA Fault Tree Analysis SW Software
HMI Human Machine Interface SwRS Software Requirements Specification
HW Hardware SVT System Verification Testing
HwRS Hardware Requirements Specification TC Track Circuit
IEEE Institute of Electrical and Electronic Engineers TU Tuning Unit
iVPI Integrated Vital Processor Interlocking TX Transmitter
IXL Interlocking VPI Vital Processor Interlocking
LlU Loop Interface Unit V&V Verification & Validation
LRU Line Replaceable Unit ZLC Zone Logic Controller
MTTHE Mean Time to Hazardous Event 236H 49 CFR 236 Subpart H
MSK Minimum Shift Keying
OCC Operations Control Center

-9-
The following is a list of definitions of terms that may be used in the PSP:
Class I railroad A railroad which in the last year for which revenues were reported exceeded the threshold
established under regulations of the Surface Transportation Board (49 CFR part 1201.1-1
(2008)).
Class I (vital) hardware is hardware, the failure of which, can adversely affect system safety.
Class I
Vital hardware is hardware whose failure modes and characteristics can be accurately
Hardware
identified, predicted and exhaustively tested. The occurrence of failure modes that could
have unsafe consequences are eliminated, prevented or otherwise accounted for by design;
they are not accounted for statistically.
Class II CLASS II Hardware (Non-Vital Hardware used to implement vital functions): Hardware
whose failure modes may adversely affect the safe implementation of a vital function but
Hardware which is not designed as vital hardware is defined as CLASS II hardware, i.e. non-vital
hardware used to implement vital functions.
Failure modes in CLASS II hardware are revealed or otherwise accounted for by means
other than vital hardware design techniques. These means include software-driven self-
checking, comparison of independent hardware circuits, and numerical assurance
techniques.
Class III CLASS III Hardware (Hardware used to implement only non-vital functions): CLASS III
hardware is defined as hardware whose operation under normal or failure conditions has no
Hardware effect on the safe implementation of any vital function.
Fail-Safe A design philosophy applied to the design of a system, subsystem, or component. The
applied design philosophy causes the system, subsystem, or component to revert and
maintain with very high probability to a state reasonably believed to be safe in the event of
any design fault or hardware failure, to a very high degree of reliability. A fail-safe design
philosophy is typically applied to the implementation of vital functions. (49 CFR Part 236)
A design philosophy applied to safety-critical systems such that the results of hardware
failures or the effect of software error shall either prohibit the system from assuming or
maintaining an unsafe state or shall cause the system to assume a state known to be safe.
(lEEE-1483)
Safety Critical A designation placed on a system, subsystem, element, component, device, function,
condition, event, operation, process or item whose operation can significantly affect human,
equipment, facility or environment safety.
Note: Vital functions are a subset of safety-critical functions. (49 CFR Part 236)
A term applied to a system or function, the correct performance of which is critical to safety
of personnel and/or equipment; also a term applied to a system or function, the incorrect
performance of which may result in an unacceptable risk of a hazard. (IEEE-1483)
Safety Validation A structured and managed set of activities, including analysis and test, which show that the
system, as specified and implemented, performs the intended functions and that those
functions result in overall safe operation. Validation answers the question, "Did we build the
riqht system?" (IEEE-1483)
Safety A structured and managed set of activities, including analysis and test, which show that the
Verification system, including its subsystems, interfaces and components, as deSigned and
implemented, meets the allocated system safety goals and requirements. Verification
answers the question, "Did we build the system riqht?" (IEEE-1483)
Vital Function A function in a safety-critical system that is required to be implemented in a fail-safe
manner. Note: Vital functions are a subset of safety-critical functions. (IEEE-1483)

- 10-
1.6 Applicable Documents
The following are referenced in this document and are listed to provide more information on a
particular system safety subject or were used as background material to provide elements of this
plan.
[1] MIL-STD 882C, System Safety Program Requirements, 19 January 1993 with Notice 1, 19
January 1996
[2] IEEE Standard 1483-2000, "Standard for the Verification of Vital Functions in Processor-based
Systems Used in Rail Transit Control"
[3] 49 CFR 228, 235, 236A thru 236G, Federal Railroad Administration, Rules, Standards, and
Instructions for Railroad Systems.
[4] 49 CFR 236, subpart H, March 5, 2005
[5] 49 CFR 236, subpart I, Jan 15, 2010
[6] AREMA C&S Manual of Recommended Practices 2010
Product Document references (for confidentiality and restriction of use refer to Appendix A, section 6):
[7] SDTC Generic Product Safety Case
[8] SDTC Requirement Specification
[9] SDTC Preliminary Hazard Analysis
[10]SDTC Architecture Description
[11]SDTC Schematics and Part List
[12]SDTC Hardware Technical Specification
[13]SDTC Hazard Analysis
[14]SDTC Hardware Safety Verification
[15]SDTC Hazard Log
[16]SDTC Maintenance Manual
[17]SDTC Application Conditions
Note: For dated references, only the edition cited applies. For undated references, the
latest edition of the reference document applies, including amendments.
1.7 PSP Document Organization
The scope of this PSP Document is to identify the documentation and analyses from the existing
Generic Product Safety Case [7] necessary to fulfill the requirements of each of the 20 parts of the
PSP as described in 236H.
The PSP Document also clarifies which configuration from Generic Product Safety Case [7] (when
different options exist) is used for the specific PATH application project.

- 11 -
12 INTRODUCTION
The Product Safety Plan (PSP) is intended to be a Port Authority Trans Hudson (PATH) document
written in response to, and intended to be compliant with, the PATH Positive Train Control Safety
Plan (PTCSP). The PSP is also responsive to applicable Federal Railroad Administration (FRA)
regulations under 49 CFR Part 236 Subpart H for the processor based equipment. The Secondary
Train Detection System (and rail continuity detection) to be used on PATH CBTC Signal Project-
ATC Project # 4600008007 is comprised of interlocking, train detection and peripheral equipment.
This plan is focused specifically on Alstom's SDTC product and its use for generic train detection in
connection with interlocking controller.
The PSP will identify the level of adherence of the generic product to the safety requirements
identified within 236H by providing the requisite evidence including safety analyses and other design
and operating documentation that support the conclusion that the SDTC interlocking system is
acceptably safe. The PSP comprises 20 parts as called for by the FRA Rule 49 CFR Part 236
Subpart H (236H), including a summary of conclusions.
The Train Detection subsystem components comprising SDTC that perform safety-critical functions
are:
1. Train detection;
2. Broken rail detection
3. Track to train transmission, when the train occupies the track circuit (Not Implemented for
PATH application project)
Alstom, the supplier for the SDTC product, is primarily responsible for the documentary evidences
that are required to fulfill the safety requirements of 236H specifically for the generic SDTC Track
Circuit product, in support of PATH. PATH shall be responsible overall for the implementation of this
PSP, as it relates to application of the SDTC product on its property.
The full PSP deliverable for PATH contains three main elements:
• a summary document identifying 236H requirements, applicable references to SDTC safety
evidence that satisfies the requirements and summary/conclusion on the requirement
• a SDTC generic product safety case which provides detailed information on the full SDTC
product and
• other appendices of all evidences required to meet the requirements of 236H.

- 12 -
SDTC HIGH LEVEL OVERVIEW

I
3.1 SDTC Foundation - DIGICODE Product Family
SDTC is an electronic product of the DIGICODE family that realizes the following safety functions
when connected to a Track Circuit (TC):
1. Train detection;
2. Broken rail detection
3. Track to train transmission, when the train occupies the track circuit (Not Implemented for
PATH application project)
On output towards IXL system, SDTC provides the indication of the Clear/Occupied state of the
Track Circuit. In case of broken rail SDTC provides the occupied indication.
A breakdown of the SDTC product is showed in Figure 1.
Impedance Bound also called Electrical Joint Impedance Bound also called Electrical Joint
,. .,
CONNECTION CABLES
1 /~
_1 ~E~~ _______________________ -1 ________ _
1TECHNICAL ROOM ..---_ _ _--'1_ _ _ _ _--'-_ _ _ _-,
SDTC PROCESSING UNIT
ATC/ATP Data
ATC I ATP
(e.g. SACEM) (e.g. ZLCNPI or Relay)
Figure 1 - SDTC breakdown
Important Note: for PATH application project the Interlocking is iVPI and ATC/ATP Data is not used.
PATH - Smartway Digital Track Circuit <7011194-2.0-08-04-01 >

- 13 -
The SOTC product is divided into two parts:

1. The Processing Unit that are housed in the Train Control Room (Technical Signaling Room)
2. The Field Circuits that are located outdoor, where the track circuit signal is transmitted and
received
The Processing Unit realizes the following main functions (only the functions used in PATH
application are listed):
• Generation and transmission of the audio-frequency signal towards Field Circuits
• Reception of the audio-frequency signal coming from Field Circuits
• Generation of the occupied/clear indication towards interlocking system
• Generation of diagnostics data towards diagnostic system (e.g. CEOO).
The Field Circuits include (only the functions used in PATH application are listed):
• Impedance Bonds (also called Electric Joints) located at the two extremities of the track circuit
and at the end of diverted branches;
• Tuning Units located at the two extremities of the track circuit and at the end of diverted
branches;
• Connection Cables connecting the Technical Room and the track circuit tuning units.
The Impedance Bonds limit the track circuit extremities. These are represented by two parallel "S"-
shaped conductors, which are fixed to the rails. A Tuning Unit is present for each Impedance Bond.
The Tuning Unit is laid on the ballast next to the rail and connected, via three conductors, to the two
rails and to the center of the Impedance Bond.
At the track circuit end in which the signal is injected, only a minimum part of the useful energy
couples into the neighboring track circuit; likewise, at the track circuit end from which the signal is
received, almost all the useful energy is transferred from the track to the Connection Cable.
In order to ensure that the signal coming from another track circuit does not overlay the useful
signal, the signal frequencies are diversified. Impedance Bond and Tuning Unit are composed by
two separate parts related to the two adjacent track circuits. The two adjacent track circuits operate
at different frequencies and different protection coding. One part is dedicated to the transmission
and the other to the reception.
As described in the previous section SOTC product has been designed with a part (named
Processing Unit) placed in the Train Control Room (Technical Signaling Room) and other equipment
(e.g. Tuning Units) installed outdoor near to the track circuit.
The following figures provide the block diagrams related to a track circuit with and without diverted
branches.

- 14 -
iVPI ,-----------------------------------------------------------------
~}~~~~~~~~~~~~~~~~~~~~~~~~~=~~=~:v~~~~===========================IJ-=~~------~
: Filte Tx Board : Rx Board
: : Filte
: : ~
l :,, ~
------------ ----------------- ---------------------------------------- -----
------ --------------~oCien1t3oard--------------------------- ------ --------:

,
MSK
Demodulator
,
------------------------------- ---------- ---------
(SACEM
base band)
r----------------- ------------------------------- ---------- --------~
:, RT Board ,,
,, ,,
Clear (1) /:
o ,,
,,
,,
Occup.(O) ,
Delay
o
etw. f - - - - - - - - - + -__ IComparator
Figure 2 - SDTC main line block diagram

- 15 -
Main Line Tx-Rx Switch

----------------------------~
, ~----------------------------- ---------------------
Tx Loop ,,
Filte Rx Switch
Board Board
Amplifier
,,
-------- --------------------
,
~--------------------------------------------------------------------------
Modem Switch
Board
MSK
Demodulator
,
---------------------
Modem Main Line Board

(SACEM
Code Generator
base band)
1-----------------
, ---------,
,
, RT Switch o
Clear (1) /: Board
Occup.(O) 1 Delay 0
etw. t--_ _ _ _ _ _-I-~IComparator
,
,
________________________________________________________________________ 1
'
Figure 3 - SDTC with diverted branch block diagram
Safety Architecture & Safety Assurance (ref. [7]): the Intrinsic (also called inherent) Fail Safe
hardware Architecture (Class I hardware) has been adopted to realize all the Vital functions (TX, RX,
RT, Impedance Bond also called Electric Joint, TU, Mother Board and L1U hardware part involved).

- 16 -
In detail (refer to Figure 2 and 3):
• The MODEM board reads the protection message jumper configuration and sends to the TX
board a 200-bit coded message. The transmission of the same message is repeated
continuously. At the same time, MODEM sends the 200-bit coded message to the RT board
which uses it as reference to verify the correctness of the protection code extracted from the
signal received from the Track Circuit (Numerical Assurance for coding strategy and Safety
Related Software i.e. SIL2).
• The RX board receives the signal from the track circuit and amplifies it. RX sends to the RT
board the rectified signal proportional to the amplitude of the signal received from the Track
Circuit. The TX-Rx switch for reversing Direction Of Traffic is not used in PATH application.
• The RT board receives the protection code extracted from the signal received from the Track
Circuit and compares it bit by bit with the Reference Code verifying the correctness (coding
safety key). If the result is positive a rectified signal is sent to a delay circuit and then to a 20KHz
generator circuit. This 20KHz signal is one of the inputs of the AND function of RMS component.
RMS is an electromagnetic component (based on the saturation of permanent magnet) that
allows the transfer of the 20kHz signal only if a DC voltage is present on a dedicated winding.
When this DC voltage is greater than a fixed value, the RT provides the clear Track Circuit
indication. Below this threshold the Track Circuit occupied indication is provided (amplitude
safety key). On the occupied/clear output indication RT board implements also an activation safe
delay of 1s. In conclusion the RT card provides the Track Circuit clear indication only:
o If the comparator circuit does not find errors on the protection message received from
Track Circuit, and
o If the amplitude of the signal received from the Track Circuit is greater than the RMS
component threshold.
• The principle of operation of Impedance Bond and Tuning Unit (ref. Figure 4) is based on a
resonant parallel circuit, represented by the inductance of the 'semi-joint' Chalf-joint') cable and
the capacitor housed in the Tuning Unit. The resonant parallel circuit solution guarantees that
the voltage transmitted or received does not increase in case of hardware failures.
In order to realize the Joint directionality, the extra-resonant current that flows in the reactive
elements of the parallel resonant circuit generates, on the rails of the semi-joint in the direction
other than the one in which the signal should be addressed, two induced voltages that blocks the
signal propagation towards the not correct direction. To avoid interference between adjacent
track circuits different frequencies and different protection messages are configured in the field.
calibration Connection cables
---.----(~:~ I
tuning
I
o--~I__________~6' ____ ~ \ semi-joint
Tuning Box
Figure 4 - Impedance Bond and Tuning Unit resonant circuit

- 17 -
• The LlU (Loop Interface Unit) interfaces the loop cables installed on diverted branches to allow the
message track to train transmission also in the switch zone. It is not used in PATH application.
3.2 Safety Methodology for SDTC

The SDTC safety lifecycle has been divided into the phases indicated in Table 1, where the
relationship between the safety lifecycle stages and the product lifecycle stages are highlighted.
The followed lifecycle is a V cycle, with the requirement specification, architecture and detailed
project and development stages as downward stages and the integration and validation stages as
upward stages. For each of these stages, the required Verification & Validation activity is provided
through the Safety Lifecycle (for supporting documentation, refer to Appendix section 6).
SDTC lifecycle phase Safety Lifecycle Activity
Subsystem Planning Safety Planning and Safety Requirement Allocation:
• Release of the Safety and V& V Plan document
• Release of the Documentation Plan document
Subsystem Hazard Identification, Preliminary Hazard and Countermeasure Analysis, Safety Requirement
Requirements Specification, Requirement Verification, Hazard Log Initialization.
• Release of the Preliminary Hazard Analysis document
• Release of the Safety Requirement Specification, contained in the Subsystem Requirements

Specification document
· Release of the Subsystem Requirements Verification Report document
Subsystem Architecture Preliminary RAM Analysis, Hazard Analysis, Functional Test Definition, Architecture and Design
Verification, continuation of Hazard Logging.
• Release of the RAM Analysis document
• Release of the Hazard Analysis document
• Release of the Functional Test Plan document
• Release of the Architecture Verification Report document
Hardware Life Cycle HW Requirement Verification, Hardware Safety Tests, HW Validation, continuation of Hazard
Logging.
• Release of the HW Requirements Verification Report document
• Release of the HW Safety Verification document
• Release of the HW Validation Report document
Software Life Cycle No new software for SDTC has been developed. SDTC uses the same software version (SIL2)
refer to the safety case [7], of the other DIGICODE family products (e.g. the same software
version of DTC24-1 is running on DIAG board and the same software version of DTC24-1 and
DTC24-2 is running on MODEM board ).
The SW is univocally identified by a part number, having the structure and the format of the part
numbers used for the HW components. Such a part number is included in the parts list of board
in which it is loaded.

- 18 -
SOTe lifecycle phase Safety Lifecycle Activity
Subsystem Integration Completion of RAM Analysis, Functional Test Application, Type Testing Definition and
Application, continuation of Hazard Logging.
• Release update of the RAM Analvsis document
• Release of the Type Test Plan document
• Release of the TyPe Test Report document
• Release of the Functional Test Report document
Subsystem Validation Final Hazard Analysis, Product Validation, finalization of Hazard Log, demonstration of Safety
Level reached:
• Release update of the Hazard Analysis document to include the Safety Target Evaluation
figure
• Release of the Hazard Log document
• Release of the Validation Report document
• Release of the Safety Case document
Table 1 - Safety Lifecycle Activities
Note: for confidentiality and restriction of use refer to Appendix A, section 6.
3.3 SDTC Product Overview For PATH

As shown in the Figure 5 and in case of a Track Circuit without diverted branches, SDTC is
composed by the following boards (or LRUs):
Processing Unit (no diverted branch - all boards located in the same rack):
• TX/RX MAIN BOX including:

o TX Board
o RX MAIN Board
• RT Board
• Modem Board
• DIAG Board
• Empty Rack
• Power Conversion Unit
Field equipment
• Tuning Unit (TU)

- 19 -
EJ .. .. EJ
T T
..
TU
..
TU
t ·-T
TX - RX Switch RX Board
TX Board
..
Generated " i Received diglcode
dlglcode signal I signal
T
Modem Board
Denied I Received diglcode

digicode ' signal
signal
T :t
RT Board
T
SACEM Free/Occupied
Message
Figure 5 - SDTC boards without diverted branches
To manage a track circuit containing switch, an additional Process Unit assembly for each switch is
needed, including the following boards:
Processing Unit (diverted branch - all boards located in the same rack):
• RX SWITCH BOX including:
o RX SWITCH Board
• RT Board
• Modem Board
• DIAG Board
• Mother board
• Empty rack
The following paragraphs provide the hardware structure of the SDTC product and the identification
of each part. Each part is univocally identified by an alphanumeric code.

- 20 -
3.4 SDTC Product Structure: Identification of Hardware for PATH
:) , G ,_:
Figure 6 - Rack front view
Figure 7 - Rack rear view (Power Conversion Unit)
Processing Unit
Tar MAIN Box· Drawer

Part Number Name Note
NS97 164 610L rev. B TX RX SOTC GRUPPO 07 GRUPPO: Group
NS97 164 611M rev. B TX RX SOTC GRUPPO OS
NS97 164 612N rev. B TX RX SOTC GRUPPO 09
NS97 164 613P rev. B TX RX SOTC GRUPPO 10
NS97 164 614Q rev. B TX RX SOTC GRUPPO 11
NS97 164 615R rev. B TX RX SOTC GRUPPO 12
NS97 164 616S rev. B TX RX SOTC GRUPPO 13
NS97 164 617T rev. B TX RX SOTC GRUPPO 14
PATH - Smartway Digital Track Circuit < 7011194-2.0-0S-04-01 >

- 21 -
Rx SWITCH Box' Drawer
N897 164 650D CASS RX SDTC SWITCH 07
N897 164651 E CASS RX SDTC SWITCH 08
N897 164 652F CASS RX SDTC SWITCH 09
N897 164 653G CASS RX SDTC SWITCH 10
N897 164 654H CASS RX SDTC SWITCH 11
N897 164 655K CASS RX SDTC SWITCH 12
N897 164 656L CASS RX SDTC SWITCH 13
N897 164 657M CASS RX SDTC SWITCH 14
TX Board (TX SDTCD)

N897 16851 OZ rev. B TX 07 HF 3
N897 168 511A rev. B TX 08 HF 3
N897 168 512B rev. B TX 09 HF 3
N897 168 513C rev. B TX 10 HF 3
N897 168 514D rev. B TX 11 HF 3
N897 168 515E rev. B TX 12 HF 3
N897 168 516F rev. B TX 13 HF 3
N897 168 517G rev. B TX 14 HF 3
RX MAIN board (RX SDTC MAIN)

N897 164 516H RX 07 SDTC MAIN
N897 164 517K RX 08 SDTC MAIN
N897 164 518L RX 09 SDTC MAIN
N897 164 519M RX 10 SDTC MAIN
N897 164 520N RX 11 SDTC MAIN
N897164521P RX 12 SDTC MAIN
N897 164 522Q RX 13 SDTC MAIN
N897 164 523R RX 14 SDTC MAIN
RX SWITCH board (RX SDTC SWITCH)

N897 164 524S RX 07 SDTC SWITCH
N897 164 525T RX 08 SDTC SWITCH
N897 164 526U RX 09 SDTC SWITCH
N897 164 527V RX 10 SDTC SWITCH
N897 164 528W RX 11 SDTC SWITCH
N897 164 529X RX 12 SDTC SWITCH
N897 164 530Y RX 13 SDTC SWITCH
N897 164 531Z RX 14 SDTC SWITCH

AlST'':;;''M
(J.
- 22 -
RT SOTC (RT NOV 3 SOTC)
N897 092 520B RT NOV 3 SOTC
MOOEM SOTC (MOOEM HF 2 SOTC

N897 163 5100 MOOEM HF 2 SOTC
OIAG SOTC (OIAG 2 SOTC)

Part Number Name I Note I
N897 093 012M OIAG SOTC I I
Mother board SOTC (MB SOTC)
Part Number Name I Note I
N897 162 510C MB SOTC I I

P700 338 KOOG CEST.COB OIGITALE SOTC
Power Conversion Unit

P700 338 A20V Not Used for PATH
P700 338 A30F CASSETTO POWER CONV 110v 110 VAC 50-60 Hz input
PATH - Smartway Oigital Track Circuit < 7011194-2.0-08-04-01 >

- 23 -
Track side equipment

TUning Unit - vertical position
P699 044 020Z CASS SINT 921 F07 F09 HF 3 VERTICALE
P699 044 021A CASS SINT 921 F07 F11 HF 3 VERTICALE
P699 044 022B CASS SINT 921 F07 F13 HF 3 VERTICALE
P699 044 023C CASS SINT 921 F09 F11 HF 3 VERTICALE
P699 044 0240 CASS_SINT_921 - F09J13_HF _3_VERTICALE
P699 044 025E CASS SINT 921 F11 F13 HF 3 VERTICALE
P699 044 026F CASS SINT 921 FOS F10 HF 3 VERTICALE
P699 044 027G CASS SINT 921 FOS F12 HF 3 VERTICALE
P699 044 02SH CASS SINT 921 FOS F14 HF 3 VERTICALE
P699 044 029K CASS SINT 921 F10 F12 HF 3 VERTICALE
P699 044 030L CASS SINT 921 F10 F14 HF 3 VERTICALE
P699 044 031 M CASS SINT 921 F12 F14 HF 3 VERTICALE
P699 044 032N CASS SINT 921 F07 F10 HF 3 VERTICALE
P699 044 033P CASS SINT 921 FOS F11 HF 3 VERTICALE
T unmQ
. U·t
nl - h ·
onzon t i lIon
a POSI
P699 044 B20G CASS SINT 921 F07 F09 HF 3 ORIZZONTALE
P699 044 B21 H CASS SINT 921 F07 F11 HF 3 ORIZZONTALE
P699 044 B22K CASS SINT 921 F07 F13 HF 3 ORIZZONTALE
P699 044 B23L CASS SINT 921 F09 F11 HF 3 ORIZZONTALE
P699 044 B24M CASS SINT 921 F09 F13 HF 3 ORIZZONTALE
P699 044 B25N CASS SINT 921 F11 F13 HF 3 ORIZZONTALE
P699 044 B26P CASS SINT 921 FOS F10 HF 3 ORIZZONTALE
P699 044 B27Q CASS SINT 921 FOS F12 HF 3 ORIZZONTALE
P699 044 B2SR CASS SINT 921 FOS F14 HF 3 ORIZZONTALE
P699 044 B29S CASS SINT 921 F10 F12 HF 3 ORIZZONTALE
P699 044 B30T CASS SINT 921 F10 F14 HF 3 ORIZZONTALE
P699 044 B31 U CASS SINT 921 F12 F14 HF 3 ORIZZONTALE
P699 044 B32V CASS SINT 921 F07 F10 HF 3 ORIZZONTALE
P699 044 B33W CASS SINT 921 FOS F11 HF 3 ORIZZONTALE
Tuning board (C SINT 921 HF BOARO)

NS97 120 140Y C.SIN HF 3 F07 F09
NS97 120 141Z C.SIN HF 3 F07 F11
NS97 120 142A C.SIN HF 3 F07 F13
NS97 120 143B C.SIN HF 3 F09 F11
NS97 120 144C C.SIN_HF _3J09J13
NS97 120 1450 C.SIN HF 3 F11 F13
PATH - Smartway Oigital Track Circuit < 7011194-2.0-0S-04-01 >

- 24 -
N897 120 146E C.SIN HF 3 F08 F10
N897 120 147F C.SIN HF 3 F08 F12
N897 120 148G C.SIN HF 3 F08 F14
N897 120 149H C.SIN HF 3 F10 F12
N897 120 150K C.SIN HF 3 F10 F14
N897120151L C.SIN HF 3 F12 F14
N897 120 152M C.SIN HF 3 F07 F10
N897 120 153N C.SIN HF 3 F08 F11
Boxes for Tuning Unit

P699044B01M CdS per SOTC (mont. orizzontale) Horizontal mounting
P6990440010 CdS per SOTC (mont. verticale) Vertical mounting
Impedance Bond (also called Electrical Joints)

P699043AOOQ POSA GIUNTO "S" OTC921 S bond
P699087AOOR GIUNTO "S" 01 LINEA MM1-VERTICALE A MURO Vertical mounting
P699087BOOZ GIUNTO "S" 01 LINEA MM1-VERT.SOTTOBANCH. Vertical mounting
P699049AOOM POSA GIUNTO TERM. OTC921 TerminalJoint
P699049A01N POSA GIUNTO TERM. OTC921 Terminal joint 2 loops
P699087EOOA GIUNTO TERMINALE-VERTICALE Terminal joint under the platform
SOTTOBANCHINA
P699087000S GIUNTO TERMINALE-VERTICALE A MURO Terminal joint on the wall lonq distance
P699050AOOY GIUNTO CORTO CIR.OTC921/E Short CircuitjOint
3.5 SOTe Product Structure: Identification of Software

MODEM and the DIAG boards are the only boards equipped with Software, identified by the part
number reported in the following table.
Board litem Name Part Number
MOOEM Software MPEPROM87C51 COOCOB96- 1.0 T807 091 110R
OIAG Software 27C256/0IACOB96_2.3 1 T807 093 310G
Table 2 - MODEM and DIAG Software Identification

- 25 -
14 PSP SUBMITTAL DEFINITION BY 236H REQUIREMENT I

The following describes the general objective of each PSP requirement, referencing §236.907 and
providing the proposed product safety documentation references, when applicable, that will be used
to illustrate adherence of the SOTC safety documentation to each §236.907 requirement.
For each 236.907 requirement, a general structure is shown in Table 4-1:
Table 4-1 PSP Overview per PSP Requirement
Su mental: Further clarification of uirement
How uirement is a of PSP
Asum uirement
The SOTC Submittal Name that will be used for

PSP Reference Name: the PSP deliverable
Reference '{ }' to section of SOTC full product
Generic Safety Case Reference Ooc / safety case [7] that is relevant to PSP
Section: irement
SOTC/vPI Safety Archive Ooc / Section Reference documents to be used to support

icabl : fulfillment of uirement
Sum / Conclusions Summ of how PSP uirement is satisfied

AlST f?)'lM ($:WM '
- 26-
4.1 SDTe System Description
236H Reference: §236,907(a)(1 )
Requirement: A complete description of the product, including a list

of all product components and their physical
relationship in the subsystem or system
PSP Reference Name: SDTC High Level Architecture/System Description
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {1 ,2} {1.3} {4.2}
and {4.3}
Safety Archive Doc:

SDTC Requirement Specification
SDTC Architecture Description
SDTC Schemes and Part List
SDTC PHA (Preliminary Hazard Analysis)
Summary/Conclusion
SDTC system documentation is briefly described in section 3 as it generally applies to PATH. More
detailed system descriptions are referenced in the SDTC Generic Product Safety Case.
In detail:
The SDTC Schematics and Part List document [11] includes the list of all SDTC product
components.
The SDTC Requirement Specification [8] and the SDTC Architecture Description [10] define in
some detail the functions and the interactions of SDTC with the interfaced system.
These documents are a source of information for the FFT/FTA fault identification (ref. Hazard
Analysis document [13]) and depends in large measure on the functional descriptions provided.
FFT/FTA references each fault to the hazards identified by the PHA document [9].

- 27 -
4.2 General Railroad Operations
Part 236H Reference: §236.907(a)(2)
Requirement: A description of the railroad operation or categories of

operations on which the product is designed to be
used, including train movement density, gross
tonnage, passenger train movement density,
hazardous materials volume, railroad operating rules,
and operating speeds.
Interpretation: As SDTC is a generic product, it is intended that the

Railroad Operations component of this PSP will be
limited to the general application of the product such
as in Section 3.5.
Descriptions of the application of the train detection
and rail continuity detection are considered covered
by Invensys as part of meeting overall Secondary
Train Detection System (STDS) safety requirements.
PSP Reference Name: General Railroad Operations (Generic Application)
Generic Safety Case Reference SDTC Generic Product Safety Case {2.15} and {4.6}
Doc/Section:
Safety Archive Doc: SDTC Application Conditions
Summary/Conclusion
The operator who mostly interacts with the SDTC product is the maintenance operator.
The methods with which the operator must interact and the maintenance information is contained in
SDTC Maintenance Manual [16).
All restrictions and precautions for the correct product use are formalized in the Application
Conditions document [17) and the only safety related ones are present in the section {4.6} of SDTC
Generic Product Safety Case.
PATH operational view to be provided outside of this generic Product Safety Plan.
For generic SDTC operation refer to section 3.1

SOTe 17 February 2012
- 28 -
4.3 Concept of Operations
Reference: §236.907(a)(3)
Requirement: An operations concepts document, including a

complete description of the product functionality and
information flows.
PSP Reference Name: SDlC Concept of Operations (CONOPS)
Generic Safety Case Reference SOlC Generic Product Safety Case {4.3}, {4.4} and
Doc/Section: {4.5}
Safety Archive Ooc:

SOlC Preliminary Hazard Analysis
SDlC Architecture Description
SOTC Hazard Analysis (including FFT/FTA)
Summary/Conclusions
SDTC Generic Product Safety Case, sections {4.3} {4.4} and {4.5} describe the Concept of
Operation of SOTC and demonstrate its safe operation under degraded modes.
The section {4.3} describes the SDTC Assurance of Correct Functional Operation.
The section {4.4} describes the SOTC guaranteed and safe operation under Effects of Faults
(including the Tolerable Hazard Rate 1.72 E-12 / h that is AREMA compliant).
The section {4.5} describes the SOTC Operation with External Influences.
The SOTC Generic Product Safety Case refers also to the SOTC documents (Requirement
Specification [8], SOTC Architecture Description [10] and Hardware Technical Specification [12]) that
define the complete set of functions performed in operating the Track circuit control, forming the
basis of discovering and identifying all the potential hazards associated with signaling operations.
The high level identification of potential hazards in the PHA [9] and their subsequent expansion in
the FFT/FTA (included in SOTC Hazard Analysis [13]) will rely heavily on the completeness of the
description of operational scenarios and other information contained in the ConOps. To this end,
traceability will be maintained between the ConOps and the PHA and FFT.

- 29 -
4.4 Safety Requirements
Requirement: A safety requirements document, including a list with

complete descriptions of all functions which the
product performs to enhance or preserve safety.
PSP Reference Name: SDTC Safety Requirements
Generic Safety Case Reference SDTC Generic Product Safety Case {3.2}, {3.6}, {3.7},
Doc/Section: {3.8} and {3.9}
Safety Archive Doc: SDTC PHA (Preliminary Hazard Analysis)
Other References: SDTC Requirement Specification (it includes PHA

identified Safety Requirements)
Summary/Conclusion:
SDTC Generic Product Safety Case, sections {3.2} and from {3.6} to {3.9} describe the complete
Safety Management of SDTC Safety Requirements.
Sections {3.2} and {3.6} describes and demonstrates evidence of compliance to the Safety
Requirement Specification including the Design Review and Safety Review processes presented in
sections {3.7} and {3.8} of SDTC Generic Product Safety Case.
The description of the management of the Safety Requirement is completed by the dedicated
section {3.9} describing the Safety Verification and Validation Process in place for SDTC.
As reported in the Preliminary Hazard Analysis document [9] the safety requirements for the SDTC
project were identified following the hazard identification, the risk classification and assessment and
the Safety Integrity Level assigning process. All the requirements, including the safety requirements,
are reported in the SDTC Requirements Specification document [8].
The main functions of the SDTC Product are to provide for PATH application:
1. To provide Train Detection / Secondary Train detection for CBTC.
2. Rail continuity detection (broken rail detection)

- 30 -
4.5 Safety Architecture
Requirement: A document describing the manner in which product

architecture satisfies safety requirements.
PSP Reference Name: SDTC Safety Architecture
Safety Case Reference SDTC Generic Product Safety Case {4, 4.2, 4.3 and
Doc/Section: 4.4}
Safety Archive Doc: SDTC Hazard Analysis (including FFT/FTA)
SDTC Hardware Safety Verification
Summary / Conclusions
SDTC Generic Product Safety Case sections {4.2} {4.3} and {4.4} describe the SDTC safety
architecture with the Concept of Operation (CONOPS) of SDTC and demonstrate its safe operation
under failures conditions.
The activities performed in the SDTC Hazard Analysis [9] have verified if the hardware and
functional architecture is suitable to achieve the safety target. The analysis has been performed
using a FMEA based on the functional/architectural decomposition of the product provided by the
Design Specifications which identify a list of countermeasures more detailed than the ones identified
by Preliminary Hazard Analysis.
A Fault Tree Analysis was also carried out to analyse the effects of multiple faults. Referring to the
Hazard Analysis [9] the SDTC Unsafe Failure Rate is equal to 1.72 E-12 I h; therefore SDTC
satisfies the SIL4 safety target as defined by EN50129 standard and compliant with AREMA.
The activities performed in the Hardware Safety Verification [14] have verified that no single failure
can lead to potentially unsafe behavior, performing FMEA single fault analysis, safety failure tests
and the verification of the creepage and clearance distances with respect to the EN50124-1
standard.
With reference to the Hardware Safety Verification document [14] the following SDTC safety
functions have been identified and analyzed referring to the related safety requirements (derived
from Requirement Specification and from Hazard Analysis):
• Operator Safety
• Track Circuit indication (Clear/Occupied)
• Broken rail check
Therefore the HW blocks/circuits listed in the following table have been analyzed with respect to the
single and multiple hardware failures.

- 31 -
Board / Assembly Safety Functions involved Functional Block / Circuit Safety Critical {YIN]
Track Circuit indication Cable Adaptation Y
(Clear/Occupied) RX filter Y
RX board
Broken rail check
Amplifier Y
ACIDC Converter N
Track Circuit indication Delay Network Y
(Clear/Occupied) Comparator Y
Broken rail check RMS Y
RT board Delayer Device 1 Y
20kHz Generator Y
Branch Receiver Y
Delayer Device 2 Y
Operator Safety Power Output Y
Track Circuit indication TX Filter Y
TX board (Clear/Occupied) ACIDC Converter Y
Broken rail check
Soft Start Power N
Data Transmission from rail to train
Track Circuit indication Code Generator N
(Clear/Occupied) Modulator N
MODEM board
Broken rail check;
Demodulator N
Operator Safety
Motherboard Motherboard Y
Operator Safety
Track Circuit indication
Power Conversion Unit PCU N
(Clear/Occupied)
Operator Safety Tuning Unit (TX and RX) Y
Track Circuit indication
Field Devices
(Clear/Occupied) Loop Interface Unit Y
Broken rail check
Safety Architecture & Safety Assurance are based on the Intrinsic (also called Inherent) Fail Safe
hardware Architecture (Class I hardware) and Numerical Assurance for Coding Strategy with Safety
Related Software for Class II hardware (refer to section 3.1 for detail description)

AlST(,)M - 32 -
4.6 Hazard Log
Requirement: A hazard log consisting of a comprehensive

description of all safety-relevant hazards to be
addressed during the life cycle of the product,
including maximum threshold limits for each hazard
(for unidentified hazards, the threshold shall be
exceeded at one occurrence).
PSP Reference Name: SDTC Hazard Log
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {3.5}
Safety Archive Doc:

SDTC Hazard Analysis (including FFT/FTA)
SDTC Hazard
Summary / Conclusions
SDTC Generic Product Safety Case, section {3.5} describes the Hazard Log management
applicable for SDTC product.
Only those hazards associated with a general application of SDTC for Train Detection (and rail
continuity detection) should be considered for PATH application.
Hazard Logging activity is carried out formally by means of the production and updating of a
database structured to collect and handle the data regarding all the applicable hazards, the relative
countermeasures and, in general, the state of the activities and all the SDTC safety-related
information. The Hazard Log document reports that all the applicable hazards have been recorded
and closed.
Closure of all hazards for the SDTC product is required prior to allow the SDTC entering revenue
service.

- 33 -
4.7 Risk Assessment
Reference: §236,907(a)(7), §236,909(c), (d), (e), Appendix B
Requirement: See 49CFR 236 §236, 909 and Appendix B to said

part; Supplier scope
'" The probability of failure for each hazard of the
product is equal to or less the corresponding
recommended Specific Quantitative Hazard
Probability Ratings classified as more favorable than
"undesirable" by AREMA Manual Part 17.3,5",
Interpretation: Supplier scope only i.e, This PSP does not cover the
safety analysis included in the railroad's PSP which
must establish with a high degree of confidence that
introduction of the product will not result in risk that
exceeds the previous condition,
PSP Reference Name: SDTC Risk Assessment
Safety Case Reference Doc/Section: SDTC Generic Safety Case {3,2}, {3,6}, {4,3} and
{4A}
Safety Archive Doc:

Summary Conclusion
SDTC Generic Product Safety Case, section {3,2} describes the complete safety life in order to
support Risk Assessment
SDTC Generic Product Safety Case, sections {3,6} describes the management of the Safety
Requirement Specification including the Risk Assessment Process,
The section {4,3} describes the SDTC Assurance of Correct Functional Operation providing the
result of safety analysis,
Finally, section {4A} describes the SDTC guaranteed and safe operation under Effects of Faults
including the Tolerable Hazard Rate 1.72 E-12 I h compliant with AREMA
PATH - Smartway Digital Track Circuit < 7011194-2,0-D8-04-01 >

Product Safety Plan Rev, 2,2
- 34 -
4.8 Hazard Mitigation Analysis
Requirement: A hazard mitigation analysis, including a complete

and comprehensive description of all hazards to be
addressed in the system design and development,
mitigation techniques used, and system safety
precedence followed, as described by the applicable
PTCSP.
Interpretation: This covers the product design based on perceived

hazards at the product level. The FFT/FTA reveals
faults as terminal events and the SDTC Safety
Analysis provides mitigations. This is not linked to the
RRSP at this level.
PSP Reference Name: SDTC Hazard Mitigation Analysis
Safety Case Reference Doc/Section: SDTC Generic Safety Case {3.2} and {3.5}
Safety Archive Doc:

Summary/Conclusions
SDTC Generic Product Safety Case, section {3.2} describes the complete safety life in order to
support Hazard Mitigation Analysis throughout the SDTC Preliminary Hazard Analysis, Hazard
Analysis, FTA and Hazard Log {3.5}.
The reduction of the identified hazards has been demonstrated compliant to the required targets
using qualitative and quantitative techniques. The evidence for the safety of the SDTC product in
case of hardware random and systematic faults occurrence has been provided through the
following performed analyses and tests:
• The activities performed in the Preliminary Hazard Analysis that have identified the list of
hazards applicable to the subsystem and the list of the safety countermeasures to be
implemented by the product to reduce the risk related to the identified hazards.
• The activities performed in the Hazard Analysis, which have verified if the hardware and
functional architecture is suitable to achieve the related safety target. The analysis has been
performed using a FMEA technique based on the functional/architectural decomposition of the
subsystem provided by the Design Specifications, identifying a list of countermeasures more
detailed than these ones identified by Preliminary Hazard Analysis.

- 35 -
• A Fault Tree Analysis was also carried out to analyse the effects of multiple faults. All potential
hazardous failures are detected and SDTC forces itself into a safe state with an unsafe failure
rate of 1.72 E-12 I h ; this value is in accordance to the target specified by the CENELEC
EN50129 standard and compliant with AREMA.
• The activities performed in the Hardware Safety Verification, that have verified that no single
failure can lead to potentially unsafe behavior were performing a FMEA technique single fault
analysis, safety failure tests and the verification of the creepage and clearance distances.
• The type testing activities that demonstrate the capacity of the SDTC to operate safely when
subjected to different external influences, inciuding electrical influences, mechanical influences,
and environmental conditions.
• The final overall assessment that is included in the Validation Reports and in the Hazard Log.
In this stage verification and validation activities were performed regarding systematic errors that
can involve the whole SDTC lifecycie including the design, the production, the operating and the
maintenance phases.
Regarding the design errors, verification and validation activities have been applied to all the
design steps following the requests and guidelines of the CENELEC Standards for integrity level
SIL4.
In relation to the possible errors during the manufacturing of the hardware parts and their
software configuration, all the verification and testing procedures have been defined and may be
applied, in addition to configuration management.
Regarding SDTC installation, configuration and maintenance aspects, the following documents
have been Released and verified:
• SDTC Installation Manual
• SDTC Maintenance Manual
• SDTC Test & Commissioning Manual
• SDTC Implementation Manual
• SDTC Application Conditions

- 36 -
4.9 SDTC Safety Verification
Requirement: A complete description of the safety assessment and

validation and verification processes applied to the
product and the results of those processes,
describing how subject areas covered in Appendix C
to this part are either: addressed directly, addressed
using other safety criteria, or not applicable.
Supplemental: Verification and validation requires forward planning
and, consequently, the PSP should identify the test
planning at each stage of development and the levels
of rigor applied during the testing process.
Interpretation: SDTC provides a full set of documentation to address

safety verification and adherence to 236H. V&V
efforts associated with SDTC are referenced here and
covered in section 4.17.
PSP Submittal Name: SOTC Safety Verification Testing Plans,

Procedures and Results
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {3.2} and {3.9}
Safety Archive Doc:

SDTC Product Development Documentation [14]
Summary/Conclusions
SDTC Generic Product Safety Case, section {3.2} describes the complete Safety Life Cycle.
section {3.9} describing the Safety Verification and Validation Process in place for SDTC. The main
safety verification activities can be summarizing as the following:
Safety Requirements Verification - This verification has considered aspects of quality, consistency,
readability and traceability, through the use of standard checklists and is documented in the SDTC
Requirement Verification Report.
Architecture Verification - This verification has considered aspects of quality, consistency, readability,
traceability and the testability of the functions implemented in relation to the requirements. These
aspects were standardized using special checklists. This Verification is documented in the SDTC
Architecture Verification Report.
HW Verification - This verification has checked the quality, the adequacy, the consistence of the
Hardware Technical Specification and of the Manufacturing documentation (e.g. Acceptance Test
Procedure). The results of this activity are included in the SDTC HW Validation Report.

- 37 -
Moreover the safety related circuits have been analyzed by a theoretical FMEA and, when needed,
safety tests, based on the failure inventory provided by the ORE155 and by the ANNEX C of
EN50129 standard, in order to verify that no single failure or failure chain can induce an unsafe
SDTC behavior. The results of this activity are included in the SDTC Hardware Safety Verification
document.
The verification of the compliance with the applicable standards regarding insulation distances of
safety related boards and regarding operator safety was also performed.
SW Verification SDTC uses the same software version - already validated - of the other DIGICODE
family products and therefore no additional verification, analysis or test was required.
Regarding the software installed in the MODEM board to generate the code message to be sent to
the Track Circuit and the diagnostic software installed on the DIAG board - both not safety related -
the activities performed for other DIGICODE products remain valid and applicable to SDTC.
These activities include the following:

• the verification and validation of defined software requirements and architecture,
• the verification of the source code respect the programming rules,
• the validation of the software testing activity.
Type Tests - Type tests have been performed in compliance with the applicable Standards and
Regulations. The test procedures including the test layout, methodology and acceptance conditions
are described in detail in the SDTC Type Test Plan and the results are included in the SDTC Type
Test Report.
Functional Tests - The functional tests have been performed to demonstrate the correct functionality
of the product under nominal operating conditions, e.g. without faults and under normal electrical
and environmental conditions. The functional test descriptions, procedures and results are reported
in the SDTC Functional Test Plan and in the SDTC Functional Test Report.
Subsystem Validation - The main activities executed in this phase are:
• The verification of the Type Testing activities, by the inspection of the Type Test Plan and Type
Test Report. The documents have been verified in order to verify the compliance to the
applicable standards and the consistence and correctness of the obtained results.
• The verification of the correct implementation of all subsystem requirements, split into functional
and not functional requirements. The verification of the functional requirements has been
provided in the Functional Test Plan and Functional Test Report. The verification of the not
functional requirements has been directly executed in the Validation Report in order to
demonstrate their correct implementation.
• The verification of the Application Conditions document was done by the check of the different
configurations, of their interfaces and of the possible use conditions within the overall system.
• The verification of the procedures of Installation, Maintenance and Test & Commissioning in
order to check the adequacy and consistence of all information provided and in order to check
that the possible design, safety and maintenance specifications and prescriptions have been
correctly taken into account.
• The verification of the compliance of all V&V cycle to the SDTC Safety and V&V Plan.
• The verification of all safety and design reviews executed on the subsystem project has been
completed correctly and all actions foreseen have been executed.

- 38 -
4.10 Safety Assurance Concepts
Reference: §236. 907(a)( 10)
Requirement: A complete description of the safety assurance

concepts used in the product design, including an
explanation of the design principles and assumptions.
PSP Reference Name: SDTC Safety Assurance Concepts
Safety Case Reference Doc/Section: SDTC Generic Safety Case {4.2}
Safety Archive Doc: NA
Summary/Conclusions
The vital functions have been designed accordingly with the intrinsic fail safe hardware technique as
defined in IEEE 1483 [2] (equivalent to inherent fail safe hardware technique as defined in the
EN50129 standard), in order to guarantee that a generic failure (random or caused by external
disturbances) does not cause an undue clear Track Circuit indication (Hardware Class I).
SDTC Generic Product Safety Case, section {4.2} describes Design Overview & Safety Principles.
A traditional technique has been adopted to realize train detection and rail continuity detection
functions within a track circuit. This technique uses the track circuit as a transmission line between
the transmission joint and the receiver joint. Accordingly, the presence of a train or the broken rail is
detected by measuring the effect of the reduction or disappearance of the Signal transmitted via
track circuit.
The Impedance Bond (7 meters long) allows the track circuits separation without rail interruption but
with a loss of a part of the useful signal in the adjacent track circuit. For this reasons adjacent track
circuits use different frequencies:
• 8 different frequencies (from 9 KHz to 21 KHz) are available: 3 + 3 for double track lines to avoid
cross talk effects and 2 frequencies to be used in specific cases as switch zones.
• 42 different track code messages can be selected to modulate the frequency obtaining a specific
identifier for each track circuit (400 bit/s speed and 200 bits for the repeated message).
The track circuit parameters variation (rail resistance/inductance and transversal leakage
conductance) and the train axle resistance shall also be taken into account in the regulations of
SDTC transmitted and received signals. Therefore SDTC has been designed and can be used only
in a specific range of the following parameters:
• maximum train axle resistance

- 39 -
• maximum value of transversal leakage conductance
The safety principles of operation are the following:
• If the received signal has amplitude lower than a threshold value ("occupied threshold") or if the
received coded message is not valid, SDTC will provide a null voltage value on IXL output.
• If the signal received has amplitude greater than a threshold value ("clear threshold") and if the
received coded message is valid, SDTC will provide a DC voltage on IXL output.
• When SDTC transmits to the track circuit the signal received from ATP/ATC system (e.g. SACEM
system), it is not able to generate undue valid or obsolete messages (not used for PATH).

- 40 -
4.11 Human Factors Analysis
Reference: §236.907(a)(11)
Requirement: A human factors analysis, including a complete

description of all human-machine interfaces, a
complete description of all functions performed by
humans in connection with the product to enhance or
preserve safety and an analysis in accordance with
Appendix E to this part in accordance with other
criteria if demonstrated to the satisfaction of the
Associate Administrator for Safety to be suitable
Interpretation: The scope of this requirement is interpreted to be

limited to:
• those functions identified in safety, fault tree
and general subsystem hazard analyses
which employ humans in the correct
execution of safety critical tasks and
• those exported constraints identified in
Section 4.19 of this PSP.
PSP ReferenceName: SOTe Human Factors Analysis
Safety Case Reference Doc/Section: SOTC Generic Safety Case {4.3.2}, {4.6}
Archive Doc: NA
Summary/Conclusions
SOTC Generic Product Safety Case, section {4.3.2} describes the SOTC interfaces including the
User interface.
User interface: LED and test point are available to visually check and to perform measurement
checks; mechanical jumpers are set in order to configure and regulate the operation of the track
circuit.
The operator who mostly interacts with the SOTC product is the maintenance operator. The methods
with which the operator must interact and the maintenance information is contained in SOTC
Maintenance Manual.
All restrictions and precautions for the correct product use are also formalized in the Application
Conditions document [17] and the safety related application conditions are also included in section
{4.6} of SOTC Generic Product Safety Case.

- 41 -
4.12 Safety Training
Reference: §236.907(a)(12)
Requirement: A complete description of the specific training of railroad
and contractor employees and supervisors necessary to
ensure safe and proper installation, implementation,
operation, maintenance, repair, inspection, testing, and
modification of the product.
Supplemental: FRA expects any training program to include employees,
supervisors and contractors engaged in railroad
operations, installation, repair, modification, testing or
maintenance of equipment and structures associated with
the product
Interpretation: It is clear from both the §236.907 requirement and the

supplemental description that this part may include the
interlocking system and train detection provider and PATH
personnel training for an operating SOTC and maintaining
SOTC, where 'maintenance' includes repair, modification,
testing and repair. It is assumed here that the STOS
project team and not ALSTOM will be responsible for
SOTC installation and initial testing.
PSP Reference Name: SDTC Safety Training

Safety Case Reference Doc/Section: SDTC Generic Safety Case {4.4.6} and {4.6}
PATH Project Training Program Plan - ATC iVPI and

SOTC Digicode Microprocessor systems
Summary/Conclusions
SDTC Generic Product Safety Case, section {4.4.6} describes Defense against Systematic Faults.
Regarding SDTC installation, configuration and maintenance aspects, the following documents have
been Released:
• SDTC Installation Manual,

• SDTC Maintenance Manual,
• SDTC Test & Commissioning Manual,
• SDTC Implementation Manual,
• SDTC Application Conditions (SDTC Generic Product Safety Case, section {4.6} for safety
related ones)
These documents provide the basic information in order to build the PATH Project Training Program
Plan - i.e. SDTC Digicode part. Training session will be delivered accordingly.

- 42 -
4.13 Safety Procedures
Reference: §236.907(a)(13)
§236.907(d)(1)
Requirement: §236. 907(a)(13) A complete description of the specific

procedures and test equipment necessary to ensure the
safe and proper installation, implementation, operation,
maintenance, repair, inspection, testing and modification of
the product. These procedures, including calibration
requirements, shall be consistent with or explain deviations
from the equipment manufacturer's recommendations.
§236.907(d)(1) The PSP shall specify all contractual

arrangements with hardware and software suppliers for
immediate notification of any and all safety critical software
upgrades, patches, or revisions for their processor-based
system, sub-system, or component, and the reasons for
such changes from the suppliers, whether or not the
railroad has experienced a failure of that safety-critical
system, sub-system, or component.
Interpretation: The interpretation of this part is that it applies to

safety-related operation and maintenance procedures
after initial installation and testing of SDTC.
PSP Reference Name: SDTC Safety Procedures
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {4.4.6} and {4.6}
Summary/Conclusions
SDTC Generic Product Safety Case, section {4.4.6} describes Defense against Systematic Faults.
§236.907(a)(13) Regarding SDTC installation, configuration and maintenance aspects, the following
guide documents have been Released:
• SDTC Installation Manual,
• SDTC Maintenance Manual,
• SDTC Test & Commissioning Manual,
• SDTC Implementation Manual,
• SDTC Application Conditions: SDTC Generic Product Safety Case, section {4.6} } for safety
related ones

AlSTt}M - 43 -
It is a mandatory requirement that the PATH application project respects these manuals and
exported constraints. (also see the previous Training section).
§236.907(d)(1) According to the Alstom procedure: "Process for Management and reporting of
railway safety related issue': the Railroad will receive immediate notification in case any safety
critical software upgrades, patches, or revisions for SDTC product (with the reasons for such
changes), whether or not the railroad has experienced the failure.
The process for Management and Report of Safety Issues covers the following detail activities:
1. Identification of safety issue
2. Ownership of the safety issue
3. Recording i.e. Safety Notice
4. Management of the safety issue (including the notification to all the Users i.e. Railroad)
5. Report
6. Periodical review
7. Return of experience

- 44 -
4.14 Part 236 A-G Compliance
Reference: §236.907(a)(14)
Requirement: An analysis of the applicability of the requirements of

subparts A-G of this part (236) to the product that
may no longer apply or are satisfied by the product
using an alternative method, and a complete
explanation of the manner in which those
requirements are otherwise fulfilled (see §234.275 of
this chapter and §236. 901 (c)).
Supplemental: The PSP must identify each pertinent requirement
considered to be inapplicable, fully describe the
alternative method used that equates to that
requirement and explain how the alternative method
fulfills or exceeds the provisions of the requirement
Interpretation: For the purposes of this PSP, the topics discussed in

Section 3.8 are considered here. The applicable rule
and the justification for alternative approaches based
on SDTC capability are provided.
PSP Reference Name: SDTC Part 236 A-G Compliance
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case
Safety Archive Doc: N/A
Summary/Conclusions
Subpart A - Rules and Instructions

• General
Not applicable to the SDTC/Digicode product.
• Roadwav Signals and Cab Signals

Not applicable to the SDTClDigicode product.
• Track Circuits
§ 236.51 Track circuit requirements.
The SDTC/Digicode track circuit's vital output will be OFF (indicating occupancy) if a
mechanical interruption (break) of the rail or track circuit cabling occurs. Because the
SDTClDigicode track circuit uses shaped wires (called "S" bonds and "0" bonds) to form
Impedance Bond (also called Electrical Joint), some broken rail sections within the
boundaries of the wire bond may go undetected.

- 45 -
§ 236.52 Relayed cut-section.
Applicable for DC track circuits only and not applicable at the product level.
§ 236.53 Track circuit feed at grade crossing.

Applicable for DC track circuits only and not applicable at the product level.
§ 236.54 Minimum length of track circuit.

Applicable at the applied level only and not applicable at the product level.
§ 236.55 Dead section; maximum length.

§ 236.56 Shunting sensitivity.

The SOTClDigicode track circuit's vital output will be OFF (indicating occupancy) when a 0.06 ohm
shunt is applied across the rails of the track circuit and the track circuit has been adjusted properly.
§ 236.57 Shunt and fouling wires.

§ 236.58 Turnout, fouling section.

§ 236.59 Insulated rail joints.

Generally, SDTClDigicode track circuits do not employ mechanical insulated joints to provide
separation between track circuits. Instead, they use Impedance Bonds via shaped wire
bonds ("S" bonds and "0" bonds) to provide this separation. When applied and adjusted
properly, different AC frequencies using different digital protection codes provide the
necessary separation and safety between adjacent track circuits.
§ 236.60 Switch shunting circuit; use restricted.

• Wire and Cables

Comment: Not applicable to the SDTClDigicode product.
• Inspection and Tests

Comment: Not applicable to the SDTClDigicode product.
Subpart B - Automatic Block Signal Systems

Not applicable to the SDTClDigicode product.

- 46 -
Subpart C - Interlocking
Not applicable to the SDTClDigicode product Additional comments follow:
§ 236.309 Loss of shunt rotection; where required.
The SDTClDigicode system does not provide 5 second loss-of-shunt protection. Any loss-
of-shunt protection must be provided external to the SDTClDigicode system via timing
relays or time delays embedded in processor vital application software.
Subpart D - Traffic Control Systems

Not applicable to the SDTClDigicode product
Subpart E - Automatic Train Stop, Train Control and Cab Signal Systems
Subpart F - Dragging Equipment and Slide Detectors (and Other Similar Protective Devices)
Subpart G - Definitions
Not applicable to the SDTC/Digicode product

- 47 -
4.15 Security
Reference: §236.907(a)(15)
Requirement: A complete description of the necessary security

measures for the product over its life-cycle.
Supplemental: Security is an important element in the design and
development of products and crosses over issues
such as developing methods to prevent hackers from
gaining access to software and developing measures
to preclude sudden system shutdown.
Interpretation: At the product level this is interpreted to apply to

physical access to SDTC equipment housed within a
locked equipment room.
PSP Reference Name: SDTC Security
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {4.5.5}
Summary/Conclusion
SDTC Generic Product Safety Case, section {4.5.5} describes Protection vs. Not Authorized Access.
To prevent damages caused by intentional acts, SDTC Processing Unit has been designed to
• be installed in a locked enclosure; either a cabinet with a lock entry or an equipment house with
an associated lock with restricted access, for example allowed only to maintenance people and
operators.
• be secure from intentional or unintentional disruption of its system software or hardware

configuration (any such disruption will lead to a more restrictive operating state).

- 48 -
4.16 Warnings and Warning Labels
Reference: §236.907(a)(16)
Requirement: A complete description of each warning to be placed

in the Operations and Maintenance Manual identified
in §236. 919, and of all warning labels required to be
placed on equipment as necessary to ensure safety.
Supplemental: Such warnings include, but are not limited to, means
to prevent unauthorized access to the system;
warnings of electrical shock hazards; cautionary
notices opposing improper usage; and configuration
management of memory and databases. The PSP
should provide an explanation justifying each such
warning and an explanation of why there are no
alternatives that mitigate or eliminate the hazard for
which the warning is placed
PSP Reference Name: SDTC Warnings and Warning Labels
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {4.4.6}
Safety Archive Doc: SDTC Product Documents P2521 Series [10], [11]
Summary/Conclusion
Hazards have been correctly mitigated or eliminated at product level, refer to Safety Validation
section 4.17.
Therefore, in order to safely install, test, operate and maintain the product, the staff has to respect
the product manuals.
The SDTC Operations, Test and maintenance Manuals provide the necessary Warnings and
Cautions with regard to safety critical procedures required in a field environment.
The Warning and Cautions with labels are related to:
• inherent electrical exposure from the nature of product i.e. Health and Safety for staff, and,
• the rules to be respected by trained staff, in order to correctly and safely install, test, operate and
maintain the product.

AlST!?&tiM
\MJ
- 49 -
4.17 SDre Safety Validation
Reference: §236.907(a)(17)
Requirement: A complete description of all initial implementation

testing procedures necessary to establish that safety-
functional requirements are met and safety-critical
hazards are appropriately mitigated.
Supplemental:
Interpretation: The interpretation of this part covers two activities; 1)

safety validation of all vital functions implemented by
SDTC, and 2) procedures for installation, testing and
cutover which protect the safety of the personnel and
equipment involved.
For satisfying this requirement, validation is

constrained to the application of the generic product.
Documentation is provided for the SDTC system
developments.
PSP Reference Name: SDTC Safety Validation Testing Plans, Procedures

and Results
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {3.2} and {3.9}
Safety Archive Doc:

NA
Summary Conclusion
SDTC Generic Product Safety Case, section {3.2} describes the complete Safety Life Cycle.
section {3.9} describing the Safety Verification and Validation Process in place for SDTC.
In order to verify the correct implementation of the safety requirements, the following analyses and
tests have been performed:
• The activities performed in the Preliminary Hazard Analysis that have identified the list of
hazards applicable to the subsystem and the list of the safety countermeasures to be
implemented by the subsystem to reduce the risk related to the identified hazards.

- 50 -
• The activities performed in the Hazard Analysis that have verified if the hardware and functional
architecture is suitable to achieve the safety target related to Vital product (SIL4). The analysis
has been performed using a FMEA based on the functional/architectural decomposition of the
subsystem provided by the Design Specification, identifying a list of countermeasures more
detailed than these ones identified by Preliminary Hazard Analysis.
A Fault Tree Analysis was also carried out to analyse the effects of multiple faults. Referring to
the Hazard Analysis document the SDTC Unsafe Failure Rate is equal to 1.72 E-12 I h;
therefore SDTC satisfies the SIL4 safety target as defined by EN50129 standard and compliant
with AREMA.
• The activities performed in the HW Safety Verification that have verified that no single failure and
no failure chain can lead to potentially unsafe behavior, performing FMEA single fault analysis,
safety failure tests and the verification of the creepage and clearance distances with respect to
the EN50124-1 standard.
• The final overall assessment that is included in the Validation Reports and in the Hazard Log.
The reduction of the identified hazards have been demonstrated compliant to the required
targets using qualitative and quantitative techniques.
All the above mentioned safety activities have been completed including the safety analysis of the
SDTC when interfaced with the iVPI interlocking System or with the Safetran 400500 relay
(equivalent to the ALSTOM A62-125 relay type).
In case of any changes impacting the product delivered to PATH, the safety validation is completed
according to the nature of the changes in order to certify the safety of the product after modification.
Regarding the procedures for installation, testing and cutover which protect the safety of the
personnel and equipment involved refer to section 4.13 of this PSP.

- 51 -
4.18 Post Implementation Testing and Monitoring
Reference: §236.907(a)(18)
Requirement: All post implementation testing (validation) and

monitoring procedures, including the intervals
necessary to establish that safety-functional
requirements, safety-critical hazard mitigation
processes, and safety-critical tolerances are not
compromised overtime, over use, or after
maintenance (repair, replacement, adjustment) is
performed; and
(iO Each record necessary to ensure the safety of the
system that is associated with periodic maintenance,
inspections, tests, repairs, replacements,
adjustments, and the system's resulting conditions,
including records of component failures resulting in
safety-relevant hazards (see §236. 917(e)(3)).
Interpretation: The interpretation of this part covers two activities; 1)

ALSTOM identification of all SDTC system elements
which require post-installation measures to be taken
to ensure their continued safe operation, and
specification of the particulars of those measures, and
2) PATH procedures which will implement those
measures and maintain the appropriate records.
PATH procedures will not be included in this PSP.
PSP Submittal Name: SDTC Post Implementation Testing and

Monitoring
Safety Case Reference Doc/Section: SDTC Generic Product Safety Case {4.4.2} {4.5} and
{4.6}
Safety Archive Doc:
NA
Summary/Conclusion
SDTC has been designed to address all safety impacts that can arise during following initial
installation such as attempts to use improper versions or revisions of software. No extraordinary
measures are required for the generic product in this respect. Exported constraints associated with
external influences have been identified refer to Safety Related Application Conditions section {4.6}
of the SDTC Generic Product Safety Case [7]. Also identified here are those influences both internal
and external that must be addressed during all post installation handling of the product components:
• Physical internal influences, refer to section {4.4.2.1} of SDTC Generic Product Safety Case
To avoid galvanic influences the insulation distances (creepage and clearance) between different
circuits have been designed compliant to the requirements of the EN50124-1 standard. The
verification included in the SDTC Hardware Safety Verification did not require any specific post
implementation measure.

- 52-
• Functional internal influences, refer to section {4.4.2.2} of SOTe Generic Product Safety ease
To avoid functional internal influences between SOTe different parts, the identified functional
blocks have been examined during the performed FMEA and FTA analysis and Hardware Safety
Verification. No specific post implementation measure are required.
• Physical external influences, refer to sections {4.4.2.3} and {4.5} of SOTe Generic Product
Safety ease
The performed Type Tests and the analysis included in the SOTe Hardware Safety Verification
confirm the SOTe immunity from the physical external interference. No specific post
implementation measure are required.
• Functional external influences, refer to section {4.4.2.4} of SOTe Generic Product Safety ease
Functional external influences may be introduced through physical connection to other systems.
The effects on safety have been analyzed during the interface analysis described in the SOTe
Hazard Analysis, where the deviations and the related safety countermeasure have been
identified and in the Hardware Safety Verification where the detailed FMEA and the failure tests
were performed. No specific post implementation measure are required.

- 53 -
4.19 Safety-Critical Assumptions and Fallback Operations
Reference: §236.907(a)(19)
Requirement: A complete description of any safety-critical

assumptions regarding the availability of the product
and a complete description of a/l backup methods of
operation.
Interpretation: It is considered here that the issue of the connection

between safe operation and system availability, is not
directly applicable in the case of SDTC; that
unavailability of at least portions of the SDTC system
due to failure requires PATH procedures that can
manage safe train passage through an interlocking if
it has been placed in a more restrictive operating
state due to failure. No different modes of system
operation are available for SDTC, and that there may
not be distinct hazards associated with fallback
operations.
That is different for CBTC operation where the SDTC
is the secondary detection i.e. the primary detection is
handle by the CBTC system itself. In that situation
SDTC could be considered as already a fallback
operation regarding the train detection function (out of
the scope of this PSP i.e. Siemens scope)
Included in this section will be SDTC assumptions
regarding its application (design basis). These would
be application safety requirements That would be
exported from the generic product safety case.
PSP Reference Name: SDTC Safety Critical Assumptions
Safety Case Reference Doc/Section:

SDTC Generic Safety Case {3.9.4} and {4: 4.3, 4.4
and 4.5} {4.6}
Safety Archive Doc:

SDTC Reliability Calculations provided to Invensys

- 54 -
Summary/Conclusions
SDTC Generic Product Safety Case, section {3.9.4} provides Reliability prediction with return of
experience (MTBF):
Mission MTBF (h) Basic MTBF (h)

SDTC configuration
no DIAG card with DIAG card
SDTC without Branch Line 155,382 135,749
SDTC with 1 Branch Line 68,669 60,886
SDTC with 2 Branch Lines 44,074 39,244
SDTC Generic Product Safety Case, sections {4, 4.3, 4,4} provides the Assurance of the Correct
Functional Operation, Effect of Faults and Operations with External Operation with the safety
assumptions taken into account during safety analysis and risk assessment.
Safety Related Application Conditions section {4.6} of the SDTC Generic Product Safety Case [7] to
be respected by PATH application project are:
General Application Conditions
SDTC - AC.2 Maximum Shunt Resistance

Safety Related: YES
Exported to: Application Design phase
Description: The Technical Application Conditions are:
• Maximum shunt resistance outside Tuning Zone: 0.5 Ohm.
Inside the Tuning Zone the train detection maximum shunt resistance degrades; therefore the
signaling design rules (e.g. light signal positioning, ATP braking curve, fouling switch, etc.) shall
consider the Tuning Zone as a "not shunting area".
The Tuning zone is defined as 3.6 m before and 3.6 m after the centre of the Impedance Bond
(also called Electrical Joint) (the length of the EJ is fixed equal to 7.2 m).
SDTC - AC.7 Protection of the power supply line

Safety Related: YES
Exported to: Installation and Maintenance phases: the requirements shall be verified before installation of the
sUbsystem i.e. Application Design phase.
Description: The power supply line that feds the Indoor Equipment shall be protected against short circuits,
overloads and current leakage to the earth circuit (optional), using:
• A circuit breaker with the mentioned characteristics (e.g. 20A with no more than 10
- 55 -
SDTC connected to a single interrupter) and correct cable sections shall be used in
order to assure the protection from short circuits and therefore the protection from fire
(e.g. due to high temperatures of supply cables).
• The protection with a single interrupter of more than one SDTC is allowed. In this
case the supply cable sections and the interrupter current rating shall be chosen to
have the supply shut off in case of short circuit of a SDTC equipment.
• A circuit breaker is also needed to cut off the 110V SDTC power supply, when
required by maintenance operation (to protect operator from electrocution).
Option for Europe: An interrupter with differential protection (the same as "GFI Ground Fault
circuit Interrupter") is required in general by European normative to protect operator from
electrocution.
Track to train transmission:
Not Applicable to PATH project
Installation, Maintenance and Configuration
SDTC - AC.11 Jumper Configuration and Regulation

Safety Related: YES
Exported to: Configuration, Installation, Maintenance and Commissioning phases.
Description: The SDTC configuration could be carried out by the adequate setting of the jumpers available
on the MODEM Boards and on the other boards.
The setting of such jumpers is described by the related procedures provided by the T&C Manual
the adjustment and the tuning of the output voltage and of the frequency shall be carried out
accordingly to the procedures described in the Installation and User and Maintenance Manuals.
These documents shall be strictly respected during the installation and the commissioning
phases of the SDTC products.
SDTC - AC.12 Frequency and Code Configuration

Safety Related: YES
Exported to: Configuration, Installation, Maintenance and Commissioning phases
Description: In order to ensure:
the correct frequency and code setting;
the correct disposal of devices in the rack and the correct racks wiring;
it is mandatory that the instructions, the procedures and the constraints provided by
Implementation Manual shall be strictly respected.
It is remarked that adjacent Track Circuits shall have different values of Code and Frequency
(see Figure 8 and Figure 9).

ALSTOiM - 56 -
f1 f3 f5 f1 f3 f5 f1 f3 f5 f1 f3 f5
c1 c7 c13 c2 cS c14 c3 c9 c15 c1 c7 c13
1 1 1 1 1 1 1 1 1 1 1 1 1
L L L L L L L L L L L L L
f2 f4 f6 f2 f4 f6 f2 f4 f6 f2 f4 f6
c4 c10 c16 c5 c11 c17 c6 c12 ciS c4 c10 c16
1 1 1 1 1 1 1 1 1 1 1 1 1
L L L L L L L L L L L L L
Figure 8 - Frequency and code setting on 2 tracks
F~ nt
>II
CH
r-·· en
,,~ f.
C71} ('7:1
Figure 9 - Frequency and code setting on 4 tracks
SDTC - AC.13 Installation and Maintenance

Safety Related: YES
Exported to: Installation, Commissioning and Maintenance phases
Description: The safe and correct functioning of the SDTC products is affected by the correct execution of
the Installation, Commissioning and Maintenance operations, so that it is mandatory that the
instructions, the procedures and the constraints provided by Installation, Commissioning and
Maintenance Manuals shall be strictly respected.
SDTC - AC.14 Protection against unauthorized access

Safety Related: YES
Exported to: Installation and Maintenance phases
Description: The installation of SDTC equipment's shall foresee the adoption of technical measures in order
to protect them against the sabotage and vandalism acts.
In particular, the Indoor EqUipment shall be installed into locales with restricted access and the
Outdoor Equipment (Tuning Units) shall be installed within cases that could be opened only
using tools and instruments.
SDTC - AC.15 Operator Safety

Safety Related: YES
Description: All metallic parts of Processing Units and Field Equipment shall be permanently connected to
the earth. At least during Maintenance phases, all cable shields shall be connected to the earth.
PATH - Smartway Digital Track Circuit <7011194-2.0-DS-04-01 >

- 57 -
IXL Output Interface Conditions
SOTC - AC.18 Constraints for Relay Interface

Safety Related: YES
Exported to: Installation, Maintenance and Operational phases: the requirements shall be verified before to
install the subsystem and it shall be ensured during its functioning i.e. Application Design phase.
Description: The following constraints are related to Vital Relay interfacing with input resistance of 1600 n:
• IXL Output in case of Clear Track Circuit: from 24 to 30 V DC;
• IXL Output in case of Occupied Track Circuit: < 2V DC;
• IXL Output without load: < 30V DC.
The following constraints are related to US Vital Relay interfacing (Safetran #400500 biased-
neutral type, equivalent to the ALSTOM A62-125 type):
• series coils connection shall be used (500 Ohm);
• Jumper P14, on RT board, shall be removed.
SOTC - AC.19 Constraints for Electronic Interlocking Interface

Safety Related: YES
install the subsystem and it shall be ensured during its functioning i.e. Application Design phase
Description: The following constraints are related to an Interlocking interface with ZLC system (400 n
equivalent):
• IXL Output in case of Clear TC: from 11 to 19 VDC with P14 jumper installed;
• IXL Output in case of Clear TC: from 9 to 15 VDC with P14 jumper not installed;
The following constraints are related to iVPI vital input port interfacing:
• Both single iVPI vital input port and two ports in parallel connection is allowed;
SOTC - AC.20 Reaction Times and Logic Integration

Safety Related: YES
install the subsystem and it shall be ensured during its functioning i.e. Application Design phase
Description: SDTC provides the occupancy indication on output, with the following timing constraints:
• In case of shunted Track Circuit, occupation delay less than 0.2 s
• In case of invalid coded message received from Track Circuit, occupation delay
less than 2.2 s, with 400 bitls rate (BL2 configuration)
• In case of invalid coded message received from Track Circuit, occupation delay
less than 3.8 s, with 200 bitls rate (BL3 configuration)
SDTC provides the clearing indication on output, with the following timing constraints:
• Clearing delay (not safety) less than 2 s with 400 bitls rate (BL2 configuration);
- 58 -
• Clearing delay (not safety) less than 3.5 s with 200 biUs rate (BL3 configuration);
• Clearing delay (safety) greater than 1.7 s with 400 biUs rate(BL2 configuration);
• Clearing delay (safety) greater than 3 s with 200 biUs rate (BL3 configuration);
Accordingly, minimal TC length shall be defined. TC length depends on both train
speed and train length:
• TC length shall ensure the train presence on the shorter TC for at least the
maximum value of the occupation delay, at the maximum train speed.
All TC lengths that are safety related shall be dimensioned taking into account the
maximum TC occupation delay .
•
Use of Impedance Bonds
SDTC - AC.22 Impedance Bond minimum distance
Safety Related: YES

Exported to: Installation and Maintenance phases i.e. Application Design phase.
Description: In case of use of Impedance Bonds, the following constraints shall be applied about the
distance between two impedance bonds:
• the Impedance Bonds shall be spaced not less than 700 m from each other, so two
impedance bonds shall not be connected inside one track circuit, only one is permitted (or
two in parallel at the same track location to accommodate larger traction return current
levels);
• for regularity reasons, the distance between the Impedance Bond direct connection
and the centre of "S" bond should be greater than or equal to 10 m (using the IB type
LS300A for Metro applications)
SDTC - AC.23 Connection to earth of the Terminal Joint central point
Safety Related: YES

Exported to: Installation and Maintenance phases i.e. Application Design phase.
Description: The central point of a Terminal Joint can be connected to additional earth conductor only if no
other connection to earth are present within the same Track Circuit. The same restriction is valid
for the short circuit joints.

- 59 -
Compatibility with low frequency TC using Filter Box device
SDTC - AC.24 Filter Box device

Safety Related: YES
install the subsystem and it shall be ensured during its functioning. i.e. Application Design phase
Description: SDTC and low frequency TC can operate in parallel using the Filter Box devices.
All the specific instructions included in the Installation Manual shall be followed.
SDTC - AC.25 Low frequency TC on opposite phase

Safety Related: YES
install the SDTC subsystem and it shall be ensured during its functioning i.e. Application Design
phase
Description: In order to detect a fault on Filter Box device, adjacent low frequency TC shall be powered with
opposite phase values.
SDTC - AC.26 Diverted Branch and Main Branch Maximum Length with low frequency TC
Safety Related: YES
install the SDTC subsystem and it shall be ensured during its functioning. i.e. Application Design
phase
Description: In case of coexistence of SDTC and low frequency TC (ref. Figure 10):
the maximum length of Diverted Branch in a series connection shall be less than or
equal to 36 m. Accordingly, trains shorter than 36 m shall not to be used;
the maximum length of Main Branch shall be less than or equal to 250 m with one
diverted branch;
the maximum length of Main Branch shall be less than or equal to 150 m with 2
diverted branch;
cable length between SER and TU shall be less than or equal to 2 km;
the broken rail detection function is provided only for the series connected rail and not
for the other rail.

- 60-
N
"
If)
ro (0 ill
f'-- ro ro
+ + +
cdb156bis cdb156
f10 (C30) f12 (C36)
c-sA
T R
2x1x185 mmq CBA
T R
eSA
R T
fS/f10 f10/f12 fS/f12
D26F D29K D27G
2x1x185 mmq
f9/f11 f71f11
D23C D21A
R T RT
ABC
-'~r7-
L
cdb155
f11 (C32)
Figure 10- Diverted Branches connected in series with Main Branches (with low frequency TC).
Rail Interconnection conditions
SDTC - AC.27 Connection of double tracks by cross-bonds

Safety Related: YES
Exported to: Installation and Maintenance phases.
Description: In presence of a double track, the up and down lines shall be never connected by direct
cross-bonds. In this case the connection is allowed only by the use of Impedance Bonds.

- 61 -
4.20 Incremental & Predefined Changes
Reference: §236.907(a)(20)
236H Requirement: A complete description of all incremental and predefined
changes (see paragraphs (b) and (c) of this section)
§236.907(b) What requirements apply to predefined

changes?
(1) Predefined changes are not considered
design modifications requiring an entirely new safety
verification process, a revised PSP, and an informational
filing for approval in accordance with §236.915. However
the risk assessment for the product must demonstrate that
the operation of the product, as modified by any predefined
change, satisfies the minimum performance standard.
(2) The PSP must identify configuration/revision
control measures designed to ensure that safety-critical
hazard mitigation processes are not compromised as a
result of any such change.
§236.907(c) What requirements apply to other

product changes?
(1) Incremental changes are planned product version
changes described in the initial PSP where slightly different
specifications are used to allow the gradual enhancement
of the product's capabilities. Incremental changes shall
require verification and validation to the extent the changes
involve safety-critical functions.
(2) Changes classified as maintenance require validation.
§236.907(d) What are the responsibilities of the

railroad and product supplier regarding communication of
hazards?
(1) The PSP shall specify all contractual arrangements
with hardware and software suppliers for immediate
notification of any and all safety critical software upgrades,
patches, or revisions for their processor-based system,
subsystem, or component, and the reasons for such
changes from the suppliers, whether or not the railroad has
experienced a failure of that safety critical system, sub-
system, or component.
(2) The PSP shall specify the railroad's procedures for
action upon notification of a safety-critical upgrade, patch,
or revision for this processor based system, sub-system, or
component, and until the upgrade, patch, or revision has
been installed; and such action shall be consistent with the
criterion set forth in § 236.915(d) as if the failure had
occurred on that railroad.
Supplemental:

- 62 -
~~--~~-------------------------------------------------------------,
Interpretation: No Predefined change is expected regarding SDTC

for PATH application project
PSP Reference Name: SDTC Incremental and Predefined Changes
Safety Case ReferenceDoc/Section:

SDTC Generic Product Safety Case {2.18}
Safety Archive Doc:

SDTC Product Development Plan
Summary/Conclusions
No Predefined change is expected regarding SDTC product for PATH application project.

- 63 -
Is PROUCT SAFETY PLAN CONCLUSIONS I

Provided within this PSP is a holistic view of the means by which the SDTC product is in compliance
with the regulatory requirements of 49 CFR part 236 Subpart Part 236 A-G and H. This case is
made based on:
• A comprehensive qualitative and quantitative level of safety resulting in a Tolerable Hazard

Rate equivalent to MTTHE safety level several orders of magnitude better than accepted
industry standards.
• Adherence to industry Rules, Standards and Best Practices such as CENELEC, AREMA,
and FRA 49 CFR Part 236 A-G, and H.
Regarding the FRA 49 CFR Part 236 C: the SDTClDigicode system does not provide 5
second loss-of-shunt protection. Any loss-of-shunt protection must be provided external to
the SDTClDigicode system via timing relays or time delays embedded in processor vital
application software.
• At the present time the verification and validation activities have been completed with
positive results and it is possible to state that the SDTC product is suitable for service in a
generic railway application, including also a North American generic railway application,
where SDTC is connected to iVPI system and to Safetran 400500 relay.
END OF DOCUMENT

- 64 -
6 APPENDIX A SDTC SAFETY REFERENCE DOCUMENTS I

The reference document list shown below in following Table A-1 are safety related documents for
SDTC that will be submitted as supporting documentation to the PSP. Some matters of
confidentiality may need to be addressed as part of the submittal process.
Two columns portray those references that are to be submitted along with this PSP and those that
will remain with ALSTOM and be available for on-site review in Rochester should the effort be
necessitated.
Code Included On site

Document
with PSP Review Only
MML 1 Project Quality Assurance Plan 315502YXXQPOO 1 X

SOTC Safety and V&V Plan 490501019W001 X
SOTC Oocumentation Plan 3155030XXPOO01 X
SOTC Preliminary Hazard Analysis 490501019W002 X
SOTC Requirements Specification 490502019SY001 X
SOTC Requirements Verification Report 490501019W003 X
SOTC RAM Analysis 490501019W004 X
SOTC Hazard Analysis 490501019W005 X
SOTC Architecture Oescription 490501019RS001 X
SOTC Functional Test Plan X3020XXTP010 X
SOTC Type Test Plan X421SXXIS047 X
SOTC Qualification Test Oescription (AREMA standard) EETCS-A TC-DTC-QTD-T X
SOTC Architecture Verification Report 490501019W006 X

SOTC Hardware Technical Specification: --- ---
OIAG Technical Specification 4903710 19HW006 X
LI U Technical Specification 490371A19HW002 X
Motherboard Technical Specification 490371019HW004 X
MOOEM Technical Specification 4903710 19HW002 X
RX Technical Specification 490371019HW003 X
TX Technical Specification 490371A 19HW001 X
RT Technical Specification 4903710 19HW005 X
Specifica Tecnica Cassetta di Sintonia 315302DXXST001 X
Specifica Tecnica Cassetta Filtri 3153020XXST002 X
MOOEM Software specification 490371 D19SW001 X

SOTC Schemes and Part List 3153020XXDG001 X
SOTC Boards Acceptance Test Specification 2049019-1 NO-S-TCF-0001 X

- 65 -
Code Included On site
Document
with PSP Review Only
SDTC Factory Acceptance Test Specification 490371D19FT001 X

SDTC Hardware Safety Verification 490501D19W007 X
SDTC (Filter Box) Hardware Safety Verification 315503ZXXRS001 X
SDTC Hardware Validation Report 490501D19W008 X
SDTC Type Test Report 490421D19TR0013 X
SDTC (Vertical TU & Filter Box) Type Test Report 490421D19TR001 X
SDTC ExtraTest type Test Report 2049019-VAL-A-TDR-0001 X
SDTC Qualification Test Report (AREMA standard) EETCS-ATC-DTC-QTR-T X
SDTC Functional Test Report 490371D19W002 X
SDTC Installation Manual 490371A 19MI001 X
SDTC Test and Commissioning Manual 490371A 19MI002 X
SDTC Maintenance Manual 490371 D19MI001 X
SDTC Application Conditions 315302DXXDG002 X
SDTC Hazard Log 490501 D 19W009 X
SDTC Validation Report 490501D19W010 X
SDTC Safety Case 49052DI9WOO1 X
SDTC Implememtation Manual 490371A19MP001 X
SDTC Safety & Design Review of 2005/04/04 (TX soft start) X503DXXSTOO1 X
SDTC Safety & Design Review_HW modifications on SC_3 7431500-RSA-A-SYV-0001 X
SDTC - Interface Hazard Analysis 2049019-RSA-A-HAA-0001 X
SDTC/Digicode Train Stop Testing Report PATH - SDTC Train Stop Testing X
Report
SDTC/Digicode - iVPI Interface Test Report SDTC - iVPI Test Report X
SDTC/Digicode - Vital Relay Interface Test Report SDTC - Vital Relay Test Report X
SDTC/Digicode - 120 VAC Operation Test Report SDTC -120 VAC Test Report X
Table A-1 PSP Submittal Reference List

- 66 -
17 APPENDIX B - FRA-TO-CENELEC CONFORMANCE MATRIX I

Unique to this PSP is the intent to identify alignment of FRA Regulations to CENELEC with the overall goal to
establish an initial basis for a cross acceptance discussion. Shown below is a preliminary mapping of the
Regulatory requirements of Subpart H (specifically §236.907) to a CENELEC based safety case based on
EN50129 being established for a proven SOTC product line.
FRA 236H PSP Generic Safety Case Safety Case Section

Reference section PSP Requirement Title Reference Description
High Level Architecture I

t:l236907(a)(1 ) 4.1 System Description Section 1 Definition of the Product
t:l236.907(a)(2) 4.2 General Railroad Operations N/A Not Applied
Concept of Operations Assurance of Correct

§236907(a)(3) 4.3 (ConOps) Section 4.3 Functional Operation
t:l236.907(a)(4) 4.4 Safety Requirements Section 3 Safety Management Report
§236.907(a)(5) 4.5 Safety Architecture Section 3 Safety Management Report
§236.907(a)(6) 4.6 Hazard Log Section 3 Safety Management Report
t:l236.907(a)(7) 4.7 Risk Analysis Section 4 Technical Safety Report
t:l236.907(a)(8) 4.8 Hazard Mitigation Analysis Section 3 Safety Manaqement Report
Verification Testing Plans, Safety Verification and

§236907(a)(9) 4.9 Procedures and Results Section 3.9 Validation
Safety Assurance Concepts Design Overview and Safety

§236.907(a)(10) 4.10 (SAC) for Design Section 4.2 PrinciQles
§236.907(a)(11 ) 4.11 Human Factor Analysis Section 4 Technical Safety Report
Sections 2.14,2.15
t:l236.907(a)(12) 4.12 Safe!y Training Plan 3.12,4.4.6 Operation and Maintenance
Sections 2.14, 2.15

§236.907(a)(13) 4.13 Safety Procedures 3.12 Operation and Maintenance
§236.907(a)(14) 4.14 FRA Part 236 A-G Compliance Section 3.6. Safety Requirements
Safety Requirements and
Sections 3.6. and Protection vs. not authorized
§236907(a)(15) 4.15 System Security 4.5.5. access
Identification of Safety
§236.907(a)(16) 4.16 Warnings and Warning Labels Section 3.6. Requirements
Safety Management Report I
§236.907(a)(17) 4.17 Safety Validation Plan Sections 3 and 4.7 Safety Qualification tests
Post Installation Safety Sections 2.14 and Installation and
§236.907(a)(18) 4.18 Requirements and Procedures 4.6.3 Commissioning
Technical Safety Report I
Safety Critical Assumptions Safety Related Application
§236.907(a)(19) 4.19 and Fallback Operations Section 4 and 4.6 Constraints
Operation and Maintenance
Pre-Defined and Incremental Sections 2.14, 2.15 I Decommissioning and
t:l236.907(a)(20) 4.20 Changes 3.12 and 3.13 Disposal
Table 8-1 FRA-to-CENELEC Conformance Matrix

PATH Digicode® PSP
APPENDIX D-2 SDTC Generic Product Safety Case

(This Appendix has been redacted in its entirety)
56 of 80
PATH Digicode® PSP
APPENDIX D-3 SDTC Safety and V&V Plan
57 of 80
abcd SDTC
06/07/11
Bologna Safety and V&V Plan
REVISIONI
REVISIONS
Revisione Autore Data Pagine totali Commenti

Revision Author Date Num. Pages Comments
F. Memmo
1 SDTC Safety 03/09/10 35 First emission.
Assurance Manager
F. Memmo
2 SDTC Safety 15/12/10 35 Modifications in all the document.
Assurance Manager
F. Memmo
3 SDTC Safety 06/07/11 35 Added the SW V&V activities.
Assurance Manager
CONFIDENTIAL. All rights reserved. Passing on and copying of this document, use and
communication of its content are not permitted without prior written ALSTOM authority. Reference Rev. Page/s
Tutti I diritti sono riservati. Ne è vietata la riproduzione, la consegna a terzi o comunque la
diffusione senza il preventivo consenso scritto di Alstom ferroviaria S.P.A. 490501D19VV001 3 2/38
abcd SDTC
06/07/11
CONTENTS
1 INTRODUCTION .................................................................................................................................................................... 4
1.1 PURPOSE .......................................................................................................................................................................... 4
1.2 DEFINITIONS AND ABBREVIATIONS .............................................................................................................................. 4
1.3 REFERENCES ................................................................................................................................................................... 5
1.3.1 NORMATIVE AND INTERNAL INSTRUCTIONS ........................................................................................................ 5
1.3.2 SPECIFIC REFERENCES .......................................................................................................................................... 5
1.4 REVISION HISTORY .......................................................................................................................................................... 6
2 SDTC DESCRIPTION ............................................................................................................................................................. 7
2.1 DESIGN OVERVIEW .......................................................................................................................................................... 7
2.2 SAFETY PRINCIPLES ....................................................................................................................................................... 8
2.3 DEFINITION OF INTERFACES .......................................................................................................................................... 9
3 SAFETY POLICY ................................................................................................................................................................. 11
3.1 SAFETY INTEGRITY LEVEL ........................................................................................................................................... 11
3.2 REUSED COMPONENTS ................................................................................................................................................ 12
3.3 RESPONSIBILITY LIMITS ............................................................................................................................................... 12
4 SAFETY PLAN ..................................................................................................................................................................... 13
4.1 SAFETY MANAGEMENT ................................................................................................................................................. 13
4.2 SAFETY AND QUALITY LINKS....................................................................................................................................... 13
4.3 TECHNICAL ACTIVITIES................................................................................................................................................. 14
4.3.1 SAFETY ANALYSIS.................................................................................................................................................. 14
4.3.2 SAFETY V&V ACTIVITIES ....................................................................................................................................... 15
4.3.3 MODIFICATION MANAGEMENT ............................................................................................................................. 16
4.3.4 DOCUMENTATION MANAGEMENT ........................................................................................................................ 17
4.3.5 SAFETY DEMONSTRATION .................................................................................................................................... 17
4.3.6 INDEPENDENT SAFETY ASSESSMENT ................................................................................................................ 17
5 PROJECT ORGANISATION ................................................................................................................................................ 18
6 SDTC SAFETY AND V&V PLAN ......................................................................................................................................... 22
6.1 SAFETY ANALYSIS ACTIVITIES .................................................................................................................................... 23
6.2 SAFETY V&V ACTIVITIES ............................................................................................................................................... 26
7 SOFTWARE VERIFICATION E VALIDATION PLAN .......................................................................................................... 32
7.1 SOFTWARE V&V ACTIVITIES ........................................................................................................................................ 33
7.2 DOCUMENT CROSS REFERENCE TABLE.................................................................................................................... 36
abcd SDTC
06/07/11
1 INTRODUCTION
1.1 Purpose
This document is the Safety and V&V Plan of the Smartway Digital Track Circuit (SDTC) electronic product.
SDTC realizes, in safety, the train detection, rail continuity detection and track to train data transmission functions
within a track circuit (TC).
The main object of the SDTC Safety Plan is to guarantee that the design of the subsystem is lead in effective way
(times and costs), respecting the required levels of safety, and that the product works in safety way during its
complete life cycle.
Therefore the safety process that ALSTOM intends to implement for the validation and the verification of the SDTC
is described and in particular including the following:
– the Safety Policy adopted in ALSTOM (Bologna);
– the safety plan with all the activities and links;
– the safety organisation in charge of the planning realization.
This Safety and V&V Plan must be a point of reference during all the SDTC development phases and in particular
for the following activities:
– risk evaluation, reduction and assessment;
– verification and validation of SDTC requirements;
– verification and validation of the architecture and of the developed hardware/software parts.
Shall be considered that this plan regards only the technical modifications applied on the SDTC after the validation
completed in 2002.
Regarding the SDTC version issued in 2002 the available Safety Case (ref. [13]) demonstrated the SDTC
compliance to CENELEC Standards (the existing standard revisions available at the issuing date) and it
demonstrated the Safety Integrity Level SIL4 of SDTC safety functions. This Safety Case was assessed by SIA
(Società Italiana Avionica) company (ref. [19])
1.2 Definitions and Abbreviations

TC Track Circuit: railway line stretch separated functionally from the adjacent stretches.
PATH Port Authority Trans-Hudson Corporation project
PDI Product Development and Industrialization
PU Processing Unit
SER Signalling Equipment Room
SIL Safety Integrity Level
SDTC Smartway Digital (audio-frequency) Track Circuit
TU Tuning Unit
abcd SDTC
06/07/11
1.3 References
1.3.1 Normative and internal instructions
[1] CENELEC EN 50126, Railway Application: The Specification and Demonstration of Reliability, Availability,
Maintainability and Safety (RAMS), September 1999.
[2] CENELEC EN 50129, Railway Applications: Safety Related Electronic Systems for Signalling, February 2003.
[3] CENELEC EN 50121-4, Railway Applications: Electromagnetic Compatibility (EMC) – Emissions and
immunity of the signalling and telecommunications apparatus, May 2001.
[4] CENELEC EN 50124-1, Railway Applications – Insulation coordination Part 1: Basic Requirements –
Clearances and creepage distances for all electrical and electronic equipment, March 2001.
[5] CENELEC EN 50125-3, Railway Applications – Environmental conditions for equipment Part 3: Equipment for
signalling and telecommunications, January 2003
[6] CENELEC EN 50128, Railway Applications: Software for Railway Control and Protection Systems, March
2001
[7] Office for Research and Experiments of the International Union of Railways (ORE)
Question A 155.3 – Revision of ORE A118/RP2
Report N°12 – Failure Catalogue for Electronic Comp onents, Utrecht, April 1988.
[8] MIL-HDBK 217F Military handbook, Reliability prediction of electronic equipment, notice 2
[9] ALSTOM, TIS Product & System Safety Manual “SIG 004”, Chapter 1 (“Policy, Strategy and Organization”).
[10] ALSTOM, Preliminary Hazard Analysis - Procedura Generale, rev.3
[11] ALSTOM, Standard PHL, Rev. 1.1
[12] ALSTOM, Procedura QA-P-35 - Gestione delle Safety and Design Review, rev. 1
1.3.2 Specific References

th
[13] ALSTOM, SDTC - Safety Case, 29 November 2002, code 49052DI9VV001 rev. 3
[14] ALSTOM, SDTC - Requirements Specification, code 490502D19SY001 rev. 4
[15] ALSTOM, Digicode – Safety Case (DTC24-1), code HW6514022981 rev. 1
[16] ALSTOM, DTC24-2 - Safety Case, code 897503090VV007 rev. 9
[17] ALSTOM, DTC24-2– Software Quality Assurance Plan, code 197305DA1SW001 rev. 2
[18] ALSTOM, DTC24-2 – Software Configuration Management Plan, code 197305DAXSW001 rev. 1
nd
[19] Società Italiana Avionica, STDC DIGICODE Independent Safety Assessment Report, 2 December 2002,
code RT/5826/01/006/1028/RV/1/021202/STB rev. 1
abcd SDTC
06/07/11
1.4 Revision history
The revision 1 represents the first emission of the SDTC Safety and V&V Plan, regarding the following modification
applied on the SDTC version already validated in 2002:
• The small technical modification applied on the TX, RX, TU and DIAG boards after the Safety Case revision 3
issuing date (November 2002).
• The Filter Box used for the first time in the Milano Linea 1 Project (Italian Metro Line) to interface existing low
frequency Track Circuits.
• The analysis of the new application conditions required by North America applications – PATH project first
application.
• The updating of all the Verification and Validation activities and safety analyses in conformity with the last
revision of CENELEC standards.
This revision 2 has been issue to correct some documental errors and some parts not sufficiently clear.
The revision 3 introduced the software life cycle, that has been performed even if SDTC uses the same software of
the other products of DIGICODE family (e.g. DTC24-1 product).
abcd SDTC
06/07/11
2 SDTC DESCRIPTION
2.1 Design Overview
SDTC is an electronic product of the DIGICODE family that realizes the following safety functions when connected
to a track circuit (TC):
1. train detection;
2. broken rail detection
3. track to train transmission, when the train occupies the track circuit.
On output towards IXL system, SDTC provides the indication of the Clear/Occupied state of the Track Circuit. In
case of broken rail SDTC provides the occupied indication.
A breakdown of the SDTC product is showed in Figure 1.
ELECTRICAL JOINT ELECTRICAL JOINT
TUNING BOX TUNING BOX
Rx Tx CONNECTION CABLES Rx Tx
FIELD
TECHNICAL ROOM
ATC/ATP Data IXL OUTPUT DOT
ATC / ATP INTERLOCKING DIAGNOSTIC

(e.g. SACEM) (e.g. ZLC/VPI or Relay) SYSTEM
(e.g. CEDD-D)
Figure 1 – SDTC breakdown
The SDTC product is divided into two parts:

1. The Processing Unit that are housed in the Technical Signalling
2. The Field Circuits that are located outdoor, where the track circuit signal is transmitted and received
abcd SDTC
06/07/11
The Processing Unit realizes the following main functions:

• Generation and transmission of the audio-frequency signal towards Field Circuits
• Reception of the audio-frequency signal coming from Field Circuits
• Generation of the occupied/clear indication towards interlocking system
• Interface to the wayside ATC/ATP message generator (e.g. SACEM system)
• Generation of diagnostics data towards diagnostic system (e.g. CEDD).
The Field Circuits includes:

• Electric Joints located at the two extremities of the track circuit and at the end of diverted branches;
• Tuning Units located at the two extremities of the track circuit and at the end of diverted branches;
• Loop interface Unit to feed the loop cable in the diverted branch when cab signalling is required;
• Connection Cables connecting the Technical Room and the track circuit tuning units.
The Electrical Joints limit the track circuit extremities. These are represented by two parallel “S”-shaped
conductors, which are fixed to the rails. A Tuning Unit is present for each Electric Joint. The Tuning Unit is laid on
the ballast next to the rail and connected, via three conductors, to the two rails and to the centre of the Electrical
Joint.
At the track circuit extremity in which the signal is injected, only a minimum part of the useful energy leaks in the
neighbouring track circuit; likewise, at the track circuit end from which the signal is drawn, almost all the useful
energy is transferred from the track to the Connection Cable.
In order to ensure that the signal coming from another track circuit does not overlay the useful signal, the signal
frequencies are diversified. Therefore Electric Joint and Tuning Unit are composed by two separate parts related to
the two track circuits in succession that operate at different frequencies and different protection coding. One part is
dedicated to the transmission and the other to the reception but in case of reversing Direction Of Traffic enabled,
the two parts is exchanged.
In order to perform the track to train transmission, SDTC transmits to the track circuit the signal received from
ATP/ATC system (e.g. SACEM system) and allows the signal direction reversing according to the train direction.
2.2 Safety Principles
A traditional technique has been adopted to realize train detection and rail continuity detection functions within a
track circuit. This technique uses the track circuit as a transmission line between the transmission joint and the
receiver joint. Accordingly, the presence of a train or the broken rail is detected by measuring the effect of the
reduction or disappearance of the signal transmitted via track circuit.
The Electric Joint allows the track circuits separation without rail interruption but with a loss of a part of the useful
signal in the adjacent track circuit. For this reasons adjacent track circuits use different frequencies and different
track code messages.
When the train is present on the track (occupied state), SDTC switches and transmits continuously the ATP/ATC
message (e.g. SACEM system).
The track circuit parameters variation (rail resistance/inductance and transversal leakage conductance) and the
train axle resistance shall be also taken into account in the regulations of SDTC transmitted and received signals.
Therefore SDTC has been designed and can be used only in a specific range of the following parameters:
abcd SDTC
06/07/11
• maximum train axle resistance

• maximum value of transversal leakage conductance
The safety principles of operation are the following:

1. If the received signal has an amplitude lower than a threshold value (“occupied threshold”) or if the received
coded message is not valid, SDTC will provide a null voltage value on IXL output.
2. If the signal received has an amplitude greater than a threshold value (“clear threshold”) and if the received
coded message is valid, SDTC will provide a DC voltage on IXL output.
3. When SDTC transmits to the track circuit the signal received from ATP/ATC system (e.g. SACEM system), it is
not able to generate undue valid or obsolete messages.
Since SDTC architecture does not imply any safety related software, the realised design is designated to be
inherently fail-safe. This indicates that, in presence of failures/malfunctions, the hardware circuits must undergo the
safe conditions (null voltage on IXL Output and no undue messages to ATP/ATC system).
Therefore all the safety requirements are implemented by hardware parts and Software is classified SIL2 in the
MODEM and SIL0 in the DIAG:
• The SIL2 integrity level has been assigned to those functions that, even if not safety related, are relevant in
term of availability. This SIL2 level has been assigned to the coder software, that generates the message bit
pattern to be transmitted to the track.
• The SIL0 integrity level has been assigned to those functions whose deviation from the specifications has
negligible effects in terms of the safety of the product. The SIL0 level has been assigned to the diagnostic
software, that acquires continuously the state of the SDTC and transmits the measurements towards a
diagnostic system.
2.3 Definition of interfaces
User Diagnostic
TU-1 / LIU
IXL output
SDTC
ATP/ATC data
(e.g. SACEM) TU-2
Power Supply
Figure 2 – SDTC Interfaces
The SDTC interfaces are the following (ref. Figure 2 and Figure 1):
abcd SDTC
06/07/11
• Power supply: the SDTC is powered by 220Vac +/-10%, 50Hz or 110Vac +/-10%, 50/60Hz;
• Field TU: the SDTC is connected via cable to 2 tuning units, at the receiving and transmitting sides of the TC;
• Field LIU: the transmission of ATP/ATC (e.g. SACEM) message on the diverted branches uses the loop
interface unit;
• IXL output: is a signal at 12 VDC rated value on 400 Ohm equivalent load.
• Diagnostic: to the diagnostic system to collect the functional state of the electronic boards and the main track
signal parameters;
• User interface: led and test point are available to visual check and to measurement checks; mechanical
jumpers are set in order to configure and regulate the operation of the track circuit.
abcd SDTC
06/07/11
3 SAFETY POLICY
The Safety Policy adopted by ALSTOM FERROVIARIA (Bologna) for supplying products for railway signalling in
general is based on the following actions:
1. definition and validation of a series of functional and completeness safety requirements for the SDTC
product and the definition of any limits within the application range;
2. management of a program which includes both safety and quality, dependant on the integrity level of the
safety requirements, which considers the entire SDTC product life cycle.
3.1 Safety Integrity Level

The safety program objectives include the establishing of the Safety Integrity Level (SIL) to be applied to the
system/subsystem. For subsystems to be developed completely from the beginning, this is usually applied by
means of preliminary safety analysis during which the main system hazards are identified and classified by
assessing the compliance of the subsystem itself with the overall system Safety Integrity.
For SDTC, as it is a unit with a clear and limited railway signalling function, the product safety integrity level has
been assumed, a priori, to be SIL 4.
Specifically:
– The SIL0 Integrity Level must be assigned exclusively to those functions whose deviation from the
specifications has negligible effects in terms of the safety of the subsystem (e.g. the diagnostic software).
– The SIL2 integrity level must be assigned to those functions that, even if not safety related, are relevant in term
of availability. (e.g. the coder software).
– The SIL4 Integrity Level must be attributed to all the functions whose correct functioning is essential to ensure
the presence of safe conditions (in case of SDTC all safety functions are implemented with inherent hardware
architecture).
The demonstration of the actual obtaining of the SIL assigned to the functions and the subsystem will comply with
the EN50129 standard [2]; specifically, the following must be demonstrated:
– for random errors, obtaining of the numeric targets defined by the EN50129 standard § A.5.2, specified in
Table 1 for completeness;
– for systematic errors, the application of a life cycle which complies with the requirements for the SIL in question
as specified by the applicable CENELEC standards [1], [2].
Tolerable Hazard Rate THR per hour

Safety integrity level
and per function
≥ 10 to < 10
-9 -8
4
≥ 10 to < 10
-8 -7
3
≥ 10 to < 10
-7 -6
2
≥ 10 to < 10
-6 -5
1
From: EN 50129
Table 1: SIL targets table
abcd SDTC
06/07/11
Shall be noted that, since the SDTC function is in a signalling system only one part of the Track Circuit control
function, it is important to demonstrate (to control random failures) a value of Unsafe Failure Rate much lower of
-9 -1 -12 -1
10 h . An acceptable target could be less than 5x10 h .
3.2 Reused Components
This Safety and V&V Plan has been issued in order to validate the small technical modifications applied on the
SDTC product and the updated technical documentation (e.g. the manuals), referring to the SDTC already
validated version
Therefore part of the safety and V&V activities already performed in the life cycle described in the Safety Case [13]
will be re-used.
This Safety Case demonstrated the SDTC compliance to SIL4 as defined in CENELEC Standards and was
assessed by SIA (Società Italiana Avionica) company (ref. [19])
Shall be noted that no new software for SDTC will be developed. SDTC will use the same software version -
already validated - of the other DIGICODE family products (e.g. the same SIL0 diagnostic software version of
DTC24-1 and the same coder SIL2 software version of DTC24-1 and DTC24-2 – see [15] and [16]).
The same software version was also installed in the SDTC version validated in 2002 (ref. Safety Case [13]).
3.3 Responsibility limits
ALSTOM FERROVIARIA (Bologna) is not responsible for the following:

– malfunctions caused by vandalism and sabotage;
– malfunctions caused by incorrect operations and maintenance or operations and maintenance which do not
comply with the applicable procedures;
– malfunctions caused by units which do not comply with the specifications and which were not supplied by
ALSTOM;
– risks caused by possible malfunctions deriving from management of the system without a function for
detecting the state of the unit and/or in the presence of manual procedures due to unavailability of parts of
the product itself.
In addition, this plan has been written in accordance with the following current safety standards:
– EN 50126 - 1999 (ref. [1]);
– EN 50129 - 2003 (ref. [2]);
– EN 50121-4 - 2001 (ref. [3]);
– EN 50125-3 - 2003 (ref. [5]);
– EN 50128 Ed. 2001 (ref. [6]).
Therefore, the compliance of SDTC product is not guaranteed for later versions of these standards.
abcd SDTC
06/07/11
4 SAFETY PLAN
The SDTC product safety and V&V plan is based on a series of activities aimed at ensuring the following:
– the process and corresponding procedures are defined and complied with applicable standards;
– the critical aspects which are harmful for safety are identified and solved in an acceptable manner;
– the safety of the system is demonstrated in an appropriate manner.
With this in mind, the safety process must be integrated as much as possible with the design activities. This
process consists of various activities, carried out following different points of view and at various times during the
development but all with the common objective of identifying critical safety aspects, solving them and documenting
the solutions.
The process is based on the definition of the product life cycle whose task is to define unambiguously a series of
distinct stages, from the Risk Analysis stage to the Validation stage.
For every stage, then, the activities must be defined, as well as the requirements, the procedures for creating them,
the relations between them and the various responsibilities.
4.1 Safety Management
The safety program is managed by coordinating a series of activities:

– planning. The first of all the activities is the definition of a safety program. The Safety Plan (this document)
must illustrate all the aspects of the safety program in detail. This plan describes the process, the activities, the
procedures, the requirements, the resources and the planning for running and managing all the work required
for system safety. All the activities defined by the plan must be controlled and verified to ensure they are
applied correctly.
– control. The critical aspects, which are harmful for safety, must be identified and solved. The control must
interact with the various parts involved, for the reciprocal alignment of the work progress and for managing the
changes and reviews. With this in mind, the safety experts who must take part in the reviews must be identified
with the objective of highlighting and discussing the project hazard aspects and the possible ways of solving
them.
– review and approval. All the formal safety documentation produced during the entire development of the
product must be subject to review and approval. The safety of the product must be demonstrated in an
appropriate manner in the Safety Case.
4.2 Safety and Quality Links
The safety is related to quality assurance. The objective of Quality Management is the definition and management
of a quality assurance and control process which involves all the product design, creation, production, delivery and
installation stages.
By helping to reduce the incidence of human errors and other problems which may arise during the various stages
of the life cycle, quality is also a fundamental preventive measurement tool for ensuring safety.
The SDTC product is developed as part of Quality Assurance. The ALSTOM FERROVIARIA (Bologna) Quality
System has ISO 9001 Certification. The quality assurance aspects, defined in the Quality Plan for the entire
development of the product, comply with the Quality Manual and its integrations (Procedure Manual and Detailed
Instructions). This plan also considers the subjects relating to the development of the software and the
management of the configuration.
abcd SDTC
06/07/11
Also note that, although the safety objectives are of extreme importance, they must always be considered
alongside other aspects, such as the reliability and availability. A high level of system safety does not guarantee
high system reliability and vice versa. One of the fundamental objectives of the development of SDTC is to design
the system with an acceptably-high safety level while maintaining a high level of reliability and availability. To
ensure this, SDTC must comply with the constraints expressed by the RAM requirements, as described in [14].
4.3 Technical Activities
The safety activities defined by this process can be classified into two main categories:
- Safety Analysis (SA);
- Safety Verification and Validation (SVV).
Finally, there are other safety-related activities (of a technical and/or management nature) not directly linked to this
Analysis and V&V. They relate to aspects like the definition and development of the safety requirements at the
various levels, their tracking and emergency and change management.
4.3.1 Safety Analysis
The figure below illustrates the flow adopted for this process.
Preliminary Hazard Analysis
Process logic flow Hazard Log

Subsystem Hazard Analysis
Data flow
Design Hazard Analysis

(HW Safety Verific.,
RAM Analysis, Type
testing, ecc.)
Figure 3: Safety Analysis process
abcd SDTC
06/07/11
The Safety Analysis involves the application of various Hazard Analyses and assessment of the solutions. The
objective is preventive: the potential hazards must be identified and the project decisions must be modified
accordingly. This means analysing and assessing (sometimes with quantitative measurements) the safety of the
solutions and also documenting them. For these purposes, various analyses, testing and calculation methods are
used. The safety is demonstrated for the various cases of normal functioning and malfunctions due to hardware
component faults and particular environmental or stress conditions.
The Safety Analysis is described in detail in this Plan and is catalogued with the code [SA-xx], where xx is an
alphanumeric identifier.
The Safety Analysis may be qualitative and quantitative. The qualitative analysis is considered to be indispensable
for identifying the type and number of the countermeasures to be adopted. The quantitative analysis could be
useful for checking that any probability targets have been obtained.
All the analysis leads to a report and any hazards identified are recorded in a Hazard Log. This makes it possible to
guarantee the complete traceability of the analysis and the results.
4.3.2 Safety V&V Activities
In general, the verification/testing is part of the development and integration process as illustrated by the flow in the
figure below.
Development stage
(i-1)
Internal
consistency Stage input (i)
verification
Stage Test Report (i)
Cross- Development stage Test

consistency (i) Specification
verification
Test
fase (i)
Internal
consistency Stage output (i) Stage Test Specification (i)
verification
Stage executable (i)
Stage Test
(i+1)
Figure 4: Safety V&V Proceass
abcd SDTC
06/07/11
The safety verification/validation involves other activities (such as inspection and review which, in turn, may include
independent analysis, testing and calculations) to guarantee that the safety requirements have been complied with
and that the safety of the product is demonstrated.
The Safety Verification and Validation is described in detail in this Plan and is catalogued with the code [SVV-xx],
where xx is an alphanumeric identifier.
The important changes made to the single product stages and, clearly, all the safety-related changes, must be kept
track of using the "Design and Safety Reviews" which will be carried out as established in the appropriate Quality
Procedure [12]. These activities must indicate the changes required and the operating consequences, such as
changes to the documents already issued or to specific algorithms.
The various "Design and Safety Review" activities may be design studies which make changes to previous
solutions, internal meetings (involving ALSTOM personnel only) or global meetings also involving the customer,
who may get involved to request changes during the specific design stage.
The various Design Reviews recorded will then be used to keep track of the changes made during the various
stages.
This plan will be updated whenever it is necessary to make variations to the current situation both in terms of the
organisation and in terms of the planned activities. This plan may be re-issued at the request of internal ALSTOM
personnel or at the request of the customer or external assessor.
The important changes made to the single product stages and, clearly, all the safety-related changes, must be kept
track of using the "Design and Safety Reviews" which will be carried out as established in the appropriate Quality
Procedure. These activities must indicate the changes required and the operating consequences, such as changes
to the documents already issued or to specific algorithms.
The various "Design and Safety Review" activities may be design studies which make changes to previous
solutions, internal meetings (involving ALSTOM personnel only) or global meetings also involving the customer,
who may intervene to request changes during the specific design stage.
The various Design Reviews recorded will then be used to keep track of the changes made during the various
stages.
This plan will be updated whenever it is necessary to make variations to the current situation both in terms of the
organisation and in terms of the planned activities. This plan may be re-issued at the request of internal ALSTOM
personnel or at the request of the customer or external assessor.
4.3.3 Modification Management
In general, this activity involves a description of the change, an assessment of its impact, the establishing of the
analysis required, application of this analysis and documentation of the results. All these activities will be carried
out in the same way as the various Risk Analyses forecasted.
Any hardware modification to be made after the development stage and after the completion of the corresponding
safety analysis must be subject to safety assessments and re-analysis to guarantee that the safety level reached is
not reduced. These changes may relate to the requirements, design or creation. This sub-process within the global
safety process includes the following aspects:
– Evaluation, justification and description of the changes and their impact on system functioning;
– Evaluation, justification and description of the safety analysis (such as analysis, type of testing and
calculations) and description of the system parts involved;
– Application of the safety analysis to the changed system parts (it may be necessary to repeat one or more
of the safety process activities described in this plan and to repeat the process for demonstrating the safety
and guaranteeing that no problems have arisen).
Adaptation of all the project documentation previously issued.

Therefore, any changes necessary after the issuing of the Safety Case will require updating of all the project
documentation and re-issuing of the Safety Case.
abcd SDTC
06/07/11
4.3.4 Documentation Management
A safety program must have correct document management which ensures the following:
1. the correct drafting of the documents in relation to compliance with the company standards (templates,
document coding, etc.);
2. the correct archiving in terms of accessibility to users and regular saving;
3. the control of the documentation issued for the final customer;
4. the methods for approving the single documents by the final customer.
All the project documents for the SDTC product are only issued after the controls carried out by the V&V Team.
The documentation for these controls, as well as being reported in the corresponding stage Verification Reports, is
anticipated by the signature of the Validation Leader in the "Controlled or Approved" document field. This signature
guarantees that a control of the compliance of the document with the documentation plan and a preliminary
checking of the content have been applied, so that they are sufficiently adequate in terms of the requirements of
the specific stage.
4.3.5 Safety Demonstration
The objective of the Safety Demonstration is to collect and summarize in the Safety Case all the information in
order to provide the evidence that SDTC product has reached the required SIL.
This evidence is provided through the activities defined in the Safety plan and in the V&V plan described in the
following chapters. The Safety Case will be structured as specified by CENELEC EN 50129 [2].
4.3.6 Independent Safety Assessment
The purpose of the safety assessment activity is to evaluate, independently from the Project Organization, that the
residual risk related to system acceptance is negligible with reference to the defined SIL.
For SDTC, the Safety Assessment is demanded:
Internally to the Internal Safety Assessor for the overall product;
Externally to a company (Independent Safety Assessor) appointed by ALSTOM (see §5).
The Internal Safety Assessment:
Evaluates the compliance of the safety management system of the site with the ALSTOM Transport
Information Solutions instructions, with the prescriptions of the Product & System Safety Manual [9] and the
applicable legislation(s) and regulations;
Prevents delivery of any system or equipment the safety level of which is not judged sufficient;
Is the only person allowed to sign the internal authorization, i.e. the formal permission to put into service
within specified application constraints;
Approves the Safety Cases and Safety Reports.
The Independent Safety Assessor:

Determines whether design and validation have achieved a system that meets the specified safety
requirements and forms a judgment as to whether the delivered product is fit for its intended purpose.
abcd SDTC
06/07/11
5 PROJECT ORGANISATION
The safety organisation for the development of the SDTC project complies with the ALSTOM Safety Manual
SIG004 [9] and with the specifications in paragraph 5.3 of the EN 50129 standard [2].
In particular the SDTC organisation follows the structures established by EN50129 in the “Figure 6 – Arrangements
for Independence for SIL3 and SIL4 product”. This structure is also shown in the Figure 5. This organization
structure has been adopted also for SDTC SIL0 components.
PM
ASSR
DES VER, VAL
LEGENDA:
PM = Project Manager = Can be the same person
DES = Designer Implementer
VER = Verifier = Can be the same Organization
VAL = Validator
ASSR = Assessor
Figure 5 – SIL 4 activity organization
An Independent Assessment will be performed by the Italian company Italian company “Bureau Veritas SCIRO“
that is accredited by the Italian Ministry of Infrastructures and Transport as a Notified Body to assess the conformity
or suitability for use of the interoperability constituents both in the high-speed rail sector and in the conventional rail
sector (according to European Directives 96/48/EC, 2001/16/EC and 2004/50/EC). “Bureau Veritas SCIRO“ is also
accredited by the Italian NSA (National Safety Authority) as an Independent Safety Assessor.
Also the previous version of SDTC, issued in 2002, was assessed but by a different Independent Assessor named
SIA (Società Italiana Avionica) (ref. [19]).
Referring to the following figure the project organisation for SDTC has two main figures: a Project Leader appointed
by the PRODUCT structure and a Validation Leader (also named Safety Assurance Manager) appointed by the
SAFETY structure. Although working on the same project, the two figures are independent and only respond to
their own structure managers.
abcd SDTC
06/07/11
Internal Safety Assessor

S. Stanghellini
TIS Products Safety Industrial

Product Engineering Quality Assurance
Assurance Engineering
D. Giangaspero A. Silvestrini
T. Impera A. Pupetti
Safety Assurance
Project Leader Project Quality manager
Manager
(A. Giovannucci) (R. D'Avossa)
(F. Memmo)
HW Design SW HW Safety
RAM Analysis Type Testing
Validation Verification Analysis
(A. Barbacini) (F. Memmo)
(F. Memmo) (V. Ornelli) (F. Memmo) (G. Adragna)
Figure 6 – SDTC Project Organisation
The main roles in charge for different activities are the following:
• Quality Manager, who coordinates the team for analysing and checking the compliance with the Quality
standards applicable to the product.
• Safety Assurance Manager (or Validation Leader), who must guarantee correct application of the V&V process
with particular reference to the safety aspects and who coordinates the activities of the RAM and Safety teams
and the internal and external resources involved in the V&V activities.
• Project Leader, responsible for the planning and integration between the hardware and software components
and the use of the resources as required for the project objectives.
• Internal Safety Assessor: responsible for the final authorization, internal to ALSTOM, for the products safety
related; he is independent from both the Design and the Safety and V&V team.
• TIS Products Safety Assurance Manager: responsible for approving the main safety related documents and
coordinating and supervising the activities executed by the Validation Leader.
The table below describes the activities in detail. Regarding the SDTC software, it shall be noted that no new
software has been developed and SDTC uses the same software versions of the other versions of DIGICODE
family. Therefore no software design activities are included both in Figure 6 and in the following table.
abcd SDTC
06/07/11
Activity Manager Description

Project A. Giovannucci This activity is be carried out for the entire life cycle. The purpose is to define the
Leader project and to monitor its development, working with the Validation Leader.
The initial activity involves the definition of the subsystem requirements and the
definition of the general subsystem architecture.
The activity continues then with the supervision of the HW developments and
their integration, as per CENELEC EN50126 and EN50129 standards.
The Project Leader is the PM indicated in EN50129.
HW Design A. Barbacini The HW Design activity involves the development of a product which complies
with the subsystem functional and safety requirements, based on the general
subsystem architecture defined in the previous stage and as per the EN50129
standard.
Safety F. Memmo These activities, carried out during the entire life cycle, have the objective of
Analysis identifying all the potential hazards of the project at the various development
levels. All the potential hazards must be recorded in the Hazard Log.
HW (Safety) V. Ornelli The purpose of the HW verification is to apply all the HW analysis related to the
Verification safety and reliability of the various components used. Another purpose is to plan
the various HW tests with Production and the Type Testing Manager.
SW Validation F. Memmo SW Validation means analysis and checking of all activities forecasted for SW
Life Cycle defined in this plan, in order to verify the correct design of the software
and the compliance with CENELEC EN50128. Moreover Validation Leader has to
verify (with tests and adequate analyses) the correct implementation of all SW
Requirements.
RAM Analysis F. Memmo The RAM analysis is carried out by the verification team, a part of the V&V team.
The project reliability and availability levels must be assessed numerically.
Type Testing G. Adragna The purpose of the Type Testing is to apply the various environmental, electrical
and electromagnet type tests for the subsystem.
SAM F. Memmo The SAM or Validation Leader ensures the correct application of the Verification
and Validation process with particular emphasis on the safety aspects.
The validation activities managed by the SAM start with the creation of a Safety
and V&V Plan and end with the collection of the results of the verification and the
generation of the Safety Case. The SAM coordinates the activities of the RAMS
teams and the internal and external company resources relating to the V&V
activities.
abcd SDTC
06/07/11
Activity Manager Description

Internal T. Impera The most relevant Safety Case documents, the V&V methodology and the safety
Safety results are approved by TIS Products SAM (T. Impera) and by Internal Safety
Approval S. Stanghellini Assessor (S. Stanghellini).
TIS Products SAM main tasks are:
• Appointment of the external verification teams of which he manages the
activities and the technical management;
• Interfacing with the other Assessor’s verification and validation bodies;
• To give the formal permission to put into service within specified
application constraints, if the safety level of the subsystem is judged
sufficient.
The Internal Safety Assessor has the responsibility for assessing the Safety
management system of the site in compliance with the ALSTOM FERROVIARIA
Information Solutions instructions and the prescriptions of the Product and
System Safety Manual. He is the person in charge to authorize the issuing of
Safety Case and Safety Report and therefore the use of a Safety Product in a
railway application.
Table 1 – SDTC project responsibilities
abcd SDTC
06/07/11
6 SDTC SAFETY AND V&V PLAN

This chapter contains the SDTC product life-cycle description. Similarly to the specifications for a generic system
as per CENELEC EN50126 [1], the life cycle may be represented by a ‘V’ scheme, as illustrated in Figure 7.
As specified in the §7, considering that no new software will be developed for SDTC and that this software is
classified SIL2 and SIL0, the software life cycle is simplified.
Product Requirements
Des: Requirements Specification
Overa ll Product Lifecycle Des: HW Technical Specification Product Valida tion
Saf: Preliminary Hazard Analysis
Val: Validation Report
Val: Safety Case
Val: Req. Verification Report Val: HW Validation Report
Val: Documentation Plan
Val: Safety and V&V Plan
Val: Hazard Log Product Integra tion
Val: Design Review Product Architecture & Design
RAM: RAM Analysis
Des: Architecture Description Ver: HW Safety Verification
Saf: Hazard Analysis Ver: Type Test Report
Val: Functional Test Plan Val: Functional Test Report
Ver: Type Test Plan
Val: Arch Verification Report
Software life cycle
Legend:
Des - Design
RAM - Reliability Availability & Maintenance Prototyping
Val - Validation Des: Schemes and Part List
Ver - Verification Des: Acceptance Test Specification
Saf - Safety
Figure 7: SDTC life cycle
For every stage of the life cycle, the specific Safety and Verification and Validation activities are defined, describing
their relations with the project activities.
The same figure, as well as the logical sequence between the various stages, illustrates an overall view of the
activities and the teams responsible for each of these, focusing its attention on the activities relating to Safety and
V&V and including certain Quality and Design activities for a clearer picture of the cycle.
The life cycle starts with the ”Product Requirements” stage. The purpose of this stage is the definition of all the
requirements which the product must comply with and the corresponding applicability conditions. In this stage,
Preliminary Hazard Analysis makes it possible to identify the functional and completeness safety requirements. The
set of all these requirements must be self-consistent and validated to create a starting base for all the remaining
product life cycle.
abcd SDTC
06/07/11
The “Product Architecture & Design” stage is applied to define the physical and safety architecture of the product
and the allocation of the requirements defined in the previous stage. This stage also includes the Hazard Analysis
activity and project stages in order to identify the potential hazards deriving from the architecture chosen and to
specify any countermeasures. The same stage must also specify a series of functional and type tests to be applied
to the final product.
Afterwards, the “Prototyping” stage for the physical creation of the actuator completely defines the product and
provides the detailed elements required for the “Product Integration” stage. This latter stage includes the RAMS
analysis (including the random HW fault analysis) and the production of the functional and type tests.
The “Product Validation” concludes the product life cycle and is used to demonstrate the safety of the product in
accordance with the initial “validated” requirements and the “Safety and V&V Plan” document. The documentation
for this is in the “Safety Case” document. The overall validation of the product ends, then, with the issuing of the
Validation Report and the generation of the Safety Case, both the responsibility of the validator who, in this way,
certifies the safety of the product, and documents this by collecting all the results of the previous activities.
After the validation, the product is ready for production (“Manufacturing” stage), which uses specific testing
procedures and instructions required to demonstrate the correct application of that stage. The documentation for
these activities is in the procedures (e.g. Acceptance Test Specification), already validated during the product life
cycle.
The product life cycle, therefore, ends with the drafting of the Safety Case and, clearly, with the closing of all the
hazards detailed in the Hazard Log. The Safety Case will be drafted as for the EN50129 [2] technical standard.
This Safety and V&V Plan may be re-issued if substantial changes are made to the project or if requested directly
by the customer or the assessor.
Note that in the case of vital HW products, the verifiers may or may not belong to the HW design team but they
must not have designed the unit.
The strategy adopted, the techniques and the instruments used for the HW verification are described in the
documents for every stage. From the safety point of view, starting with the Product Hazard Analysis, it is necessary
to plan the correct vital part verification and analysis (SIL 4). In addition, it is necessary to verify the reliability of the
single parts to complete the RAM analysis at a product level. For the non-vital HW parts (SIL 0), as well as defining
the requirements, nothing else is required other than the overall integration tests for assessing the overall
functionality.
The sections below provide a detailed description of the Safety, Verification and Validation activities carried out
during the life cycle of the SDTC device in every specific stage, including the stage input documents, the
documents produced, a description of the activities and the person or team responsible. For the sake of simplicity,
every activity is given the name of the document produced which, at times, may be included in another document.
6.1 Safety Analysis activities
The following list describes the Safety Analysis and reports, as well as a brief description, the Input and Output
documents and the activity manager.
This plan is a base document for the various activities described below. However, for the sake of simplicity, the
input documents required will not be included as they are considered to be common to all.
abcd SDTC
06/07/11
[SA-1] Preliminary Hazard Analysis
INPUT – Preliminary Hazard Analysis – General Procedure [10]

– Standard PHL, contained in [11]
– SDTC Requirements specification and HW Technical Specification (preliminary).
OUTPUT – SDTC Preliminary Hazard Analysis
– SDTC Hazard Log (first issue)
– SDTC Requirements Specification (updated with safety requirements)
DESCRIPTION The objective of the Preliminary Hazard Analysis is to identify the hazards for the product in
question and to assess the risk associated to these. The following is required:
– Identification and systematic listing of all the hazards reasonably possible associated to the
product in question and its application conditions
– Identification of the sequences of events which lead to these hazards
– Estimation of the frequency of occurrence of each hazard
– Estimation of the possible severity of the consequences of each hazard
– Estimation of the risk associated to each hazard
– Determination and classification of the acceptability of the risk associated to each hazard
identified
– Highlighting of the countermeasures to be adopted, which must become Safety Requirements.
The procedure for applying this is described in detail in [10]
The hazards identified in the PHA will also be recorded in a Hazard Log, to be used as the base
for managing risks during the life cycle of the product. The results of the preliminary risk analysis
and the countermeasures identified are used to re-draft the safety requirement list, which will be
supplied to the designer for possible reviewing and for insertion within the product Requirements
Specification.
IN CHARGE OF Verifier
[SA-2] Hazard Analysis
INPUT – SDTC Requirements Specification and HW Technical Specification (final);

– SDTC Preliminary Hazard Analysis;
– Results of HW safe circuits RAMS analysis (this activity is done in parallel and described in
HW Safety Verification e RAM Analysis documents)
OUTPUT – SDTC Hazard Analysis
– SDTC Hazard Log (revision)
DESCRIPTION This involves identifying any hazards deriving from the architectural solutions adopted for creating
the product. The hazards identified must have corresponding countermeasures.
This activity will be carried out parallel to the detailed RAMS analysis for the vital HW parts and
will provide it with input (e.g. fault chains to be analysed) and will use some of its results, such as
the reliability (failure rate) predictions and fault mode assessments.
The operating method envisages the use of the following techniques:
- “Bottom Up” analysis by means of FMEA (Failure Mode and Effect Analysis). This activity
analyses in a systematic way and using a predefined set of guideword the effects of all the
possible failure mode of the functions identified in the architecture of the SDTC. The goal is to
identify the relationship between the failure mode and the PHA identified hazards.
abcd SDTC
06/07/11
- “Top Down” analysis by means of FTA (Fault Tree Analysis). FTA analyses in a systematic
way SDTC hazards defined in PHA with the aim to evaluate effectiveness of
countermeasures identified in FMEA. These countermeasures has to reduce hazard risk
within tolerable limits for SIL allocated to SDTC and to its functions.
As for the safety countermeasures, they must be expressed clearly so that they can then be
related to the safety requirements, in this case, the HW requirements only.
[SA-3] Hazard Logging
INPUT – SDTC Preliminary Hazard Analysis

– SDTC Hazard Analysis
– All the safety analysis
OUTPUT – SDTC Hazard Log
DESCRIPTION The purpose of this activity, maintained for the entire product life cycle, is the construction of a
hazard log, a base instrument for the continuous management of the risks. The Hazard Log must
be updated during the life cycle whenever there is a variation in any dangerous situation identified
or whenever a new dangerous situation is identified. The Hazard Log must include a detailed
description of the following:
– the objective or purpose of the activity
– dangerous events and contributing components
– probable consequences and frequencies of the sequence of events associated to every
dangerous situation
– the risk of every dangerous situation
– the tolerance criteria of the risk for the application
– the measures taken to reduce to a tolerable level or to eliminate the risk for every dangerous
situation
– a process for re-examining the tolerance of the risk
– a process for re-examining the effectiveness of the risk reduction measures
– a process for the continuous management of the risk and for the collection of the accident
data
– a process for Hazard management
– the limits of any analysis applied
– any hypothesis considered during the analysis
– any confidence limit applied to the data used during the analysis
– the methods, instruments and techniques used
– the personnel involved in the process and their duties.
At the end of all the safety project and analysis processes, the Hazard Log must show that all the
hazards have been in some way covered by appropriate countermeasures and then closed.
Failure to close a hazard may require re-opening of one of the previous stages.
IN CHARGE OF Verifier to register open points
Validator to close open points
abcd SDTC
06/07/11
6.2 Safety V&V activities
The following list describes the Safety Verification and Validation Analysis and reports, as well as a brief
description, the Input and Output documents and the activity manager.
This plan is a base document for the various activities described below. However, for the sake of simplicity, the
input documents required will not be included as they are considered to be common to all.
[SVV-1] Requirements Verification
INPUT – SDTC Preliminary Hazard Analysis

– SDTC Requirements Specification
OUTPUT – Requirements Verification Report
DESCRIPTION The activity is carried out by inspecting the documentation and the purpose is to check that the
product requirements are complete and consistent, ensuring the correct functioning of the product
in terms of the specified application conditions. The detailed requirements, including the safety-
related ones, are contained in the preliminary version of the Requirements Specification.
The insertion of the safety requirements relating to the countermeasures identified by the PHA
must be verified.
The verification activity must check that the functional requirements are in some way testable and
that the external interfaces with other products or with any operators are defined from the
functional point of view.
In addition, it must be verified that the language used is clear and appropriate for the description of
the requirements, which must be numbered and classified, and it must be verified that the relative
SIL associated is reported for each of these.
IN CHARGE OF Validator
[SVV-2] Functional Test Planning
INPUT – SDTC Requirements Specification
OUTPUT – SDTC Functional Test Plan

DESCRIPTION This activity must include planning of the functional tests which prove safety and compliance with
the functional product requirements. The tests are carried out on the complete product with all its
parts.
The test specification document must define the following:
- the environment, the instruments, the configurations, the simulators and the programs used to
develop the tests
- the test cases and the test data
- the tests which verify the functioning of the Product in the presence of malfunctions and
verification of the returning of the product to a safe condition
- the test criteria on whose basis the test results must be assessed.
The results of the activities described will be added to the same document.
abcd SDTC
06/07/11
[SVV-3] Type Test Planning
INPUT – SDTC Requirements and Hw Technical Specification

– CENELEC EN 50121-4 [3], EN 50124-1 [4], EN 50125-3 [5]
OUTPUT – SDTC Type Test Plan
DESCRIPTION The product must be verified under the electrical, environmental and mechanical conditions
specified by the CENELEC standards for equipment operating in areas which envisage the
occasional presence of persons. The reliability of the product under extreme environmental and
electromagnetic conditions must be proven. Any interference emitted by the product must be
verified.
[SVV-4] Architecture Verification
INPUT – SDTC Requirements Specification and HW Technical Specification

– SDTC Type Test Plan
– SDTC Functional Test Plan and Report
– SDTC RAM Analysis
– SDTC Hardware Safety Verification
– SDTC Type Test Report
OUTPUT – Architecture Verification Report

DESCRIPTION The project documentation will be reviewed in terms of its completeness, consistency, safety and
traceability. Specifically, this activity must ensure the following:
– that the HW requirements in the Product Requirements Specification are consistent and, if
required, have been expanded sufficiently into more detailed requirements;
– that the Hazard Analysis refers to the Hazards listed in the PHA; and that the consistency
between FMEA and FTA is verified. This activity is carried out to verify if all the faults or errors
identified in the FMEA correspond to FT starter events;
– the HW-related product requirements are traceable in the HW requirements with the correct
SIL;
– the requirements must correctly apply the countermeasures identified in the product Hazard
Analysis.
As well as the project input explicitly declared for the activity, if available, the documents which
more specifically relate to the Product Integration stage (e.g. RAM Analysis, Application
Conditions) may also be considered.
[SVV-5] RAM Analysis
INPUT – MIL-HDBK 217F Military handbook, Reliability prediction of electronic equip. [8];
– SDTC Requirements and HW Technical Specification (final version)
– SDTC Schemes & Part List
OUTPUT – SDTC RAM Analysis
abcd SDTC
06/07/11
DESCRIPTION In the first stage, the RAM Analysis must make an initial assessment of the reliability and
availability of the product, providing certain HW project indications of the analysis identifies
reliability problems which cannot be dealt with using the chosen architecture.
The activity, based on the data provided by the HW design for the estimated reliability of the single
components, continues by quantifying, and therefore completing, the RAM analysis.
The data used to predict the failure rates is based on the statistical data defined in the standard
Military Handbook [8].
[SVV-6] Hardware Safety Verification
INPUT – Question A 155.3 – Failure Catalogue for Electronic Components [7]

– SDTC Preliminary Hazard Analysis
– SDTC Requirements and HW Technical Specification (final)
OUTPUT – SDTC Hardware Safety Verification

DESCRIPTION This involves the laboratory simulation of the series of faults and fault chains identified during the
safety analysis for SIL 4 HW or involves checks which reveal the insignificance of the changes
made to the vital units compared to previous validated versions.
It involves the application of an FMEA (Failure Mode Effect Analysis) for establishing the effects of
single HW faults, for the SIL 4 components or cards. The analysis used the fault catalogue as
specified by ORE recommendations [7] and Annex C of EN50129 standard [2]. The criteria used
to identify the laboratory tests must be justified adequately.
Usually, each vital HW part identified (such as a card) will be divided into functional blocks and for
each of these blocks, there will be identification of the corresponding functional fault modes, with
the effects at a local level, on the card and on the actuator product. The division into functional
blocks will be backed up with a detailed description, including preliminary analysis of the impact on
the safety of each block. This activity also includes analysis for certifying the absence of common
fault modes, originating in the non-vital products, which may affect the safety of the vital products.
The effect of the multiple faults must then be assessed by means of Fault Tree Analysis (FTA). On
the basis of the results of the Hazard Analysis and FMEA, the effects of the potentially-dangerous
fault chains will be verified, perhaps by simulating these fault chains on the actuator product
prototypes already created.
Compliance with EN 50124-1 will also be analysed, in terms of the surface and air isolation
distances.
This analysis must also verify the safety requirements at a Product Requirements level and check
that faults or shifts from normal functioning do not alter the safety functionality of the component.
abcd SDTC
06/07/11
[SVV-7] Type Testing
INPUT – SDTC Type Test Plan

– CENELEC EN 50121-4 [3], EN 50124-1 [4], EN 50125-3 [5]
OUTPUT – SDTC Type Test Report
DESCRIPTION This involves the application of the tests planned in the product Type Test Plan document.
These tests make it possible to verify the functioning of the various actuator product HW parts,
integrated with each other and configured as for real use, under extreme environmental and
electromagnetic conditions.
[SVV-8] Functional Testing
INPUT – SDTC Functional Test Plan

OUTPUT – SDTC Functional Test Report
DESCRIPTION This involves the application of the product functional tests already planned in the Functional Test
Plan.
The report must specify the results of all the product functional tests. The product is tested
complete with all its parts and the tests are the global functional tests.
If the expected result does not correspond to the requirements, a change must be requested and it
must be tracked. The test is then repeated to check the compliance of the change made and, if
required, other tests relating to functionality which might be affected by this change must also be
repeated.
[SVV-9] Manufacturing Verification Report
INPUT – SDTC Requirements and HW Technical Specification

– SDTC Schemes & Parts List
– SDTC Acceptance Test Specification
OUTPUT – SDTC Manufacturing Verification Report, included in the SDTC Validation Report document.
DESCRIPTION This activity includes the following:

- Verification of the product documentation in terms of congruency and consistency, both
internally and in relation to the applicable project documents (HW Technical Specification and
RAM Analysis)
- Verification of the format specified for the Quality Reports or ‘Inspection Notes’ which must be
produced during the Manufacturing stage.
abcd SDTC
06/07/11
[SVV-10] Validation Report
INPUT – All the product documentation
OUTPUT – SDTC Validation Report

– SDTC Hazard Log (open points final closing)
DESCRIPTION This activity includes the following:

- Verification of the compliance with the product requirements. This activity, based on visual
inspections, must provide direct traceability between the requirements, the corresponding
verification methods and the results of the verification. Specifically, it contains the results of
the [SVV-1] and [SVV-4] verification.
- Re-examining of all the project documentation and, in particular, verifying if the safety analysis
carried out is sufficient to demonstrate the coverage of the hazards defined in the Hazard
Analysis for the SIL 4 HW parts.
- Verification of the results of the functional and type tests envisaged for the Product Integration.
The validator may, at his discretion, accept the test results or ask for them to be re-applied.
- Closing of all the hazards recorded in the Hazard Log.
- Reviewing of all the project and verification documentation in terms of completeness,
consistency and traceability
- Compliance of the V&V process as required by the Safety and V&V plan, described in this
document
- Control of the design reviews which require product changes, verifying that the stages subject
to these changes are again subject to specific tests.
Every discrepancy detected and the errors identified must be reported in a separate Validation
Report Appendix.
Finally, the detailed definitive project documents are assessed, as follows:
– SDTC Requirements and HW Technical Specification
– SDTC Acceptance Test Specification.
[SVV-11] Safety Case
INPUT – All the project documentation

OUTPUT – SDTC Safety Case
DESCRIPTION The main purpose of this activity is the drafting of the “Generic Product” type “Safety Case” in
accordance with the guidelines of the EN 50126 [1] §6.9.3.3 technical standard and in compliance
with the requirements of EN 50129 [2].
The Safety Case must provide the required proof documentation for the safety principles adopted,
by means of appropriate references to the project documentation. The Safety Case must also
guarantee that appropriate tools and procedures have been used to demonstrate the safety levels
required. The Safety Case must be approved by the appropriate Railway Authorities and must
include the following:
- A description of the product
- A list of the product safety requirements and an assessment of the SIL associated
- An analysis of the quality and safety controls adopted during the life cycle
abcd SDTC
06/07/11
- An assessment of the safety of the product and the relative ‘audits’ carried out
- A general description of the safety techniques adopted
- Verification of the creation of the safety techniques
- A list of the limits and constraints for the application of the product.
abcd SDTC
06/07/11
7 SOFTWARE VERIFICATION E VALIDATION PLAN

The software lifecycle, as shown in the following figure, starts with the “SW Requirements” phase, derived from the
results of SDTC Requirements and SDTC Architecture phases, and can be defined complete once the software
validation of all software module has been performed.
Results deriving from SW Validation will be used in the Integration and Validation phases.
Legenda:
Q - Quality From Subsystem Requirements Phase and To Subsystem Integration Phase
Des - Design Architecture Phase
Val - Validation
Ver - Verification
SW Requirements a nd Architecture SW Valida tion

Software Pla nning
Des: Software Requirements Specification Val: Software Validation Report
Des: Software Architecture and Design Specification
Q: Software Quality Assurance Plan Val: Software Requirements Test Specification

Q: Software Config Management Plan [SW/ HW Integration Test Plan]
Q: Software Maintenance Plan
Val: Software Requirements and Architecture
Verification Report
SW/ HW I ntegra tion
Val: Software Requirements Test Report
Val: SW Validation Plan [SW/ HW Integration Test Report]
Ver: SW Verification Plan
SW M odule Design
Des: Software Module Design Spec
Ver: Software Module Verification Report
Coding
Des: Software Source Code & Supporting Documentation
Ver: Software Source Code Verification
Figure 8 – SDTC software life cycle
The lifecycle for the software activities complies with the specifications in EN 50128 [6] for SIL0 (diagnostic) and for
SIL2 (coder).
Moreover the software life cycle has been simplified respect to the EN50128 [6] standard:
- some activities have been joined;
- because of the low complexity of the software code, the Module Testing, SW Integration and SW/HW
Integration activities on the software can be considered performed trough a single verification activity, to be
carried out directly on the target (SW Requirements Testing).
Shall be noted that no new software for SDTC has been developed. SDTC uses the same software version -
already validated - of the other DIGICODE family products (e.g. the same SIL0 software version of DTC24-1 is
running on DIAG board and the same SIL2 software version of DTC24-1 and DTC24-2 is running on MODEM
board ). The same software version was also installed in the SDTC version validated in 2002 (ref. Safety Case
[13]).
abcd SDTC
06/07/11
7.1 Software V&V activities
[SW-Val-1] SW Requirements Test Specification
INPUT
SDTC SW Requirements Specification
(included in “Software Technical Specification”)
SDTC SW Architecture and Design Specification
(included in “Software Technical Specification”)
OUTPUT
SW Requirements Test Specification

(included in “SDTC Software Requirements Test Specification and Report”)
DESCRIPTION
The aim of this activity is to specify the tests required in order to demonstrate the correct
implementation of the SDTC SW requirements. These tests shall include:
- “positive” tests in order to demonstrate the correct functioning in nominal conditions;
- “negative” tests in order to demonstrate the specified behavior in case of malfunctioning.
For each tests at least the following information shall be provided:
- the test methodology that will be followed;
- devices and tools that will be used;
- input data;
- expected results;
- test objective and acceptance criteria.
[SW-Val-2] SW Requirements and Architecture Verification
INPUT
SDTC Requirements Specification
SDTC Architecture Specification
SDTC Hazard Analysis
SW Requirements Specification
(included in “SDTC Software Technical Specification”)
SW Architecture and Design Specification
OUTPUT
SW Requirements and Architecture Verification Report

(included in “SDTC SW Validation Report”)
abcd SDTC
06/07/11
DESCRIPTION
The aim of this activity is to:
- Verify compliance of activities and documents with applicable plans, guides and templates;
- Verify consistency, adequacy and completeness of software requirements test cases, also
towards the SDTC architecture;
- Verify coverage of software requirements with SDTC requirements, verifying the correct SIL
allocation required by SDTC Requirements Specification and Hazard Analysis;
- Verify coverage between SW requirements and specified tests;
- Verify the coverage of SW architecture description towards the SW requirements,
apportioning all the requirements to the functions.
[SW-Ver-1] SW Module Verification Report
INPUT
SW Module Design Specification
OUTPUT
SW Module Verification Report

DESCRIPTION
The aim of this activity is to provide an overall evaluation of the SW Module Design activities,
through a documental inspection of the software design documents.
In particular shall be verified:
- the correspondence between the defined functions and the implemented SW modules;
- the adequacy of SW Requirements Test Specification, where the defined test cases shall
be able to completely verify each functions
[SW-Ver-2] SW Source Code Verification
INPUT
abcd SDTC
06/07/11

SW Module Design Specification
SDTC Delivery Sheet
OUTPUT
SW Source Code Verification Report

DESCRIPTION
The aim of this activity is to verify (for SIL2 only), through the code inspection, the readability,
the adequacy of inserted comments, the use of the required language and the consistency with
the SW Module Design Specification.
This activity includes the verification respect to the coding rules of the EN 50128, Annex A.
[SW-Val-3] SW Requirements Testing
INPUT
OUTPUT
SDTC Software Requirements Test Specification and Report

DESCRIPTION
This activity reports the results of the tests included in the document “SDTC Software
Requirements Test Specification and Report”. At least the following information shall be
provided:
- Description of test environment, tools, equipment configurations and simulators;
- Identification of used HW and SW parts
- Description of test results and their evaluation (anomalies shall be indicated).
[SW-Ver-3] SW Validation
INPUT

SDTC Architecture Description
SDTC Software Technical Specification
SDTC Delivery Sheet
abcd SDTC
06/07/11
SDTC Software Requirements Test Specification and Report

All the SDTC life cycle documentation
OUTPUT
SDTC SW Validation Report

DESCRIPTION
At least the following activities shall be performed:
• Verification respect to the SW Validation Plan (§7 of this document);
• Verification of the SW requirement coverage respect to the SDTC Requirements (including
the SIL verification);
• Verification of the SW requirement consistency and traceability between SDTC
architecture and SW requirements;
• Verification of performed SW requirements testing activities (coverage and results);
• Verification of the SW Module Verification and Source Code Verification activities;
• Verification of “Safety and Design Reviews” applicable to SW life cycle;
• Management of possible Open Points.
7.2 Document Cross Reference Table
The Figure 8 illustrates the lifecycle applied and the following table compares the SDTC Documentation Plan with
the “Documents Cross-Reference Table” reported in EN 50128, clause 7: “lifecycle issues and documentation”.
PHASES DOCUMENTS DOCUMENTS Note

(*) = in parallel with EN 50128 SDTC
other phases
SYSTEM INPUTS A 1. System Requirements Specification SDTC Requirements Specification
A 2. System Safety Requirements
Specification
A 3. System Architecture Description SDTC Architecture Description
A 4. System Safety Plan SDTC Safety and V&V Plan
B 1. No new software for SDTC has been developed.
SDTC uses the same already validated SW of
DIGICODE family products (e.g. DTC24-1 and
SW PLANNING (*) Sw Quality Assurance Plan DTC24-2 SW Quality Assurance Plan, [17]
DTC24-2).
No new quality management strategy introduced
for SDTC.
DTC24-2 SW Configuration Management DIGICODE family products (e.g. DTC24-1 and
Sw Configuration Management Plan
Plan, [18] DTC24-2).
No new configuration management strategy
introduced for SDTC.
B 3. Sw Verification Plan SDTC Safety and V&V Plan
Due to low SW complexity only a SW
B 4. Sw Integration Test Plan - Requirement Testing activity has been
performed.
- Due to low SW complexity only a SW
B 5. Sw/Hw Integration Test Plan Requirement Testing activity has been
performed.
abcd SDTC
06/07/11
PHASES DOCUMENTS DOCUMENTS Note

(*) = in parallel with EN 50128 SDTC
other phases
B 6. Sw Validation Plan SDTC Safety and V&V Plan
DTC24-2 SW Configuration Management DIGICODE family products (e.g. DTC24-1 and
Sw Maintenance Plan
Plan, [18] DTC24-2).
No new configuration management strategy
B 8. Data Preparation Plan - Not configurable SW
B 9. Data Test Plan- - Not configurable SW
SW C 1. Sw Requirements Specification SDTC Software Technical Specification

REQUIREMENTS
C 2. SDTC SW Req. Test Specification and
Sw Requirements Test Specification
Report
C 3. Sw Requirements Verification Report SDTC SW Validation Report
SW DESIGN D 1. Sw Architecture Specification SDTC Software Technical Specification
D 2. Sw Design Specification SDTC Software Technical Specification
D 3. Sw Arch. and Design Verification SDTC SW Validation Report
Report
SW MODULE E 1. Sw Module Design Specification SDTC Software Technical Specification Only for SW SIL 2
DESIGN
E 2. Sw Module Test Specification - Due to low SW complexity only a SW
Requirement Testing activity has been
performed.
E 3. Sw Module Verification Report SDTC SW Validation Report
CODE F 1. Sw Source Code SDTC Delivery Sheet
F 2. Sw Source Code Verification Report SDTC SW Validation Report
MODULE G 1. Sw Module Test Report - Due to low SW complexity only a SW
TESTING Requirement Testing activity has been
performed.
E3 Sw Module Verification Report SDTC SW Validation Report
SW INTEGRATION H 1. Sw Integration Test Report - Due to low SW complexity only a SW
Requirement Testing activity has been
performed.
H 2. Data Test Report - Not configurable SW
SW/HW I 1. Sw/Hw Integration Test Report Due to low SW complexity only a SW
INTEGRATION Requirement Testing activity has been
performed.
VALIDATION (*) J 1. Sw Validation Report SDTC SW Req. Test Specification and
Report
SDTC SW Validation Report
ASSESSMENT (*) K 1. Sw Assesment Report -
MAINTENANCE L 1. Sw Change Records DTC24-2 SW Quality Assurance Plan, [17] No new software for SDTC has been developed.
DTC24-2).
No new change management strategy
No new software for SDTC has been developed.
L 2. Sw Maintenance Records DTC24-2 SW Quality Assurance Plan, [17]
DTC24-2).
No new maintenance strategy introduced for
SDTC.
Table 2 - Document cross reference table
abcd SDTC
06/07/11
A. ANNEX – CODING RULES
As required by the EN 50128 standard [6], software coding rules shall be defined and followed.
Each software module shall include in the source code the following information:
· program name;
· version;
· copyright (c);
· year of program issuing;
· author.
For each function the following information shall be provided:

/*
* ------------------------------------------------------------------------
* name:
* input:
* output:
* description:
* ------------------------------------------------------------------------
*/
Figure 1: Function header
where:
• name: name of the function;
• input: list of the variables (including the type), that shall be provided on input to the function
• output: list of the variables that are provided on output by the function, including: the variables
that are transferred to the function with its addresses, the global variables that are modified by
the function and its returned value.
• description: description of the implemented functions.
PATH Digicode® PSP
APPENDIX D-4 SDTC Subsystem Requirements Specification
58 of 80
abcd SDTC
13/04/11
Bologna Requirement Specification
REVISIONI
REVISIONS

1 A. Barbacini 14/05/02 28 First issue
Review to answer to the requirement verification report

2 A. Barbacini 18/10/02 27
490501D19VV0012
Requirements of 5.5 m distance from TU to rail and

3 A. Giovannucci 13/10/08 22 compatibility/overlap of SDTC audio frequency track circuit
with power frequency one
4 A. Barbacini 06/09/10 26 After Requirement Verification Report.
Updated to improve requirements readability. Following

requirements have been modified:
- SDTC_SAFETY 1.1);
5 A. Giovannucci 13/04/11 26
- SDTC_SAFETY 1.5);
- SDTC_SAFETY 1.6);
- SDTC_LINE CHARACTERISTIC 2.1).
communication of its content are not permitted without prior written ALSTOM authority. Reference Issue Page/s
Tutti I diritti sono riservati. Ne è vietata la riproduzione, la consegna a terzi o comunque la 2/26
diffusione senza il preventivo consenso scritto di Alstom Ferroviaria S.P.A. 490502D19SY001 5
abcd SDTC
13/04/11
CONTENTS
1 INTRODUCTION .................................................................................................................................................................... 5
1.1 SCOPE ............................................................................................................................................................................... 5
1.2 FIELD OF APPLICATION .................................................................................................................................................. 5
1.3 DEFINITIONS AND ACRONYMS....................................................................................................................................... 5
1.4 REFERENCES ................................................................................................................................................................... 6
1.4.1 STANDARDS ........................................................................................................................................................... 6
1.4.2 SDTC DOCUMENTATION .......................................................................................................................................... 6
2 GENERAL DESCRIPTION ..................................................................................................................................................... 7
2.1 SYSTEM DEFINITION ........................................................................................................................................................ 7
2.2 SYSTEM REQUIREMENTS ............................................................................................................................................... 8
2.2.1 USER INTERFACE ..................................................................................................................................................... 9
2.2.2 INTERFACES WITH OTHER SYSTEMS .................................................................................................................... 9
2.3 FUNCTIONAL DESCRIPTION ........................................................................................................................................... 9
2.3.1 TRACK CIRCUIT AS A TRANSMISSION LINE .......................................................................................................... 9
2.3.2 TRACK CIRCUIT SEPARATION: ELECTRIC JOINT ................................................................................................. 9
2.3.3 CHARACTERISTICS OF SIGNAL TRANSMITTED .................................................................................................. 10
2.3.4 DYNAMICS OF SIGNAL RECEIVED ........................................................................................................................ 10
2.3.5 FUNCTIONAL SPECIFICATIONS ............................................................................................................................ 10
2.3.6 PRINCIPLES OF OPERATION ................................................................................................................................. 11
2.4 SAFETY REQUIREMENTS .............................................................................................................................................. 12
2.4.1 TRAIN DETECTION SAFETY REQUIREMENTS ..................................................................................................... 12
2.4.1.1 Logic “AND” function ......................................................................................................................................... 13
2.4.1.1.1 Received message test .............................................................................................................................. 13
2.4.1.1.2 RX Filter board fail-safe circuits ................................................................................................................. 13
2.4.1.1.3 Measuring the effective value of the voltage from the track ....................................................................... 14
2.4.1.2 Delay in clearing the track circuit ...................................................................................................................... 14
2.4.1.3 Message protection code .................................................................................................................................. 14
2.4.2 TRAIN COMMUNICATION SAFETY REQUIREMENTS........................................................................................... 14
2.5 OPERATING CONDITIONS ............................................................................................................................................. 14
2.6 ELECTRIC CHARACTERISTICS ..................................................................................................................................... 14
2.7 MECHANICAL CHARACTERISTICS ............................................................................................................................... 15
2.8 RELIABILITY CHARACTERISTICS ................................................................................................................................. 15
2.9 OPERATORS ................................................................................................................................................................... 15
2.10 OPERATING METHODS .................................................................................................................................................. 15
2.11 CONSTRAINTS AND NOTES .......................................................................................................................................... 15
3 REQUIREMENT DETAILS ................................................................................................................................................... 16
3.2 LINE CHARACTERISTICS............................................................................................................................................... 18
abcd SDTC
13/04/11
3.3 PERFORMANCE REQUIREMENTS ................................................................................................................................ 18

3.4 USER CHARACTERISTICS ............................................................................................................................................. 19
3.5 DESIGN REQUIREMENTS .............................................................................................................................................. 19
3.6 RAM REQUIREMENTS ................................................................................................................................................ 20
3.7 ENVIRONMENTAL CONDITIONS ................................................................................................................................... 20
4 SAFETY REQUIREMENT TRACEABILITY ......................................................................................................................... 23
5 CRITERIA FOR TESTING REQUIREMENTS ...................................................................................................................... 24
FIGURES
Figure 1. SDTC components and interfaces. ...............................................................................................................8

Figure 2:Track circuit operation ..................................................................................................................................12
abcd SDTC
13/04/11
1 INTRODUCTION
1.1 Scope
The purpose of this document is to show the requirements of the Smartway Digital Track Circuit. This device is
used to detect trains and broken rails, and to transmit data track to train information under conditions of safety.
The device has been named SDTC. The acronym SDTC means Smartway Digital Track Circuit. It is an audio
frequency track circuit operating in the band 9.5 kHz to 20.7 kHz with digital data transmission; the track circuits are
bounded by electrical joints.
The purpose is to provide all the elements needed to correctly assess function and performance of the device. This
document begins with a general block description and then more detailed levels are gradually introduced until all
the main system functions have been defined.
This document defines all typical performance characteristics, safety architecture and the internal and external
connections.
All system requirements are stated and numbered. Safety requirements conform to the traceability standards
specified in the “Preliminary Hazard Analysis”. Test criteria are given for all requirements, i.e. the tests which must
be successfully conducted for the requirement to be met.
Functional and implementation details are not provided. For these details you should refer to documents [7] and [8].
1.2 Field of application

Typical applications envisage use of the device on metro lines where it performs train and broken rail detection
functions without the need to physically interrupt the rail, and track to train control information.
The device replaces the traditional low frequency track circuits which require the use of isolated joints which involve
interruptions in the rails.
SDTC can be used on any AC or DC electrified and non-electrified line.
1.3 Definitions and Acronyms

Ballast Transversal conductance of track expressed in Siemens per km
CEDD-D Concentratore Elaboratore Dati Diagnostici Digicode - Maintenance and Diagnostics System
EJ Electric Joint
FTR Functional Test Report
LIU Loop Interface Unit
PU Processing Unit : rack containing the electronic boards of the SDTC, housed in the SER
RMS Sold-state magnetic relay (Relè Magneto Statico)
RT Train Detection: SDTC board containing Comparator, RMS and Delay circuits (Rivelatore Treno)
SACEM Système d’Aide à la Conduite à l’Exploitation et à la Maintenance
SER Signalling Equipment Room: room or cab containing the equipment. The Technological Office may
be in the station or along the line
DOT Direction of traffic
TC Track Circuit: railway line stretch separated functionally from the adjacent stretches. The stretch may
comprise one or two switch branches.
abcd SDTC
13/04/11
TU Tuning Unit
TWC Train Wayside Communication
ZLC Zone Logic Calculator - Solid-state interlocking with Vital Processor

MTBF Mean Time Between Failures
MTTR Mean Time To Recovery
1.4 References
1.4.1 Standards
[1] EN 50129 Railway Applications: Safety Related Electronic Systems for signalling", February 2003
[2] EN 50121-4 Railway applications – Electromagnetic compatibility. Part 4: Emission and immunity of
signalling and telecommunications apparatus. July 2006
[3] EN 50125-3 Railway applications – Environmental conditions for equipment. Part 3: Equipment for
signalling and telecommunications.
[4] MIL HNBK 217F, Military Hand-Book, Reliability prediction of electronic equipment, 1993
[5] Protocollo di comunicazione seriale, Norma Tecnica TC.E/S.S.I./0001/002 ed.01/93, Ferrovie dello Stato -
Divisione Tecnologie e Sviluppo di Sistema -
[6] EN50124-1 Railway applications – Insulation coordination, Part 1: Basic requirements – Clearances and
creepage distances for all electrical and electronic equipment
1.4.2 SDTC Documentation

The documents relating to the SDTC are listed below.
[7] Smartway DTC – System requirement Specification – SIF/5330307
[8] SDTC – System Design Document (MASTRIA part) - SIF/5333380
abcd SDTC
13/04/11
2 GENERAL DESCRIPTION
2.1 System definition

The SDTC consists of the components listed below.
• Processing Unit (PU): the PU is the set of electronic boards located in a rack which is housed in the signalling
equipment room; it includes the circuit to manage the audio frequency signal in the track circuit and the
interfaces to other systems. The track circuit signal is picked up by the train car borne equipment when it
occupies the track circuit; to do this, the transmitter must be in the front of the train and according to the
direction the traffic the ZLC drives the selection of the position of transmitter cable on the electric joint. In special
areas where transmitter cable can not be connected, as point diverted branches, one more additional signal
transmitter is provided to a loop cable laid between the rails.
• Tuning Unit (TU): the tuning unit performs tuning and adaptation functions for the track circuit being controlled
and the one next to it. The TU is located on the ballast near to the electric joint. There are two TU for each
SDTC system. Only half of each TU is used. There is a board with two sections in each TU: one to transmit and
the other to receive. Therefore each Processing Unit uses the transmission section of the TU located at the
beginning of the track circuit and the reception section of the TU located at the end of the track circuit. The
transmission section of the latter is used for the adjacent track circuit.
• Loop Interface Unit (LIU): the LIU is the electrical interface between the field cable and the loop inserted in the
rails where the track circuit signal can not reach the car borne equipment, as on the diverted branch switch
points
• Electric Joint (EJ): the electric joint performs functions separating adjacent track circuits so that the rails are
not mechanically interrupted. Mechanical joints are still envisaged for point track circuits. Given the separation
function, each EJ is shared by two adjacent track circuits. Therefore each SDTC uses two "EJ halves": the
transmission half, located at the beginning of the track circuit, and the reception half, located at the end of the
track circuit.
• Connection cables: as well as the field cable, between the PU and TU, and the system internal connection
cable there are also cables to connect the SDTC to the ZLC system (interlocking management) and the cables
to connect the SDTC to the TWC system (train communication); one more connection may be the diagnostic
link to an CEDD-D system (diagnostic and maintenance management).
Figure 1 shows the connection between the various SDTC components and the connections with the external
devices, i.e. the ZLC, the TWC and the CEDD-D.
The ZLC acquires the information from the SDTC using the vital input boards. These are fail-safe devices intended
to distinguish between high and low voltage levels. The minimum high level, corresponding to Clear track circuit
information, must be 6.5 V. This value conforms to that provided by a SDTC with a nominal voltage of 12 Vdc when
the track circuit is clear. The SDTC acquires the DOT signal from the ZLC, by an its non vital output board.
From the TWC (Train Wayside Communication) system it comes the base band data signal that the SDTC conveys
to the train when it is on the rails.
When one or two diverted branches (points) connect the main track line, then the point track has an own SDTC
module, the first is called Main SDTC the latter are called Switch SDTC. In the Switch module the transmitter feeds
a loop between the rail for the cab signalling train transmission.
abcd SDTC
13/04/11
ELECTRIC "S-BOND" ELECTRIC "S-BOND"
TUNING UNIT TUNING UNIT
FIELD
SER
PROCESSING UNIT SDTC - DIGICODE
SACEM Data TC DOT Diagnostic
Stand-by
SACEM Normal CEDD
ZLC
Figure 1. SDTC components and interfaces.
The CEDD-D is the generic system that acquires the information from the SDTC, performs an encoding function
and then supplies information about correct functioning.
As well as showing the system status in real time, the CEDD-D provides a series of information which allow the
maintenance operator to check the functioning of the SDTC.
2.2 System requirements

SDTC will function on track circuits with a maximum length of 400 m, maximum cable length of 4000 m and where
all the other parameters defining the length of the track circuit are compatible; in the track circuit there are up to two
points (switch diverted branches), each point track has an own SDTC module. SDTC is designed to supply the
clear track circuit output only where this information is permanently available for a time greater than a given
duration.
The SDTC is a system having a vital output which can be directly interfaced to electro-mechanical relay or to static
input of the Solid State Interlocking ZLC. This connection informs the other systems on the train occupancy status
in the metro line.
From the other systems, see SDTC Mastria part requirements specification, SDTC receives the DOT and the
Sacem data signal.
The diagnostic information at the front of the boards are available for maintenance. This diagnostic information can
be centralised if a connection is envisaged between the SDTC and the CEDD-D central system.
A special “Operator Terminal” can be used during installation to assist the operator during set-up and testing.
abcd SDTC
13/04/11
2.2.1 User Interface

The SDTC user interface consists of a set of warning lights and test points located on the front panels of the PU
cards.
If the CEDD-D system is not present or is unavailable, the status of the warning lights and test points enables
identification of the faulty components.
The analysis procedures will be shown in the Maintenance Manual.
2.2.2 Interfaces with other systems

The SDTC has five external interfaces:
• With the power supply system: a power supply voltage of 230 (or 110) V AC ± 10% must be provided to
ensure correct SDTC functioning.
• With the solid state interlocking equipment: a vital digital signal with the following characteristics is supplied:
A. 0 V DC for a occupied track circuit and 12 V DC for a clear track circuit where the input resistance of the
circuit acquiring the signal is equal to 400 Ω,
B. 0 V DC for a occupied track circuit and 24 V DC for a clear track circuit where the input resistance of the
circuit acquiring the signal is equal to 1600 Ω.
A is compatible with the direct connection of the SDTC to the ZLC where inputs are acquired using its vital input
boards; B enables interfacing with conventional railway relays.
• With the solid state interlocking system: a non vital digital signal with the following characteristics is
received:
0 V DC for one Direction Of Traffic and 24 V DC for the other DOT where the input resistance of the circuit
acquiring the signal is equal to 2000 Ω.
• With the train wayside control system: a base band data signal at 500 bit/second with the following
characteristics is received:
0 V DC (no current) for bit 0 and 24 V DC (10 mA current) for the bit 1, open collector output, where the input
resistance of the circuit acquiring the signal is 2000 Ω.
• With the remote diagnostic system: the SDTC supplies the diagnostic information using a serial protocol
(RS232 or RS 422 channel physical support, communication protocol conforms to [5]). The protocol is master-
slave point-multipoint with the master function assigned to the CEDD-D.
2.3 Functional Description
2.3.1 Track Circuit as a transmission line

Train detection and broken rail detection functions uses the track circuit as a transmission line between the
transmission joint and the receiver joint. Accordingly, the presence of a train or rail non-continuity is detected by
measuring the effect of the reduction or disappearance of the signal transmitted via track circuit. When the track is
occupied by a train, the transmission line goes from the transmission joint to the pick up coils of the car borne
equipment. Being the pick up coils at the beginning of the train, the position of the transmission joint must be
swapped with the receiver joint according to the direction of the traffic, or when not possible, signal is picked up
from a loop between the rails.
The device injects a signal in differential mode between the rails in correspondence to a track circuit extremity and
draws it in correspondence to the other track circuit extremity. As a consequence, a vital occupied/vacant output is
generated following measurement of the signal received. In special areas the signal is injected in a loop.
2.3.2 Track circuit separation: Electric Joint

In the Smartway DTC system, the track circuits are separated without rail interruption. In order to perform this
function, the joint engages a track section of a limited extension.
abcd SDTC
13/04/11
2.3.3 Characteristics of signal transmitted

The absence of mechanical joints implies imperfect separation between neighboring track circuits and loss of a
certain part of the useful signal, in correspondence to each Electric Joint, in the adjacent track circuit.
frequencies are diversified.
The number of the track frequency is determined by the physical behavior of the electric joint and by the effect of
the cross talk between two adjacent and parallel tracks. It will be followed the same choice of the DTC921 system.
To this end, eight channels are available for the SDTC, that is, eight different frequencies can be transmitted in a
certain track circuit. More specifically, three (F7, F9 and F11) are reserved for the uneven track, whilst the other
three (F8, F10 and F10) are reserved for the even track. Two spares (F13 and F14) are reserved for special cases,
for example in points area.
In order to limit the length of the Electric Joints (7m), the F7÷F14 frequencies of the signals transmitted in the track
circuits are selected within the range of the audio-frequencies. In particular, the SDTC utilizes the 9÷21 kHz band.
Each channel engages a 400 Hz band for train detection function and a 500 Hz band for cab signaling.
The Audio-frequency transmission channel permits digital modulation on the signal, which is used to transmit data
messages at a speed of 400 or 200 bit/s for train detection or 500 bit/s for cab signaling.
In the SDTC, the data message composition is fixed when the track is vacant and serves to identify the signal
transmitted for the signal received; the data message is a Sacem variable information when the track is occupied.
When the track is vacant, the bit sequence that modulates the signal is attained from the cyclic repetition of the
same message; a total of 24 different track code message identifiers are available, 3 each frequency. During the
track occupancy, the SDTC sends continuously the SACEM message received from the TWC equipment.
The track detection codes will be selected in order to have the maximum distance on the line between two track
circuits of the same frequency and the same code.
2.3.4 Dynamics of signal received

Account should be taken of the characteristic parameters of the track as a transmission line. The transversal
leakage conductance (Ballast) is variable, due to meteorological and environmental conditions that can modify the
state of the ballast.
This variability gives rise to a variation in the attenuation introduced by the track circuit and, as a consequence, the
amplitude of the signal received is not constant.
2.3.5 Functional specifications

The fundamental functional specifications with which the device must comply relate to the shunt resistance of the
train axle, the electric characteristics of the track, the current for the pick up coils and the value of the mains
voltage that supplies the Smartway DTC equipment.
The specification relating to the train axle defines the value limit admitted for the Shunt. This is based on the
assumption that all axles are potentially able to occupy the track circuit and are assimilated to a resistor placed
between the rails (Shunt), with a value not exceeding the given limit.
The specification related to the track defines the value limit admitted for the Ballast. This is based on the
assumption that the track is assimilated to a transmission line having a transversal conductance always comprised
within a zero value and the given limit value.
The specification related to the current in the rail or in the loop defines the minimum value allowed to assure correct
pick up coil signal receiving, in order to guarantee everywhere needed the car borne data reception for train
protection and control functions.
The mains voltage specification defines the dynamics of the mains voltage vis-à-vis nominal value.
abcd SDTC
13/04/11
These last three functional specifications define the limit situations that produce the minimum and maximum
amplitude of the signal received:
a) Minimum energy: when the Ballast is equal to the limit value and the mains voltage is equal to the minimum
value;
b) Maximum energy: when the Ballast is equal to zero and the mains voltage is equal to the maximum value.
These values depend also on the length of the track circuit and of the cables.
2.3.6 Principles of Operation

Smartway DTC operation may be summarized as follows:
a) If the signal received has an amplitude that is greater than the set threshold value (“clear threshold”), the device
produces a certainly “high” output, indicating a clear track circuit;
b) If the signal received has an amplitude that is lower than the set threshold value (“occupied threshold”), the
device produces a certainly “low” output, indicating an occupied track circuit.
During clear track circuit, the verification of the message received is attained when a bit-by-bit message is
recognized on the signal to be the same as the message transmitted. Accordingly, the safety verification of the
accuracy of the message received ensures that the message comes effectively from the source that generated it.
During occupied track circuit, the SDTC transmit the SACEM message as is it from TWC, without keeping any
memory or record of the SACEM data message. The loop signal is fed by SACEM message every time, regardless
clear/occupied status of the track circuit.
Following the actual direction of traffic, inside the SDTC is present a circuit that switches the transmitter and
receiver cable in order to present the pick coil current in the front of the train, because the pick coil current is closed
by the first train axle. The short circuit loop is not affected by the train first axle, so the injection point may be
whatever.
In order for the Smartway DTC to produce an output that is consistent with the clear/occupied state of the track
circuit (operation), it must be ensured that the amplitude of the signal received, in all the situations set forth in the
functional specifications of the track circuit, is lower than the Occupied Threshold, in the case of an occupied track
circuit or broken rail.
The following two conditions must be satisfied to ensure track circuit operation:
a) With track circuit vacant, under minimum energy conditions, the amplitude of the signal received should not be
lower than the “vacant threshold”;
b) In a Shunt limit situation, and under maximum energy conditions, the amplitude of the signal received should not
be greater than the “occupied threshold”.
The amplitude of the signal transmitted in the track circuit is determined by establishing that the amplitude of the
rail current should never be lower than a minimum preset value. This means that the rail current, at the point where
the signal is drawn from the track, should be equal to the minimum value under minimum energy conditions. The
minimum rail current value should ensure that the minimum axle current for the pick coil function is good for car
borne operation and that the ratio of noise to signal is good for operation of the SER equipment.
The amplitude of the signal received is fixed by establishing that, under minimum energy conditions, this is equal to
a certain minimum value. That minimum value is never the same as the Vacant Threshold and is selected at a
higher value. The reason for this margin stems from the need to ensure a “high” output value clear from oscillations
and the need to avoid the Pre-Shunt phenomena near the electrical joint area, which can make the amplitude of the
signal received go below the Vacant Threshold.
The considerations made are set forth in Figure 2, which provides a representation of the intervals within which the
amplitude of the signal received can vary, the case of an occupied or vacant track circuit, and the intervals within
which the amplitude of the same signal received determines the “high” or “low” Smartway DTC vital output.
The minimum value is unique for all track circuits and all channels, whilst the maximum value depends on the
length of the track circuits and the channel, once the functional specifications of the track circuits are fixed.
abcd SDTC
13/04/11
amplitude of received signal
TC vacant
HIGH output
minimum value
threshold of vacant TC
threshold of occupied TC
TC occupied LOW output
zero
Figure 2:Track circuit operation

The safety requirements divide in two parts: the train detection requirements and the train communication
requirements.
1
The SDTC is a fail-safe system and its safety requirements ensure a Safety Integrity Level (SIL) equal to 4, i.e. the
level required by EN 50129 (v. [1], page 61, par A.4.2.2 Relationship between SIL and Safety Targets) to prevent
train collisions and derailment.
The figure set by System Requirements [7] indicates the failure rate for an unsafe event less than 10 E-12 per
hour, concerning both train detection function and train transmission function. The safety of the train detection
function is assured by the SDTC subsystem. Concerning the transmission function, to reach the safety target for
any hazards some protection from the ATC subsystem are necessary.
Fail-safe functioning of SDTC is achieved using intrinsically safe circuits (inherent fail-safety) which ensure safety
functions using individual components in the face of an illustration that all credible fault modes for the components
do not result in unsafe conditions. The inherent safety guarantees are contained within the intrinsic physical
properties of the component or in the way in which it was designed.
2.4.1 Train detection safety requirements

Fail-safe SDTC functioning is such that clear track circuit information is given under safe conditions only in the
event that the track circuit is actually clear. All possible faults automatically generate occupied track circuit
information.
With the aim of preventing incorrect clear track circuit information from being supplied (caused by disturbance
similar to a clear track circuit signal), a safety delay circuit is used so that clear track circuit information is only given
when the signal remains for a time period greater than the preset delay.
The SDTC train detection safety functions are shown below.
1
Refer to the definition shown in EN 50129
EN 50129 Fail-Safe: a concept which is incorporated into the design of a product such that, in the event of a failure, it enters
or remains in a safe state.
abcd SDTC
13/04/11
1. The track circuit is declared clear only if the following two conditions occur simultaneously. The test is performed
by a logic AND function using an inherently safe magnetic structure called a static magnetic relay (RMS).
• The received message must be checked to see if it is correct.
• The effective voltage value from the track (message) must be measured using a fail-safe technique.
The message is checked by comparing the received message and the transmitted message using an inherently
safe circuit known as the COMPARATOR.
Measurement of the effective value of the received voltage and the vital AND function are performed by the static
magnetic relay.
2. Clear track circuit delay.
3. Protection code for the transmitted message so that the transmitter can be linked to the receiver.
If the track circuit contains point branches, the track circuit is declared clear if, as well as the conditions listed
above, checked on the Main line receiver, the same is checked on the point Switch receiver.
2.4.1.1 Logic “AND” function

The track circuit is declared clear if, and only if:
1. The result of the comparison between the transmitted and received message is positive.
2. The effective value of the voltage received from the track is between the two RMS thresholds.
It is not sufficient simply for the transmitted and received messages to be the same to generate clear track circuit
status. Given that even when the track circuit is occupied a weak signal can still arrive at the receiver input, the
comparator may supply a positive outcome. Therefore a safety threshold function must be created that is capable
of identifying the received signal level.
Simply measuring the effective value of the received voltage does not guarantee that the voltage has been
generated by the SDTC transmitter rather than an external source of disturbance.
Therefore clear track circuit status can only be deduced if both conditions are met simultaneously.
The logic AND function is performed by the same static magnetic relay (RMS) which assesses the voltage.
2.4.1.1.1 Received message test

The test to assess whether the received message is correct is performed by comparing each bit of the transmitted
message with each bit of the received message.
The task of the comparison section is to check that the signal received has effectively and correctly been generated
by its actual source. This is to ensure that the clear track circuit information has not been produced by a
disturbance signal. These disturbance signals may come from the traction currents, as a result of the unbalance in
the track circuit under consideration, or from other track circuits with the same carrier frequency installed on the
same track, from the moment the electric joints are no longer a perfect barrier. The messages transmitted by the
SDTC are differentiated so that the properties described are operationally effective.
The comparator is designed so that a positive result for the comparison can only occur if the messages have preset
dynamic characteristics. This further protection ensures that the occupied track circuit condition is achieved (safety)
in the event of a static signal caused by a fault.
2.4.1.1.2 RX Filter board fail-safe circuits

As can be seen in the next section, the device used to assess the effective value of the received voltage has one
threshold. A signal whose voltage is greater than this threshold constitutes a clear track circuit signal. A signal
voltage below the threshold constitutes a occupied track circuit. Therefore, faults compromising safety which could
occur on the RX filter board are those which cause an increase in voltage.
The RX filter board has been designed using techniques and components to ensure that this type of event does not
occur.
abcd SDTC
13/04/11
2.4.1.1.3 Measuring the effective value of the voltage from the track
The safe assessment of the voltage contained in the message from the track is performed by a passive device
known as the static magnetic relay (RMS). It consists of an electromagnet, a permanent magnet and a transformer
joined together in a single structure by two rectangular magnetic plates. The two plates have a very low residual
magnetism. The device functions with the help of a special external alternated power supply. The RMS has one
intervention thresholds. A signal whose voltage is above this thresholds constitutes a clear track circuit signal. A
signal voltage below the threshold constitutes a occupied track circuit.
2.4.1.2 Delay in clearing the track circuit

The function of this delay is to prevent a noise, which assumes the characteristics of a transmitted messages for a
brief period, from causing an unwanted clear track circuit. This protection is limited in time (1.5-2 s) because if the
noise is equal to a long period, then no protection can be applied.
2.4.1.3 Message protection code

To ensure protection against electromagnetic disturbance and traction disturbances, the transmitted message is
encoded using a codeword which is repeated a set number of times (10) inside the message.
If the coding was only designed to provide a protection function against electromagnetic disturbance, this function
would not have to be fail-safe in that the only necessity would be to distinguish between a received message and
any disturbance and therefore it would be sufficient to transmit any track message.
It is possible, although the probability is very low, that a signal from a clear track circuit with a frequency equal to
that of a occupied track circuit, interferes to cause an undue clear track circuit.
To ensure that this does not happen the transmission message is encoded in such a way that 3 different protection
codes are assigned to each carrier frequency. This is a further safety measure in that each SDTC track circuit is
identified not only by the carrier frequency but also by its protection code.
2.4.2 Train communication safety requirements

Following the safety constraint 4.5 in Smartway DTC System Requirements Specification [8], the SDTC equipment
in transmission to train mode shall not store more than one SACEM message (that is 80 bit long at 500 bit/s), or in
other words the SDTC shall not have any memory to store the SACEM message and repeat wrongly it
continuously.
2.5 Operating conditions

o o
Components installed in SER is guaranteed in a temperature range of -25 C to +70 C and at a relative humidity no
greater than 95% RH. Functioning of components installed in the field (near the track) is guaranteed in a
o o
temperature range of -40 C to +80 C and at a relative humidity no greater than 99% RH. See EN 50125-3 [3].
Components installed in SER are designed so that they function correctly under mechanical stress defined by EN
50125-3 [3]in the position outside the track (1 m from the rail).
Components installed near the track are designed so that they function correctly under mechanical stress defined
by EN 50125-3 [3]in the position on ballast.
2.6 Electric Characteristics

The SDTC insulation and overvoltage constraints follow the EN50124-1 [6]. The electro magnetic compatibility
constraints follow the EN 50121-4 [2].
The SDTC requires an external power supply to function correctly. The features of the power supply are described
in § 2.2.2. The internal power supplies are generated by the Power Conversion Module containing the power
supply transformer and the fuse protection devices. This module is located in the rear part of the SDTC rack and
communicates with the motherboard over wires and connectors.
To limit the power difference between the cable conductors connecting the SER and the track circuit and the
ground to values, the cable housing and armour are connected to the earth plate located next to the line.
abcd SDTC
13/04/11
To reduce cross talk between the pairs in the same cable, each pair is twisted with a casual step.
2
The rack is earthed in a single point using a conductor with a section not less than 16 mm . Each rack is earthed by
the metal structure of the cubicle. The connection cables are anchored to the base of the cubicle and are earthed
using a single earth bolt which is connected in turn to the conductor used to earth the cubicle.
2.7 Mechanical Characteristics

The PU and SDTC boards which are in the standard Double Eurocard format (233x280 mm) are inserted in a
Europe format rack (19” x 6U). The rack has enough slots to contain two SDTC modules, both Main or Switch
module.
The racks is inserted either in metal cubicles. The size of the cubicles is such that 10 SDTC can be inserted in
each one. When required, a TWC rack is inserted in the cubicle. Each cubicle contains two ventilation modules. A
box for overload switches and the cables coming from the outside is placed in an other cubicle.
The SER circuit components subject to high current voltage are enclosed, for reasons of accident prevention and to
limit irradiated disturbance, in a metal box which contains, as well as the transmitter power driver and output filter,
passive filters of the receiver.
The Tuning Unit and Loop Interface Unit boards are in non standard format.
The Tuning Unit and Loop Interface Unit are designed for positioning on the ballast.
2.8 Reliability Characteristics

The MTBF of the SDTC is 15000 hours, according to MIL HDBK 217F [4].
The MTTR is 1 hour.
2.9 Operators
Once installed the SDTC device does not have to be managed by an operator except in the event of maintenance.
Maintenance personnel must be aware of relevant documentation and adhere to standard accident prevention
measures. Those sections of the SDTC with potential electric shock hazards are marked according to current
regulations.
2.10 Operating methods

After installation and start-up, the SDTC is enabled using the power switch located on the front of the TX_RX BOX.
Under correct functioning conditions no operator intervention is envisaged.
2.11 Constraints and notes

Correct SDTC functioning depends on correct installation, test and commissioning, and maintenance. Therefore
that specified in documents Installation Manual and Test and Commissioning Manual must be strictly adhered to.
Faulty boards and boxes must be replaced in the event of malfunctioning.
All materials used in the SDTC are assessed by ALSTOM to ensure that unsuitable/dangerous materials are not
utilised.
abcd SDTC
13/04/11
3 REQUIREMENT DETAILS
The requirements are marked SDTC_ZZZ_x.y and numbered beginning with the subsection.
The numbering used is intended to enable tracing of the requirements in terms of application and testing.

SDTC_SAFETY 1.1) Safety condition
SDTC, after installation, test and commissioning, use and maintenance correct procedures in each
specific manual, must safely detect the clear/occupied state of any track circuit belonging to the
section of controlled line under these constraints related to Shunt Resistance:
*
- Outside Tuning Zone : maximum shunt resistance equal to 0.5 Ohm;
- Inside Tuning Zone: no constraints related to shunt resistance, to train detection purpose the
Tuning Zone shall be consider as a “not shunting area”.
In the event of malfunctioning or faults the system must be transferred as quickly as possible to the
safety state corresponding to the occupied track circuit condition.
SDTC_SAFETY 1.2) Broken rail

In the event of a broken rail SDTC must switch to the safety state and remain so until the line has
been repaired.
SDTC_SAFETY 1.3) Immunity to disturbance from other SDTC

SDTC must ensure correct functioning in the presence of other SDTC located on parallel tracks or the
same track. In particular, SDTC must ensure correct functioning on lines with 2 or more tracks: signal
transmitted on adjacent track circuits must be configured with different frequencies and with different
coded modulation message (200 bit/s or 400 bit/s coded message rate).
SDTC_SAFETY 1.4) Immunity to traction disturbance

SDTC must ensure correct functioning in the event of traction disturbance.
SDTC_SAFETY 1.5) Occupied track circuit reaction time

SDTC shall detect the train presence on the controlled track circuit with a delay lower than 0.2 s.
This time is calculated from the moment in which the train shunts the rails to the moment in which the
SDTC output is transferred from the clear to the occupied state.
In case of not valid coded message received from Track Circuit, SDTC shall provide the occupied
indication on output, with the following timing constraints:
1. occupation delay lower than 2.2 s with 400 bit/s coded message rate;
2. occupation delay lower than 3.8 s with 200 bit/s coded message rate.
This time is calculated from the moment in which the SDTC code is no more acknowledged to the
moment in which the SDTC output is transferred from the clear to the occupied state (without shunting
conditions).
*
The Tuning Zone is defined as the track part comprised between the two edge of the same electrical joint.
abcd SDTC
13/04/11
SDTC_SAFETY 1.6) Clearing track circuit reaction time

SDTC shall provide the clearing indication on output, with the following timing constraints:
1. clearing delay (not safety related) lower than 2 s with 400 bit/s coded message rate;
2. clearing delay (not safety related) lower than 3.5 s with 200 bit/s coded message rate;
3. clearing delay (safety related) greater than 1.7 s with 400 bit/s coded message rate;
4. clearing delay (safety related) greater than 3 s with 200 bit/s coded message rate;
This time is calculated from the moment in which the last train axle leaves the rails of the controlled
track circuit to the moment in which the SDTC output is transferred from the occupied to the clear
state.
SDTC_SAFETY 1.7) Interface with equipment

SDTC must be able to safely supply clear track circuit status output to both static and relay equipment.
The residual voltage value on the output toward IXL when the track circuit is occupied or the rail is
broken must be defined.
SDTC_SAFETY 1.8) Insulation requirements

SDTC must be designed to ensure:
- creepage and clearance insulation distances compliant to EN50124-1
- electric isolation and reciprocal immunity to disturbances between transmission and reception
cables.
These requirements ensure that false clear track information cannot be given following lack of
insulation, accidental contact or cross talk between the transmission and reception pair conductors.
SDTC_SAFETY 1.9) Overload protection

SDTC must be designed, installed and maintained in such a way that suitable protection against
overloads in ensured.
SDTC_SAFETY 1.10) Sabotage protection

Access to SDTC must be protected against sabotage by installing the PU in a technological room and
the use of keys.
SDTC_SAFETY 1.11) Safety Integrity Level

SDTC must ensure a Safety Integrity Level of 4. This level must be guaranteed on the "system" level
for the transmission function and can be achieved by the SDTC itself for the train detection function.
In particular, signal sent to the train by SDTC shall be already protected by coding when received from
SACEM system.
SDTC_SAFETY 1.12) Safety demonstration

The safety demonstration shall comply to standard EN 50126 and EN 50129 [1].
SDTC_SAFETY 1.13) DOT requirement

Any failure in DOT circuit shall not produce any hazardous configuration: in particular, DOT circuit
must avoid loss of insulation between transmission and reception cables.
SDTC_SAFETY 1.14) Train transmission requirement

SDTC in transmission mode, communication to the train, shall not store more than one SACEM
message (80 bit at 500 bit/s).
abcd SDTC
13/04/11
3.2 Line characteristics

SDTC_LINE CHARACTERISTIC 2.1) Track circuit length
Safe SDTC functioning must be ensured with a variable track circuit length in the range:
20÷400 m, with variable transverse conductance between 0 and 0.5 S/km, shunt resistance equal to
0.5 Ω outside Tuning Zone and rail equal to 60 kg/m.
SDTC_LINE CHARACTERISTIC 2.2) Track circuit separation

SDTC must use devices to separate the track circuits which guarantee the mechanical continuity of
the rails. Rails can only be interrupted on passing branches.
SDTC_LINE CHARACTERISTIC 2.3) Track circuit with point branches

Safe SDTC functioning must also be guaranteed on track circuits containing no more than 2 point
branches. In the presence of 2 point branches, SDTC functioning must be guaranteed for straight line
section lengths between 20 and 400 m, passing branch lengths no greater than 100 m, with variable
transverse conductance of between 0 and 0.5 S/km, shunt resistance equal to 0.5 Ω and rail equal to
60 kg/m.
SDTC_LINE CHARACTERISTIC 2.4) Line electrification

SDTC must ensure correct functioning on both AC and DC electrified lines.
3.3 Performance requirements

SDTC_PERFORMANCE 3.1) Power supply
SDTC must function correctly when powered by:
- an effective voltage of 110 V AC ± 10% and a frequency of 50/60 Hz ± 2%;
- an effective voltage of 220 V AC ± 10% and a frequency of 50 Hz ± 2%.
SDTC_PERFORMANCE 3.2) Occupation of the downstream track circuit

SDTC, under shunt resistance conditions equal to 0 ohm, must ensure occupation of the track circuit
downstream within the next 5 m beginning from the first edge of the joint.
SDTC_PERFORMANCE 3.3) Occupation of the upstream track circuit

SDTC, under shunt resistance conditions equal to 0 ohm, must ensure the occupation of the track
circuit upstream within the 5 m preceding the second edge of the joint.
SDTC_PERFORMANCE 3.4) PU centralisation
SDTC must function correctly with the PU installed in a technological room located up to 4 km of cable
length from the furthest Tuning Unit.
SDTC_PERFORMANCE 3.5) Diagnostics

SDTC must be fitted with diagnostic signalling that can be accessed by operator and maintenance
personnel. This signalling must be available locally and remotely.
SDTC_PERFORMANCE 3.6) Transmission function performances

The maximum switching time from detection mode to transmission mode shall be 200 ms.
abcd SDTC
13/04/11
The maximum switching time from transmission mode to detection shall be 200 ms.
The minimum current in transmission mode into each rail shall be 100 mA.
SDTC_PERFORMANCE 3.7) Distance from TU to nearest rail
SDTC Tuning Unit can be located near the track at a maximum distance of 5.5 m from the nearest rail.
SDTC_PERFORMANCE 3.8) Compatibility of SDTC with low frequency power track circuit
SDTC track circuit can be installed as overlay equipment among with low frequency power track circuit
in the range 50-75 Hz, having insulating joints and Z bonds as in single rail insulated track circuit. Both
SDTC and power frequency TC can operate at the same time.
SDTC_PERFORMANCE 3.9) Time occupancy during DOT transition

SDTC track circuit shall occupied for a time less or equal to 0.6 s when DOT is changed.
SDTC_PERFORMANCE 3.10) Soft start power up

SDTC overload on the transmitter during the power up transition shall be limited by a delay of 1 sec
after the switch on of the power supply.
SDTC_PERFORMANCE 3.11) SACEM transmission on short track and on loop

SACEM current loop shall be overlapped in the S bond area and SACEM track circuit current shall be
increase to 200 mA minimum on short track circuit <80 m.
3.4 User characteristics

SDTC_USER 4.1) Packaging requirement
SDTC must be packed in the more convenient form for installation, test and commissioning,
maintenance and cost reduction.
SDTC_USER 4.2) User Safety

SDTC shall be realized in order to avoid:
- hazard of fire and toxic gasses emissions;
- accidental contacts with hazardous voltage and sharp edges on fixture/fittings. In case it is not
possible, adequate labels shall be applied on the apparatus to advise the operator about the
related risks.
Moreover SDTC shall ensure user safety through:
- connection of the apparatus case to the ground;
- definition of procedures of installation, maintenance and commissioning.
3.5 Design requirements

SDTC_DESIGN 5.1) Standards requirement
SDTC must designed according to all relevant CENELEC standards.
SDTC_DESIGN 5.2) Materials

The materials used directly or in the manufacturing process will be compliant with conformity standard
specifications. A process of manufacturing control and test, within a Quality System ISO9001, shall be
implemented.
abcd SDTC
13/04/11
3.6 RAM requirements
SDTC_RAM 6.1) Reliability

SDTC must ensure mission reliability of at least 15000 hours and a MTTR of 60 minutes.
3.7 Environmental conditions

SDTC_ENVIRONMENT 7.1) Environment
SDTC must function correctly under the conditions described in CENELEC standard 50125-3, EN
50121-4 [2]. In particular this system works correctly in T1 class environment for room equipment and
T2 for external equipment. Room is building with climatic control from –25° to +70° C and 95% RH;
external is from –40° to +80° C and 95% RH.
abcd SDTC
13/04/11
Request
SIL Short description
Classification ID
SDTC_SAFETY 1.1 4 Safety condition
SDTC_SAFETY 1.2 4 Broken rail
SDTC_SAFETY 1.3 4 Immunity to disturbance from other

SDTC
SDTC_SAFETY 1.4 4 Immunity to traction disturbance
SDTC_SAFETY 1.5 4 Occupied track circuit reaction time

SDTC_SAFETY 1.6 4 Clearing track circuit reaction time
SDTC_SAFETY 1.7 4 Interface with equipment
Safety requirements SDTC_SAFETY 1.8 4 Insulation requirements
SDTC_SAFETY 1.9 0 Overload protection
SDTC_SAFETY 1.10 4 Sabotage protection
SDTC_SAFETY 1.11 4 Safety Integrity Level
SDTC_SAFETY 1.12 4 Safety demonstration
SDTC_SAFETY 1.13 4 DOT requirement
SDTC_SAFETY 1.14 4 Train transmission requirement
SDTC_LINE_CHARACTERISTIC 2.1 0 Track circuit length

SDTC_LINE_CHARACTERISTIC 2.2 0 Track circuit separation
Line characteristics
SDTC_LINE_CHARACTERISTIC 2.3 4 Track circuit with point branches
SDTC_LINE_CHARACTERISTIC 2.4 N/A Line electrification
SDTC_PERFORMANCE 3.1 0 Power supply
SDTC_PERFORMANCE 3.2 0 Occupation of the downstream track
circuit
SDTC_PERFORMANCE 3.3 0 Occupation of the upstream track
circuit
SDTC_PERFORMANCE 3.4 N/A PU centralization
Performance SDTC_PERFORMANCE 3.5 0 Diagnostics
requirements
SDTC_PERFORMANCE 3.6 0 Transmission function performance
SDTC_PERFORMANCE 3.7 0 Distance from TU to nearest rail
SDTC_PERFORMANCE 3.8 4 Compatibility of SDTC with low

frequency power track circuit
SDTC_PERFORMANCE 3.9 0 Time occupancy during DOT
transition
abcd SDTC
13/04/11
Request
SIL Short description
Classification ID
SDTC_PERFORMANCE 3.10 0 Soft start power up
SDTC_PERFORMANCE 3.11 0 SACEM transmission on short track

and on loop
SDTC_USER 4.1 0 Packaging requirement
User characteristics *
SDTC_USER 4.2 4 User Safety
Design SDTC_DESIGN 5.1 4 Standards requirement

requirements SDTC_DESIGN 5.2 N/A Materials
RAM requirements SDTC_RAM 6.1 0 Reliability and MTTR
Environmental
condition SDTC_ENVIROMENTAL 7.1 N/A Environment
NOTE:
• SIL4 Requirements indicated with a “*” are not directly affecting railway safety, but they represent
requirements to be implemented for operators and personnel safety.
• In the case of architectural requirements for which is not possible to assign a safety integrity category, SIL
equal to N/A (Non Applicabile) is indicated.
abcd SDTC
13/04/11
4 SAFETY REQUIREMENT TRACEABILITY

A traceability table is given below for the requirements identified in the document entitled “SDTC-Preliminary
Hazard Analysis” and those described in this document.
Traceability only concerns safety requirements. These requirements must be observed for the entire lifecycle of the
project. Therefore software requirements are traced further in the document entitled “Software Technical
Specifications” whereas hardware requirements are traced in the document entitled “Hardware Technical
Specifications”.
The table from the “Preliminary Hazard Analysis” is shown below with the last column containing the requirement
number as listed in this document.
ID SR PHA ID SRS (Safety Requirements)
SDTC_SR.5 SDTC_SAFETY 1.4
SDTC_SR.9 SDTC_USER 4.2

SDTC_USER 4.2
SDTC_DESIGN 5.1

SDTC_SAFETY 1.2
SDTC_SAFETY 1.11
SDTC_DESIGN 5.1
SDTC_SR.17 SDTC_LINE CHARACTERISTIC 2.3

SDTC_SAFETY 1.6

Table 1- Safety requirement traceability table.
abcd SDTC
13/04/11
5 CRITERIA FOR TESTING REQUIREMENTS
The criteria and methods used to test the requirements are listed below.
REQUIREMENT TEST CRITERIA
Safety Requirements
Testing and validation of device safety functioning and

SDTC_SAFETY 1.1 Safety condition architecture. Test pass for dedicated functional tests.
SDTC_SAFETY 1.2 Broken rail Same demonstration as # SR 1.1 is applicable.
SDTC_SAFETY 1.3 Immunity to disturbance from Testing and validation of the Safety Demonstration,
other SDTCs functional tests and tests envisaged by EN.
SDTC_SAFETY 1.4 Immunity to traction Testing and validation of the Safety Demonstration,
disturbance functional tests and the results of field experimentation.
SDTC_SAFETY 1.5 Occupied track circuit reaction Testing and validation of this specific safety function and
time functional tests to check times.
SDTC_SAFETY 1.6 Clear track circuit reaction time Same demonstration as # SR 1.5 is applicable.
Testing and validation of the Safety Demonstration and

SDTC_SAFETY 1.7 Interface with equipment functional tests.
Checking technical documentation and visual inspection

SDTC_SAFETY 1.8 Insulation requirements (test).
SDTC_SAFETY 1.9 Overload protection Inspection of rack and cubicle installation.
SDTC_SAFETY 1.10 Sabotage protection Inspection.
SDTC_SAFETY 1.11 Safety Integrity level Same demonstration as # SR 1.1
Testing and validation of the Safety Demonstration, and

SDTC_SAFETY 1.12 Safety demonstration tests envisaged by EN
Testing and validation of the Safety Demonstration and

SDTC_SAFETY 1.13 DOT requirement functional tests.
SDTC_SAFETY 1.14 Train transmission Testing and validation of the Safety Demonstration and
requirement functional tests.
abcd SDTC
13/04/11
Line characteristics
SDTC_LINE CHARACTERISICS 2.1 Track circuit

Testing and validation of FTP.
length

Same demonstration as # SR 2.1 is applicable.
separation

Same demonstration as # SR 2.1 is applicable.
with passing branches
SDTC_LINE CHARACTERISICS 2.4 Line Same demonstration as # SR 2.1 and field

electrification experimentation analysis are applicable.
Performance requirements
SDTC_PERFORMANCE 3.1 Power supply Passing of all functional tests according to FTR.
SDTC_PERFORMANCE 3.2 Occupation of the

Testing and validation of FTR.
downstream track circuit
SDTC_PERFORMANCE 3.3 Occupation of the

upstream track circuit
SDTC_PERFORMANCE 3.4 PU centralisation Installation inspection.
Testing of FTP. Testing of information presented by the

SDTC_PERFORMANCE 3.5 Diagnostics CEDD-D.
SDTC_PERFORMANCE 3.6 Transmission function

performances
SDTC_PERFORMANCE 3.7 Distance from TU to

nearest rail
SDTC_PERFORMANCE 3.8 Compatibility of SDTC

with low frequency power track circuit
SDTC_PERFORMANCE 3.9 Time occupancy

during DOT transition
SDTC_PERFORMANCE 3.10 Soft start power up Testing and validation of FTR.
SDTC_PERFORMANCE 3.11 SACEM

transmission on short track and on loop
abcd SDTC
13/04/11
User characteristics
SDTC_USER 4.1 Packaging requirement Inspection.
Checking technical documentation and visual inspection

SDTC_USER 4.2 User Safety (test).
Design requirements
SDTC_DESIGN 5.1 Standards requirement Validation according to EN.
SDTC_DESIGN 5.2 Materials Inspection.
RAM requirements
SDTC_RAM 6.1 Reliability Inspection.
Environmental conditions
SDTC_ENVIRONMENT 7.1 Environment Inspection.
PATH Digicode® PSP
APPENDIX D-5 SDTC Architecture Description
59 of 80
abcd SDTC
14/04/11
Bologna Architecture Description
REVISIONI
REVISIONS

1.0 Draft 19/06/00 - From Digicode HW spec. rev. 4
1.1 A. Giovannucci 12/01/01 - Engineering erased
1.2 A. Regazzi 09/02/01 - 03/01/01 Reading form U200
1.3 A. Regazzi 28/03/01 -
1.4 A. Giovannucci 12/06/01 - Technical characteristics
1.5 A. Giovannucci 30/05/02 - “ , arrester
2 A. Giovannucci 17/12/02 36 Power line filter
3 A. Giovannucci 27/10/08 33 MM L1; overlay of SDTC and 75 Hz track circuit
After Architecture Verification Report rev. 1; added 110 Vac

power supply; removed upper threshold.
BL3 increased reaction time and 200 bit/s for increased

noise immunity
diffusione senza il preventivo consenso scritto di Alstom Ferroviaria S.P.A. 490371D19HW001 5
abcd SDTC
14/04/11
CONTENTS
1 INTRODUCTION .................................................................................................................................................................... 6
1.1 SCOPE ............................................................................................................................................................................... 6
1.3 REFERENCES ................................................................................................................................................................... 7
1.3.1 STANDARDS .............................................................................................................................................................. 7
1.3.2 SDTC-DIGICODE DOCUMENTATION ....................................................................................................................... 7
2 SMARTWAY DTC SYSTEM ................................................................................................................................................... 8
2.1 OVERVIEW......................................................................................................................................................................... 8
2.2 FIELDS OF APPLICATION ................................................................................................................................................ 8
2.3 FUNCTIONAL DESCRIPTION ........................................................................................................................................... 8
2.3.1 TRACK CIRCUIT AS A TRANSMISSION LINE .......................................................................................................... 8
2.3.2 TRACK CIRCUIT SEPARATION: ELECTRIC JOINT ................................................................................................. 8
2.3.3 CHARACTERISTICS OF SIGNAL TRANSMITTED .................................................................................................... 9
2.3.4 DYNAMICS OF SIGNAL RECEIVED .......................................................................................................................... 9
2.3.5 FUNCTIONAL SPECIFICATIONS ............................................................................................................................ 10
2.3.6 PRINCIPLES OF OPERATION ................................................................................................................................. 10
2.4 ARCHITECTURE .............................................................................................................................................................. 12
2.4.1 INTERFACES ........................................................................................................................................................... 13
2.4.2 PROCESSING UNIT ................................................................................................................................................. 15
2.4.3 FIELD CIRCUIT ........................................................................................................................................................ 15
2.6 RELIABILITY CHARACTERISTICS ................................................................................................................................. 16
2.7 ENVIRONMENTAL CHARACTERISTICS........................................................................................................................ 16
2.8 TECHNICAL CHARACTERISTICS .................................................................................................................................. 17
2.9 OVERVOLTAGE ARRESTERS ....................................................................................................................................... 18
2.10 POWER LINE FILTER ...................................................................................................................................................... 19
3 FIELD EQUIPMENT ............................................................................................................................................................. 20
3.1 SAFETY RELATED FUNCTIONAL ITEM ........................................................................................................................ 20
3.2 ELECTRIC JOINT ............................................................................................................................................................ 20
3.2.1 MECHANICAL CHARACTERISTICS ........................................................................................................................ 20
3.2.2 FUNCTIONAL CHARACTERISTICS ........................................................................................................................ 20
3.2.3 DESCRIPTION OF OPERATION ............................................................................................................................. 21
3.2.4 ELECTRIC JOINT PRINCIPLE OF OPERATION ..................................................................................................... 23
3.2.5 PRINCIPLES OF SAFETY ........................................................................................................................................ 24
3.3 TUNING UNIT ................................................................................................................................................................... 24
3.3.1 DESCRIPTION OF CSIN921 BOARD ...................................................................................................................... 25
3.3.1.1 Tuning Unit........................................................................................................................................................ 25
abcd SDTC
14/04/11
3.3.1.2 Matching Unit .................................................................................................................................................... 26

3.3.1.3 Pre-Shunt Unit .................................................................................................................................................. 26
3.3.2 MECHANICAL CHARACTERISTICS, LAYING AND CLAMPING ............................................................................ 26
3.4 LOOP CABLE .................................................................................................................................................................. 27
3.5 LOOP INTERFACE UNIT ................................................................................................................................................. 27
3.6 CONNECTION CABLES .................................................................................................................................................. 28
4 PROCESSING UNIT ............................................................................................................................................................. 29
4.1 FUNCTIONAL CHARACTERISTICS ............................................................................................................................... 29
4.2 BLOCK DIAGRAM ........................................................................................................................................................... 30
4.3 SAFETY RELATED FUNCTIONAL ITEMS ...................................................................................................................... 33
4.4 COMPATIBILITY BETWEEN SDTC AND LOW FREQUENCY TC ................................................................................. 33
4.5 COMPATIBILITY BETWEEN SDTC AND 4TH RAIL RETURN CONNECTIONS ........................................................... 35
4.6 DIVERTED BRANCH CONFIGURATIONS ...................................................................................................................... 37
4.6.1 DIVERTED BRANCH CONFIGURATIONS FOR LOW FREQUENCY TRACK CIRCUIT COMPATIBILITY............. 38
4.7 COMPOSITION ................................................................................................................................................................ 39
4.8 CUBICLE .......................................................................................................................................................................... 39
5 SDTC FUNCTIONAL BLOCKS ............................................................................................................................................ 42
5.1.1 FUNCTIONAL DECOMPOSITION OF PROCESSING UNIT .................................................................................... 43
5.1.1.1 Functional decomposition of the Processing Unit ............................................................................................. 43
5.1.2 FUNCTIONAL DECOMPOSITION OF CONNECTION ELEMENTS......................................................................... 50
5.2 POWER SUPPLY ............................................................................................................................................................. 51
6 REQUIREMENTS AND ARCHITECTURE. .......................................................................................................................... 54
6.2 LINE CHARACTERISTICS............................................................................................................................................... 55
6.3 PERFORMANCE REQUIREMENTS ................................................................................................................................ 56
6.4 USER CHARACTERISTICS ............................................................................................................................................. 57
6.5 DESIGN REQUIREMENTS .............................................................................................................................................. 57
6.6 RAM REQUIREMENTS .................................................................................................................................................... 57
6.7 ENVIRONMENTAL CONDITIONS ................................................................................................................................... 57
FIGURES
Figure 2-1. Frequency and code setting on tracks for SDTC. ......................................................................................9
Figure 2-2.Track circuit operation ...............................................................................................................................11
Figure 2-3. Elements and interfaces of the Smartway DTC. ......................................................................................12
Figure 2-4. Interfaces ..................................................................................................................................................13
Figure 2-5 - Interfaces of the SDTC............................................................................................................................14
Figure 3-1. Electric Joint operation .............................................................................................................................21
Figure 3-2. Broken Rail detection within Electric Joint ...............................................................................................22
abcd SDTC
14/04/11
Figure 3-3. Pre-Shunt phenomenon ...........................................................................................................................22

Figure 3-4. Electric Joint principle of operation ..........................................................................................................23
Figure 3-5. Tuning Unit operation ...............................................................................................................................24
Figure 3-6. Block diagram of CSIN921 Board ............................................................................................................25
Figure 3-7. Tuning Unit, diagram of principle. ............................................................................................................25
Figure 3-8. Loop layout ...............................................................................................................................................27
Figure 4-1. Block diagram of the SDTC – main line ...................................................................................................30
Figure 4-2. Block diagram of the SDTC – diverted branch .........................................................................................31
Figure 4-3. Low frequency single rail track circuit ......................................................................................................34
Figure 4-4. Low frequency and audio frequency track circuits ...................................................................................34
Figure 4-5. DC 4th rail return schematics ...................................................................................................................35
Figure 4-6. Loop "8" layout .........................................................................................................................................36
Figure 4-7. Loop "8" layout without 75 Hz TC ............................................................................................................36
Figure 4-8. Cross over by low frequency track circuit with short series diverted branch ...........................................38
Figure 4-9. Cubicle arrangement. ...............................................................................................................................40
Figure 4-10. Cubicle rear. ...........................................................................................................................................41
Figure 5-1. Functional Decomposition of SDTC: level 0 ............................................................................................42
Figure 5-2. Functional Decomposition of PU: level 1 .................................................................................................43
Figure 5-3. Functional decomposition of the Processing Unit - level 2 ......................................................................44
Figure 5-4. Functional decomposition of the Processing Unit – RX board: level 2 ....................................................46
Figure 5-5. Input/output function description of the Processing Unit – MODEM board: level 2 .................................47
Figure 5-6. Functional decomposition of the Processing Unit – RT board: level 2 ....................................................48
Figure 5-7. Functional decomposition of the Processing Unit – TX board: level 2 .....................................................49
Figure 5-8. Functional decomposition of the Processing Unit –DIAG board: level 2 .................................................50
Figure 5-9. Functional decomposition of the Connection Elements: level 1 ..............................................................51
Figure 5-10. Power Supply functional decomposition – Level 1.................................................................................52
Figure 5-11. Power Supply functional decomposition – Level 2.................................................................................53
abcd SDTC
14/04/11
1 INTRODUCTION
1.1 Scope
This document describes the architecture of the Smartway DTC (Digicode) system for Metro application.
The document analyses the components making up the system describing its functional and operating
characteristics.
The description takes into account the aspects and characteristics more significant for each element. Attention is
focused on the safety architecture of the system.
Ballast Transversal conductance of track expressed in Siemens per km

BL Base Line
2oo3 Two out of 3 computing system
CEDD-D Concentratore Elaboratore Dati Diagnostici Digicode – Maintenance and Diagnostics System
CPFSK Continuous phase frequency shift modulation
EJ Electric Joint
GND Ground
LIU Loop Interface Unit
MSK Minimum shift keying
MTTR Mean time to repair
PU Processing Unit : rack containing the electronic boards of the SDTC, housed in the SER
RMS Sold-state magnetic relay (Relè Magneto Statico)
RT Train Detection: SDTC board containing Comparator, RMS and Delay circuits (Rivelatore Treno)
Rx Receiver
SER Signalling Equipment Room: room or cab containing the equipment. The Technological Office may be
in the station or along the line
TC Track Circuit: railway line stretch separated functionally from the adjacent stretches. The stretch may
comprise one or two switch branches.
TU Tuning Unit
Tx Transmitter
TWC Train Wayside Communication

ZLC Zone Logic Calculator - Solid-state interlocking with Vital Processor
abcd SDTC
14/04/11
1.3 References
1.3.1 Standards
[1] EN 50129 Railway Applications: Safety Related Electronic Systems for signalling", CENELEC TC 9X-SC
9XA-WGA2, February 2003 f
[2] EN 50126 Railway Applications. The Specification and Demonstration of Dependability, Reliability,
Availability, Maintainability and Safety (RAMS), 1999-09
[3] IEC 1508-4 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems.

Part 4: Definitions and abbreviations. May 97.
[4] EN 50121-4 Railway applications – Electromagnetic compatibility. Part 4: Emission and immunity of
signalling and telecommunications apparatus. July 2006
[5] EN 50125-3 Railway applications – Environmental conditions for equipment. Part 3: Equipment for
signalling and telecommunications
[6] Protocollo di comunicazione seriale, Norma Tecnica TC.E/S.S.I./0001/002 ed.01/93, Ferrovie dello Stato -
Divisione Tecnologie e Sviluppo di Sistema -
1.3.2 SDTC-Digicode Documentation

[8] SDTC, Subsystem Requirement Specification, rev. 5, 490502D19SY001
[9] Audio-Frequency Track Circuit Digicode DTC24 and DTC921/SDTC - Interference mask, rev. 3, 7431500-
HWE-A-TCF-0001
[10] Digicode Cable – Product Specification – ver. 1, 1/8/00
[11] Smartway DTC System, SDTC-digicode Product Safety Case, 49052DI9VV001, rev. 3
abcd SDTC
14/04/11
2 SMARTWAY DTC SYSTEM
2.1 Overview
The Smartway DTC is a solid-state system that realizes, in safety, the train detection, rail continuity detection and
track to train data transmission functions within a track circuit (TC). It is part of the ALSTOM system MASTRIA 200
for signaling, see SDTC-System Design Document (MASTRIA part) [7].
At the Smartway DTC output, the user system is supplied with vital logic signal, which corresponds to the vacant or
occupied status of the track circuit. If a train is present or a rail is interrupted mechanically, the device indicates that
the track circuit is occupied. If there is no train present or the rail is not interrupted, the device indicates that the
track circuit is vacant.
The user system should have appropriate electric characteristics, for example, a vital input port of the ZLC or an
FS90-606 or FS90-840 relay system. The connection cable type is 2 x 1 mm² H05VV-F with a maximum distance
of 500 m (cable resistance 40 Ohm/km). In case of greater distance, up to 4 km, and by the same cable, a 24 Vdc
FS90 or equivalent relay can be used as interface between SDTC and ZLC.
In order to enhance system availability in the field, the Smartway DTC may supply diagnostics functions. In this
case, the Smartway DTC can be interfaced, via serial connection, with a portable diagnostic PC or with a
centralized system that collects diagnostics data (for example, the CEDD-D system).
Smartway DTC stands for the ALSTOM Railway Audio-frequency Digital Track Circuit.
2.2 Fields of Application

The Smartway DTC can be employed on all railway and metro lines, whether electrified or not. SDTC has three
different configurations:
- BL1, see the reference [11] Safety Case rev.3 on 2002 (PBS no more applicable to production);
- BL2, having fast data rate and fast reaction time room equipment;
- BL3, having more noise immunity and slow reaction time, room equipment.
BL2 and BL3 share common field equipment.
Having regard to compatibility with the electric traction system, reference should be made to the document
“Digicode – Interference Mask” and to the EN50121-3 standard.
2.3 Functional Description
2.3.1 Track Circuit as a transmission line

A traditional technique has been adopted to realize train detection and rail continuity detection functions within a
track circuit. This technique uses the track circuit as a transmission line between the transmission joint and the
receiver joint. Accordingly, the presence of a train or rail non-continuity is detected by measuring the effect of the
reduction or disappearance of the signal transmitted via track circuit.
The device injects a signal in differential mode between the rails in correspondence to a track circuit extremity and
draws it in correspondence to the other track circuit extremity. As a consequence, a vital occupied/vacant output is
generated following measurement of the signal received.
2.3.2 Track circuit separation: Electric Joint

In the Smartway DTC system, the track circuits are separated without rail interruption.
Unlike the traditional Low Frequency Track Circuits, the track has no mechanical joints.
The Electric Joint allows the track circuits to be limited without rail interruption. In order to perform this function, it
engages a track section of a finished extension.
abcd SDTC
14/04/11
2.3.3 Characteristics of signal transmitted

The absence of mechanical joints implies imperfect separation between neighboring track circuits and loss of a
certain part of the useful signal, in correspondence to each Electric Joint, in the adjacent track circuit.
frequencies are diversified.
To this end, eight channels are available for the SDTC, that is, eight different frequencies can be transmitted in a
certain track circuit. More specifically, three (F7, F9 and F11) are reserved for the uneven track, whilst the other
three (F8, F10 and F10) are reserved for the even track. Two spares (F13 and F14) are reserved for special cases,
for example in points area.
Frequency differentiation between even and uneven tracks neutralizes the effect of cross talk.
In order to limit the length of the Electric Joints (7m), the F7÷F14 frequencies of the signals transmitted in the track
circuits are selected within the range of the audio-frequencies. In particular, the SDTC utilizes the 9÷21 kHz band.
Each channel engages a 400 Hz band for train detection function and a 500 Hz band for cab signaling.
The availability of an Audio-frequency transmission channel ensures digital modulation on the signal, which can be
used to transmit data messages at a speed of 400 bit/s in BL1 and BL2, of 200 bit/s in BL3 for train detection or
500 bit/s for cab signaling.
In the SDTC, the message composition is fixed when the track is vacant and serves solely to identify the signal
transmitted for the signal received; the message is a Sacem variable information when the track is occupied.
The bit sequence that modulates the signal is attained from the cyclic repetition of the same message, when the
track is vacant; a total of 42 different track code message identifiers are available. During the track occupancy, the
SDTC send continuously the SACEM message, formed by a header and 80 bits.
An example of a typical frequency and code setting is Figure 2-1. As can be noted, another 8 track circuits are
placed between two track circuits having the same frequency and the same code. However, in the absence of
codes, the same signal would be repeated after 3 track circuits only.
.. F7 F9 F11 F7 F9 F11 F7 F9 F11 F13 F7 F9 ..

.. C19 C25 C31 C20 C26 C32 C21 C27 C33 C37 C19 C25 ..
.. F8 F10 F12 F8 F10 F12 F8 F10 F12 F14 F8 F10 ..

.. C22 C28 C34 C23 C29 C35 C24 C30 C36 C40 C22 C28 ..
Figure 2-1. Frequency and code setting on tracks for SDTC.
2.3.4 Dynamics of signal received

Account should be taken of the characteristic parameters when using the track as a transmission vehicle. The
transversal leakage conductance (Ballast) is variable, due to meteorological and environmental conditions that can
modify the state of the ballast.
This variability gives rise to a variation in the attenuation introduced by the track circuit and, as a consequence, the
amplitude of the signal received is not constant.
The dynamics of the signal received increases when the track circuit length and signal frequency increase.
abcd SDTC
14/04/11
2.3.5 Functional specifications

The fundamental functional specifications with which the device must comply relate to the shunt resistance of the
train axle, the electric characteristics of the track and the value of the mains voltage that supplies the Smartway
DTC equipment.
The specification relating to the train axle defines the value limit admitted for the Shunt. This is based on the
assumption that all axles are potentially able to occupy the track circuit and are assimilated to a resistor placed
between the rails (Shunt), with a value not exceeding the given limit.
The specification related to the track defines the value limit admitted for the Ballast. This is based on the
assumption that the track is assimilated to a transmission line having a transversal conductance always comprised
within a zero value and the given limit value.
The last specification defines the dynamics of the mains voltage vis-à-vis nominal value.
The last two functional specifications define the limit situations that produce the minimum and maximum amplitude
of the signal received:
a) Minimum energy: when the Ballast is equal to the limit value and the mains voltage is equal to the minimum
value;
b) Maximum energy: when the Ballast is equal to zero and the mains voltage is equal to the maximum value.
2.3.6 Principles of Operation

Smartway DTC operation may be summarized as follows:
a) If the signal received has an amplitude that is lower than the set threshold value (“occupied threshold”), the
device produces a certainly “low” output, indicating an occupied track circuit;
b) If the signal received has an amplitude that is greater than the set threshold value (“vacant threshold”), the
device produces a certainly “high” output, indicating a vacant track circuit, provided that the outcome of the
message accuracy verification is positive.
Verification of the message received is attained when a bit-by-bit message is recognized on the signal to be the
same as the message transmitted. Accordingly, the safety verification of the accuracy of the message received
ensures that the message comes effectively from the source that generated it.
In order for the Smartway DTC to produce an output that is consistent with the vacant/occupied state of the track
circuit (operation), it must be ensured that the amplitude of the signal received, in all the situations set forth in the
functional specifications of the track circuit, is lower than the Occupied Threshold, in the case of an occupied track
circuit or interrupted rail.
The following two conditions must be satisfied to ensure track circuit operation:
a) With track circuit vacant, under minimum energy conditions, the amplitude of the signal received should not be
lower than the “vacant threshold”;
b) In a Shunt limit situation, and under maximum energy conditions, the amplitude of the signal received should not
be greater than the “occupied threshold”.
The amplitude of the signal transmitted in the track circuit is determined by establishing that the amplitude of the
rail current should never be lower than a minimum preset value. This means that the rail current, at the point where
the signal is drawn from the track, should be equal to the minimum value under minimum energy conditions. The
minimum rail current value should ensure that the ratio of noise to signal ensures good operation of the equipment,
as discussed in the Interference mask document [9].
The amplitude of the signal received is fixed by establishing that, under minimum energy conditions, this is equal to
a certain minimum value. That minimum value is never the same as the Vacant Threshold and is selected at a
higher value. The reason for this margin stems from the need to ensure a “high” output value free from oscillations
and the need to avoid the Pre-Shunt phenomena (as explained in Paragraph 3.2.3), which can make the amplitude
of the signal received go below the Vacant Threshold.
abcd SDTC
14/04/11
The considerations made are set forth in Figure 2-2, which provides a representation of the intervals within which
the amplitude of the signal received can vary, the case of an occupied or vacant track circuit, and the intervals
within which the amplitude of the same signal received determines the “high” or “low” Smartway DTC output.
The minimum value is unique for all track circuits and all channels, whilst the maximum value depends on the
length of the track circuits and the channel, once the functional specifications of the track circuits are fixed.
amplitude of received signal
TC vacant
HIGH output
minimum value
threshold of vacant TC
threshold of occupied TC
TC occupied LOW output
zero
Figure 2-2.Track circuit operation
abcd SDTC
14/04/11
2.4 Architecture
The Smartway DTC is conceived as a centralized system, that is, the track circuit is situated in remote position from
the Signaling Equipment Room (SER), where the equipment is concentrated.
The Signaling Room houses the centralized hardware of the device, known as the Processing Unit, while the field
circuit is located outside, where the track circuit signal is transmitted and received.
Accordingly, the architecture of the Smartway DTC is divided into two:
• Field circuit.
• Processing Unit;
In addition to the track circuit, the field circuit comprises all and everything needed by the transmission channel
(Field Equipment).
A breakdown of the basic Smartway DTC system is represented in figure 2-3.
FIELD
SER
PROCESSING UNIT SDTC - DIGICODE
SACEM Data TC DOT Diagnostic
Stand-by
SACEM Normal CEDD
ZLC
Figure 2-3. Elements and interfaces of the Smartway DTC.
abcd SDTC
14/04/11
2.4.1 Interfaces
The interfaces are detailed in the following figure:
User Diagnostic
Vital TC output TU 1/
LOOP
SDTC
Vital SACEM data
TU 2
Power supply
Figure 2-4. Interfaces
- Power supply: the SDTC is powered by 220Vac +/-10%, 50Hz or 110Vac +/-10%, 50/60Hz at 100 VA;
- Field TU: the SDTC is connected via cable to two end tuning units, at the receiving sides of the track
circuit;
- Field LOOP: the transmission f signal is via the loop interface unit, on the diverted switch branch;
- vital output: is a signal at 12 Vdc rated value, on 400 Ohm equivalent ZLC N/R vital input, or 24 Vdc rated
voltage at the coil of standard 1600 Ohm relay, when track circuit is vacant; rated voltage is 0Vdc when
track circuit is occupied;
- diagnostic: to the diagnostic system to collect the functional state of the electronic boards and the main
track signal parameters;
- user interface: led and test point are available to visual check and to measurement checks; mechanical
In Figure 2-5 each interface is detailed, and specified in the following Table 2-1.
abcd SDTC
14/04/11
B A
D C
FIELD E
L
SER LED
Test t points
PROCESSING UNIT SDTC
F
H
TC DOT Diagnostic
I M
G
Stand-by
SACEM Normal CEDD Power Supply
ZLC
Figure 2-5 - Interfaces of the SDTC
Communication
Interface From to Input/output internal/external protocol
electrical AC
A Field Field Input External
cabling
electrical AC
B Field Field Output External
cabling
electrical AC
C Field Operation room Input External
cabling
electrical AC
D Field Operation room Output External
cabling
Field- Operation electrical AC
E Input/Output External
Operation room room-Field cabling
F Operation room Operation room Input Internal current data loop
electrical AC
G Operation room Operation room Input Internal
cabling
electrical DC
H Operation room Operation room Output Internal
cabling
I Operation room Operation room Output Internal RS485
L Operation room User Output Internal Led / Test points
M Operation room Operation room Input Internal AC cabling
Table 2-1. Interfaces
abcd SDTC
14/04/11
2.4.2 Processing Unit

The Signaling Equipment Room (SER) houses the Processing Unit, that is, the part of the system that realizes the
main functions:
• Generation and transmission of the signal versus field circuit;
• Reception and detection of the signal coming from field circuit;
• Generation of the occupied/vacant vital output versus user system;
• Interface to the wayside SACEM generator;
• Generation of diagnostics data versus user system.
2.4.3 Field Circuit

The field circuit is represented by the track circuit rails and the Field Equipment comprising:
• Electric Joints S at extremities of main line and S or Terminal at the end of diverted branches;
• Tuning Units at the two extremities of the track circuit and at the end of diverted branches;
• Loop interface Unit to feed the loop cable in the diverted branch when cab signaling is required;
• Connection Cables connecting the Signaling Equipment Room and the track circuit tuning units.
“S-Bond” Electric Joints limit the track circuit extremities. These are represented by two parallel “S”-shaped
conductors, which are fixed to the rails. There is a Tuning Unit in correspondence to every Electric Joint. The
Tuning Unit is laid on the ballast next to the rail and connected, via three conductors, to the two rails and to the
center of the Electric Joint.
The Electric Joint/Tuning Unit assembly represents the interface between the Connection Cable and the track, the
function of which is to route the energy of the signal primarily in the approved direction. This means that, at the
track circuit extremity in which the signal is injected, only a minimum part of the useful energy will be dispersed in
the neighboring track circuit; likewise, at the track circuit end from which the signal is drawn, almost all the useful
energy will be transferred from the track to the Connection Cable.
Every Electric Joint/Tuning Unit assembly involves logically two neighboring track circuits. Accordingly, two
sections can be distinguished, in the Electric Joint and in the Tuning Unit, each one of which is destined to operate,
at the related frequency, with one of the two track circuits. In particular, adopting the rule of transmitting the signal
in the same direction (e.g., in opposition to train direction) on the different track circuits of a track, ensures that one
section, in each Electric Joint or Tuning Box, is dedicated to signal transmission in a track circuit and the other to
signal reception from the other track circuit. In case of reversing Direction Of Traffic, in some electric joint both the
two sections can be dedicated to the transmission or both to the reception.
The Connection Cable is the element that connects the Tuning Unit to the SDTC. There is one Connection Cable
for each Tuning Unit. The Connection Cable is a shielded cable containing two conductor pairs, one for each of the
two track circuits of the Tuning Unit.

The Smartway DTC is an inherent fail-safety system designed to detect, in vital mode, the presence of a train or rail
discontinuity within a track circuit. This is according to the EN50126 standard [2].
The system is designed in such a way as to avoid any failure (a system disturbance, an individual fault, the
deterioration of some component, etc.) giving rise to a hazardous situation i.e., a situation in which the device
indicates “vacant track circuit” when, in reality, the track circuit is occupied.
-12 -1
The value of the wrong side failures rate is 10 h , as specified in Requirements Specifications Document [8].
SDTC so has to safely detect and signal free/occupied state of TC and the eventual break of rail and to safely
transmit to train SACEM messages. These functions are SIL4.
abcd SDTC
14/04/11
TC status detection is performed through sending to rail a signal properly defined in amplitude and in frequency.
This signal is also frequency modulated with a protection code that identify TC monitored; indeed this code is
different for two neighboring TCs.
Transmitted signal is received at the other edge of TC if, and only if, TC is free and rail is not broken.
Received signal is then filtered and demodulated (protection code is extracted from); SDTC considers TC free only
if amplitude of this received signal is above a minimum threshold and if protection code extracted is right. If one of
two conditions is missing, TC is considered occupied by SDTC (safe state).
Data transmission from rail to train is used to deliver the velocity profile. SACEM signal is received from a
baseband generator; it is modulated, amplified and filtered before sending to rails or to loop.
To reach safety target requested by Safety Integrity Level SIL4, SDTC has been designed with inherent fail safe
architecture, according to EN 50129 [1] standard.
The RX filters, TX filters and circuits for checking amplitude and correctness of protection code of received signal
and modulation and transmission of SACEM message shall have an inherent fail safe architecture.
2.6 Reliability characteristics

The MTBF (mean time between failure) of the SDTC is 100 000 hours and the MTTR (mean time to repair) is 1
hour.
2.7 Environmental characteristics

The environment of the SDTC operation is compliant with the definitions in EN 50125-3 [5] and EN50121-4 [4]
standards.
abcd SDTC
14/04/11
2.8 Technical characteristics

The technical characteristics of the Smartway DTC are as follows:
• TC length: from 20 to 400 m;
• Transversal conductance: from 0 to 0.5 S/km (2 Ω·km), LTC=400 m;
from 0 to 1 S/km (1 Ω·km), LTC=320 m;
0÷0.3 S/km (3.3 Ω·km) wayside/train transmission;
• Maximum shunt resistance 0.5 Ohm;
• Overlap length 7 m (joint length);
• Maximum distance between
SER and track connections 4.5 km if LTC=350 m, Ballast 0.5 S/km (2 Ω·km);
2.0 km if LTC=400 m, Ballast 0.5 S/km (2 Ω·km);
4.5 km if LTC=280 m, Ballast 1 S/km (1 Ω·km);
2.0 km if LTC=320 m, Ballast 1 S/km (1 Ω·km)
• Cable type
2
2x1.5 mm , 40 nF/km, shielded;
• Minimum axle current: 100 mA (at 0.3 S/km ballast) (3.3 Ω·km)
• Data transmission speed: 400 bit/s for train detection in BL2,
200 bit/s for train detection in BL3;
500 bit/s for Sacem;
• Rail continuity control throughout track circuit;
• Maximum number of points in TC 2;
• Power supply 220 Vac ±10% at 50 Hz;
110 Vac ±10% at 50 Hz to 60 Hz;
• Power consumption 95 VA, average value;
• Temperature range -25°/+70° in the SER; -40°/+80° in the field;
• Frequency carriers (n.°8) 9.5-11.1-12.7-14.3-15.9- 17.5-19.1-20.7 kHz;
• Modulation MSK ±100 Hz at 400 bit/s (Digicode TC) in BL2
CPFSK ±100 Hz at 200 bit/s in BL3
CPFSK ±100 Hz at 500 bit/s (Sacem data);
• SACEM data input 24 V on 2200 Ω, insulation 1000 Vac;
• Occupation delay lower than 200 ms with shunt applied on the TC
lower than 2.2 s with 400 bit/s not valid coded message (BL2)
lower than 3.8 s with 200 bit/s not valid coded message (BL3)
• Clearing delay lower than 2 s (not safety with 400 bit/s rate (BL2)
lower than 3.5 s (not safety) with 200 bit/s rate (BL3)
greater than 1.7 s (safety) with 400 bit/s rate (BL2)
greater than 3 s (safety) with 200 bit/s rate (BL3)
abcd SDTC
14/04/11
• DOT 0.8 s after DOT change;

• Vital Output Vital Output 12 Vdc on 400 Ω or 24 Vdc on 1600 Ω,
24 Vdc on 1500 Ω, insulation 2000 Vdc;
• Diagnostic RS232 front or RS422/485 rear connector,
at 9600 bit/s, packet data protocol.
2.9 Overvoltage arresters

The TX RX cable must be protected by an arrester as the following one. The length of the cable from the arrester to
the SDTC-Digicode mother board must be less than 15 m.
L1
L2
L1 L2
L1 L2
load
Grounding is realized through the screw at the front of the module tightened to the DIN rail.
Terminals L1-L1 and L2-L2 are connected with 1.5 sq mm insulated wire (max load 6 A).
ELETTRICAL CHARACTERISTICS :
Rated voltage 230 Vac – Maximum load 6A - 230 Vac

Peak current (T>20 µs) 6.500 A
LIMITING VOLTAGE ( L1 - GND or L2 - GND ) : 470 Vdc ± 20%
OPERATION TIME ( L1 - GND o L2 - GND ) : < 500 ns
LIMITING VOLTAGE ( L1 - L2) : 430 Vdc ± 20%
OPERATION TIME ( L1 - L2) : < 25 ns
Screw terminals 16A max – cable cross section 0.13÷2.5 sq. mm.
abcd SDTC
14/04/11
2.10 Power line filter

The cubicle containing the SDTC modules must be supplied by the 220 Vac power line by means of a power line
filter as the following one.
Alstom part number F197003201V
Type Epcos B84112-B-B120
Electrical characteristics:
2 x 0.68 uF
2 x 4700 pF
2 x 1.8 mH
Voltage rated 250 V 50/60 Hz
Current rated 20 A
abcd SDTC
14/04/11
3 FIELD EQUIPMENT
3.1 Safety related functional item

In the following chapters the architecture of SDTC field part will be described. The following table lists the functional
blocks that are safety related.
Block Safety Related Safety Related Functions

EJ Yes Electrical separation between track circuits
TU Yes Matching of the transmitted and received signal to the track
CONNECTING CABLES Yes Connection of the room equipment to the field track equipment
LIU Yes Signal transmission to the train via the loop
Table 3-1. Safety related functions of field equipment.
3.2 Electric Joint
3.2.1 Mechanical Characteristics

The “S-Bond” electric joint (EJ) used in the Smartway DTC is represented by a pair of insulated single-pole
2
conductors, (with a 2 x 150-185 mm section) connected to the rails by clearance hole connectors.
The electric joint conductors are placed, in longitudinal stretches vis-à-vis rails, near the rail and fixed by specific
clips (shaped springs), every 60 cm.
However, the conductors are laid on the sleepers and fixed by specific strips in the transversal “S” parts vis-à-vis
rails.
The Electric Joint is connected to the Tuning Unit by three insulated single-pole conductors, with a section
2
of 25 mm . Two of these conductors are fixed to the rails in correspondence to the central section of the Electric
Joint via clearance hole connectors. The third connector is connected to the cables of the “S”, in the center of the
Electric Joint, by a comb terminal.
3.2.2 Functional Characteristics

The Electric Joint is an element that, along with the Tuning Unit, separates two neighboring track circuits.
In addition, the Electric Joint balances the return current of the electric traction.
abcd SDTC
14/04/11
3.2.3 Description of operation

The Electric Joint engages a track stretch of a certain extension, in which the rails are not interrupted mechanically.
semi-joints
V2 V1
fx fy
A B C
Tuning box
fx fy
Figure 3-1. Electric Joint operation
Having regard to figure 3-1, the Electric Joint is connected to the Tuning Unit by three conductors, identified by the
letters “A”, “B” and “C”. Conductor “B” is connected to the center of the Electric Joint and belongs functionally to
both track circuits. Indeed, the track circuit signal to the left of the Electric Joint, at fx frequency, is emitted or drawn
from the track by conductors “A” and “B”, whilst the track circuit signal to the right of the Electric Joint, at fy
frequency, is emitted or drawn from the track by conductors “B” and “C”.
The Electric Joint is composed of two semi-joints, each one of which relates to one of the two track circuits. These
are represented by a rectangular coil turn, formed on three sides by the “S” cables and, on the fourth side, by the
rail.
The track circuit to the left of the Electric Joint, at fx frequency, utilizes the right semi-joint, whilst the track circuit to
the left, at fy frequency, utilizes the left semi-joint.
The effectiveness of the Electric Joint is valued by a directionality magnitude. Directionality is defined as followed:
V1 applied to track circuit to which energy is to be sent
Direct= -- .
V2 applied to track circuit to which energy is not to be sent
The typical directionality value that can be attained by the Electric Joints used in the SDTC falls 2,5 ÷ 3.
The track stretch occupied by the Electric Joint has a certain extension, which length is fix: 7,2 m.
Within the Electric Joint, the Shunt profile of both the track circuits has a downward performance. Considering the
Shunt on the edges of the Electric Joint to be 0.5 Ω, the length of the stretch in which it becomes lower than 0.25 Ω
falls within 2 m.
As far as the detection of rail discontinuity within the Electric Joint is concerned (please refer to Figure 3-2), the
device ensures this function only for the rail stretches on which the cables that form the “S” are placed. However,
rail discontinuity on one of the other two rail stretches decreases the signal to the receiver and might be insufficient
to make it go below the “occupied threshold”.
abcd SDTC
14/04/11
rails on which breakage is detected
rails on which breakage is could not be detected
Figure 3-2. Broken Rail detection within Electric Joint
The Electric Joint is subject to the so-called Pre-Shunt phenomenon (figure 3-3). This consists in decreasing a
track circuit signal due to the presence of an axle in the neighboring track circuit close to the joint. The effect may
become critical under the more unfavorable conditions, that is, minimum energy in Track Circuit x, in that this
decrease could give rise to early track circuit x occupation. To overcome this effect a preshunt circuit is inserted in
the tuning box.
TC y TC x
TC x signal is affected by TC y shunt
Figure 3-3. Pre-Shunt phenomenon
The following measures reduce the Pre-Shunt effects:

a) employing an appropriate circuit, contained in the Tuning Unit, which reduces the magnitude of the
phenomenon;
b) regulating the amplitude of the signal received to a value greater than the “vacant threshold” value so that the
decrease in that signal does give rise to track circuit occupation.
abcd SDTC
14/04/11
3.2.4 Electric Joint principle of operation
B A A'
+-
Isx Idx Idx
Iris
fx Iris
C
Isx Iris Idx
-+
E' E D
Cx
S- S+
fx
Figure 3-4. Electric Joint principle of operation
Reference should be made to figure 3-4. The principle of operation of the Electric Joint is based on a parallel
resonant circuit, represented by an inductance formed by the coil turn of the semi-joint plus two Electric
Joint/Tuning Unit connection cables and by a capacity, housed in the Tuning Unit.
In order to make the Electric Joint directional, the extra-resonant current that circulates in the reactive elements of
the parallel resonant circuit is exploited. Such current generates, on the rails of the semi-joint in the direction other
than the one in which the signal should be addressed, two induced voltages of such polarity as to obstruct signal
propagation towards the direction not approved.
Let’s assume that the signal at fx frequency has to be transmitted leftwards. Accordingly, the signal is applied to the
S+ and S- terminals so as to use the right resonant circuit, which has been highlighted by a dotted line (ED stretch,
rail + DC stretch, cable + pair of connection cables with Tuning Unit + Cx capacity). Likewise, the left resonant
circuit will be used by the track circuit to the right of the Electric Joint.
For ease of understanding Electric Joint operation, a half-wave of the alternating signal is considered. The
terminals are indicated as S+ and S- in order to highlight the polarity of the half-wave considered.
Following the application of such voltage, the Iris extra-resonant current circulates in the coil turn of the resonant
circuit, as indicated by the arrow. This implies that two voltages are localized in the DE and AA rail stretches: DE
voltages, which is generated by self-induction on the DE rail stretch and AA’ voltage, which is generated by mutual
induction between the AA’ rail stretch and the cable lying thereon.
Therefore, the DE voltage and the AA’ voltage, with the polarities indicated, tend to obstruct the passage of the Idx
current and, therefore, to favor Electric Joint directionality.
Likewise, the same considerations can be repeated for the other half-wave, taking care to invert the voltage
polarities and current directions.
Moreover, the principle of operation is the same even when the Electric Joint receives the signal from the track.
The parallel resonant configuration also allows the equivalent impedance of the Electric Joint/Tuning Unit assembly
to be raised for the purpose of:
a) limiting as far as possible the power lost in the emission and withdrawal of the signal from and to the track;
b) improving the Shunt.
abcd SDTC
14/04/11
3.2.5 Principles of Safety

The sole safety function of the electric joint is not to increase voltage as a result of a fault in which it might be
involved. To this end, the electric joint is designed as a parallel resonant joint; any fault that involves this type of
circuit causes an impedance decrease along with a fall in voltage.
Measures have been adopted for all other safety functions such as alternation of carrier frequencies on the same
track and the use of different protection codes.
3.3 Tuning Unit

The Tuning Unit is a field device installed in correspondence to every Electric Joint, which represents the
interfacing element with the track, that is, the element on which the Connection Cable terminates and which is used
to emit or draw the signal on the track.
The following terminate on the Tuning Unit:
a) the Connection Cable with the Equipment Room
b) the Connection Cables with the Electric Joint on the track.
The Tuning Unit is represented by a board, the CSIN921 Board, on which passive components are mounted. This
is housed in a plastic case equipped with appropriate terminals for clamping the Connection Cables to the Electric
Joint and the Connection Cable.
The operation of the Tuning Unit is strictly correlated to that of the Electric Joint. In fact, separation of two adjacent
track circuits is made by the Electric Joint/Tuning Unit assembly. Accordingly, as for the Electric Joint, two sections
are identified in the Tuning Unit (please see figure 3-5), each dedicated to one of the two track circuits.
fx fy
Connection cables GE-TU
A B C
fx fy (fx < fy)
CN3 CN4
Connection cable
Figure 3-5. Tuning Unit operation
Each section is connected to the related semi-joint (track-side) and to the related pair of conductors of the
Connection Cable (Signaling Equipment Room).
The two sections are equal from a functional point of view and differ only in respect of the value of the components
mounted on the board, given that they must transfer signals at different frequencies.
By way of convention, it is established that the minor frequency of the two is always reserved for the section of the
Board heading the “A”-”B” terminals (Electric Joint side) and “CN3” terminal (Signaling Equipment Room side).
abcd SDTC
14/04/11
3.3.1 Description of CSIN921 Board
CN3
A
Matching Pre-Shunt Tuning
fx RV1
fx fy fx
fx
fy
Matching Pre-Shunt Tuning
fy RV2
fy fx fy
C
CN4
Figure 3-6. Block diagram of CSIN921 Board
The CSIN921 Board is represented by the functional blocks set forth in figure 3-6. The two sections by which it is
constituted can be seen in the overall block diagram.
As the architecture of the board is symmetrical, the description of the board will be developed for one section only.
The input from the track of each section is protected by a VDR with a working voltage of 170 Vdc and 2 mA current.
3.3.1.1 Tuning Unit
calibration Connection cables
tuning
semi-joint
Tuning Box
Figure 3-7. Tuning Unit, diagram of principle.
Given that the principal function of this device is to “tune” the electric joint, this component is known as the Tuning
Unit. In fact, as mentioned in Chapter 3.2, there is a capacity in each of the two sections of the Tuning Unit that, by
abcd SDTC
14/04/11
tuning itself via appropriate Connection Cables with the inductance represented by the corresponding semi-joint,
forms the parallel resonant circuit. Resonance tuning is made at the carrier frequency of the Channel.
In addition to the tuning capacity, the Tuning Unit also comprises a variable calibration inductance, placed in series
to the Electric Joint/Tuning Unit Connection, the function of which is to ensure precise tuning of the resonant circuit,
loading the tolerances of the capacitors and inductance’s.
3.3.1.2 Matching Unit

As discussed earlier, the Tuning Unit is the joining element between the Connection Cable and the track (Electric
Joint). The diversity of the impedance’s to be paired justifies the presence of a matching function.
The Electric Joint impedance (more specifically, that of the Matching Unit loaded by the Electric Joint) is more or
less resistive in the signal band, insofar as it is a resonant circuit.
In these conditions, matching is realized at transformer thus ensuring galvanic insulation of the system
from the track.
Moreover, in series to the low voltage winding of the transformer (Electric joint side winding) a series L-C circuit has
been placed. This circuit, tuned at the TC carrier frequency, has 2 major functions :
• amplitude equalization of the transfer function of the cable;
• protection of the transformer against saturation due the low frequency currents coming from the track.
3.3.1.3 Pre-Shunt Unit

Another important function is implemented on the Tuning Unit, that is, that of reducing the Pre-Shunt phenomenon
which, as discussed earlier in Chapter 3.2, is due to the employment of the Electric Joint.
The cause of the Pre-Shunt stems from the fact that, following the presence of a Shunt in the adjacent track circuit,
a route capable of dispersing a part of the useful signal is established. Amongst the other elements, the circuit
comprises the tuning capacity of the adjacent track circuit, and represents a series resonance, which, although not
tuned to the frequency of the useful signal, absorbs a part of it.
The principle of operation of the Pre-Shunt circuit consists in altering, at the useful signal frequency, the reactance
of the tuning capacity of the adjacent track circuit. The scope of this is to “untune” the series resonance and thus
obstruct the passage of the current in the loss circuit. As mirrored in figure 3-6, the Pre-Shunt circuits are tuned on
the other frequency present in the tuning unit.
At the same time, the Pre-Shunt circuit must possess the requirement of being as “transparent” as possible to the
frequency of that track circuit in order not to disturb regular operation. At the frequency of that track circuit, the
reactance of the Pre-Shunt circuit works modestly towards the joint/unit resonance.
The characteristic of the Pre-Shunt circuit is that of operating at the frequency of the track circuit to be protected
from the Pre-Shunt, while being set in parallel to the tuning capacitors of the adjacent track circuit.
The Pre-Shunt Unit is represented by a series resonant circuit.
3.3.2 Mechanical characteristics, laying and clamping

The Tuning Unit is represented by a PVC case housing CSIN 921 Board, on which the components are
mounted.
Dimension of PVC case: 310x370x140 mm.
IP 65
Dimension of board: 220x340 mm, width 2.4 mm .
The units are clamped to an appropriate pedestal sunk in the ballast, beyond the track and in correspondence
to each Electric Joint.
abcd SDTC
14/04/11
Connection with the Electric Joint is realized via three S=25 mm2 insulated single-pole conductors, one of which
clamped to the center of the Electric Joint, whilst the other two are clamped to the rails, in correspondence to the
central section of the Electric Joint. The conductors are kept next to one another by plastic strips and are protected
by a heavy plastic sheath.
The unit should be less than 2 m away from the nearest rail.
The unit has 5 holes with cable glands for the mooring of the Relational Cable and the three Connection Cables
with the Electric Joint.
Connection of the Relational and Connection Cable conductors with the Electric Joint to the board is realized by
means of cable lugs pinched at the extremity of the conductors and locked on screws mounted on the said board.
Unscrewing is ensured by the use of self-locking nuts.
A plastic frame is mounted on the components side of the board, the function of which is to limit the effects of the
vibrations caused by the passing of trains.
3.4 Loop cable

The loop cable is laid between the rails of the diverted branch when cab signaling is required overall. This because,
when the train is leaving the main straight line exiting on the diverting branch, the leading cab driver coach has not
more the Tx in front of it and it can not pick up the cab signal track circuit current, so a loop close to the rails is fed
by the signaling room by a dedicated Tx, see following figure. The loop Tx is at different frequency respect to the
one of the track circuit.

TERMINAL-BOND"
TU
Rx
LIU
LOOP
FIELD
SER
SDTC
PROCESSING UNIT PROCESSING UNIT
MAIN SWITCH
Figure 3-8. Loop layout
3.5 Loop Interface Unit

The LIU (loop interface unit) is a field device installed in correspondence to every Loop, which represents the
interfacing element with the loop cable, that is, the element on which the Connection Cable terminates and which is
used to emit the signal on the loop.
From electrical point of view the LIU is made only by a transformer, matching the connection cable coming from the
signaling room to the loop cable.
abcd SDTC
14/04/11
3.6 Connection Cables

The connection Cables connect the Equipment Room with the Tuning Units. These consist of 2 twisted pairs for TC
signals plus a service telephone pairs. A shield and an armor are present for noise rejection and mechanical
purposes. The service pair can be used as a telephone connection during calibration and the putting into service of
electric joints. The two principal pairs transport the transmission and receiver signals of the two adjacent track
circuits served by the tuning unit and by the electric joint; accordingly, they are crossed by signals set on separate
frequency bands.
For further details, please refer to the document “Shielded cable pairs for track circuits on 2x25 kV 50 Hz electric
traction railway lines – Product Technical Specification” [10].
abcd SDTC
14/04/11
4 PROCESSING UNIT
The PU is the part of the SDTC system housed in the Equipment Room. This is made of board-mounted active and
passive components.
The PU contains the vital equipment of the device, which transmits and receives the track circuit signal to and from
the field circuit. It generates the occupied/vacant output towards the user system (ZLC).
The boards of each Smartway DTC occupy one half of a rack, which in turn is housed in a cabinet that can contain
up to five racks.
To interface Smartway DTC with Sacem 2oo3 platform, in each Signalling Equipment Room a TWC rack is housed
in 1 SDTC cabinet associated with 4 SDTC racks.
The Relational Cables of the field circuit and the connection cables with the ZLC system and the CEDD-D system
are connected logically to the rack.
4.1 Functional Characteristics

The fundamental functions implemented in the Processing Unit are:
a) generation of the message that modulates the track circuit signal;
b) generation of the track circuit modulated signal;
c) transmission of the track circuit signal towards the field circuit;
d) reception of the track circuit signal from the field circuit;
e) measurement of the energy level of the signal received from the track circuit;
f) demodulation of the message contained in the signal received from the track circuit;
g) comparison of the message received with the message transmitted;
h) generation of the occupied/vacant vital output towards user system;
i) reverse the Direction Of Travel, i.e. the transmitter position on the rails;
j) electrical interface to the base band wayside Sacem message generator;
k) generation of diagnostics data towards CEDD-D system;
abcd SDTC
14/04/11
4.2 Block diagram

The following is the block diagram of a simple track circuit, without the diverted branches of switch points.
T.U. T.U.
ASCV Point Rx
Tx - Rx Switch
Tx Board Rx Board
Filter
Filter
Amplifier Amplifier
Modem Board CD
Switch detector
MSK
Demodulator
CPFSK MSK Code XTAL
Modulator Modulator generator oscillator
SACEM
base band
RT Board
Free (1) /
D
Occup.(0)
Delay
netw.
D Comparator
Rit 2
RMS Rit 1
Amplifier Generator
20 kHz
Figure 4-1. Block diagram of the SDTC – main line
abcd SDTC
14/04/11
When a diverted branch of a point adds to a main line track circuit, then the following block diagram is added to the
main line one.
L.I.U.
T.U.
Tx Loop Rx Point
Filter
Board Board Filter
Amplifier Amplifier
Modem Point
Board
MSK
Demodulator
CPFSK XTAL
Modulator oscillator

SACEM
Code Generator
base band
RT Point D
Free (1) / Board
Occup.(0) Delay D Comparator
netw.
Rit 2
RMS Rit 1
Generator
Amplifier
20 kHz
Figure 4-2. Block diagram of the SDTC – diverted branch
Note: the maximum number of diverted branches in a main line track circuit is 2.
The cab signal transmission on the point area is by a B1 type loop. The frequency carrier in the loop is other than
the main line track circuit one. When the loop length is greater than 74 m, then the loop cable is laid with one
transpositions, otherwise without any transposition.
The point diverted branch SDTC equipment is similar to a one TC main line rack module and occupy the same rack
space.
Reference should be made to the block diagram shown in Figure 4-1 following the route made by the track circuit
signal.
The starting point is the generation of the modulating signal by the Coder. The modulating signal is represented by
a cyclically repeated bit sequence. The bit sequence contains the Protection Code associated to the track circuit
(Document “Smartway DTC– Software Technical Specification”).
abcd SDTC
14/04/11
The Protection Code is selected, via mechanical setting, during the putting into service.
When receiving the bit sequence to be transmitted, the Modulator of BL1 and BL2 generates the MSK modulated
signal, which is realized as a 2FSK with a modulation index of 0.5, that is, with total frequency deviation equal to
half of the transmission speed expressed in Hertz. In correspondence to each “0” bit, the “f-” frequency is
transmitted. In correspondence to each “1” bit, the “f+” frequency is transmitted. The “f+” and “f-” frequencies are
equal to the carrier increased and decreased by the frequency deviation, which is 100 Hz for a speed of 400 bit/s.
In BL3 modulator, that is CPFSK type, modulation index is 0.25, with 100 Hz frequency deviation at 200 bit/s
speed, increasing in this way the noise immunity of the receiver.
When the first axle of the train occupies the track circuit, then the received signal goes down and the modulator
switches from the wayside protection code at 400 or 200 bit/s to the Sacem cab signal message at 500 bit/s. The
frequency shift remains unchanged at +/-100 Hz, so the modulated Sacem signal is a CPFSK having modulation
index of 0.4
The modulated signal is equipped with the power needed to supply the field circuit by means of a push-pull
switching amplifier.
The pass-band Transmission Filter is realized by passive components and transforms the square-wave signal
generated by the amplifier into the sine curve signal that supplies the field circuit.
After running over the field circuit, the track circuit signal returns to the SDTC, where it is transformed by the vital
circuits that establish the occupied/vacant state of the track circuit.
The pass-band Receiver Filter is realized by passive components and selects the track circuit signal drawn directly
from the field circuit on the normal layout branch.
The Receiver Amplifier increases the signal level so as to make it compatible with the operation of the next circuits.
The occupied/vacant state of the track circuit depends upon the effective voltage value of the signal received and
upon the composition of the data message.
Starting from the output of the Receiver Amplifier, two separate routes can be identified: one dedicated to the
valuation of the effective value and the other for comparing the message transmitted and the message received.
The two routes converge in circuit, the solid-state magneto relay, which ensures a true output as and when the
conditions at the inputs are true.
The fail-safe Comparator compares the demodulated data and the data transmitted by the Coder on a bit-by-bit
basis. The sequences compared must be in phase in order to achieve positive comparison. In order to obtain
alignment, the data transmitted must be delayed for an interval of time equal to the delayed propagation of the
signal via track circuit. This function is realized by the Delay Network.
The output of the Comparator supplies the RIT1 delay (Delay circuit 1 or Ritardatore 1) that, in turn, enables the
20 kHz generator.
The 20 kHz frequency oscillator represents one of the two inputs of the Solid-state Magnetic Relay (RMS).
In depot point application, the signals coming from the switch branches are amplified, rectified, leveled and
combined in an AND circuit to enable the transfer of the 20 kHz oscillation. The threshold of reference for the
switch signals is the +12V supply voltage of the MODEM board. Its modification impedes the correct data reception
and, therefore, the disappearance of 20 kHz.
The RMS transfers the alternating signal from the first input to the output as and when a continuous voltage having
an amplitude greater than a certain threshold is present on the second input.
The outgoing signal from the Receiver Amplifier is rectified to supply the RMS continuous input. The RMS
threshold level is guaranteed intrinsically by its construction characteristics.
The RMS output is then rectified to enter into the RIT2 delay, the output of which generates the occupied/vacant
Smartway DTC signal.
The function of the RIT1 and RIT2 delay is to avoid the undue temporary clearance of the track circuit ensuring, in
safety, that the signal clears the track circuit only after the characteristic delay timing.
abcd SDTC
14/04/11
The comparator supplies the RIT1 delay. The function of this delay is to delay the energisation of the 20 kHz
generator for about 1 s only after continuous comparison of the data transmitted and received. In addition, the
delay sets its output almost immediately to zero if negative pulses of the comparator output are detected when the
bits do not correspond.
The magnetic threshold supplies the RIT2 delay. The function of this delay is to delay the energisation of the vital
output of the equipment (occupied/vacant) for about 1 s in BL1, BL2 and 2 s in BL3, after applying the 20 kHz
signal and the energy level of the signal received at the magnetic threshold inputs. After clearance of the normal
layout branch, the overall energisation delay is about 2 s in BL1, BL2 and 3 s in BL3. Moreover, the function of the
RIT2 is to supply an output or zero or maximum (12V per vital input and 24V per relay coil) without intermediate
values versus user.
The complete point branch receiver takes the signal from the branch end, that is similar to the main line receiver
one. The signal is filtered, demodulated and compared to transmitted data coming from the main line modulator, by
means of a set of RX, MODEM and RT point boards. A TX point board is added for the loop transmission.
The simplified point branch receiver checks only the energy level on the point branch, enabling the 20 kHz chain in
the main line RT board, so without any other board adding.
4.3 Safety related functional items

In the following chapters the architecture of SDTC room part will be described. The following table lists the
functional blocks that are safety related.
Block Safety Related Safety Related Functions

RX Yes Filtering signal coming from the receiver end of the track circuit
Internal DC power supply generation
TX Yen Signal amplification
MODEM Yes Track circuit code generation SOFTWARE is classified SIL2
RT Yes Comparison between transmitter and received data
Generation of safe delay time
DIAG No
MB Yes Insulation
POWER CONVERSION Yes Power Supply
Table 4-1. Safety related functions of room equipment.
4.4 Compatibility between SDTC and Low Frequency TC
When SDTC audio frequency electrical joint track circuit is going to substitute a traditional low frequency insulated
joint track circuit, then there is a problem about how to manage installation, test and commissioning of the new
equipment during the continuing revenue service of the original old one. Generally, traditional low frequency track
circuits are in the range of 50 to 75 Hz. During the migration phase, from the old track circuit to the new one,
service is normally by day and new commissioning is in progress by night. So, actions should be taken during the
night in order to disconnect the old equipment, to short the insulating joints and to connect the electrical joints;
after, at the end of the night, all the field has to be restored before on the morning the commercial service starts
again.
Some helps, in managing the migration from the old to the new, comes if the boundaries of the track circuits remain
unchanged. In case of double insulated rails track circuit equipped by impedance bonds it is very difficult to keep at
the same time and at the same place both impedance bonds and S bond electrical joint, especially if the former are
resonant type. In case of single rail track circuit, see Figure 4-3, having “Z” bonds for traction return to sub station,
then some simple equipment can be added in order to operate at the same time both types of signaling.
abcd SDTC
14/04/11
Rx TCB Tx TCA 75 Hz
Track transformers
Ground rail
TC B TC A
Ground rail
Insulating joint Z bond

Figure 4-3. Low frequency single rail track circuit
The basic principle of overlaying single rail low frequency track circuit wit SDTC audio frequency track circuit is to
replace the Z bond by the S bond, to by pass the insulating joint using capacitors that also block the low frequency
signal leakage on the audio frequency tuning unit, and to block the audio frequency signal leakage on the low
frequency track transformers by means of inductors, see Figure 4-4.
Rx TCB audio frequency Tx TCA audio frequency
Rx TCB 75 Hz Tx TCA 75 Hz
Tuning Unit
Track transformer
Filter inductance
TC B TC A
Ground rail
Filter capacitor S bond

Figure 4-4. Low frequency and audio frequency track circuits
The S bond just replaces the original Z bond of the low frequency track circuit. The filter capacitors are big enough
to still insulate the 75 Hz track circuit, but they are near a short circuit for the 9-21 kHz SDTC track circuit. Normally
abcd SDTC
14/04/11
the only insulating joints have a very little capacitance, so the filter capacitors, and the Tuning unit ones that are
smaller and in series with them, should not affect the operation of the related 75 Hz track circuit vane relay, i.e.
they should not modify the phase relation between transmitted and received 75 Hz, at both transmitter and receiver
track sides. On the other hand, the filter capacitor does not affect the resonance at SDTC audio frequency and acts
just as a localized low impedance across the insulating joint. Least, the filter inductance avoids audio frequency of
SDTC being withdrawn by the 75 Hz track circuit equipments (these ones may otherwise act like a shunt for the
SDTC audio frequency), both transmitting and receiving, but they are also close to a short circuit, or to a low drop,
for the 75 Hz track circuit signal. Inside the tuning unit, the presence of a series resonant circuit avoids the audio
frequency SDTC transmitter and receiver to shunt the 75 Hz track circuit.
The filter capacitors and the filter inductances are contained in a box besides the track, called “Filter Box” (Cassetta
Filtri) and they are connected to the rails at the same points of the original 75 Hz track circuit. Also SDTC Tuning
unit is connected to the rails at the same points.
Being the SDTC a double insulated track circuit, the “Ground Rail” should be well insulated from the earth along the
line, and eventually connected to earth only at substation places in single points well far each others.
When 75 Hz track circuits are decommissioned, then the insulating joints can be removed and the Filter Box has to
be removed, going back the STDC field installation to the standard configuration with TU and without Filter Box.
4.5 Compatibility between SDTC and 4th rail return connections

When in DC traction system the return is on the 4th rail, then this can be directly connected to the running rail, see
Figure 4-5 following.
Cross Bond
75 Hz TC + SDTC
“Ground” rail
4th
3rd
3rd
“Ground” rail
4th
+750 Vdc Equipotential 0V

links
SSE
Figure 4-5. DC 4th rail return schematics
The equipotential links permit the audio frequency harmonic current, coming from train power electronic drivers, to
exit from the train and to close its loop in Sub Station between 4th rail and ground rail. This builds up a great
unbalance of the harmonic currents on the running rails and may cause undue track circuits drops after the code
signal interference.
abcd SDTC
14/04/11
50 uF decoupling for 75 Hz
Tuing capacitor for SDTC

“Ground” rail
4th
9,6 m
3rd
3rd
“Ground” rail
4th
0V
+750 Vdc
SSE
Figure 4-6. Loop "8" layout
Operating principle of Loop “8” is its inductance tuned with a parallel capacitor, in order to be an high load for the
audio frequency TC. The “8” shape permits to implement an air inductor coupled to the rails, its middle twist cancel
the coupling leakages to the rails, In order to not load the 75 track circuit, one end of the loop is connected to the
rail, the ground one, the second end id decupled by means of a 50 µF capacitor, similar to the Filter Box one. This
capacitor is nearly a short circuit for audio frequency but it is a big impedance for 75 Hz, so the 75 Hz TC is not
affected by it. The center of Loop “8” is the center tap of an air autotransformer, so it is connected to the 4th rail in
place of the original equipotential link between return rail and ground rail.
Loop “8” is not a boundary between TC and it is not connected by cable to the equipment room.
When the 75 Hz TC is decommissioned or it is not present at all, the configuration of Loop “8” is without decoupling
capacitor, so the loop is directly connected to both rails, see the following Figure 4-7.
In/2
In
L
In/2
Figure 4-7. Loop "8" layout without 75 Hz TC
abcd SDTC
14/04/11
4.6 Diverted branch configurations

The following figures show the possible diverted branch configurations. The length of the diverted branch is the
distance between the Insulated Rail Joints of the switch and the track connections of the Tuning Unit. Diverted
branches are in parallel to the main line by means of a cross bond over the insulating joints.
Main branch Diverted branch

L2
L1 (m) L2 (m)
300 20
L1
210 60
150 100
Table 4-2: Track circuit with 1 diverted branch
Main branch Diverted branch Diverted branch

L2 1 2
L1 (m)
L2 (m) L3 (m)
L1 160 20 20
110 60 60
L3
65 100 100
Table 4-3: Track circuit with 2 diverted branches

1 2
L1 (m)
L2 L2 (m) L3 (m)
L3 180 40 20
125 60 40
L1
80 100 20
Table 4-4: Track circuit with 2 nested branches
abcd SDTC
14/04/11
4.6.1 Diverted branch configurations for low frequency track circuit compatibility.
When SDTC audio frequency electrical joint track circuit is going to substitute a traditional low frequency insulated
joint track circuit, then on cross over there is found the diverted branch configuration of the original low frequency
track circuit, referred to as "series" branch configuration, in which the rail of the diverted branch is in series with the
rail of the main line, see following figure.
1+782
1+835
1+864
cdb156bis cdb156
f10 (C30) f12 (C36)
2x1x185 mmq
CBA CBA CBA
T R T R R T
f8/f10 f10/f12 f8/f12
D26F D29K D27G
2x1x185 mmq
f9/f11 f7/f11
D23C D21A
R T R T
CBA ABC
cdb155 cdb157
f11 (C32) f7
Figure 4-8. Cross over by low frequency track circuit with short series diverted branch
In the series diverted branch the mechanical insulating joints are on the main line rails, and a long cable connection
put in series one rail of diverted branch with one rail of the main line cut by the insulating joint; the other rails of
main line cut are connected by a short Z bond ("ground" rail). Being the diverted branch in metro application at high
tangent angle, the two branches in crossover are very short, in the order of about 20 m.
In the standard SDTC audio frequency track circuit the insulating mechanical joints of the switch are placed on the
diverted branch, and the equipotential Z is on the diverted branch too. When the diverted branch is long then it is
not possible to keep the long rail in series and the normal configuration of Table 4-2 will be used.
abcd SDTC
14/04/11
4.7 Composition
The base equipment of a SDTC module comprises four sets of equipment:
• TX-RX Box unit, represented, in turn, by two facing boards assembled mechanically in a single module: the TX
FILTER Board and the RX FILTER Board;
• RT Board;
• MODEM Board;
• POWER CONVERSION unit;
The following is present when the Smartway DTC is required to have diagnostics:
• DIAGNOSTICS Board.
4.8 Cubicle
One cubicle can contains up to 8 SDTC modules and 1 TWC Sacem module, or 10 SDTC modules. The cubicle
dimension are 600 x 800 x 2010 mm.
abcd SDTC
14/04/11
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RT
RT
RX
RX
RX
RX
RT
TX
RT
TX
TX
TX
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RX
RT
RT
RT
RT
TX
TX
TX
TX
FAN COILS FAN COILS
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RT
RT
RT
RT
RX
TX
TX
TX
TX
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RX
RT
RT
RT
RT
TX
TX
TX
TX
FAN COILS FAN COILS

MODEM
MODEM
TWC RACK
DIAG
DIAG
RX
RX
RT
RT
TX
TX
Figure 4-9. Cubicle arrangement.
abcd SDTC
14/04/11
POWER POWER
POWER POWER
CONV. CONV.
CONV. CONV.
POWER POWER
POWER POWER
CONV. CONV. CONV. CONV.
FAN COILS FAN COILS
POWER POWER
POWER POWER
CONV. CONV. CONV. CONV.
POWER POWER
POWER POWER
CONV. CONV.
CONV. CONV.
FAN COILS FAN COILS
TWC RACK
POWER
POWER
CONV.
CONV.
Figure 4-10. Cubicle rear.
abcd SDTC
14/04/11
5 SDTC FUNCTIONAL BLOCKS

SDTC is composed by Processing Unit and by a functional block named Connection Elements, because it includes
EJ, TU and LIU.
Functional Decomposition starts from general SDTC, then the functional block of room and field equipment, i.e. PU
and Connection Elements.
SDTC 0
TX
TC
SIGNAL_RX_CR
TC_ML MOD_SACEM
TRAIN
CONNECTION
ELEMENTS
1
CAVO_EXT (TX) BF 1
CAVO_EXT (RX)
MOD_SACEM
GATE_A
BF 2 GATE_B
I/F USER LEGENDA
CAVO_EXT (RX) CONT_CORR
PROCESSING UNIT TC – TRACK CIRCUIT
POS_V0
ACC / RELAYS TC_ML – TRACK CIRCUIT, MAIN LINE OR
RICH_COMM DIVERTED BRANCH
CEDD
DIAGN_MSG
CEDD – INTERLOCKING OR RELAYS

ACC/RELAYS
SACEM SIGNAL
CEDD – I/F CEDD
TWC
I/F USER – I/F USER (LED, TEST POINT, ETC.)
TWC – TWC RACK
TRAIN – TRAIN
Figure 5-1. Functional Decomposition of SDTC: level 0
abcd SDTC
14/04/11
5.1.1 Functional Decomposition of Processing Unit
PROCESSING UNIT 1
1.1
DEV_IN
BF 2
CAVO_EXT(RX)
GATE_B
GATE_A
PROCESSING UNIT I/F USER
CONT_CORR
RICH_COMM
CEDD
POS_V0
ACC / RELE’
DIAGN_MSG
SACEM CEDD
TWC
MOD_SACEM
BF 2
LEGENDA
BF 2 – Connections Elements
ACC/RELAYS – INTERLOCKING OR RELAYS
CEDD – I/F CEDD
I/F USER – I/F USER (LED, TEST POINT,

ETC.)
TWC – TWC RACK
Figure 5-2. Functional Decomposition of PU: level 1
5.1.1.1 Functional decomposition of the Processing Unit

The following Figure 5-3 shows the functional breakdown of the Processing Unit of level 2. Due to the large number
of inputs and outputs of each function block is not possible to bring to the whole representation the details of the
interconnection link between the various functional blocks, and the flow of logical link between the functional blocks
that make up the Processing Unit will therefore be highlighted, referring to the figures above for the details of the
inputs and outputs of each functional block.
abcd SDTC
14/04/11
PROCESSING UNIT 1.1

LEGENDA
1.1.1 TWC – TWC Rack ACC – ACC or RELAYS

TX to TC
BF 2 BF 2 – CONNECTION ELEMENTS
FILTRO_TX DIAGNOSTIC SIGNALS

BF 1.1.4 BF 1.1.5
1.1.3
RX BOARD
RX from ML / BRANCH
RX_RT DIAGNOSTIC SIGNALS
BF 2 BF 1.1.5
RX_MODEM
BF 1.1.2
RT BOARD VITAL OUTPUT Free/Occ.

1.1.2 ACC
RX_CODE
TX_CODE Reference for Comparator
RX_MODEM DIAGNOSTIC SIGNALS

BF 1.1.3
BF 1.1.5 MOD_SACEM
1.1.4 BF 2
SACEM SIGNAL MODEM BOARD
FILTRO_TX
TWC
BF 1.1.1
OUTPUT POWER DRIVER
TX BOARD
DIAGNOSTIC SIGNALS
MODULATED SACEM SIGNAL BF 1.1.5
1.1.5
BF 1.1.1 DIAGNOSTIC MESSAGES

DIAGNOSTIC SIGNALS
BF 1.1.2 DIAG BOARD CEDD
BF 1.1.3
BF 1.1.4
Figure 5-3. Functional decomposition of the Processing Unit - level 2
The operation of the Processing Unit sketched in the Functional blocks shown in Figure 5-3, can be summarized as
follows.
MODEM board cyclically reads the configuration of jumpers that store a 16 bits protection code to be sent to the
TC; starting from this code the MODEM board generates and send to the TX board a 200-bit code message (signal
"Power Stage Driver" in Figure 5-3) which is the driver signal of the power stage of the last one. The transmission
of the message is continuous, ie messages of the same code is repeated every 200 bit seamlessly.
At the same time, the MODEM board send the 200-bit code message (Forbidden) also to RT board that uses it as
reference code in verifying the correctness of the protection code extracted from the signal received from the TC
(signal "Reference code x comparison "in Figure 5-3 or, more specifically, DT_NEG signal in Figure 5-5). This
signal has the same characteristics of the signal sent to the TX board, which is composed of a 200-bit message
that is repeated more seamless continuity.
Moreover, MODEM board also modulates SACEM signal (see SACEM_SIGNAL in Figure 5-5) coming from TWC
rack and send it to rail through TX board (signal "Power Stage Driver" in Figure 5-3).
The TX board, suitably driven by by MODEM board, generates a signal at a fixed frequency (the frequency of the
preset channel) frequency modulated with the protection code (i.e. the code message referred to above). The
signal is then properly filtered by the same TX board and it is sent to the RX board ( "Signal FILTRO_TX" in Figure
5-3).
abcd SDTC
14/04/11
Also for SACEM message transmission TX board receives modulated SACEM signal from MODEM board and
transmits it to rails through RX board.
The RX board is limited to forward the signal received from the TX board to TC through the functional block "Field
Equipment Isolation" (" TX signal to TC " in Figure 5-4 or, also called CAVO (TX)). The reason for which the signal
directed to the TC passes through the RX board is that the former implements a change of direction (DOT) function
by setting up special contacts controlled by two relays (K3 and K4). So if the two relay are excited the contacts are
closed, allowing the reception of the signal from the TC and the signal transmission to the TC. The RX board,
indeed, receives the signal picked up from the other end of the TC regarding which the signal was transmitted. Also
the received signals ( "RX signal from CT” in Figure 5-4), before to reach the RX board, transits through Tuning
Units. The signals received by the TC are filtered and amplified by the RX board, and then forwarded to the RT
board ( " RX Signal filtered by ML or Branch Line" in Figure 5-4). In particular, the RX board sends a signal
amplified and rectified to the RT board (called THRESHOLD), whose amplitude is proportional to the amplitude of
the signal received from the TC.
Also for SACEM message transmission RX board is limited to forward the signal received from the TX board to TC
through the functional block "Field Equipment Isolation" (" TX signal to TC " in Figure 5-4 or, also called CAVO
(TX)).
The RT board performs the following operation:
To forward the signal received from the TC main line (the "RX signal filtered by CT" in Figure 5-3 and also called
RIC in Figure 5-6) via the RX board, to MODEM board (in Figure 5-5 this signal takes the IN_DEM name).
MODEM board receives and demodulates the RIC signal (“Signal RX from CT” in Figure 5-3) extracting the
protection code to be verified. Extracted code is forwarded again to the RT board (“Signal Code RX from CT” in
Figure 5-3 or, more detailed, DR signal in Figure 5-5 and in Figure 5-6).
The RT board, indeed, receives the protection code extracted from the signal received from the TC main line and
compares bit to bit to the Reference Code (called DT_NEG in Figure 5-5 and in Figure 5-6) verifying the
correctness.
If check is successful, a generated signal is delivered to a device delaying it and transmitting it to a 20KHz
generator device that, in turn, generates a 20KHz signal. This signal is transferred directly to the RMS input.
The 20kHz signal is then forwarded to the Magnetostatics relay input; this is a component that allows the transfer to
the output of the 20kHz signal only if it receives on a dedicated winding the signal THRESHOLD (signal received
from the RX board, which is above) greater then a fixed value (9.7VDC ± 2%) below which the TC is considered
occupied.
Then in the presence of TC free the RMS transfers to the output the 20kHz signal which, when rectified, supply
power to the input of second delaying device.
This introduces a delay of about 1 seconds from the time when it receive power from the RMS to the time when the
it raises its output. The output of Delayer Device 2 is nothing but the vital output to the ACC ( "Output Vitale Lib. /
Occ." in Figure 5-3 or, more specifically, POS_V0 signal in Figure 5-6).
From the above it is clear that the SDTC signals that the TC is free to ACC only if both the following conditions are
verified:
- The Comparator of the RT board found no errors on the protection code extracted from the signal received from
Main Line,
- The RMS of the RT board found that the amplitude of the signal received exceeds a value below which the TC is
considered occupied (and below a maximum value).
As mentioned previously, the functional decomposition of the Processing Unit shown in Figure 5-3 is only meant to
provide an overall view, but is unable to detail the functional link between these different blocks. Therefore the
following figures show a zoom of the functional decomposition in order to detail the inputs and outputs of each
function block.
abcd SDTC
14/04/11
PROCESSING UNIT 1.1
1.1.1 THRESHOLD
D_POS_V0 BF 1.1.3
BF 1.1.3
IN_DEM
AN_I
BF 1.1.3
TX_FILTER
BF 1.1.4 DVOLTFTX
RIC BF 1.1.3
TX_FILTER
BF 2
BF 1.1.4
MOD_SACEM
RX BOARD DRIC
DINFRX
BF 1.1.5
DVRX
Legenda
DVOLTFTX
BF 1.1.3 – RT BOARD
BF 1.1.4 – TX BOARD
MOD_SACEM
BF 1.1.5 – DIAG BOARD BF 2
BF 2 – Connection Elements
Figure 5-4. Functional decomposition of the Processing Unit – RX board: level 2
abcd SDTC
14/04/11
PROCESSING UNIT 1.1
1.1.2
DR BF 1.1.3
BF 1.1.5
SINC_RX BF 1.1.3
BF 1.1.5
IN_SACEM DT_NEG BF 1.1.3

TWC
BF 1.1.5
COM_POT
BF 1.1.3
IN_DEM
MODEM BF 1.1.4
BOARD
CD
BF 1.1.5
HF_LF
Legenda
BF 1.1.3 – RT BOARD
MOD_SACEM
TWC BF 1.1.4
– TWC RACK
BF 1.1.5 – DIAG BOARD
Figure 5-5. Input/output function description of the Processing Unit – MODEM board: level 2
abcd SDTC
14/04/11
PROCESSING UNIT 1.1
1.1.3
DR
SINC_RX
BF 1.1.2
DT_NEG
NEG_RIT1
DRIT
BF 1.1.5
RIC
20KHZ
BF 1.1.1
THRESHOLD U_THRESHOLD
RT D_POS_V0 BF 1.1.1
BOARD BF 1.1.5
Legenda
IN_DEM
BF 1.1.2
BF 1.1.1 – RX BOARD
POS_V0
BF 1.1.2 – MODEM BOARD ACC / RELAYS
BF 1.1.5 – DIAG BOARD
ACC / RELAYS – INTERLOCKING OR RELAYS
Figure 5-6. Functional decomposition of the Processing Unit – RT board: level 2
abcd SDTC
14/04/11
PROCESSING UNIT 1.1
1.1.4
FILTRO_TX
BF 1.1.1
DAMPFTX
DAMPFET BF 1.1.5
COM_POT DVOLTFTX BF 1.1.1

BF 1.1.2
BF 1.1.5
TX BOARD GATE_A
MOD_SACEM GATE_B
BF 1.1.2 I/F USER
CONT_CORR
MOD_SACEM
BF 2
Legenda
BF 1.1.1 – RX BOARD BF 1.1.5 – DIAG BOARD BF 2 – Connection Elements
BF 1.1.2 – MODEM BOARD I/F USER – I/F USER (LED, TEST POINT, ETC.)
Figure 5-7. Functional decomposition of the Processing Unit – TX board: level 2
abcd SDTC
14/04/11
PROCESSING UNIT 1.1

NEG_RIT1
DRIT
1.1.5
U_SOGLIA
BF 1.1.3
20KHZ
D_POS_V0
DT_NEG
SINC_RX
TR_CK
HF_LF
BF 1.1.2
DR
CD
DIAGN_MSG
CEDD
DIAG BOARD
DRIC
DINFRX
BF 1.1.1 DVRX
DSW1
Legenda
BF 1.1.1 – RX BOARD
DAMPFTX
BF 1.1.2 – MODEM BOARD
DAMPFET BF 1.1.3 – RT BOARD

BF 1.1.4
DVOLTFTX
RICH_COMM
CEDD CEDD – I/F CEDD
Figure 5-8. Functional decomposition of the Processing Unit –DIAG board: level 2
5.1.2 Functional decomposition of Connection Elements

The following figure shows the functional decomposition of Connection Elements.
abcd SDTC
14/04/11
CONNECTION ELEMENTS 2
2.1
SIGNAL_RX_CR CAVO_EXT (RX)

TC_ML BF 1
TU RX
2.2
SIGNAL_RX_DEV1 CONNECTION DEV1_EXT

TC_DEV ELEMENTS BF 1
RX BRANCH
RECEIVER 1
LEGENDA
2.4 BF 1 – PROCESSING UNIT
TC –TRACK CIRCUIT
CAVO_EXT (TX) SIGNAL_TX
BF 1 TC
TRAIN –TRAIN
TU/LIU TX
MOD_SACEM MOD_SACEM TC_ML – TRACK CIRCUIT MAIN LINE
BF 1 TRAIN
TC_DEV – TRACK CIRCUIT,

BRANCH RECEIVER
Figure 5-9. Functional decomposition of the Connection Elements: level 1
5.2 Power Supply

Power Supply is delivered to PU, while field items (TU, LIU, EJ) are passive elements, that is they have not power
supply.
PU is supplied with a 220VAC - 50Hz or a 110VAC – 50/60Hz into the Power Conversion Unit.
Power Conversion Unit generates the following alternate voltages:
- 24VAC_DIG,
- 24VAC_LOC,
- 19 VAC,
- 50 VAC.
First three of them are used by RX board that generates voltages needed to proper operation of the other module
boards. The 50 VAC voltage is used by TX board to generate DC voltage to supply Output Power.
Power Supply functional decomposition is shown in Figure 5-10 and in Figure 5-11.
abcd SDTC
14/04/11
POWER A
A.1 A.2
50VCA
110VAC / 24VCA_DIG
Power 220VAC
Supply
POWER CONVERSION
24VCA_LOC PROCESSING UNIT
UNIT
19VCA
Power
Supply - POWER SUPPLY
Figure 5-10. Power Supply functional decomposition – Level 1
abcd SDTC
14/04/11
POWER SUPPLY – PROCESSING UNIT A.2
A.2.2 A.2.3
NEG12
50VCA
A.1 Vdd A.2.5
AC/DC CONVERTER 50V_POS Circuiti interni +5V
50V A.2.6 VDD_NS DC/DC CONVERTER
Vdd A.2.1 A.2.6
A.2.1 (TX BOARD) 5V
24_LOC (RT BOARD)
24_DIG
A.2.1 A.2.3
NEG12 A.2.4 A.2.4

NEG12
A.2.5
A.2.1
A.2.6 Vdd
VOLTAGE REGULATOR
+5V
(MODEM BOARD)
A.2.2 A.2.3
19VCA
A.2.3
24VCA_LOC Vdd
A.1 A.2.4
24VCA_DIG A.2.5
AC/DC CONVERTER 19VCA
(RX BOARD) A.2.6 A.1 A.2.5
VDD_NS 24_DIG
A.2.3
NEG12
A.2.3 A.2.1 POWER SUPPLIES
24_LOC AND VOLTAGE
A.2.4 Vdd
DIAGNOSTIC
50V_POS (DIAG BOARD)
A.2.3 A.2.2
24_DIG +5V
A.2.4 A.2.3
A.2.6
Figure 5-11. Power Supply functional decomposition – Level 2
abcd SDTC
14/04/11
6 REQUIREMENTS AND ARCHITECTURE.

In this chapter it is reported the relationship between the functional block described in the architecture and the
requirements indicated in the specification.
Make reference to the tables of functional blocks Table 3-1 Table 4-1 and to their operating principle described in
chapters §3 §4 and §5.
Requirements Functional Block SIL
SDTC_SAFETY 1.1 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG, SIL 4
MB, POWER CONVERSION
Safety condition
SDTC_SAFETY 1.2 EJ, TU, CONNECTING CABLES, TX, RX, RT, MODEM, MB, SIL 4
POWER CONVERSION
Broken rail
POWER CONVERSION
Immunity to disturbance
from other SDTCs
SDTC_SAFETY 1.4 EJ, TU, CONNECTING CABLES SIL 4
Immunity to traction
disturbance
POWER CONVERSION
Occupied track circuit
reaction time
POWER CONVERSION
Free track circuit reaction
time
SDTC_SAFETY 1.7 RT, MB, SIL 4
Interface with equipment
Insulation requirements
SDTC_SAFETY 1.9 TU, CONNECTING CABLES SIL 0

Overload protection
SDTC_SAFETY 1.10 TX, RX, RT, MODEM, DIAG, MB, POWER CONVERSION SIL 4
Sabotage protection
abcd SDTC
14/04/11
Safety Integrity Level
Safety demonstration
SDTC_SAFETY 1.13 TX, RX SIL 4

DOT requirement
SDTC_SAFETY 1.14 TX, RT, MODEM SIL 4

Train transmission
requirement
Table 6-1. Safety Requirements
6.2 Line characteristics
SDTC_LINE_
CHARACTERISTIC 2.1 EJ, TU, CONNECTING CABLES, TX, RX, RT, MODEM, MB,
SIL 0
Track circuit length POWER CONVERSION
SDTC_LINE_
CHARACTERISTIC 2.2
EJ, TU, CONNECTING CABLES, TX, RX, RT, MODEM SIL 0
Track circuit separation
SDTC_LINE_
CHARACTERISTIC 2.3 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG,
SIL 4
Track circuit with point MB, POWER CONVERSION
branches
SDTC_LINE_
CHARACTERISTIC 2.4
EJ, TU, CONNECTING CABLES NA
Line electrification
Table 6-2. Line characteristics
abcd SDTC
14/04/11
6.3 Performance requirements
SDTC_PERFORMANCE 3.1
Power supply EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG,
SIL 0
SDTC_PERFORMANCE 3.2 EJ, TU, CONNECTING CABLES, TX, RX, RT, MODEM, MB,
POWER CONVERSION
Occupation of the SIL 0
downstream track circuit
SDTC_PERFORMANCE 3.3 EJ, TU, CONNECTING CABLES, TX, RX, RT, MODEM, MB,
POWER CONVERSION
Occupation of the SIL 0
SDTC_PERFORMANCE 3.4 CONNECTING CABLES, TX, RX

PU centralization NA
SDTC_PERFORMANCE 3.5 DIAG

Diagnostics SIL 0
SDTC_PERFORMANCE 3.6 TX, RX, RT, MODEM

Trasmission function SIL 0
performance
SDTC_PERFORMANCE 3.7 EJ, TU, CONNECTING CABLES

Distance from TU to NA
nearest rail
SDTC_PERFORMANCE 3.8 EJ, TU, CONNECTING CABLES

Compatibility of SDTC with SIL 4
low frequency power track
circuit
Table 6-3. Performance requirements
abcd SDTC
14/04/11
6.4 User characteristics
SDTC_USER 4.1 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG, NA
Packaging requirement MB, POWER CONVERSION
SDTC_USER 4.2 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG, SIL 4*
User Safety MB, POWER CONVERSION
Table 6-4. User characteristics
6.5 Design requirements
SDTC_DESIGN 5.1 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG,
SIL 4
Standards requirement MB, POWER CONVERSION
SDTC_DESIGN 5.2 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG,
NA
Materials MB, POWER CONVERSION
Table 6-5. Design requirements
6.6 RAM requirements
SDTC_RAM 6.1 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG, SIL 0
Reliability and MTTR MB, POWER CONVERSION
Table 6-6. RAM requirements
6.7 Environmental conditions
SDTC_ENVIROMENTAL 7.1 EJ, TU, LIU, CONNECTING CABLES, TX, RX, RT, MODEM, DIAG, SIL 0
Environment MB, POWER CONVERSION
Table 6-7. Environmental conditions
abcd SDTC
14/04/11
NOTE:
• SIL4 Requirements indicated with a “*” are not directly affecting railway safety, but they represent
requirements to be implemented for operators and personnel safety.
• In the case of architectural requirements for which is not possible to assign a safety integrity
category, SIL equal to N/A (Non Applicabile) is indicated.
PATH Digicode® PSP
APPENDIX D-6 SDTC Architecture Verification Report
60 of 80
abcd SDTC
30/05/11
Bologna Architecture Verification Report
REVISIONI
REVISIONS

P. Capatti
1 Project Safety Assurance 04/09/09 68 First Release
Manager
F. Memmo
2 PDI Safety 15/09/2010 65 Update due to new release of documents to be validated
F. Memmo
3 PDI Safety 14/04/11 65 Update due to new release of documents to be validated
F. Memmo Update due to new release of Hazard Analysis and of

4 PDI Safety 30/05/11 65
Technical Software Specification
communication of its content are not permitted without prior written ALSTOM authority. Codice interno / Reference Rev. Page/s
Tutti i diritti sono riservati. Ne è vietata la riproduzione, la consegna a terzi o comunque la
diffusione senza il preventivo consenso scritto di ALSTOM Ferroviaria S. P. A. 490501D19VV006 4 2/67
abcd SDTC
30/05/11
CONTENTS
1 INTRODUCTION .................................................................................................................................................................... 5
1.1 SCOPE ............................................................................................................................................................................... 5
1.3 REFERENCE DOCUMENTS .............................................................................................................................................. 7
1.3.1 APPLICABLE STANDARDS ....................................................................................................................................... 7
1.3.2 INTERNAL DOCUMENTATION .................................................................................................................................. 7
2 INPUT AND OUTPUT DOCUMENTS..................................................................................................................................... 9
3 METHODOLOGY ................................................................................................................................................................. 10
4 MODULE ARCHITECTURE DESCRIPTION VERIFICATION.............................................................................................. 13
4.1 QUALITY AND CONSISTENCE VERIFICATION ............................................................................................................ 14
4.2 FUNCTIONAL VERIFICATION OF SDTC MODULE ....................................................................................................... 16
4.2.1 CONGRUENCE VERIFICATION WITH SDTC MODULE ......................................................................................... 16
4.3 VERIFICATION WITH RESPECT TO STANDARDS AND PLANS ................................................................................. 17
4.3.1 VERIFICATION WITH RESPECT TO STANDARD EN 50129 ................................................................................. 17
4.3.2 VERIFICATION WITH RESPECT TO SAFETY AND V&V PLAN ............................................................................. 18
5 SUBSYSTEM RAM ANALYSIS VERIFICATION ................................................................................................................. 21
5.2 VERIFICATION WITH RESPECT TO SDTC MODULE REQUIREMENTS ...................................................................... 24
5.3 VERIFICATION WITH RESPECT TO ARCHITECTURE ................................................................................................. 24
6 SUBSYSTEM HAZARD ANALYSIS VERIFICATION .......................................................................................................... 30
6.2 VERIFICATION WITH RESPECT TO PRELIMINARY HAZARD ANALYSIS .................................................................. 32
6.3 VERIFICATION WITH RESPECT TO ARCHITECTURE ................................................................................................. 33
6.5 VERIFICATION ACCORDING APPLICABLE DESIGN REVIEWS.................................................................................. 35
6.6 ALLOCATION OF SAFETY REQUIREMENTS................................................................................................................ 36
6.7 VERIFICATION OF FAULTS TREES ............................................................................................................................... 38
7 SUBSYSTEM FUNCTIONAL TEST PLAN VERIFICATION ................................................................................................ 40
7.2 VERIFICATION WITH RESPECT TO SDTC MODULE REQUIREMENTS ...................................................................... 44
abcd SDTC
30/05/11
7.3.2 VERIFICATION WITH RESPECT TO SAFETY E V&V PLAN .................................................................................. 47

8 HARDWARE AND SOFTWARE TECHNICAL SPECIFICATION VERIFICATION .............................................................. 50
8.2 VERIFICATION WITH RESPECT TO APPLICABLE DESIGN REVIEWS ....................................................................... 55
9 VERIFICATION RESULTS ................................................................................................................................................... 56
9.1 ARCHITECTURE DESCRIPTION .................................................................................................................................... 56
9.2 RAM ANALYSIS ............................................................................................................................................................... 59
9.3 HAZARD ANALYSIS ........................................................................................................................................................ 59
9.4 FUNCTIONAL TEST PLAN .............................................................................................................................................. 60
9.5 HARDWARE/SOFTWARE TECHNICAL SPECIFICATION ............................................................................................. 63
10 CONCLUSION ...................................................................................................................................................................... 65
11 ANNEXES ............................................................................................................................................................................ 67
Allegato 1 Checklist ................................................................................................................................ 67
FIGURES
Figure 1 – Verification Cycle .......................................................................................................................................12

Figura 2 - Diagram of SDTC module Architecture Description Verification ................................................................13
Figure 3 - Diagram of RAM analysis verification ........................................................................................................21
Figure 4 – Verification diagram of HA .........................................................................................................................30
Figure 5 – Verification Diagram of FTP ......................................................................................................................40
Figure 6 – Verification Diagram of HW Techn. Spec. Documents of SDTC module..................................................50
abcd SDTC
30/05/11
1 INTRODUCTION
1.1 Scope
This document constitues the verification report (Architecture Verification Report, SyAVRp) of SDTC module
architecture. SDTC is conceived and produced by ALSTOM Ferroviaria Bologna to comply SIL4 level, according to
applicable CENELEC standards.
In the following this report will be referenced with acronym SyAVRp.
By considering [EN 50126] and [EN 50129] standard, this document covers activity of Verification related to
Architecture Definition phase with regard to documentation quality, compliance to safety and availability conditions
and module operations. Moreover, according to [SDTC S&VVP] it delivers also the verification of HW/SW Technical
Specification (ref. [SDTC HTS] and [SDTC SWTS]).
SyAVRp has been written to document activities described in [SDTC S&VVP], §7.6. In particular, it constitues
mandatory element of System Verification for following aspects:
Proof of right architecture specification with respect to functional and safety requirements of SDTC module and
its adequacy for use in a specific application context;
Proof, through documental inspections, of SDTC module design compliance to applicable standards and
requirements.
SyAVRp needs correlation with the following documents :
SDTC module documentation, where applicable;
SDTC Preliminary Analysis, [SDTC PHA];
SDTC Requirements Specification, [SDTC SyRS];
SDTC Architectural Documentation, [SDTC SyAD];
Safety Analysis of SDTC, [SDTC HA];
Reliability Analysis of SDTC, [SDTC RAMAn];
Functional Test Plan of SDTC, [SDTC FTP];
SW Technical Specification, [SDTC SWTS];
HW Technical Specification, [SDTC HTS].
Draft of SyAVRp is charged to Validation group and it is performed by using skills and procedures descrive in
applicable Safety and V&V plan, [SDTC S&VVP].
abcd SDTC
30/05/11
ACC Apparato Centrale Calcolatore

AOP n Architectural Open Point identifier
ASCV-GS Apparato di Stazione con Calcolatore Vitale per Grandi Stazioni
CdB Circuito di Binario
CEDD Centro Elaborazione Dati Diagnostica
DC Document Consistency
DT Document Template
DTC24-2 Digital Track Circuit, versione 24-2
FMEA Failure Mode and Effect Analysis
FTA Fault Tree Analysis
FTP Functional Test Plan
FTPOP n FTP Open Point
HA Hazard Analysis
HAAS n Anomaly identified of Hazard Analysis with respect to Module Architecture
HAPA n Anomaly identified of HA with respect to Preliminary Hazard Analysis
HR Highly Recommended
HW HardWare
LRU Line Replaceable Unit
MTBF Mean Time Between Failure
MTTR Mean Time To Repair
N/A Not Applicable
OP Open Point
OPHA n Hazard Analysis Open Point
PBS Product Breakdown Structure
R Recommended
RAMOP n RAM Open Point
RAMS Reliability Availability Maintainability and Safety
RBD Reliability Block Diagram
SAD Subsystem Architecture Description
SRS Subsystem Requirements Specification
Ss Sottosistema
SW SoftWare
SyAVR System Architecture Verification Report
V&V Verification & Validation
abcd SDTC
30/05/11
1.3 Reference Documents
1.3.1 Applicable Standards
[EN 50126] European Committee for Electrotechnical Standardization (CENELEC)

EN 50126
Railway Applications - The Specification and Demonstration of Reliability, Availability,
Maintainability and Safety (RAMS), September 1999
[EN 50129] European Committee for Electrotechnical Standardization (CENELEC)
EN 50129
Railway Applications - Safety related electronic systems for signalling, February 2003
[MIL-217F] MIL-HNBK 217F
Military Hand-Book, Reliability prediction of electronic equipment, Notice 2
1995
1.3.2 Internal Documentation
[SDTC S&VVP] ALSTOM FERROVIARIA

SDTC - Safety and V&V Plan
490501D19VV0021, Rev. 2
[SDTC PHA] ALSTOM FERROVIARIA
SDTC – Preliminary Hazard Analysis
490501D19VV002, Rev. 2
[SDTC SyRS] ALSTOM FERROVIARIA
SDTC – Subsystem Requirements Specification
490502D19SY001, Rev. 5
[SDTC SyAD] ALSTOM FERROVIARIA
SDTC – Subsystem Architecture Description,
490371D19HW001, Rev. 5
[SDTC RAMAn] ALSTOM FERROVIARIA
SDTC – RAM Analysis,
490501D19VV004, Rev. 4
[SDTC HA] ALSTOM FERROVIARIA
SDTC – Hazard Analysis,
490501D19VV005, Rev. 5
abcd SDTC
30/05/11
[SDTC FTP] ALSTOM FERROVIARIA

SDTC – Functional Test Plan,
X302DXXTP010, Rev. 5
[SDTC HTS] ALSTOM FERROVIARIA
SDTC – HW Technical Specification:
HTS.1. SDTC DIGICODE – Tx Technical Specification code
490371A19HW001 rev.2.0;
HTS.2. SDTC DIGICODE – Rx Technical Specification code
490370D19HW003 rev.1.2;
HTS.3. SDTC DIGICODE – RT Technical Specification code
490370D19HW005 rev.3.0;
HTS.4. SDTC DIGICODE – Motherboard Technical Specification
code 490370D19HW004 rev.1.1;
HTS.5. SDTC DIGICODE – MODEM Technical Specification code
490370D19HW002 rev.2.0;
HTS.6. SDTC DIGICODE – LIU Technical Specification code
490370A19HW002 rev.1.2;
HTS.7. SDTC DIGICODE – DIAG Technical Specification code
490370D19HW006 rev.5.0;
HTS.8. SDTC 921 HF – Specifica Tecnica Cassetta di Sintonia
code 315302DXXST001 rev. 7;
HTS.9. SDTC – Specifica Tecnica Cassetta Filtri code
315302DXXST002 rev. 2.
[SDTC HWSV] ALSTOM FERROVIARIA

SDTC – Hardware Safety Verification,
490501D19VV007, Rev. 2
[SDTC SWTS] ALSTOM FERROVIARIA
SDTC – Software Technical Specification,
490371D19SW001, Rev. 2
[SDTC SRVR] ALSTOM FERROVIARIA
SDTC – Subsystem Requirements Verification Report,
490501D19VV003, Rev. 3
abcd SDTC
30/05/11
2 INPUT AND OUTPUT DOCUMENTS

Verification will be performed by assuming the following main input documents:
[1] ALSTOM Ferroviaria
SDTC– Safety and V&V Plan
Code: 490501D19VV001, Rev. 2
[2] ALSTOM Ferroviaria S. p. A.
SDTC- Preliminary Hazard Analysis
Codice: 490501D19VV002, Rev. 2
SDTC- Requirements Specification
Code: 490502D19SY001, Rev. 5
Main documents to verify are:
SDTC - Architecture Description
Code: 490501D19RS001, Rev. 5
SDTC- RAM Analysis
Code: 490501D19VV004, Rev. 4
SDTC - Hazard Analysis
Code: 490501D19VV005, Rev. 5
SDTC - Functional Test Plan
Code: X302DXXTP010, Rev. 5
SDTC - Software Technical Specification
Code: 490371D19SW001, Rev. 2
SDTC – HW Technical Specification:
HTS.1. SDTC DIGICODE – Tx Technical Specification code 490371A19HW001 rev.2.0;
HTS.2. SDTC DIGICODE – Rx Technical Specification code 490370D19HW003 rev.1.2;
HTS.3. SDTC DIGICODE – RT Technical Specification code 490370D19HW005 rev.3.0;
HTS.4. SDTC DIGICODE – Motherboard Technical Specification code 490370D19HW004 rev.1.1;
HTS.5. SDTC DIGICODE – MODEM Technical Specification code 490370D19HW002 rev.2.0;
HTS.6. SDTC DIGICODE – LIU Technical Specification code 490370A19HW002 rev.1.2;
HTS.7. SDTC DIGICODE – DIAG Technical Specification code 490370D19HW006 rev.5.0;
HTS.8. SDTC 921 HF – Specifica tecnica Cassetta di Sintonia code 315302DXXST001 rev.7.
HTS.9. SDTC – Specifica Tecnica Cassetta Filtri code 315302DXXST002 rev. 2.
Output document is this report titled:

ALSTOM Ferroviaria
SDTC- Subsystem Architecture Verification Report
Code: 490501D19VV006, Rev. 4
abcd SDTC
30/05/11
3 METHODOLOGY
Applied methodology is mainly based on design examination with respect to techniques and activities requested by
applicable standard and by ALSTOM best practice. Design’s state is deducted by available documentation,
combined, if it is useful, by intervews to responsible personnel. It is importan the support of several checklists, as:
Checklist prepared to verify adeqacy of each document to Quality Requirements,
Compliance matrices, to verify application of guidelines stated by [EN 50129] standard,
Considerations devoted to document the effot sustained to assure an adequate level of completeness and
readiness of V&V activities.
This report documents verification and technical evaluation of activities described in the following six module
documents:
SDTC Design Specification,
SDTC RAM Analysis,
SDTC Hazard Analysis,
SDTC Functional Test Plan,
SDTC SW Technical Specification,
SDTC HW Technical Specification.
Verification is performed according to sequence of phases shown in Figure 1. That sequence is general and
foreses verification of indicated documents and verification report generation in “i” release. In this report are
descritbed verifications performed and anomalies found into documents. Application of modifications to documents
examined (respectively in ”m”, “n”, “l”, . . releases), based on anomalies listed in verification report, converts them
in the next release ( respectively “m+1”, “n+1”, “l+1” release). New releases of documents are checked with respect
to anomalies listed in verification report and, if modifications are adequate to close anomalies, are accepted for
subsequent use during project life-cycle. Contemporarily it shall be produced a new release of this report (“i+1”) to
close open points (anomalies) due to modifications of design documents.
Verification report (this document) is highlited in grey in Figure 1 and release of checked documents are those
listed in §2 and in §1.3.
Verification process is based on the following steps:
Quality and Consistence Verification of each document first level is based on prepared checklist. Verification
takes account both formal aspects defined in Allegato 1 and technical contents of each activity analysed,
signalling gaps and/or flimsiness (es. insufficient o not complete descriptions, tests missing, wrong calculations,
erroneous or not sufficient assumptions).
Verification of SDTC module adequacy to Assessor’s request thorugh reports of Design Review , if any. The
results of this verification are directly associated to functional verification of examined documents.
Verification of congruence of each phase with respect to applicable inputs coming from previous phase
(bottom-up traceability).
Verification of consistency between requirements and guidelines defined by applicable standards and features
of SDTC module defined by design contained in SDTC design documents documentazione (congruency to
standards).
Results of verifications are listed in related tables with indication of anomaly’s severity. Two severity levels are
considered: Major and Minor. Their meaning is:
Minor: this severity level is used for documentary anomalies that have no significant influence in the next
phases of SDTC module life-cycle. This kind of anomalies does not require an immediate new release of
esamine document; introduction of corrective actions is posponed to next release of document requested by
modifications of module specification or by Major-type anomalies.
abcd SDTC
30/05/11
Major: this severity level is used for all anomalies involving normal functioning of SDTC module; then they
have significant influence in the next phases of SDTC module life-cycle. This kind of anomalies requires
adequate corrective actions from responsible personnelnonce and a new release of examined document.
Therefore, anomalies/modification involving requirements/architecture of SDTC module (i.e. requiring new
requirements or modification of technical features) shall have Major severity level.
To deliver more readiness to document, verification results related to anomalies will be summarized, for each
document, in a separated paragraphs titled respectively “Architecture Description” (with identifiers: “SAD_OP”, SAD
Open Point), “RAM Analysis” (with identifiers: “RAM_OP”, RAM Open Point), “Hazard Analysis” (with identifiers:
“HA_OP”, Hazard Analysis Open Point), “Functional Test Plan” (with identifiers: “FTP_OP”, Functional Test Plan
Open Point), “HW/SW Technical Specification” (with identifiers: “HTS_OP”- HW/SW Technical Specification Open
Point). In these paragraphs each corrective action is properly numbered and traced to paragraph(s) where related
anomaly is listed.
abcd SDTC
30/05/11
Subsystem Architecture Other documentation

Description (Hazard Analysis, RAM
Release “m” Analysis, . . . . . )
Releases “n”, “l”, . . . .
Verification Ss Architecture
Verification Report
Release “i”
Correction Design Review
Subsystem Architecture Other documentation

Description
Releases “n+1”, “l+1”, . .
Release “m+1” .
Verificatio Ss Architecture
n
Verification Report
Release “i+1”.
Documents accept
Figure 1 – Verification Cycle
abcd SDTC
30/05/11
4 MODULE ARCHITECTURE DESCRIPTION VERIFICATION

Verification of [SDTC SyAD] document is based on different phases:
Quality and Consistence Verification;
Functional Verification of SDTC module and its components structure;
Congruence Verification with respect to standards and Safety and V&V plan.
In Figura 2 is shown diagram of verifications.
SDTC
Architecture Verification Report
SDTC Revisione i
Architecture Description
Revisione m
Checklist of Quality &
Consistence of Document,
Paragraph 4.1.
Verification
Functional Verification:
- Verification of Congruence
with system,
Paragraph 4.2.
Verification
In present report releases’

Verification with respect to
indexes have following
standards and to plan:
values: - [EN 50129]
m=3 - [SDTC S&VVP],
Paragraphs 4.3.1 and 4.3.2.
i=1 Verification
Figura 2 - Diagram of SDTC module Architecture Description Verification
abcd SDTC
30/05/11
4.1 Quality and Consistence Verification
Table 1 – Quality and Consistence Verification of document [SDTC SyAD]
Identifier Verification Item Result / Anomaly
SAD.1. Document Quality (according to Allegato 1)
- DT Verified: OK
- DAR Verified: OK
- DC Verified: OK
A minor anomaly. Minor
Found anomaly are detailed in Table 2.
SAD.2. Application Context
- Detailed Description of SDTC module Verified: OK
- Definition of SDRC module structure Verified: OK
- Description of each board/assembly of SDTC module Verified: OK
- Description of links and protocols used between board/assembly cof SDTC module Verified: OK
- Identification and completeness of safety principles of SDTC module

Verified: OK
- Traceability with respect to Subsystem Requirements

Verified: OK
The following table contains detailed consideration about quality check of [SDTC SyAD] document, each identified
with SADQCn.
Table 2 – Anomalies of Quality and Consistence of [SDTC SyAD] document
cation: Correctness and consistency of SCOPE with respect to objectives of document and to life-cycle of SDTC
Reference/ Description/ Result
Page Action Anoma
§1, page 5 Scope paragraph is missing. Minor
Introduce paragraph SCOPE. Closed in Rev. 4 of [
cation: Congruence of references (references used effectively matching with those declared, no errors of cross-reference, etc. )
Page Action Anoma
§1.3, page 6 Only [2], [4], [13], [14] and [15] are used in [SDTC SyAD] text. Minor
In §1.3 delete documents not used in [SDTC SyAD] text.
abcd SDTC
30/05/11
§2.7, page 13 Reference of EN 50125-3 standard is missing.. Minor

Introduce ref. [5] in §2.7. Closed in Rev. 4 of [
§1.3.1, page 6 Error in [1]. EN 50129 standard is not in evaluation stage (it is not ENV). Minor
Errata corrige in §1.3.1 (EN 50129 instead of ENV 50129).. Closed in Rev. 4 of [
cation: Correctness of acronyms and their correspondance to textual references (i.e.. number of acronyms declared not differen
d)
Page Action Anoma
§1.2, page 5 Acronyms EJ, DTC921, LIU, SW and TU declared in §1.2, are not used in Minor
[SDTC SyAD] document.
Closed in Rev. 4 of [
Add these acronyms (if it is useful), otherwise delete them from §1.2 list.
§1.2, page 5 Acronyms 2oo3, CPFSK, DIGICODE, GND, MSK, MTBF, MTTR, RX and TX, Minor
used in [SDTC SyAD] document, are not listed in §1.2. Closed in Rev. 4 of [
Add these acronyms in §1.2 list.
§3.1, page 17 Acronym GE is wrong. Minor
Substitute Ge with EJ. Closed in Rev. 4 of [
ation: Correctness, readability and comprehensibility of text
und.
Reference/ Description/ Resul
Page Action Anoma
ation: Detailed description of SDTC module
Reference/ Description/ Resul
Page Action Anoma
§3 Loop Interface Unit (LIU) and Inductive Connections are missing Major
Introduce description of Loop Interface Unit and Inductive Connections. Closed in Rev. 4 of
§4.3 page 29 Compatibility between SDTC and Low Frequency TC is missing. Major
Complete §4.3. Closed in Rev. 4 of
Doc Interface description is missing. Major
Introduce a paragraph in §2 to describe the interfaces of SDTC module. Closed in Rev. 4 of
§3 Safety critical components of SDTC module are not identified. Major
In §3 introduce a paragraph with identification of safety related items. Closed in Rev. 4 of
§4 A paragraph describing all possible branch line configurations’ constraints (for Major
instance in terms of length of branches, etc) is missing.
Closed in Rev. 4 of
Introduce a such paragraph.
fication: Definition of SDTC structure
Reference/ Description/ Result/
Page Action Anomal
ound.
fication: Description of each board/assembly cof SDTC module
abcd SDTC
30/05/11
Doc SDTC blocks are not adequately described, neither related boards. Major
Introduce those descriptions; each board should be described in a separate Closed in Rev. 4 of [S
paragraph.
Doc There is no functional block structure definition. Major
Introduce a chapter with functional blocks of SDTC module, gerarchically Closed in Rev. 4 of [S
distributed (i.e. starting from higher to lower level of abstraction).
cation: Description of links and protocols used between boards/assemblies of SDTC module.
ound.
cation: Identification and completeness of safety principles of SDTC module.
Doc No information about SW used in MODEM board is delivered neither about Major
SW functions implemented and related SIL level.
Closed in Rev. 4 of [S
§2.5, page 12 Description of safety principles of SDTC module is not complete (references Major
to break of rail and SACEM function are missing).
Complete §2.5.
§Doc No description of fail-safe circuiti s done, neither threshold values (i.e. RMS Major
threshold and RMS opeartion)
Doc Besides functional blocks, there is no SIL associated to them. Major
Add in [SDTC SyAD] a paragraph where each functional block and related Closed in Rev. 4 of [S
SIL is identified.
There is no information about technique used to reach the safety target SIL 4.
cation: Traceability with respect to Subsystem/Module Requirements
Doc No traceability between architecture and SDTC module requirements is Major
delivered in [SDTC SyAD] document.
RESULTS OF VERIFICATION: [SDTC SyAD] is compliant to quality and consistence requirements.
4.2 Functional Verification of SDTC module

This paragraph hosts verification of whole SDTC module regarding to its architectural features and functions;
moreover, it is verified that eventual upgrades impacting on SDTC module are properly introduced in architectural
description.
4.2.1 Congruence Verification with SDTC module

Verification executed on [SDTC SyAD] document, with respect to updated documentation of SDTC has no found
congruence anomalies. Therefore, [SDTC SyAD] document and SDTC structure descrive in it are congruent with
documents which gerarchically are derived.
RESULTS OF VERIFICATION: [SDTC SyAD] is congruent with respect to updated documentation.
abcd SDTC
30/05/11
4.3 Verification with respect to Standards and Plans
4.3.1 Verification with respect to Standard EN 50129

[EN 50129], Annex E contains some informative recommendations (guidelines) relatied to techniques applicable to
various phases of life-cycle. In particular Table E. 4 identifies techniques adoptable to system/subsystem/module
architecture specification. In this paragraph these suggestions are taken into account to verify if (and how much)
they could be assumed receipt in life-cycle of SDTC module, to reach SIL 4 target.
Table 3 – Verification with respect to Standard EN50129
Technique/Measure Recomm. Applicability Note(s)
1. HR OK
Separation of Safety- SDTC implements the function of TC status detection and delivers a vital output to
Related Systems from ACC.
non Safety-Related
Systems.
2. - Not Implemented.
Single Electronic This structure is not permitted to SIL 4 components, then it is not adopted for SDTC
Structure with self tests (indeed it is based on inherent fail-safe architecture - See. point n° 5).
and supervision
3. - Not Implemented.
Dual Electronic Structure SDTC is based on inherent fail-safe architecture (See. point n° 5).
4. HR Not Implemented.
Dual Electronic Structure SDTC is based on inherent fail-safe architecture (See. point n° 5).
based on composite fail-
safety with fail-safe
comparison
5. HR Implemented / OK
Single Electronic SDTC is based on inherent fail-safe architecture. Verification of right implementation of
Structure based on this kind of architecture is executed in [SDTC HWSV] report.
inherent fail-safety
Single Electronic SDTC is based on inherent fail-safe architecture (See. point n° 5).
Structure based on
reactive fail safety
Diverse Electronic SDTC is based on inherent fail-safe architecture (See. point n° 5).
Structure with fail-safe
comparison
8. HR Implemented / OK
Justification of the Reliability quantification with base and mission MTBFs of SDTC module is executed in
Architecture by a RAM Analysis (rif. [SDTC RAMAn]) document.
quantitative reliability
abcd SDTC
30/05/11
Technique/Measure Recomm. Applicability Note(s)

analysis of the hardware.
RESULTS OF VERIFICATION: [SDTC SyAD] is congruent with respect to [EN 50129].

In Table 4 are listed anomalies found during verification of [SDTC SyAD] document, regarding to compliance to [EN
50129].
Table 4 – Anomalies with respect to standard [EN 50129]
rification: Compliance to EN50129

ier Reference/ Description/ Result/
Page Action Anomaly
1. Doc In [SDTC SyAD] are not clearly defined safety-related and not safety related Major
functions. Moreover, no enough information is delivered with regard to non
Closed in Rev. 4 of [SDT
what boards implementing safety related functions and what boards
implementing not safety related functions.
2. Doc In [SDTC SyAD] there is a brief explanation of inherent fail-safe architecture, Major
but there is no information about boards designed with this architecture. It
shoulbe referenced EN 50129 standard instead of EN 50126.
4.3.2 Verification with respect to Safety and V&V Plan

Design phase of sub system/module requires the verification of compliance to Safety and V&V plan related to
subsystem/module, [SDTC S&VVP].
The §7 of [SDTC S&VVP] delivers:
− list of document to verify (input)
− document containing result of verifications executed.
− prescriptions deriving from verifications.
The prescriptions deriving from verifications raccolte are collected in Table 5 with results or references to
paragraphs containing verification.
Table 5 – Verification of congruence of [SDTC SyAD] with respect to [SDTC S&VVP]
Activity required Verification executed Results

by Plan
1. [SDTC SyAD] does not contain identification of “Safety Related” functional blocks. Verified. OK
Architecture shall
be decomposed in
functional blocks
and those safety
related shall be
clearly identified.
abcd SDTC
30/05/11
Activity required Verification executed Results

by Plan
2. [SDTC SyAD] does not contain requirements allocation with respect to functional blocks Verified. OK
of SDTC module.
Subsystem
Requirements shall
be included and
allocated within sub
system
architecture.
3. Architectural techniques adopted to implement safety requirements and to reach Safety Verified. OK
Target SIL 4, are:
Architectural
techniques adopted - implementation of inherent fail safe architecture in circuits performing SIL 4 functions
shall be compliant (filters, amplifiers, signal amplitude detection, code check);
to safety
- generation of signals used to detect TC status; they are frequency modulated and
requirements and
they transfer a protection code to distinguish neighbouring TCs and to detect the
their integrity level.
possible breaking of rail.
Adequacy of adepte solution is verified in [SDTC HWSV] report.
Brief information is done in §2.5 of [SDTC SyAD] related to “Safety Principles” (See.
point 1).
4. Regarding to safety analysis See Point n° 3. Verified. OK
Architectural Regarding RAM Analysis, in [SDTC RAMAn] report it is shown that SDTC module
techniques shall reaches the target defined by [SDTC SyRS].
take into account
Architectural techniques contained in [SDTC SyAD] are compliant to SDTC module
RAM and Safety
RAM requirements ( see [SDTC SyRS] and [SDTC RAMAn]).
analyses performed
until this phase.
5 First releases of [SDTC SyAD] have no verification report. Verified. OK.
Verification of This document verifies also that past “Safety and Design Review” are receipt in last
changes defined in release (rel. 3) of [SDTC SyAD] document.
“Safety and Design
Review”, performer
during project
development shall
be properly applied.
RESULTS OF VERIFICATION: [SDTC SyAD] is congruent with respect to [SDTC S&VVP]
Table 6 – Compliance to Safety V&V Plan
erification: Compliance to Safety V&V Plan

Reference/ Description/ Result/
Page Action Anomaly
P3. Doc Architectural decomposition is shown in §2.4 of [SDTC SyAD], but safety Major
related blocks are not identified.
abcd SDTC
30/05/11
P4. Doc No requirements allocation is delivered in [SDTC SyAD]. Major

abcd SDTC
30/05/11
5 SUBSYSTEM RAM ANALYSIS VERIFICATION

Verification of [SDTC RAMAn] document is based on different phases (see Figure 3):
Verification with respect to applicable requirements of SDTC module;
Verification with respect to architectural document;
In Figure 3 is shown diagram of verifications.
SDTC
Architecture Verification
SDTC Report
RAM Analysis Release k
Release n
Document Quality &

Consistence Checklist
Verificati Paragraph 5.1.
on
SDTC Verification with respect to

SDTC applicable
RAM Analysis requirements,
Release i Verificati
Paragraph 5.2.
on
Verification with respect to

SDTC Architecture,
Change Paragraph 5.3.
s
In present Verificati
report on
releases’
indexes have
following Verification with respect to
values: SDTC standards and to plans:
RAM Analysis - [EN 50129]
n=3 - [SDTC S&VVP],
Release n+1
i=2 Paragraphs 0 and 5.4.2.
Verificati
on
k=2
Figure 3 - Diagram of RAM analysis verification
abcd SDTC
30/05/11
Sequence of verifications shown in Figure 3 shall be repente if there are changes on SDTC module affecting its
architecture and then its RAM values.

Table 7 – Quality and Consistence Verification of [SDTC RAMAn]
RA1. Document Quality (according to Allegato 1)

- DT Verified: OK
- DAR Verified: OK
- DC Verified: OK
Some minor anomalies Minor
Closed in Rev. 3
Anomalies’ detail is contained in Table 8
RA2. Technical Description of SDTC module
- identification of LRU (Line Replaceable Unit); Verified: OK
- proper description of functional blocks with a detail adequate to under stand
reliability model or reference to other documents; Verified: OK
- proper allocation of functions to HW components or reference to other documents. Verified: OK

Line Replaceable Units (LRU) are identified in §2.2,; the following LRUs are listed:
Process Unit
1. Mother board (PN N897 162 510C)

2. RT Board (PN N897 092 520B or PN DTR0000253565)
3. Modem Board (PN N897 163 510Q or PN DTR0000253566)
4. TX Board (PN N897 168 5---)
5. RX Board (PN N897 164 5---)
6. Diag Board (PN N897 093 011L / PN N897 093 012M)
7. Power Conversion Unit (PN P700 338 A20V / PN P700 338 A30F)
Field equipment
8. TU (PN N897 120 1---)
9. LIU (PN N897 169 010T).
In § 2.1 a brief description of SDTC module and their functions is done.
Allocation of HW components to functional blocks of each board of SDTC module is
contained in the Annexes of [SDTC RAMAn] (each board has an individual Annex
document).
RA3. Definition of environmental and operative conditions
- Proper definition of environmental and operative conditions (temperature, moisture, Verified: OK
vibrations);
The environmental and operative conditions are contained in §3.1 of all the Annexes of
[SDTC RAMAn] (each board has an individual Annex document).
Environemental conditions classification is made according to [MIL-217F].
abcd SDTC
30/05/11
RA4. Reliability Analysis

- Verify correctess of theoretical references; Verified: OK
- Definition of a prediction method (e.g. Stress Analysis according to [MIL-217F])

and/or of a SW tool used for calculation (if applicable); Verified: OK
- Completeness and readiness of tables containing MTBF values and used Verified: OK
parameters for calculation;
- Verify correctess of executed calculations and consistency to defined model. Verified: OK
Reliability Theoretical Model is detailed in §3.2 of each Annex.
Reliability Block Diagrams are detailed in §3 of [SDTC RAMAn] master document
Base and Mission reliability are calculated in §3.4 of [SDTC RAMAn] for various SDTC
configurations.
Table containing detailed MTBF values are contained in §3.3 of [SDTC RAMAn] master
document and in §3.2 of each Annex.
The calculation executed are rigth and consistent with respect to theoretical model.
RA5. Manuteneability Analysis
- Verify correctess of theoretical definitions; Verified: OK
- Verify correctess of executed calculations and completeness of information Verified: OK
Manuteneability Theoretical Model is defined in [SDTC RAMAn] - §4.1.
Manuteneability Analysis is performed in [SDTC RAMAn] - §4.2.
RA6. Availability Analysis
- Verify correctess of theoretical definitions; Verified: OK
- Verificare la correttezza della stima degli indicatori di Indisponibilità Intrinseca e
Verified: OK
Operativa;
- Verify consistency of executed calculations and completeness of information Verified: OK
Availability Theoretical Model is defined in [SDTC RAMAn] - §5.1.
Availability Analysis is performed in [SDTC RAMAn] - §5.2.
Table 8 lists observations related to quality check of document, each identified by RAMQCn identifier.
Table 8 – Quality and Consistency Anomalies of [SDTC RAMAn]
Item of verification: Congruence of references (references used effectively matching with those declared, no
errors of cross-reference, etc. )
No anomaly found.
Item of verification: Correctness of acronyms and their correspondance to textual references (i.e.. number of
acronyms declared not different form that of acronyms used)
RAMQC 1 § 2.2, pag. 8 Add acronyms LRU and PN in §1.1 list, because Minor
they are used in document.
Item of verification: Correctness, readability and comprehensibility of text
No anomaly found.
Item of verification: Technical Description of SDTC module
No anomaly found.
Item of verification: Definition of environmental and operative conditions
No anomaly found.
Item of verification: Reliability Analysis
abcd SDTC
30/05/11
No anomaly found.
Item of verification: Manuteneability Analysis
No anomaly found.
Item of verification: Availability Analysis
No anomaly found.
RESULTS OF VERIFICATION: [SDTC RAMAn] is compliant to quality and consistence requirements.
5.2 Verification with respect to SDTC module Requirements

[SDTC RAMAn] shall verify compliance of SDTC module with the following requirements:
− §2.8 – Reliability Characteristics;
− SDTC/SR-3.5 – Reliability.
Verification of [SDTC RAMAn] with respect to SDTC module requirements generates observations collected in the
following table. Each observation is identified by RAMSR n identifier:
Table 9 – Verification of [SDTC RAMAn] document with respect to requirements contained in [SDTC SyRS]
Identifier SDTC Requirements References on Verification of requisite Result/

RAM document evaluation
Anomaly
RAMSR 1 §2.8 – Reliability §3 – Reliability, Reliability, Maintenability and Verified.
Characteristics Availability analyses are
§4 – Maintenability, OK
executed and results reaches
§5 – Availability. target values requested in
[SDTC SyRS] - §2.8.
RAMSR 2 SDTC/SR-3.5 – §3 Reliability calculation Verified.
Reliability performed in [SDTC RAMAn]
OK
reaches targed contained in
SDTC/SR-3.5.
RESULTS OF VERIFICATION: [SDTC RAMAn] is compliant to SDTC module requirements
5.3 Verification with respect to Architecture

[SDTC RAMAn] is strictly dipende by SDTC module architecture; this paragraph contains verification of agreement
with architecture of SDTC module contained in last release of [SDTC SyAD].
Verification of [SDTC RAMAn] with respect to SDTC architecture generates observations collected in the following
table. Each observation is identified by RAMA n identifier
Tabella 10 – Verification of [SDTC RAMAn] document with respect to [SDTC SyAD]

Description/
An] Action
abcd SDTC
30/05/11
ctional Overview Description delivered in §2.1 is coherent to architecture of S

contained in last release of [SDTC SyAD].
RESULTS OF VERIFICATION: [SDTC RAMAn] is compliant to [SDTC SyAD].

The § 6 of [EN 50126] standard delivers requirements to meet regarding to Reliability, Availability, Maintainability
and Safety prescriptions applicable to various phases of SDTC module life-cycle.
For SDTC module design life-cycle phase contained in §6.5 (and sub-paragraphs) is applied “Phase 5:
Apportionment of System Requirements”.
In Table 11 elencate are listed, both prescription (requirements) and check (verifications), of standard Applicable to
Reliability, Availability e Maintainability of SDTC module.
Table 11 – Verification of [SDTC RAMAn] document with respect to [EN 50126] Standard
Description of activities Description of activities [SDTC RAMAn]

foreseen
§4. 3. 5 § 3.4 and Annexes deliver results of basic and mission reliability for various SDTC Ver
Railway module configurations and for each board respectively as Failure Rate and MTBF. Not
Technical concepts of
availability are based on No FMEA is conducted for reliability. Thi
a knowledge of: can
Analysis of maintenaibility of SDTC module has been performed according to b) point of con
a) reliability in terms of:
EN 50126 standard (for detail see §4 of [SDTC RAMAn]. “mi
- all possible system bec
failure modes in the Point c) of EN 50126 standard is satisfied in User&Maintenance Manual of SDTC mo
specified applicationa and module. with
environment; in u
are
- the probability of ass
occurrence of each failure
MT
or alternatively, the rate
mu
of occurrence of each
than
failure;
one
- the effect of failure on
the functionality of the
system.
b) maintainability in terms
of:
- time for the performance
of planned maintenance;
- time for detection
identification and location
of the faults;
- time for restoration of
the failed system
(unplanned
abcd SDTC
30/05/11

foreseen
maintenance).
c) operation and
maintenance in terms of:
- all possible operation
modes and required
maintenance, over the
system life-cycle;
- the human factor issues.
a) allocate functional The § 2.2 contains functional decomposition of SDTC module, while annexes contain Ver
requirements to HW components’ allocation on those functional blocks.
nt of subsystems, components
rements and external facilities This requirements of Standard is not referred to RAM activity defined in
found. “[SDTC RAMAn]”, but it is mentioned because it represents the initial step for design of
SDTC module.
s
b) allocate safety Safety requirements are contained in [SDTC SyRS]. Ver
requirements to
1 subsystems, components This requirements of Standard is not referred to RAM activity defined in
and external facilities to “[SDTC RAMAn]”, but it is mentioned because it represents the initial step for design of
reduce risk found SDTC module.
c) specify subsystems, This requirement is satisfied in [SDTC PHA] and in [SDTC HA]. Ver
components and external
devices found to satisfy SDTC module architecture shall take into account recommendation emerging from
whole RAMS system safety analyses; then they influence RAM Analysis.
requirements, including
impact from common
cause faults and multiple
faults.
d) new examination of This verification report covers all aspect related to review of RAM program. Ver
RAM program
Acceptance criteria for For RAM activity described in “[SDTC RAMAn]” acceptance criteria are specified in Ver
2 of this subsystems, components [SDTC SyRS]:
e to and external facilities §2.8
ements requirements. SDTC/SR_RM-3.5
e with
omponent demonstration and Calculations in “[SDTC RAMAn]” §3 and Annexes (§3.2) show compliance of SDTC Ver
acilities acceptance processes module to this requirements of standard.
and procedures for
subsystems, components
and external facilities
requirements.
6. 6. 3. 1 SDTC module is designed and defined by documents Ver
esign and
Requirement 1 of this - [SDTC SyRS],
on
phase shall be to design
- [SDTC SyAD],
the subsystems and
s components to meet - [SDTC PHA],
RAMS requirements.
- [SDTC HA].
abcd SDTC
30/05/11

foreseen
6. 6. 3. 2 RAM aspects related to HW structure defined by design according to document listed Ver
above are analysed in [SDTC RAMAn] that verify the corrispondence of SDTC module
Requirement 2 of this
with design specification regarding RAM aspects.
phase shall be to realise
the design of the
subsystems and
components to meet
RAMS requirements.
Outline of 1. Project Identification SDTC module is clarly identified, and RAMS organization is contained in Safety and Ver
cation V&V Plan [SDTC S&VVP] of SDTC module..
1. 1 Identify project
2. General Description of The § 2 and related subparagraphs of [SDTC RAMAn] deliver SDTC module description Ver
system
2. 3 Technical Description
of subsystems
3. Operating and The §§ 3.2. of each annex of [SDTC RAMAn] list environmental and operative Ver
environmental conditions conditions of SDTC module.
3. 1 Identify modes and Operating modes, that is mission of subsystem, are defined in § 3 of [SDTC RAMAn].
operations
3. 2 Life expectancy In §3.1 is written that: Ver
“It is assumed that SDTC module is continously operating (i.e. 24h per day), for 8760
hours per year.
Mission time is assumed 20 years, then 175200h.”
3. 3 Identify The §§ 3.2. of each annex of [SDTC RAMAn] list environmental and operative Ver
environmental conditions conditions of SDTC module.
4 Reliability Reliability target is specified by requirements: SDTC/SR_RM- 3.5. Ver
4. 1 Reliability targets
4. 2 Define the reliability Reliability target is specified by requirements: SDTC/SR_RM- 3.5. Ver
targets in order to meet
the required performance
of specific application
4. 3 System Failure Mode The § 3.4 of [SDTC RAMAn] and all annexes contain evaluation of MTBF. Ver
and Mean Time Between
Failures (MTBF)
5. Maintenance and The § 4.2 of [SDTC RAMAn] contains evaluation of Preventive Maintenance. Ver
Repair
5. 1 Preventive
Maintenance
abcd SDTC
30/05/11

foreseen
5. 2 Repair The § 4.3 of [SDTC RAMAn] contains evaluation of Corrective Maintenance. Ver
Specify MTTR (Mean
Time To Restore) of the
system (in hours or days);
Define the time elements
which are comprised in
the MTTR.
6 Safety Please refer to PHA and HA documents for this Item. Ver
7 Availability The § 5.1 of [SDTC RAMAn] contains Availability Model and § 5.2 contains Availability Ver
Evaluation.
7. 1 Availability
Specification
8 Demostration of RAMS [SDTC RAMAn] and verification of this paragraph represents the demostration Ver
performance requested by RAM Performance of SDTC module.
RESULTS OF VERIFICATION: [SDTC RAMAn] is compliant to [EN 50126]

The §6 of [SDTC S&VVP] contains some activities to execute as RAM analysis of SDTC module. The synthesis of
these activities is contained in the following table used for coherence verification of [SDTC RAMAn].
Table 12 – Anomalies found verification of [SDTC RAMAn] document with respect to [SDTC S&VVP]
Reference Description of activities Reference Description of attivities Action/

foreseen
[SDTC S&VVP] [SDTC RAMA [SDTC RAMAn] Decision
n]
§ 7.2 – [SVV-5] 1. In the first stage, the RAM § 3 This paragraph contains Verified.
Analysis must make an initial Subsystem information about OK
RAM Analysis
assessment of the reliability and Reliability mission and reliability
availability of the subsystem, Evaluation calculation requested by
providing certain HW project plan.
indications of the analysis
identifies reliability problems
which cannot be dealt with using
the chosen architecture.
2. The activity, based on the § 5 Executed analysis proofs Verified.
data provided by the HW design Conclusion compliance of SDTC OK
for the estimated reliability of the module to RAM
single components, continues by requirements.
quantifying, and therefore
completing, the RAM analysis.
abcd SDTC
30/05/11
Reference Description of activities Reference Description of attivities Action/

foreseen
[SDTC S&VVP] [SDTC RAMA [SDTC RAMAn] Decision
n]
3. The data used to predict the § 3.3 The reliability figures Verified.
failure rates is based on the have been evaluated OK
statistical data defined in the using the Stress analysis
standard Military Handbook. reported in Military
Handbook:
• MIL-HDBK 217F
Notice 2,
Reliability
prediction.
VERIFICATION RESULTS: [SDTC RAMAn] is congruent with [SDTC S&VVP].
abcd SDTC
30/05/11
6 SUBSYSTEM HAZARD ANALYSIS VERIFICATION

Verification of [SDTC HA] document is based on different phases (see Figure 4):
Verification with respect to applicable requirements of SDTC module (including those derived from PHA);
Verification with respect to architectural document;
SDTC Module
Report
Release i
Verificati
on Document Quality &
Consistence Checklist,
Paragraph 6.1.
Verificati
on Verification with respect
to PHA,
Paragraph 6.2.
SDTC Module
Hazard Analysis Verificati
Release n on
Verification with respect
to Architecture of SDTC,
Paragraph 6.3.
Verificati
to Design Review,
Paragraph 6.4.
In present
report
Verificati
releases’ Allocation of safety
on
indexes have requirements,
following Paragraph 6.6.
values:
n=5 Verificati
i=4 to Fault Tree Analysis,
Paragraph 6.7.
Figure 4 – Verification diagram of HA
Sequence of verifications shown in Figure 4 shall be repente if there are changes on SDTC module affecting its
architecture and then its Hazard Analysis.
abcd SDTC
30/05/11
Table 13 – Quality & Consistence Verification of [SDTC HA] document

HA1. Document Quality (according to Allegato 1)
- DT Verified: OK
- DAR Verified: OK
- DC Verified: OK
HA2. Methodology
- Consistency of methodology with respect to § 7.1, item [SA-2] of [SDTC S&VVP] Verified: OK
HA3. Design Description
- Identification of main functions of SDTC module; Verified: OK
- Identification of main interfaces; Verified: OK
- Identification and completeness of safety principles of SDTC module;
- Recall to SDTC module architecture, through a brief description and/or proper Verified: OK
references to other documents, in particolar for safety elements. Verified: OK
HA4. Applicable Hazards and safety target

- Identification of applicable hazards of SDTC, properly labeled or reference to Verified: OK
[SDTC PHA];
- Identification, for each hazard, of safety target to reduce risk to reach, based on Verified: OK
initial and final RCI.
HA5. Environmental and Operative Analysis
- Identification of an analysis technique effective and comprehensible; Verified: OK
- Consistence and completeness of examined hazards with respect to applicable Verified: OK
hazards, previously defined;
- Consistence and completeness of hypoteses according to methodology; Verified: OK
- Consistence and completeness of formalisms according to methodology; Verified: OK
- Comprehensibility and completeness of analysis, with respect to functional and Verified: OK
operative model of SDTC module.
HA6. Analysis detailed (qualitative and quantitative)
- Identification of an analysis technique effective and comprehensible; Verified: OK
- Identification of verification item congruent with previous safety analysis and with
methodology applied; Verified: OK
- Consistence and completeness of hypoteses according to methodology; Verified: OK
Verified: OK
- Consistence and completeness of formalisms according to methodology;
- Comprehensibility and completeness of analysis, with respect to architectural and Verified: OK
RAM model of SDTC module;
- Evaluation of qualitative and quantitative results with respect to applicable Verified: OK
standards.
HA7. Conclusion
- Adequacy and congruence of conclusion with respect to previous chapters. Verified: OK
Table 14 lists observations related to quality check of document, each identified by HAQCn identifier.
Table 14 – Quality and Consistency Anomalies of [SDTC HA]
abcd SDTC
30/05/11
No anomaly found.
No anomaly found.
Item of verification: Correctness, readability and comprehensibility of text
No anomaly found.
Item of verification: Design Description of SDTC module
No anomaly found.
Item of verification: Applicable Hazards and safety target
No anomaly found.
Item of verification: Environmental and Operative Analysis
No anomaly found.
Item of verification: Analysis detailed (qualitative and quantitative)
No anomaly found.
Item of verification: Conslusion
No anomaly found.
Identifier Reference/ Description/ Result/
Page Action Anomaly
HAQC 1 --- --- ---
RESULTS OF VERIFICATION: Quality & Consistence verification of [SDTC HA] document is positive.
6.2 Verification with respect to Preliminary Hazard Analysis

This paragraph contains results derived from congruence verification between Hazard Analysis [SDTC HA] and
Preliminary Hazard Analysis [SDTC PHA] documents.
Verifications are intended to check [SDTC HA] with respect to:
completeness of Hazards used in the FMEA;

coherence of RCI residue value, after countermeasures’ implementation. Thess countermeasures shall be
included in [SDTC SyAD];
justification for difference (if any) between final RCI foreseen by [SDTC PHA] and that delivered by FMEA of
[SDTC HA].
Table 15 details all observations related to congruence of [SDTC HA] with [SDTC PHA]. Each anomaly is identified
through the acronym HAPAn.
Table 15 – Verification of [SDTC HA] with respect to [SDTC PHA]
abcd SDTC
30/05/11
ID Verification Item Description/Action Decision /

Anomaly
HAPA1 --- --- ---
HAPA2 --- --- ---
RESULTS OF VERIFICATION: [SDTC HA] document is congruent with [SDTC PHA] document
6.3 Verification with respect to Architecture

[SDTC HA] is strictly dependent from SDTC module architecture (mainly from functional structure, internal and
external links).
This paragraph contains results derived from correspondance verification of SDTC functional structure used for
functional FMEA during Hazard analysis with information contained in [SDTC SyAD].
Functional structure of SDTC module architecture is constitued by a series of block diagrams, deriving from general
functional scheme of SDTC module. These diagrams are generated for details lower level architecture until to basic
functional block. Each block (on all level) have input and output signals.
Verifications are intended to check [SDTC HA] with respect to:
correspondance of functional decomposition of SDTC assumed as reference for analysis and architecture of
SDTC contained in [SDTC SyAD];
completeness of analysis in terms of functional blocks and input / output signals analysed.
Table 16 details all observations related to congruence of [SDTC HA] with [SDTC SyAD]. Each anomaly is
identified through the acronym HAASn.
Table 16 – Verification of [SDTC HA] with respect to [SDTC SyAD]
Correspondance of schematics used for FMEA with Architecture of SDTC module

ID Functional Reference/ Description/Action Decision /
Diagram Anomaly
Page
HAAS1 All 4 - Module Functional decomposition used for FMEA has Major
Description and been derived from direct and detailed
Modelisation inspection of electrical schemes and boards Closed in
(pages 26-52) consttuing SDTC module. All identified signals rev. 4 of
have been analysed through a systematic [SDTC HA]
application of guidewords (failure modes)
defined before. This decomposition is not
present in [SDTC SyAD] document.
RESULTS OF VERIFICATION: [SDTC HA] document is congruent with [SDTC SyAD] document regarding to
functional decomposition.

[EN 50129], Annex E contains some informative recommendations (guidelines) related to techniques applicable to
various phases of life-cycle. In particular Table E.6 identifies the techniques that can used for system/sub system
specification. In this paragraph normative suggests are taken into account to verify if and how they have been
recepit within life –cycle of SDTC module, related to SIL4 module development.
abcd SDTC
30/05/11
Technique/Measure Recomm. Applicability Notes Decision/

Anomaly
1. Preliminary HR Implemented / OK Verified.

Hazard Analysis [SDTC PHA] document has been drafted. OK
Consistence verification of PHA is performed in report
[SDTC SRVR].
2. Fault Tree HR Implemented / OK Verified.
Analysis A Fault Tree Analysis of SDTC module is documented in OK
Annex 2 of [SDTC HA].
3. FMECA HR Implemented / OK Verified.

A Failure Modes and Effects Criticality Analysis of SDTC OK
module is documented in Annex 1 of [SDTC HA].
4. HAZOP HR Implemented / OK Verified.
[SDTC PHA] document contains an HAZOP in §5.1. OK
Consistence verification of PHA is performed in report
[SDTC SRVR].
5. Cause- HR Implemented / OK Verified.

Consequence Not applied to this phase of SDTC module life cycle, OK
diagrams because Operating Analysis contained in §4 of Annex 1 of
[SDTC HA] is assumed to be equivalent.
6. Markov diagrams R Not Implemented N/A

This technique is very useful when the safety is strictly
dependent by sub system/system reliability, but this is not
the case of SDTC module. Indeed, SDTC module has an
inherent fail-safe architecture.
7. Event Tree R Not Implemented N/A

This technique has not been used because Operating
Analysis and FMECA contained in Annex 1 of [SDTC HA]
are assumed to be equivalent.
8. Reliability Block R Partially Implemented / OK Verified.

Diagram This technique has been used for RAM analysis, but not OK
for safety analysis, because it is not necessary for this
task.
However, by considering the whole RAMS tasks,
application verification of this recommendation is assumed
to be positive.
9. Zonal Analysis R Not Implemented N/A

This technique is not necessary with respect to Scope of
[SDTC HA] document.
10. Common Cause HR Not Implemented N/A

Failure Analysis This technique has not been formally adopted in this phase
of SDTC module life-cycle, but it has been considered for
finding functional area sto be further verified.
abcd SDTC
30/05/11
Technique/Measure Recomm. Applicability Notes Decision/

Anomaly
For application verification of this technique please refer to
next life-cycle phases and related verification reports.
11. Historical Event R This technique has been taken into account during design N/A
Analysis phase, but it is not formally documented.
Table 17.- Congruence Verification with EN50129
Verification of activities requested by [EN 50129] standard for design of systems / subsystems SIL 4 is positive.

In this paragraph is detailed verification with respect to § 7.1 - [SA-2] of [SDTC S&VVP] document.
Verification has been executed according to checklist shown in Table 18.
Identifier Verification Item Decision/

Anomaly
HA_SVVP.1. Presence of functional bottom-up analysis (FMEA).

§ 5 of Annex 1 of [SDTC HA] contains functional FMEA Verified.
OK.
HA_SVVP.2. Presence of Top-down analysis (FTA)
§ 5 of Annex 2 of [SDTC HA] contains FTA Verified.
OK.
HA_SVVP.3. Consistence Verification between FMEA and FTA
La verifica in oggetto è presente nel documento nel § 5 e relativi sottoparagrafi . Traceability Verified.
is inserted in a field of FMEA tables (see §5 of Annex 1 of [SDTC HA]) as a dedicated OK.
column; this allows the link of failure mode to basic event of FTA, when applicable.
All failure modes applicable of FMEA have correspondance with references to basic events Verified.
declared in FTA diagrams. OK.
Table 18.- Detailed Verification with respect to Safety and V&V Plan
[SDTC HA] document is fully coherent with requirements of [SDTC S&VVP].
6.5 Verification according applicable Design Reviews

SDTC module has three design reviews, described in the following files:
DR-1. sdr_2005 04 04_SDTC_TX_2.doc;
DR-2. SDTC SDR Giunto 8 Apr 2011 v1.doc;
DR-3. SDTC SDR 200 bit_s Apr 2011 v1.doc.
RESULTS OF VERIFICATION: All observations derived from Design Review DR-1 are receipt in latest
release of Hazard Analysis Document [SDTC HA]; Design Reviews DR-2 and DR-3 report themselves a
dedicated safety analysis, therefore no modification to Hazard Analysis Document are required.
All the actions related to Design Reviews are closed.
abcd SDTC
30/05/11
6.6 Allocation of safety requirements

This paragraph verifies that safety requirements specified in [SDTC HA] are properly allocated to life-cycle phases.
Table 19 contains safety requirements identified in [SDTC HA], allocation specified in [SDTC HA] and results of
verification.
Table 19 – Allocation of safety requirements
ID Allocation Results of verification

SDTC-HAR-1 Whole lifecycle of SDTC module Verified OK
SDTC-HAR-2 Manufacturing Verified OK
SDTC-HAR-3 Test activity Verified OK
SDTC-HAR-4 Installation Verified OK
Maintenance
SDTC-HAR-5 Relation cables (*) Verified OK
SDTC-HAR-6 Connection cable to ACC Verified OK
SDTC-HAR-7 Installation and Maintenance Verified OK
SDTC-HAR-8 Connection PU – ACC Verified OK
SDTC-HAR-9 Installation Verified OK
Maintenance
SDTC-HAR-10 SDTC Module Verified OK
Application Condition (*) SDTC_HA-AC.1
SDTC-HAR-11 Configuration of RX board (for branch line signals) (*) Verified OK
SDTC-HAR-12 Configuration of RX board (for main line signals) Verified OK
SDTC-HAR-13 Configuration of RX Filter / Amplification (RX board) Verified OK
SDTC-HAR-14 Configuration of Modulator / Demodulator (MODEM board) Verified OK
SDTC-HAR-15 Configuration of Code Generator (MODEM board) Verified OK
SDTC-HAR-16 Configuration of Comparator and Branch Receiver (RT board) Verified OK
SDTC-HAR-17 Configuration of Delayer Device 2 (RT board) Verified OK
SDTC-HAR-18 Configuration of Output Power (TX board) Verified OK
SDTC-HAR-19 Configuration of Mother Board Verified OK
SDTC-HAR-20 Configuration of TU Verified OK
SDTC-HAR-21 TU cancelled in the HA
rev. 5
SDTC-HAR-22 Power Conversion Unit Verified OK
SDTC-HAR-23 Amplification (RX board) Verified OK
SDTC-HAR-24 Comparator, 20kHz Generator, Delayer Device 1 and Delayer Device 2 Verified OK
(RT board)
abcd SDTC
30/05/11

SDTC-HAR-25 RX board Verified OK
MODEM board
RT board
TX board
SDTC-HAR-26 Cable Adaptation (RX board) Verified OK
SDTC-HAR-27 Comparator (Scheda RT board) Verified OK
SDTC-HAR-28 AC/DC Converter (TX board) Verified OK
SDTC-HAR-29 Cable Adaption (RX board) Verified OK
SDTC-HAR-30 RX Filter (RX board) Verified OK
SDTC-HAR-31 Comparator (RT board) Verified OK
SDTC-HAR-32 Printed Cirduit Board of RX board Verified OK
SDTC-HAR-33 Printed Cirduit Board of Mother board Verified OK
SDTC-HAR-34 Amplification (RX board) Verified OK
SDTC-HAR-35 RMS (RT board) Verified OK
SDTC-HAR-36 Branch Receiver (RT board) Verified OK
SDTC-HAR-37 Delay network (RT board) Verified OK
SDTC-HAR-38 Code Generator (MODEM board) Verified OK
SDTC-HAR-39 Code Generator (MODEM board) Verified OK
SDTC-HAR-40 Configuration of MODEM board/ installation Verified OK
SDTC-HAR-41 Power Output (TX board) Verified OK
SDTC-HAR-42 Demodulator (MODEM board) Verified OK
SDTC-HAR-43 Printed Cirduit Board of MODEM board Verified OK
SDTC-HAR-46 Delay Network (RT board) Verified OK
SDTC-HAR-48 Printed Circuit Board of RT board Verified OK
SDTC-HAR-50 Device Delayer 1 (RT board) Verified OK
SDTC-HAR-51 20kHz Generator (RT board) Verified OK
SDTC-HAR-52 RMS (RT board) Verified OK
SDTC-HAR-53 Branch Receiver (RT board) Verified OK
SDTC-HAR-54 Delayer Device 2 (RT board) Verified OK
SDTC-HAR-55 Output Power (TX board) Verified OK
SDTC-HAR-56 TX Filter (TX board) Verified OK
abcd SDTC
30/05/11

SDTC-HAR-57 Printed Circuit Board of TX board Verified OK
SDTC-HAR-58 TU Verified OK
LIU
Inductive Connections (RX branch line)
SDTC-HAR-59 TU Verified OK
LIU
Inductive Connections (RX branch line)
SDTC-HAR-60 SDTC module Verified OK
Application Condition SDTC_HA-AC.2
SDTC-HAR-61 SDTC module Verified OK
Application Condition SDTC_HA-AC.3
SDTC-HAR-62 Train board equipment and SACEM system Verified OK
Application Condition SDTC_HA-AC.4,
SDTC_HA-AC.5
SDTC-HAR-63 MODEM board (Modulator) Verified OK
(*)
All requirments star-signed are not directly related to railways safety, but they represent a needed
protection to guarantee safety of operating personnel. Therefore, their SIL will be met by verifying that
SDTC module has been designed according to italian or CENELEC standard erlated to electrical safety or
health and labour safety.
RESULTS OF VERIFICATION: Safety Requirements Allocation verification of [SDTC HA] document is
positive.
6.7 Verification of Faults Trees

This paragraph contains results derived by consistency verification of Fault Tree Analysis developed during Hazard
Analysis and of its congruence with FMEA.
Verifications have the aim to check [SDTC HA] - § 7 (and Annex 2), with respect to:
traceability of Fault Tree basic events with failure modes identified in FMEA;
completeness of Fault Tree, with reference to applicable hazards of SDTC module.
Tabella 20 details verifications and their results. Each step of verification is identified though acronym FTAn.
Tabella 20 – Verification of [SDTC HA] document with respect to Fault Tree Analysis

Anomaly
FTA1 Traceability of Fault Tree Fault Tree is correlated to FMEA Verified OK
basic events with failure through traceability between failure
modes identified in FMEA mode and related iniziato event.
This reference is explicitly
contained in a dedicated field of
FMEA table.
abcd SDTC
30/05/11

Anomaly
FTA2 Completeness of Fault Fault Tree is aimed to analyse Verified OK
Tree, with reference to multiple faults causing one or more
applicable hazards of operative hazards (H.1 and H.2):
SDTC module
[H.1]: Undue Signalling of TC
free,
[H.2]: Undue Signalling of rail
integral.
These Hazards are the TOP
EVENT of Fault Tree.
Hazard [H.3] is related to SACEM
system and to the train board
equipment.
Other hazards ([H.4], [H.5], [H.6],
[H.7], [H.8] and [H.9]) are due to
systematic errors or to power
supply faults and are minimized by
proper procedural
countermeasures.
Used approach to Fault Tree
Analysis is considered correct and
adequately explained.
RESULTS OF VERIFICATION: Congruency and consistency verification of Fault Tree Analysis contained in
[SDTC HA] document is positive.
abcd SDTC
30/05/11
7 SUBSYSTEM FUNCTIONAL TEST PLAN VERIFICATION

Verification of [SDTC FTP] document is based on different phases:
Verification with respect to requirements to test functionalities of SDTC module;
SDTC Module
Report.
Release k
SDTC Module
Functional Test Plan
Release n
Document Quality &
Consistence Checklist ,
Paragraph 7.1.
Verification
SDTC Module Verification with respect

Architecture Verification to applicable SDTC
Report requirements,
Release i Paragraph 7.2.
Verification
In present Verification with respect

report to standards and to
releases’ plan:
Changes - [EN 50129]
indexes have
- [SDTC S&VVP],
following Verification
Paragraphs 0 7.3.2.
values:
n=4
i=2
SDTC Module
k=1
Functional Test Plan
Release n+1
Figure 5 – Verification Diagram of FTP
abcd SDTC
30/05/11

Table 21 – Quality and Consistence Verification of [SDTC FTP] document

FTP1 Document Quality (according to Allegato 1)
- DT Verified: OK
- DAR Verified: OK
- DC Verified: OK
FTP2 General Description
- Introduction to SDTC module functions; Verified: OK
- Brief Description of SDTC module architecture; Verified: OK
- Identification of all interfaces, including diagnostics. Verified: OK
The § 2 contains a brief general description of SDTC module; reguarding to functions
and interfaces, §2.3 references applicable design documents.
FTP3 Methodology
- Definition of a methodology to identify all test case; Verified: OK
- Definition of a methodology to manage anomalies; Verified: OK
- Right application of methodologies above listed. Verified: OK
Tests’ methodology is described in § 3.
FTP4 Organization
- Synthetic description of test organization, including skills of test personnel. Verified: OK
FTP5 Definition of Test Environment
- Identification of test equipments (including sw, if any); Verified: OK
- Description and completeness of general test procedures; Verified: OK
- Identification and description of test instrumentation (e. g. Oscilloscopes, simulators, Verified: OK
etc).
Test Environment is described in § 4.
FTP6 Test Plan
- Univocal identification of tests; Verified: OK
- Subdivision of tests for typology; Verified: OK
- Individuation of SDTC module requirements not testable, but verifiable by inspection Verified: OK
(visual or on documentation);
- Synthetic description of test to execute; Verified: OK
- Traceability with respect to applicable requirements; Verified: OK
- Synthetic description of test objectives; Verified: OK
- Definition of detailed procedure to execute the test; Verified: OK
- Identification of expected results, with reference numerical values, if applicable; Verified: OK
- Consistence of each test with respect to applicable requirements. Verified: OK
FTP7 Test Completeness
- Verification that all testable requirements are covered by test, including SW Verified: OK
requirements;
- Adequacy of tests with respect to applicable requirements. Verified: OK
In the following table lists observations related to quality check of document, each identified by FTPQCn identifier.
abcd SDTC
30/05/11
Table 22 – Quality and Consistency Anomalies of [SDTC FTP] document
ent Quality: Verification according to DT, DAR and DC of Allegato 1.

ntifier Reference/ Description/ Decision/
Page Action Anomaly
1 Doc Title of [SDTC FTP] contains a reference to a specific application Minor
(Metro Milan 1).
Closed in Rev.
Modify title deleting reference to MML1, because Functional Test Plan [SDTC FTP]
has to be referred to SDTC generic product.
verification: Correctness of acronyms and their correspondance to textual references (i.e.. number of acronyms declared not different
acronyms used)
Page Action Anomaly
2 §1.4.2, Page 6 Acronym PT is not used whitin [SDTC FTP] test. Minor
Delete this acronym. Closed in Rev.
[SDTC FTP]
3 §1.4.2, Page 6 Acronym TE is not used whitin [SDTC FTP] test. Minor
[SDTC FTP]
4 §1.4.2, Page 6 Acronym GE is not used whitin [SDTC FTP] test. Minor
[SDTC FTP]
verification: Congruence of references (references used effectively matching with those declared, no errors of cross-reference, etc. )
Page Action Anomaly
5 §1.5.1, Page 8 Reference [G4] is not used within [SDTC FTP] text. Minor
Delete this reference. Closed in Rev.
[SDTC FTP]
[SDTC FTP]
[SDTC FTP]
8 §1.5.1, Page 8 Reference [G7] does not contain any document. Minor
[SDTC FTP]
9 §1.5.2, Page 8 Reference [DP4] is not used within [SDTC FTP] text. Minor
[SDTC FTP]
abcd SDTC
30/05/11
verification: Correctness, readability and comprehensibility of text

10 § 2.1 The phrase “Infatti oltre a …” is incomplete. Minor
verification: Organization
Page Action Anomaly
11 Pag. 12 In [SDTC FTP] there is no synthetic description of test organization, Minor
including skills of test personnel.
Closed in Rev.
[SDTC FTP]
verification: Test Plan
Page Action Anomaly
12 §5 All tests have no reference to applicable requirements, altough in Major
page 14 template of test case foresees fields containing
(FTP_OP 1)
requirements.
Closed in Rev.
Add requirements’ references.
[SDTC FTP]
13 §5 Tests are no subdivided in various typology. Minor
Closed in Rev.
[SDTC FTP]
14 Pages 19-32 §5.2, §5.3, §5.4 and §6 contain operative turn in service and tuning Minor
procedures.
Closed in Rev.
They should be inserted before §5/§5.1 (Test Plan). [SDTC FTP]
verification: Completeness of Tests

Page Action Anomaly
15 §5.1 Test case #10 is not clear. Minor
To cover #SR3.5 it should be check that MTBF value calculated in Closed in Rev.
RAM Analysis report is equal or major than requested (15000h). [SDTC FTP]
To cover #SR3.4 is should be perform a field test with PU linked to TU
with a 4Km cable length or find in documentation the related
information.
Clarify and distinguish both aspects.
16 §5.1 Test cases do not contain field devoted to applicable requirements. Major
Add requirements’ references
(FTP_OP 2)
Closed in Rev.
[SDTC FTP]
17 §5.1 Test Case #7 is not included in traceability table contained in §6.4 Minor
Closed in Rev.
[SDTC FTP]
VERIFICATION RESULTS: [SDTC FTP] is compliant to quality and consistence requirements.
abcd SDTC
30/05/11
7.2 Verification with respect to SDTC module Requirements

Verification with respect to SDTC module Requirements is executed to check requirements contained in [SDTC
SyRS].
In following table are detailed all observations derived from test verification with respect to requirements; each is
identified by FTPSRn identifier.
Table 23 – Verification of [SDTC FTP] with respect to [SDTC SyRS]
Identifier SDTC module References in Verification and evaluation of Decision/

Requirement FTP requirement Anomaly
FTPSR 1 SDTC_SAFETY 1.1 SDTC.FTP.002 Testing and validation of device OK
safety functioning and architecture.
Safety condition SDTC.FTP.004
Test pass for dedicated functional
SDTC.FTP.008 tests.
SDTC.FTP.014
FTPSR 2 SDTC_SAFETY 1.2 SDTC.FTP.012 Same demonstration as OK
# SDTC_SAFETY 1.1 is applicable.
Broken rail
FTPSR 3 SDTC_SAFETY 1.3 Testing and validation of the Safety OK
SDTC.FTP.002 Demonstration, functional tests and
Immunity to
tests envisaged by EN.
disturbance from
other STDC
FTPSR 4 SDTC_SAFETY 1.4 Testing and validation of the Safety Not OK / Major
SDTC.FTP.013 Demonstration, functional tests and (FTP_OP 3)
Immunity to traction
the results of field experimentation.
disturbance Closed in Rev. 5
of [SDTC FTP]
FTPSR 5 SDTC_SAFETY 1.5 Testing and validation of this specific OK
SDTC.FTP.009 safety function and functional tests to
Occupied track circuit
check times.
reaction time
FTPSR 6 SDTC_SAFETY 1.6 Same demonstration as # SR 1.5 is OK
SDTC.FTP.009 applicable.
Free track circuit
reaction time
FTPSR 7 SDTC_SAFETY 1.7 SDTC.FTP.009 Testing and validation of the Safety Not OK / Minor
Demonstration and functional tests. Closed in Rev. 5
Interface with
equipment of [SDTC FTP]
FTPSR 8 SDTC_SAFETY 1.8 SDTC.FTP.008 Checking technical documentation OK

and visual inspection (test).
Insulation
requirements
FTPSR 9 SDTC_SAFETY 1.9 Inspection of rack and cubicle OK
SDTC.FTP.008 installation.
Overload protection
FTPSR 10 SDTC_SAFETY 1.10 Inspection. OK
SDTC.FTP.008
Sabotage protection
abcd SDTC
30/05/11

FTPSR 11 SDTC_SAFETY 1.11 Reference to safety documentation. Not OK / Major
Safety integrity level (FTP_OP 4)
SDTC.FTP.014
Closed in Rev. 5
of [SDTC FTP]
FTPSR 12 SDTC_SAFETY 1.12 Testing and validation of the Safety Not OK / Major
Demonstration, and tests envisaged (FTP_OP 6)
Safety demonstration SDTC.FTP.014 by EN
Closed in Rev. 5
of [SDTC FTP]
FTPSR 13 SDTC_SAFETY Testing and validation of the Safety Not OK / Major
1.13 Demonstration and functional tests. (FTP_OP 7)
SDTC.FTP.014
DOT requirement Closed in Rev. 5
of [SDTC FTP]
FTPSR 14 SDTC_SAFETY 1.14 Testing and validation of the Safety OK
SDTC.FTP.015 Demonstration and functional tests.
Train transmission
requirement
FTPSR 15 SDTC_LINE_CHARA Testing and validation of FTP. OK
SDTC.FTP.009
CTERISTICS 2.1
SDTC.FTP.005
Track circuit lenght
FTPSR 16 SDTC_LINE_CHARA Same demonstration as OK
CTERISTICS 2.2 SDTC.FTP.009 # SDTC_LINE_CHARACTERISTICS
SDTC.FTP.00 2.1 is applicable.
Track circuit
separation 5
FTPSR 17 SDTC_LINE_CHARA Same demonstration as Not OK / Minor

CTERISTICS 2.3 SDTC.FTP.009 # SDTC_LINE_CHARACTERISTICS Closed in Rev. 5
SDTC.FTP.00 2.1 is applicable. of [SDTC FTP]
Track circuit with
passing branches 5
FTPSR 18 SDTC_LINE_CHARA Field experimentation analysis are Not OK / Major

CTERISTICS 2.4 SDTC.FTP.002 applicable. (FTP_OP 8)
SDTC.FTP.01
Line electrification Closed in Rev. 5
6 of [SDTC FTP]
FTPSR 19 SDTC_PERFORMAN Passing of all functional tests OK
SDTC.FTP.009 according to FTR.
CE 3.1
Power supply
FTPSR 20 SDTC_PERFORMAN Testing and validation of FTR. OK
CE 3.2
SDTC.FTP.01
Occupation of the 6
downstream track
circuit
CE 3.3
SDTC.FTP.016
Occupation of the
abcd SDTC
30/05/11

FTPSR 22 SDTC_PERFORMAN Installation inspection. Not OK / Minor
CE 3.4 SDTC.FTP.009 Closed in Rev. 5
PU centralization of [SDTC FTP]
FTPSR 23 SDTC_PERFORMAN Testing of FTP. Testing of Not OK / Major

CE 3.5 information presented by the CEDD- (FTP_OP 9)
SDTC.FTP.017 D.
Diagnostics Closed in Rev. 5
of [SDTC FTP]
CE 3.6
SDTC.FTP.011
Transmission function
performance
FTPSR 25 SDTC_PERFORMAN SDTC.FTP.001 Testing and validation of FTR. OK
CE 3.7
SDTC.FTP.002
Distance from TU to
nearest rail SDTC.FTP.004
FTPSR 26 SDTC_PERFORMAN SDTC.FTP.003 Testing and validation of FTR. OK

CE 3.8 SDTC.FTP.005
Compatibility of SDTC
SDTC.FTP.006
with low frequency
power track circuit SDTC.FTP.007
CE 3.9
SDTC.FTP.018
Time occupancy
during DOT transition
CE 3.10 SDTC.FTP.019
Soft start power up
CE 3.11
SACEM transmission SDTC.FTP.020
on short track and on
loop
FTPSR 30 SDTC_USER 4.1
Packaging SDTC.FTP.014 Reference to safety documentation. OK
requirement
FTPSR 31 SDTC_USER 4.2 SDTC.FTP.007 OK
User Safety SDTC.FTP.008 Functional tests and tests envisaged

SDTC.FTP.014 by EN.
SDTC.FTP.021
abcd SDTC
30/05/11

FTPSR 32 SDTC_DESIGN 5.1 OK
Standards SDTC.FTP.014 Validation according to EN.
requirement
FTPSR 33 SDTC_DESIGN 5.2 Testing and validation of FTR. OK
SDTC.FTP.014
Materials
FTPSR 34 SDTC_RAM 6.1 Testing and validation of reliability Not OK / Minor

SDTC.FTP.010 analysys. Closed in Rev. 5
Reliability
of [SDTC FTP]
FTPSR 35 SDTC_ENVIROMEN Functional tests and tests envisaged Not OK / Major
TAL 7.1 by EN. (FTP_OP 5)
SDTC.FTP.021
Environment Closed in Rev. 5
of [SDTC FTP]
VERIFICATION RESULTS: [SDTC FTP] verification is compliant with respect to SDTC module requirements.

This paragraph contains congruence verification between SDTC module Functional Test Plan and single applicable
item of table E. 9 of [EN 50129] Standard.
Table 24 – Verification of [SDTC FTP] document with respect to [EN 50129] standard
Technique/Measure Recomm. Application Note(s)
3. HR: comprehensive functional tests Verified. OK

Functional testing of the should be carried out on the bases of
Tests listed in §5.1 fully cover all SDTC
system. well defined test cases to demonstrate
requirements.
the specified characteristics and safety
requirements are fulfilled.
VERIFICATION RESULTS: [SDTC FTP] document is congruent with respect to [EN 50129] standard.
7.3.2 Verification with respect to Safety e V&V Plan

This paragraph verifies congruence of Functional Test Plan of SDTC module with §5.2 “Safety V&V activities “-
[SVV-2] of [SDTC S&VVP] document. In following table are listed all activities foreseen by [SDTC S&VVP] for
SDTC module functional test plan preparation. For each activity the table contains related references to
[SDTC FTP] and then verification results.
abcd SDTC
30/05/11
Table 25 – Verification of [SDTC FTP] with respect to [SDTC S&VVP]
Attività richiesta
dal Piano
§ 6. 2 Attività di Verifiche eseguite Risultati
Safety a V&V-
[SVV-3]
1. The following paragraphs of [SDTC FTP] define requested activities: Verified: OK
The test § 4 Ambiente di test
specification
§ 4.2 Strumenti di misura.
document must
define the
environment, the
instruments, the
configurations, the
simulators and the
programs used to
develop the tests.
The test § 6.1 Piano dei test funzionali
specification
document must
define the test cases
and the test data.
The test § 6.1 Piano dei test funzionali
specification
document must
define the tests
which verify the
functioning of the Ss
in the presence of
malfunctions and
verification of the
returning of the
subsystem to a safe
condition
Plan has to highlight § 6.1 Piano dei test funzionali
traceability of all
requirements
through proper
functional tests and
inspections.
abcd SDTC
30/05/11
Attività richiesta
dal Piano
§ 6. 2 Attività di Verifiche eseguite Risultati
Safety a V&V-
[SVV-3]
The test § 6 Piano dei test
specification
document must
define the test
criteria on whose
basis the test results
must be assessed
8. [SDTC FTP] does not collects description of previous activities. Verified: Accepted
Functional Test Report has been foreseen.
The results of the
activities described
will be added to the
same document.
(SDTC Functional
Test Plan).
VERIFICATION RESULTS: [SDTC FTP] document is congruent with [SDTC S&VVP].
Item of verification: Compliance to Safety V&V Plan

Identifier Reference/ Description/ Result/Anomaly
Page Action
FTP_VNP1. Doc No paragraphs of [SDTC FTP] define the tests Major

which verify the functioning of the Ss in the
presence of malfunctions and verification of the (FTP_OP 11)
returning of the subsystem to a safe condition. Closed in Rev. 5 of [SDTC FTP]
FTP_VNP2. Doc The §6 of [SDTC FTP] defines test classes and Major
test template, but not acceptance criteria.
(FTP_OP 12)
Closed in Rev. 5 of [SDTC FTP]
abcd SDTC
30/05/11
8 HARDWARE AND SOFTWARE TECHNICAL SPECIFICATION VERIFICATION

Verification of [SDTC HTS] and [SDTC SWTS] documents is based on different phases:
Quality and Consistence Verification, including technical evaluation of results of peformed activity;
Verification with respect to Safety Design Reviews HW/SW related;
SDTC Module
Hw Technical Specification
Release n Documents Qualità & Consistenza
SW Technical specification Checklist,
Release m
Paragraph 8.1.
Verification
Verification with respect to Design

Reviews,
Paragraph 8.2.
Verification
SDTC Module
Report In present
Release i report
releases’
indexes have
following
values:
m=2
Changes ni = 1/7
i=2
SDTC Module
Hw Technical Specification
Release n+1
Figure 6 – Verification Diagram of HW Techn. Spec. Documents of SDTC module
abcd SDTC
30/05/11
SDTC module has not a single [SDTC HTS] document; instead, each board of SDTC module has a proper HW
technical specification document; therefore, [SDTC HTS] is subdivided in the following documents:
Table 26 - Quality and Consistence Verification of [SDTC HTS] and [SDTC SWTS] documents
Identifier Verification Item Decision/

Anomaly
HTS1 Quality of documents (according to Allegato 1)
- DT Verified: OK
- DAR Verified: OK
- DC Verified: OK
Some minor anomalies found. Minor
Found anomalies are detailed in Table 27.
HTS2 General Description
- Synthetic and comprehensible of functions and typologies of applications; Verified: OK

- Synthetic and comprehensible of architecturals features of SDTC module; Verified: N/A
- Synthetic identification of SDTC module external interfaces; Verified: N/A
- Identification and completeness of safety principles of SDTC module; Verified: N/A
- HW configuration limits of SDTC module. Verified: OK
General description of boards is contained in §2 of each HW technical specification
document nel § 2. 2.
Description of interfaces is not contained in each HW technical specification, but in Accepted
Safety principles are not described in each HW technical specification, but in [SDTC SyAD]
document. Accepted
Chapters 4 or 5 of each HW technical specification contains information about configuration
of related board.
Moreover, a separate document, SDTC HW Configuration rel.3 code 490371A19CM001 is
devoted to describe the various SDTC cubicle configurations.
abcd SDTC
30/05/11
HTS3 Requirements
- Definition of a method to clearly and unequivocally identify requirements; Verified: N/A

- Identification of a sufficient requirements typology number (i.e.. Functional, interface, Verified: N/A
safety);
- No duplication of requirements (e.g. two requirements with same identifier details not Verified: N/A
useful or not justified);
- Completeness of requirements (all functions shall be adequately specified); Verified: N/A
- Identification of a safety integrity level with respect to requirements;
Verified: N/A
- Hw design aspect must be properly covered by requirements:
Structured definition of functional requirements, according to ALSTOM PBS
standard;
Definition of requirements to project development;
Definition of installation and constraint requirements;
Definition of safety integrity requirements.
Verified: N/A
- Traceability matrix with respect to SDTC module requirements.
Requirements of SDTC module are not contained in each HW technical specification, but in
[SDTC SyRS] document.
HTS4 Architecture Description
- Hyerarchical structure of SDTC module according to ALSTOM PBS standard; Verified: N/A.
- Description of various SDTC module Assemblies (level Assembly) with related Verified: N/A
interfaces; Verified: OK
- Description of single SDTC boards (level Element) with related interfaces:
Identification of electrical charateristics of each board;
Identification of mechanical charateristics of each board and its physical position
within rack and/or cubicle;
Definition of operative and environmental charateristics of each board;
Use of adequate representation (e.g.. Blocks schematics).
HW technical specifications describe directly each board (level Element) and:
- electrical charateristics of each board;
- mechanical charateristics of each board;
- operative and environmental charateristics of each board.
For Tx, Rx, DIAG, MODEM, LIU, TU and RT a blocks schematic is used to better represent
board’s features. Motherboard is very simple and does not require any representation.
Physical position within rack and/or cubicle is contained in a separate document, titled:
SDTC HW Configuration rel.3 code 490371A19CM001.
abcd SDTC
30/05/11
In following table are listed all observations related with quality and consistency check; each is identified with VQCn
identifier.
Table 27 – Quality&Consistency Anomalies of [SDTC HTS] documents
Identifier Reference/ Description/ Decision/

Page Action Anomaly
HWQC 1 HTS1 - § 1.3 HTS1: none of all documents Minor

listed in 1.3 is used in text. Only
HTS2 - § 1.3
[7] should be added, because
HTS3 - § 1.3 related standard is cited in §2.4
page 8.
HTS4 - § 1.3
Documents [1], [2], [3] listed in
HTS5 - § 1.3
1.3 are not used in text.
HTS6 - § 1.3
HTS2: none of all documents
related standard is cited in §2.5
page 12. Moreover, standard
VDE0435/IEC 255-1-00 is cited
in §2.2, but it is not inserted in
§1.3.
page 12.
listed in 1.3 is used in text.
page 12.
page 7.
Delete references not used and
introduce reference for Mil
Handbook in §2.5.
Only for HTS2: add
VDE0435/IEC 255-1-00
standard in §1.3.
abcd SDTC
30/05/11
Identifier Description/ Action Decision / Anomaly
HWQC 2 HTS1: SDM acronym is not used Minor

within text. / Delete it from §1.2
list.
HTS2: SDM acronym is not used
within text. Instead ASCv and
RMS are used in text but they
are not listed in §1.2. / Delete
HTS1 - § 1.2 SDM and add ASCV and RMS in
acronyms’ list.
HTS2 - § 1.2
HTS3: SDM and TWC acronyms
HTS3 - § 1.2 are not used within text. Instead
HTS5 - § 1.2 RMS is used in text but it is not
listed in §1.2. / Delete SDM and
TWC and add RMS in acronyms’
list.
HTS5: SDM acronym is not used
within text. Instead PLL, MSK
and FSK are used in text but
they are not listed in §1.2. /
Delete SDM and add PLL, MSK
and FSK in acronyms’ list.
Item of verification: General Description
No anomaly found.
Item of verification: Requirements
Not Applicable, because requirements of SDTC module are not contained in each HW technical specification, but in
[SDTC SyRS] document.
Item of verification: Architecture Description
Identifier Description/ Action Decision / Anomaly
HWDA 1 All Docs Interfaces of boards are shown Accepted.

in figures, but there are no
Systematic description of board
systematic tabeles/information interfaces is reported in
about them. Only MODEM board [SDTC SyAD].
has a table (Table 1) containing
the meaning of board interfaces
VERIFICATION RESULTS: AIl [SDTC HTS] documents are compliant to quality&consistency requirements.
abcd SDTC
30/05/11
8.2 Verification with respect to applicable Design Reviews

SDTC module has three design reviews, described in the following files:
DR-1. sdr_2005 04 04_SDTC_TX_2.doc;
DR-2. SDTC SDR Giunto 8 Apr 2011 v1.doc;
DR-3. SDTC SDR 200 bit_s Apr 2011 v1.doc.
and several testing activities carried out during its development, that is:
TA-1. SDTC DOT switch test.doc;
TA-2. Shanghai_formal_test_report.doc;
TA-3. SDTC Pe and SN ratio.rev.2.doc;
TA-4. plan essais SNCF.doc;
TA-5. Traction compatibility.DOC.
DR-1 is related to the Soft Start and it has been traced in Hw Technical Specification of the TX board and it will
verified in the FTP document (see test SDTC.FTP.019).
DR-2. is related to the introduction of “8 shaped” joint to reduce traction disturbances on SDTC; has been traced in
Architecture Description and it will be verified in a dedicated Test Session.
DR-3. is related to RT and Modem boards modification due to reduce bit rate from 400bit/s to 200bit/s, it has been
traced in Hw Technical Specification of the related boards and it will be verified in a dedicated Test Session.
TA-1 is a plan (and report) of test performed in the past (during SDTC development) and it is included in FTP and
FTR.
TA-2 is related to prototypes for Shanghai and it is not related to requirements (for instance, the ballast has been
measured).
TA-3 and TA-5 are related to tolerance with respect to traction harmonics and they are traced in the FTP.
TA-4 collects some installation constraints included in the Implementation manual and in the T&C manual (this
verification will be executed within the System Validation Report).
All prescriptions derived from 0 are included in last release of of [SDTC HTS] documents.
RESULTS OF VERIFICATION: All observations derived from Design Review with impact on SDTC hardware
(see DR-1) are fully receipt in latest release of [SDTC HTS] document; this document is congruent with
respect to applicable Design Reviews.
abcd SDTC
30/05/11
9 VERIFICATION RESULTS
9.1 Architecture Description

In Table 28 are summarized all “Major” anomalies found for verifications contained in §5; they are identified with
(SAD_Op n) code, their Reference, Corrective Action against them and their State.
Table 28 – Open Points Major of [SDTC SyAD] document
Corrective Action Ref. State

Loop Interface Unit (LIU) SADQC.8 Open
and Inductive Connections
Closed in Rev. 4 of [SDTC S
are missing.
Introduce description of
Loop Interface Unit and
Inductive Connections.
Compatibility between SADQC.9 Open
SDTC and Low Frequency
TC is missing.
Complete §4.3.
Interface description is SADQC.10 Open
missing.
Introduce a paragraph in §2
to describe the interfaces of
SDTC module.
Safety critical components SADQC.11 Open
of SDTC module are not
identified.
In §3 introduce a paragraph
with identification of safety
related items.
A paragraph describing all SADQC.12 Open
possible branch line
configurations’ constraints
(for instance in terms of
length of branches, etc) is
missing.
Introduce a such
paragraph.
SDTC blocks are not SADQC.13 Open
adequately described,
neither related boards.
Introduce those
descriptions; each board
should be described in a
separate paragraph.
abcd SDTC
30/05/11

There is no functional block SADQC.14 Open
structure definition.
Introduce a chapter with
functional blocks of SDTC
module, gerarchically
distributed (i.e. starting from
higher to lower level of
abstraction).
No information about SW SADQC.15 Open
used in MODEM board is
delivered neither about SW
functions implemented and
related SIL level.
Description of safety SADQC.16 Open
principles of SDTC module
is not complete (references
to break of rail and SACEM
function are missing).
Complete §2.5.
No description of fail-safe SADQC.17 Open

circuiti s done, neither Closed in Rev. 4 of [SDTC S
threshold values (i.e. RMS
threshold and RMS
opeartion)
Besides functional blocks, SADQC.18 Open
there is no SIL associated
to them.
Add in [SDTC SyAD] a
paragraph where each
functional block and related
SIL is identified.
There is no information
about technique used to
reach the safety target SIL
4.
No traceability between SADQC.19 Open
architecture and SDTC
module requirements is Closed in Rev. 4 of [SDTC S
delivered in [SDTC SyAD]
document.
In [SDTC SyAD] are not SAD_VNP1 Open
clearly defined safety-
related and not safety Closed in Rev. 4 of [SDTC S
related functions. Moreover,
no enough information is
delivered with regard to non
what boards implementing
safety related functions and
what boards implementing
abcd SDTC
30/05/11

not safety related functions.
In [SDTC SyAD] there is a SAD_VNP2 Open
brief explanation of inherent
fail-safe architecture, but Closed in Rev. 4 of [SDTC S
there is no information
about boards designed with
this architecture. It shoulbe
referenced EN 50129
standard instead of
EN 50126.
Architectural decomposition SAD_VNP3 Open
is shown in §2.4 of
[SDTC SyAD], but safety Closed in Rev. 4 of [SDTC S
related blocks are not
identified.
No requirements allocation SAD_VNP4 Open
is delivered in
[SDTC SyAD]. Closed in Rev. 4 of [SDTC S
For sake of completeness, Table 29 lists all “Minor” open points found.
Table 29 –Minor Open Points of [SDTC SyAD] document
Ref. Corrective Action Stato

SADQC.1 Scope paragraph is Open
missing.
Closed in Rev. 4 of [SDTC SyAD]
Introduce paragraph
SCOPE.
SADQC.2 Only [2], [4], [13], [14] and Open
[15] are used in
[SDTC SyAD] text.
In §1.3 delete documents
not used in [SDTC SyAD]
text.
SADQC.3 Reference of EN 50125-3 Open
standard is missing..
Closed in Rev. 4 of [SDTC SyAD]
Introduce ref. [5] in §2.7.
SADQC.4 Error in [1]. EN 50129 Open
standard is not in
evaluation stage (it is not Closed in Rev. 4 of [SDTC SyAD]
ENV).
Errata corrige in §1.3.1
(EN 50129 instead of
ENV 50129)..
abcd SDTC
30/05/11
SADQC.5 Acronyms EJ, DTC921, Open

LIU, SW and TU declared
in §1.2, are not used in Closed in Rev. 4 of [SDTC SyAD]
Add these acronyms (if it is
useful), otherwise delete
them from §1.2 list.
SADQC.6 Acronyms 2oo3, CPFSK, Open
DIGICODE, GND, MSK,
MTBF, MTTR, RX and TX, Closed in Rev. 4 of [SDTC SyAD]
used in [SDTC SyAD]
document, are not listed in
§1.2.
Add these acronyms in
§1.2 list.
SADQC.7 Acronym GE is wrong. Open
Substitute Ge with EJ. Closed in Rev. 4 of [SDTC SyAD]
9.2 RAM Analysis

Verifications contained in §5 and related paragraphs found one Major Open point and some “Minor” open points,
that are described in Table 30. They can be closed in a next release of [SDTC RAMAn] document, but this is not
requested by these anomalies.
Table 30 – Minor Open Points of [SDTC RAMAn] document
Ref. Corrective Action Stato

RAMQC 1 Add acronyms LRU and PN in §1.1 list, because they are used in Open
document.
Closed
§5.4 § 3.4 and Annexes deliver results of basic and mission reliability for Open
1
various SDTC module configurations and for each board respectively as

Failure Rate and MTBF.
No FMEA is conducted for reliability.
9.3 Hazard Analysis

Verifications contained in §6 and related paragraphs found one Major Open point, that is described in the following
table and identified with (HA_OP n) identifier. Same table contains also anomalies’ Reference, Corrective Action
against them and their State.
Table 31 – Major Open Points of [SDTC HA] document
Code Corrective Action Ref. State
1
This anomaly can be considered “minor” type, because SDTC module is made with HW proven in use and there are field data
assuring a MTBF value much greater than theoretical one.
abcd SDTC
30/05/11

(HA_OP 1) Functional decomposition HAAS1 Open
used for FMEA has been
derived from direct and Closed in rev. 4 of
detailed inspection of [SDTC HA]
electrical schemes and
boards consttuing SDTC
module. All identified signals
have been analysed through
a systematic application of
guidewords (failure modes)
defined before. This
decomposition is not present
in [SDTC SyAD] document.
9.4 Functional Test Plan

In Table 32 are listed the “Major” anomalies found during verifications contained in §7 and related paragraphs.
These anomalies require a new release of [SDTC FTP] document. They are identified with code (FTP_OP n).
Same table contains also anomalies’ Reference, Corrective Action against them and their State.
Table 32 – Major Open Points of [SDTC FTP] document

(FTP_OP 1) All tests have no FTPQC 12 Open
reference to applicable
requirements, altough in Closed in Rev. 5 of
page 14 template of test [SDTC FTP]
case foresees fields
containing
requirements.
Add requirements’
references.
(FTP_OP 2) Test cases do not FTPQC 16 Open
contain field devoted to
applicable Closed in Rev. 5 of
requirements. [SDTC FTP]
Add requirements’
references.
(FTP_OP 3) Test cases #3 and #5 FTPSR 4 Open
do not contain test
related to traction Closed in Rev. 5 of
disturbances. [SDTC FTP]
To cover requirement
#SR1.4 Safety
Demonstration and
functional tests could be
used.
abcd SDTC
30/05/11

(FTP_OP 4) Safety integrity level is FTPSR 11 Open
not verified by tests
referenced. Closed in Rev. 5 of
[SDTC FTP]
To proof SIL it should
reference to safety
documentation.
(FTP_OP 5) Requirement #SR1.12 FTPSR 1 Open
is not covered by tests
[SDTC FTP]
it should reference to
type tests.
(FTP_OP 6) Requirement #SR1.12 FTPSR 12 Open
is not covered by tests
[SDTC FTP]
Testing and validation of
the Safety
Demonstration, and
tests envisaged by EN
(FTP_OP 7) Test Case #11 does not FTPSR 13 Open
cover #SR1.14.
Closed in Rev. 5 of
Both DOTs are tested
[SDTC FTP]
in Test Case #9, but
#SR1.14 foresees
presence of faults,
absent in Test Case #9.
It is possible to refer a
fault test conducted for
Hw Safety Verification.
(FTP_OP 8) Test Cases #2 and #5 FTPSR 18 Open
cover #SR2.4 for DC
electrified line, but AC Closed in Rev. 5 of
electrified lines are not [SDTC FTP]
included..
It should be reference
similar tests performed
in AC lines or product
documentation.
(FTP_OP 9) Information presented FTPSR 23 Open
by the CEDD-D are not
included. Closed in Rev. 5 of
[SDTC FTP]
Include them.
FTP_OP 10) [SDTC FTP] document §7.3.1 Open
is not compliant to point
3 of table E.9 of [EN Closed in Rev. 5 of
50129] standard (it is [SDTC FTP]
the only point of this
standard releted to
Functional Test
Planning activity).
abcd SDTC
30/05/11

FTP_OP 11) No paragraphs of FTP_VNP1 Open
[SDTC FTP] define the
tests which verify the Closed in Rev. 5 of
functioning of the Ss in [SDTC FTP]
the presence of
malfunctions and
verification of the
returning of the
subsystem to a safe
condition.
FTP_OP 12) The §5 of [SDTC FTP] FTP_VNP2 Open
defines test classes and
test template, but not Closed in Rev. 5 of
acceptance criteria. [SDTC FTP]
The following table contains the “Minor” anomalies found in [SDTC FTP] document.
Tabella 33 – Minor Open Points of [SDTC FTP] document
Ref. Corrective Action State

FTPQC 1 Title of [SDTC FTP] contains a reference to a specific application Open
(Metro Milan 1).
Modify title deleting reference to MML1, because Functional Test
Plan has to be referred to SDTC generic product.
FTPQC 2 Acronym PT is not used whitin [SDTC FTP] test. Open
Delete this acronym.
FTPQC 3 Acronym TE is not used whitin [SDTC FTP] test. Open
Delete this acronym. Closed in Rev. 5 of [SDTC FTP]
FTPQC 4 Acronym GE is not used whitin [SDTC FTP] test. Open
Delete this acronym. Closed in Rev. 5 of [SDTC FTP]
FTPQC 5 Reference [G4] is not used within [SDTC FTP] text. Open
Delete this reference. Closed in Rev. 5 of [SDTC FTP]
FTPQC 8 Reference [G7] does not contain any document. Open
FTPQC 9 Reference [DP4] is not used within [SDTC FTP] text. Open
FTPQC 10 In §2.1 the phrase “Infatti oltre a …” is incomplete. Open
abcd SDTC
30/05/11
FTPQC 11 In [SDTC FTP] there is no synthetic description description of test Open

organization, including skills of test personnel.
FTPQC 13 Tests are no subdivided in various typology. Open
FTPQC 14 §5.2, §5.3, §5.4 and §6 contain operative turn in service and Open
tuning procedures.
They should be inserted before §5/§5.1 (Test Plan).
FTPQC 17 Test Case #7 is not included in traceability table contained in §6.4 Open
FTPSR 7 Reference to test case is not correct (it is referenced Test Case Open
#5, but Test Case #6 should be applicable).
FTPSR 17 Reference to test case is not correct (it is referenced Test Case Open
#2, but Test Case #4 should be applicable).
FTPQC 15 Test case #10 is not clear. Open
FTPSR 22 To cover #SR3.5 it should be check that MTBF value calculated in
FTPSR 1 RAM Analysis report is equal or major than requested (15000h).
To cover #SR3.4 is should be perform a field test with PU linked Closed in Rev. 5 of [SDTC FTP]
to TU with a 4Km cable length or find in documentation the related
information.
Clarify and distinguish both aspects.
9.5 Hardware/Software Technical Specification

In Table 34 are listed the “Major” anomalies found during verifications contained in § 8 and related paragraphs.
They are iden tified with code (HTS_Op n). Same table contains also anomalies’ Reference, Corrective Action
against them and their State.
Table 34 – Major Open Points of [SDTC HTS] documents

(HTS_OP.1) Some observations derived from Design Review (DR-1) are §8.2 Open
not fully receipt in latest release of [SDTC HTS] documents; Closed in Rev. 2 of HTS.2
therefore, these documents shall be updated.
Table 35 contains the “Minor” anomalies found in [SDTC HTS] documents .
Table 35 - Minor Open Points of [SDTC HTS] documents
Rif. Azione Stato
abcd SDTC
30/05/11
HWQC 1 HTS1: none of all documents listed in 1.3 is used in text. Only [7] should be added, Open
because related standard is cited in §2.4 page 8.
(for HTS1 this
Documents [1], [2], [3] listed in 1.3 are not used in text. open point is
HTS2: none of all documents listed in 1.3 is used in text. Only [7] should be added, partially
because related standard is cited in §2.5 page 12. Moreover, standard VDE0435/IEC closed)
255-1-00 is cited in §2.2, but it is not inserted in §1.3.
HTS3: none of all documents listed in 1.3 is used in text. Only [7] should be added,
HTS4: none of all documents listed in 1.3 is used in text.
Delete references not used and introduce reference for Mil Handbook in §2.5.
Only for HTS2: add VDE0435/IEC 255-1-00 standard in §1.3.
HWQC 2 HTS1: SDM acronym is not used within text. / Delete it from §1.2 list. Open
HTS2: SDM acronym is not used within text. Instead ASCv and RMS are used in text
but they are not listed in §1.2. / Delete SDM and add ASCV and RMS in acronyms’
list.
HTS3: SDM and TWC acronyms are not used within text. Instead RMS is used in text
but it is not listed in §1.2. / Delete SDM and TWC and add RMS in acronyms’ list.
HTS5: SDM acronym is not used within text. Instead PLL, MSK and FSK are used in
text but they are not listed in §1.2. / Delete SDM and add PLL, MSK and FSK in
acronyms’ list.
abcd SDTC
30/05/11
10 CONCLUSION
This is release no. 2 of verification report of following documents:

SDTC- Subsystem Architecture Description
Code: 490371D19HW001, Rev. 5
SDTC- RAM Analysis
Code: 490501D19VV004, Rev. 4
SDTC- Hazard Analysis
Code: 490501D19VV005, Rev. 5
SDTC- Functional Test Plan
Code: X302DXXTP010, Rev. 5
SDTC- Software Technical Specification
Code: 490371D19SW001, Rev. 2
SDTC– HW Technical Specification:
Verification activities contained in this document highlight that [SDTC HA], [SDTC FTP], [SDTC SyAD],
[SDTC RAMAn], [SDTC SWTS], [SDTC HTS] documents have no Major anomalies.
Therefore, the Architecture Verification activity of SDTC module is closed.
During analyses contained in [SDTC HA] some application conditions emerged for use of SDTC module (see §6):
SDTC_HA-AC.1 A differential magnetothermic plant switch to protect PU power supply from overloads,
shortcircuits and ground dispersion is requested (ref. SDTC-HAR-10).
SDTC_HA-AC.2 SDTC has to safely guarantee the execution of free/occupied TC function with the following
limit conditions for shunt and ballast:
o Transversal Conductivity: from 0 to 0,25 S/km, for a TC lenght equal to 2000 m;
o Maximum Shunt Resistance: 0,5 Ω.
In particular, the value of Shunt Resistance can be influenced by several factors (that could
be monitored), as rail oxydation, high resistance of rolling stock bogies, etc. Values above
listed are binding for SDTC use (ref. SDTC-HAR-60).
abcd SDTC
30/05/11
SDTC_HA-AC.3 SDTC has to safely guarantee the execution of free/occupied TC function if its power supply
is 220 VAC ±10% @ 50Hz or 110 VAC ±10% @ 50/60Hz voltages. These values are
constraints for SDTC use (ref. SDTC-HAR-61).
SDTC_HA-AC.4 The train board equipment shall demodulate the signal and to check correctness of SACEM
message (ref. SDTC-HAR-62).
SDTC_HA-AC.5 The message received from SACEM system shall be protected by coding (ref. SDTC-HAR-
62).
SDTC_HA-AC.6 For the specific application “Metro Milan Line 1”, it shall be assured the following application
conditions:
i. It is forbidden to make inter-rails links within electrical joints;
ii. Two inter-rails links cannot be made in the same TC;
iii. Two inter-rails links cannot be made in neighbouring TCs, independently of their
distance;
iv. Two inter-rails links have to be far almost 200m each other;
v. If two inter-rails links are on two TCs having the same frequency, they to be far almost
400m each other;
vi. Inter-rails links within TCs longer than 200m should be avoided. If it is not possible and
if it is not foreseen TX-RX change, the link can be made with RX joint minus than 150m
distant.
abcd SDTC
30/05/11
11 ANNEXES
Allegato 1 Checklist
ITEM Document Quality

DT Document Template
- Conformity to ALSTOM template;
- Presence of Signatures;
- Page number written on frontispiece equal to effective;
- Correcteness of releases and author(s) traceability;
- Completeness and comprehensibility of release motivation(s).
- Variable fields (data, release, num. Doc. , titles) rightly indicated in header and in footer of each page);
- Correcteness of indexes (titles, number of pages, …. );
DAR Document Acronyms and References
- Correcteness and consistency of paragraph Scope and Applicability with respect to objectives of document and
to life-cycle;
- Completeness of references (Standard used, tool and database used as references, applicable documents);
- Congruence of references (references used effectively matching with those declared, no errors of cross-
reference, etc. );
- Correctness of acronyms and their correspondance to textual references (i.e.. number of acronyms declared not
different form that of acronyms used).
DC Document Consistency
- Consistency of Contents with respect to effettive structure of document;
- Correctness in chapters and paragraphs numbering;
- Correctness, readability and comprehensibility of text.
PATH Digicode® PSP
APPENDIX D-7 SDTC Hardware Validation Report

61 of 80
PATH Digicode® PSP
APPENDIX D-8 SDTC Validation Report

62 of 80
PATH Digicode® PSP
APPENDIX D-9 SDTC Installation Manual
63 of 80
SDTC - PATH Application
INSTALLATION MANUAL
02/08/11 F. Campedelli
A. Giovannucci D. Giangaspero
P.A. Aisa
BOLOGNA
DATE WRITTEN BY CHECKED APPROVED
Confidentiality Category Control Category

Via di Corticella 75
Riservato Normale Controllato Not Controllato
DISTRIBUTION 40128 Italia
Tel. +39 051.4163111 - Fax +39 051.4163436
Restricted Normal Controlled Not Controlled
CONFIDENTIAL. Sharing or copying of this document, and use or communication of its contents Rev. Lang. P age/s
All rights reserved. is not permitted without prior written authorization. X-HWE-A-UMM-0001 9 eng 46
abcd SDTC - PATH Application
02/08/11
Bologna INSTALLATION MANUAL
REVISIONS

1 R. Marzola 24/04/02 43 Issue
2 A. Giovannucci 31/07/02 46 Added comments, figures and tolerances
3 A. Giovannucci 16/01/09 42 Version for MM L1
4 A. Giovannucci 19/11/09 40 Updated drawings; updated definitions §1.2; removed

norms §1.3; updated references § 1.3; added
configuration with cassette filter § 2.4; AR60 TU
cables A and C § 3; drawings § 4-5-6-; entry cable
cubicle frame § 9.1
5 A. Giovannucci 29/10/10 43 Update after Verification Report; added power

conversion 110 V AC and TC field cable part number
6 A. Barbacini 14/03/11 43 Some parts that were in Italian were translated into
English and added US units.
P.A. Aisa
7 P.A. Aisa 05/04/11 48 Modifications based on comments received from US

application
8 P.A. Aisa 17/06/11 46 PATH application, new document code

A. Giovannucci
9 A. Giovannucci 02/08/11 46 MCM cables
CONFIDENTIAL. Sharing or copying of this document, and use or communication of its Reference Issue Page/s
contents is not permitted without prior written authorization. 2/46
X-HWE-A-UMM-0001 9
02/08/11
SAFETY RULES FOR PERSONNEL

WARNING: When required to work in the field or in the signaling room, employees must
follow good working practices for human safety and adhere to the current regulations
against electrocution. In the signaling room, check that the power main complies with
current regulations and that all metal parts are correctly grounded. For field equipment,
employees must follow the rules for electric traction environment near the rails, according
to the specific application 25 kV 50Hz, 3 kV DC, or 750 V DC. Always check before
grounding any metal parts locally.
WARNING: All operations involving employees must be performed under safe conditions.
Employees must be protected using Personal Protection Equipment (PPE), i.e.:
o Safety shoes
o High visibility clothing (maximum degree)
o Protective helmet
o Protective gloves
Moreover, all work units must be equipped with and carry a medical safety box. When
operating in the tunnel other devices are needed, such as breathing apparatus, portable
lights, communication phones, etc. Please refer to the local railway/metro procedure.
WARNING: There may be differences when operating in the signal room (SER) or in the
field (track). In the first case, employees will keep in touch with the Central Supervision
Room to signal their presence in the room and to remove any alarms. In the second case,
employees will be divided into at least two groups, one in the field and one in the room, in
communication with each other and with the Central Supervision Room by phone. The
Central Supervision Room will provide them permission to enter in the track side. Please
refer to the local railway/metro procedure.
WARNING: All room equipment, the cable shield and armor, and the metal parts in the
field (except when traction system is 3 kV DC) are normally connected to the ground
(earth). Before performing any operation, check the integrity of the ground wires
(green/yellow) and check the integrity of cable insulation measuring system (if present).
WARNING: During constant operation on cables or parts connected to cables, e.g. the
cable cubicle frame or cable terminal in the field, it is necessary to temporarily ground the
shield and the armor, if present.
WARNING: Protection rating of TU in the field is IP 65, when completely closed. The
protection degree of room equipment inside the cubicle is IP 41, when the cubicle doors
are closed.
WARNING: Dangerous voltages and currents may be present inside or near power supply
units. Be careful performing operations on this equipment.
During installation operations, avoid wearing any metal objects, such as bracelets, watches
X-HWE-A-UMM-0001 9
02/08/11
or other jewelry. Metal objects that come into contact with dangerous voltage sources and
ground conductions can cause serious burns or lethal shock.
Access is prohibited for children and/or incompetent/unauthorized personnel.

WARNING: When personnel work with electrical equipment they must practice the
following precautions:
- Locate emergency switches to be operated in case of an emergency
- Disconnect protection circuits when performing the following activities:
- Cable connection / disconnection
- Subrack connection / disconnection
- Board connection / disconnection
- Software Upgrade
- Always check that the power supply is disconnected when operating on racks
- Never work alone
- Survey the work area and identify any slippery areas, uncovered cables and sharp
edges
- If an accident should occur, avoid involving other employees. Seek first aid
immediately.
WARNING: Electrostatic discharge may occur on electronic equipment.
To prevent faults on electronic devices, use an electrostatic bracelet when handling
electronic devices, such as integrated circuits.
Snap-to-banana coiled cord
Alligator clip for heart/chassis

connection
Wrist strap coiled cord
Figure 1: Antistatic Bracelet
Table 0-1: SAFETY RULES FOR PERSONNEL
X-HWE-A-UMM-0001 9
02/08/11
CONTENTS
SAFETY RULES FOR PERSONNEL ............................................................................................................................................. 3
1 INTRODUCTION .................................................................................................................................................................... 8
1.1 SCOPE OF THIS DOCUMENT........................................................................................................................................... 8
1.2 DEFINITIONS AND ACRONYMS ....................................................................................................................................... 9
1.3 REFERENCES ................................................................................................................................................................... 9
1.4 GENERAL ........................................................................................................................................................................ 10
1.5 DRAWINGS OF BOND LAYOUTS .................................................................................................................................. 12
2 TABLES FOR ELECTRIC JOINT INSTALLATION ............................................................................................................. 13
2.1 “S” BOND ........................................................................................................................................................................ 13
2.2 TERMINAL BOND ............................................................................................................................................................ 15
2.3 SHORT CIRCUIT BOND .................................................................................................................................................. 17
3 OPERATION A: CABLE TO RAIL CONNECTION (CEMBRE KIT)..................................................................................... 19
3.1 KIT CEMBRE AR60 FOR S CABLE ................................................................................................................................ 20
3.2 CEMBRE KIT AR60 FOR TU CABLES............................................................................................................................ 23
3.3 TOOLS FOR DRILLING RAILS ....................................................................................................................................... 25
3.4 CHARACTERISTICS OF THE RECOMMENDED TOOLS............................................................................................... 26
3.4.1 HYDRAULIC TOOL TYPE HT 131-C ........................................................................................................................ 26
3.4.2 HYDRAULIC NUT SHEARING DEVICE TYPE RHTD 3241 ..................................................................................... 26
3.4.3 HYDRAULIC PUMP TYPE PO 700........................................................................................................................... 26
3.4.4 PORTABLE ELECTRIC HYDRAULIC PUMP CPE-0-P12 ........................................................................................ 26
3.4.5 WOODEN TIE DRILL TYPE SD-5P .......................................................................................................................... 26
3.4.6 RAIL BRILL TYPE LD-1P .......................................................................................................................................... 27
4 OPERATION B: INSTALLATION ELECTRIC JOINT CABLES........................................................................................... 28
5 OPERATION C: INSTALLATION OF CONNECTING CABLES .......................................................................................... 32
5.1 CLIP LAYOUT .................................................................................................................................................................. 35
5.2 INSTALLATION OF TERMINAL BONDS WITH CENTER CONNECTION...................................................................... 37
6 OPERATION D: INSTALLATION OF THE TUNING UNITS ................................................................................................ 38
7 OPERATION G: INSTALLATION OF INDOOR EQUIPMENT ............................................................................................. 42
7.1 PART NUMBERS FOR ROOM EQUIPMENT .................................................................................................................. 42
7.2 ROOM INSTALLATION.................................................................................................................................................... 42
7.3 CONNECTION OF THE FIELD CABLE TO THE ARRIVAL CABLE ............................................................................... 43
7.4 CONNECTION OF CABLES BETWEEN CUBICLES ...................................................................................................... 44
8 INSTALLATION VERIFICATION ......................................................................................................................................... 45
8.1 INSTALLATION INSPECTION ......................................................................................................................................... 45
8.2 CONNECTION INSPECTION ........................................................................................................................................... 45
X-HWE-A-UMM-0001 9
02/08/11
9 SHIPPING AND PACKING .................................................................................................................................................. 46
FIGURES
Figure 1: Antistatic Bracelet ................................................................................................................................................ 4
Figure 1-1 “S”bond, Terminal Bond and Short Circuit Bond: List of Components Used in the Installation Operations ..... 8
Figure 1-2. “S” Bond Configurations ................................................................................................................................. 10
Figure 1-3. Terminal Bond ................................................................................................................................................ 10
Figure 1-4. Short circuit joint ............................................................................................................................................. 11
Figure 3-1. Fixing Points of the SDTC “S” Bond to the Rails (see Drawing: G69908900AB) .......................................... 20
Figure 3-2. Fixing Points of the SDTC Terminal Bond to the Rails (See Drawing: G69908900DE) ................................ 21
Figure 3-3. Installation of Cembre Kit AR60 (See Drawing: G69908900AB) ................................................................... 22
Figure 3-4. Fixing Points of the “S” Bond TU Cables to the Rails (See Drawing: G69908900AB) .................................. 23
Figure 3-5. Fixing Points of the Terminal Bond TU Cables to the Rails (See Drawing: G69908900DE) ......................... 24
Figure 3-6. Installation of the Cembre kit AR60 for TU cables (See drawing: G69908900DE) ....................................... 25
Figure 4-1. Layout of the “S” Bond (See Drawing: G69908900AB) ................................................................................. 28
Figure 4-2. Fixing Cembre Cable Terminal Type 2A24. 15-M120V to Cembre Kit AR60 in an S Bond
(See Drawing: G69908900AB) .................................................................................................................................. 29
Figure 4-3. Layout of the terminal Bond (See Drawing: G69908900DE) ......................................................................... 30
Figure 4-4. . Fixing Cembre Cable Terminal Type 2A24. 15-M120V to Cembre Kit AR60 in a S Bond
(See Drawing: G69908900DE) .................................................................................................................................. 31
Figure 5-1. Layout of the “S” Bond Connecting Cables (See Drawing: G69908900AB) .................................................. 32
Figure 5-2. Fixing the Cembre Cable Terminal CCS25-M12 to the Cembre Kit AR60 (See Drawing: G69908900AB) .. 33
Figure 5-3. Fixing the Connecting Cable to the Center of the “S” Bond (See Drawing: G69908900AB) ......................... 33
Figure 5-4. Layout of the Terminal Bond Connecting Cables (See Drawing: G69908900DE) ........................................ 34
Figure 5-5. Fixing the Cembre Cable Terminals CCS25-M12 and Cembre Type 2A 37.26-M12 to the Cembre Kit AR60
on the Terminal Bond (See Drawing: G69908900DE). ............................................................................................. 35
Figure 5-6. 7 Layout of clips to fix the “S” bond and the cables to the rail (See Drawing: G69908900AB) .................... 36
Figure 5-8. Cross-section of the clips to fix the bonds and the cables to the rail (See Drawing: G69908900AB) ........... 37
Figure 6-1. Cross-section of the vertical wall tuning box (See Drawing: G69908900AB) ................................................ 40
Figure 6-2. Cross-section of the vertical under platform tuning box (See Drawing: G69908900BC) ............................... 40
Figure 6-3. Cross-section of the vertical support tuning box (See Drawing: G69908900CD) .......................................... 41
Figure 6-4. Cross-section of the horizontal tuning box (See Drawing: G69908700KD) ................................................... 41
Figure 7-1. Upper part of the rear mother board with connectors CN2 and CN5............................................................. 43
TABLES
Table 0-1: SAFETY RULES FOR PERSONNEL................................................................................................................ 4
X-HWE-A-UMM-0001 9
02/08/11
Table 2: Definitions and Acronyms ..................................................................................................................................... 9

Table 3: References ........................................................................................................................................................... 9
Table 4: Bond Layouts ...................................................................................................................................................... 12
Table 5: Electric Joint Installation ..................................................................................................................................... 13
Table 6: Electric Joint Installation ..................................................................................................................................... 15
Table 7: Electric Joint Installation - Gauge Dependant .................................................................................................... 15
Table 8: Terminal Joint Installation ................................................................................................................................... 16
Table 9: Terminal Joint Installation - Gauge Dependant .................................................................................................. 17
Table 10: Short Circuit Bond Installation .......................................................................................................................... 18
Table 11: Short Circuit Bond Installation - Gauge Dependant ......................................................................................... 18
Table 12: Short Circuit Bond Installation - Gauge Dependant ......................................................................................... 25
Table 13: Fixing Cables to the Tuning Units ..................................................................................................................... 39
Table 14: Part Numbers for Room Equipment ................................................................................................................. 42
X-HWE-A-UMM-0001 9
02/08/11
1 INTRODUCTION
1.1 Scope of this Document

This document describes the installation of the Smartway DTC track circuit for Metro applications.
This manual consists of 8 sections or “work operations” for installation along the track. The operations concerned can
be carried out at different times, even if they are presented in sequence, for easier tasks planning by the personnel in
charge of installation.
For the positioning of the joint we will refer to what is called hereafter called the “progressive distance” of the joint.
The progressive distance is understood to be the distance from a reference point.
In Figure 1.1 the numbers indicated correspond to the installation operations for the three types bonds referred to in the
“General” section.
Below is a short summary of the different operations:
Connection of the cables to the rails (Cembre kits AR60).
Laying of the electric joint cable.
Installation of the tuning units.
Laying of the connecting cables
Laying of the transmitter/receiver cables (TX/RX).
Laying of the loop cable.
Installation of the loop interface unit
Installation of the room equipment.
1 1 1 1 1
2
2 2
1 1 1 1 1
4 4 4 4 4 4 4
3 3 3
5 5 5
6 5 6 5 6 5
Figure 1-1 “S”bond, Terminal Bond and Short Circuit Bond: List of Components Used in the Installation Operations
X-HWE-A-UMM-0001 9
02/08/11
DTC Digital Track Circuit

MAT Manufacturing Acceptance Test
PE Protective Earth (Ground)
TC Track Circuit: railway line stretch that is functionally separated from the adjacent
stretches. The stretch may comprise one or two switch branches.
TU Tuning Unit
UPS Uninterruptible Power Supply
Table 2: Definitions and Acronyms
1.3 References
SDTC 921 HF, Specifica Tecnica Cassetta di Sintonia, v. 7, 315302DXXST001

SDTC, Specifica Tecnica Cassetta Filtri, v. 2, 315302DXXST002
SDTC, Application Conditions, v. 5, 315302DXXDG002
Digicode DTC24, Specifica Tecnica Cavi CdB AF ver. 2 - X302DXXST005
Digicode Cable, Product Technical Specification rev. 2, X-HWE-A-TCF-0003
Table 3: References
X-HWE-A-UMM-0001 9
02/08/11
1.4 General
Below are the definitions of the components used for installation of Alstom SDTC:
1) The electric joint
With the term “electric joint” we mean the whole cable and of the connections thereof to the rails. There are three types
of electric joints:
“S” bond
Terminal bond
Short circuit bond
1.a) “S” bond

This bond allows the separation of two adjacent track circuits and can be arranged in two symmetric, equivalent
configurations.
PROGRESSIVE KILOMETRIC DISTANCE PROGRESSIVE KILOMETRIC DISTANCE
Figure 1-2. “S” Bond Configurations
1.b) Terminal bond

This bond allows a track circuit to be delimited in the presence of one or two mechanical interruptions of the rails (see
the figure below).
In presence of only one mechanical interruption any traction current could continue on the next track circuit by running
through the full length of the cable of the joint.
In case of two mechanical interruptions of the rails, the traction current, if any, can reach the next track circuit through a
cable connected to the center of the joint. From the next track circuit, the above mentioned cable can be connected to
one rail or to the center point of an impedance bond.
PROGRESSIVE KILOMETRIC DISTANCE PROGRESSIVE KILOMETRIC DISTANCE
Figure 1-3. Terminal Bond
X-HWE-A-UMM-0001 9
02/08/11
1.c) Short circuit bond

Short circuit bonds are mounted in correspondence to the limits between a SDTC track circuit and a zone where the
two rails must be equipotent (for instance a territory without signaling at all).
PROGRESSIVE KILOMETRIC DISTANCE
Figure 1-4. Short circuit joint
2) Connecting cables
Connecting cables are defined as the cables which connect the tuning units to the track and to the electric joint.
 The “S” bond features three connecting cables with a section of 25 mm2 (about 3 AWG ). Two of these cables are
connected to the rails in correspondence of the progressive distance of the joint, whereas the third cable is
connected to the center point of the electric joint, in correspondence with the same mileage.
 The terminal bond features three connecting cables with a section of 25 mm2 (about 3 AWG ). Both are connected
to the rail in correspondence with the progressive distance.
 The short circuit bond features three connecting cables with a section of 25 mm2 (about 3 AWG ). Both are
connected to the rail in correspondence with the progressive distance.
3) Tuning units
“Tuning units” are defined as the device which is connected between the transmitter/receiver cables and the electric
joint, of whatever type it may be. The function of the tuning units is to amplify the impedance of the joint with respect to
the transmission/reception of the signal from and to the tracks.
5) Reception/Transmission cables
The reception and transmission cables connect the tuning units and the L.I.U. to the indoor equipment. The conductors
feature a 1.5 mm² section (about 15 AWG) and run two or four through one single sheath, based on the system
requirements.
6) Indoor equipment
Indoor equipment consists of the racks and subracks housing the boards Tx, Rx, MODEM, RT, and the optional
diagnostic board. The indoor equipment can be located in a station or in an equipment room along the line.
X-HWE-A-UMM-0001 9
02/08/11
1.5 Drawings of Bond Layouts

For the installation of the filed equipment, please see the instructions provided in the following bond layouts.
VERTICAL WALL LAYOUT DRAWINGS

G69908900AB
G69908900DE
VERTICAL UNDER PLATFORM LAYOUT DRAWINGS

G69908900BC
VERTICAL SUPPORT LAYOUT DRAWINGS

G69908900CD
Table 4: Bond Layouts
X-HWE-A-UMM-0001 9
02/08/11
2 TABLES FOR ELECTRIC JOINT INSTALLATION
2.1 “S” Bond

INSTALLATION 1 INSTALLATION 2
L2 L1 L2 L1
A
C
Fsx B Fdx Fsx B Fdx

C
A
A B C A B C
Tuning box Tuning box

type Fdx/Fsx type Fdx/Fsx
INSTALLATION 3 INSTALLATION 4
L2 L1 L2 L1
A
C
Fsx B Fdx Fsx B Fdx

C
A
A B C A B C
Tuning box Tuning box

type Fdx/Fsx type Fdx/Fsx
Table 5: Electric Joint Installation
Length of Lengths Channels

Tuning unit 1 Type of installation
Bond (1, 2, 3, or 4)
Part No. L1 = L2 Fsx Fdx
Cable
250 MCM
P699044D20Z 25 m 3.6 m f7 f9 1 2
P699044B20G (82 ft) (11.8 ft) f9 f7 3 4
1
The first code is for vertical installation; the second code is for horizontal installation
X-HWE-A-UMM-0001 9
02/08/11

Bond (1, 2, 3, or 4)
Cable
250 MCM
P699044D32N 25 m 3.6 m f7 f10 1 2
P699044B32V (82 ft) (11.8 ft) f10 f7 3 4
P699044D21A 25 m 3.6 m f7 f11 1 2

P699044B21H (82 ft) (11.8 ft) f11 f7 3 4
P699044D22B 25 m 3.6 m f7 f13 1 2

P699044B22K (82 ft) (11.8 ft) f13 f7 3 4
P699044D23C 25 m 3.6 m f9 f11 1 2

P699044B23L (82 ft) (11.8 ft) f11 3 4
f9
P699044D24D 25 m 3.6 m f9 f13 1 2
P699044B24M (82 ft) (11.8 ft) f13 f9 3 4
P699044D25E 25 m 3.6 m f11 f13 1 2

P699044B25N (82 ft) (11.8 ft) f13 f11 3 4
P699044D26F 25 m 3.6 m f8 f10 1 2

P699044B26P (82 ft) (11.8 ft) f10 f8 3 4
P699044D33P 25 m 3.6 m f8 f11 1 2

P699044B33W (82 ft) (11.8 ft) f11 f8 3 4
P699044D27G 25 m 3.6 m f8 f12 1 2

P699044B27Q (82 ft) (11.8 ft) f12 f8 3 4
P699044D28H 25 m 3.6 m f8 f14 1 2

P699044B28R (82 ft) (11.8 ft) f14 f8 3 4
X-HWE-A-UMM-0001 9
02/08/11

Bond (1, 2, 3, or 4)
Cable
250 MCM
P699044D29K 25 m 3.6 m f10 f12 1 2
P699044B29S (82 ft) (11.8 ft) f12 f10 3 4
P699044D30L 25 m 3.6 m f10 f14 1 2

P699044B30T (82 ft) (11.8 ft) f14 f10 3 4
P699044D31M 25 m 3.6 m f12 f14 1 2

P699044B31U (82 ft) (11.8 ft) f14 f12 3 4
Table 6: Electric Joint Installation
Note 1: For each joint the total length of the cable is obtained by totaling the lengths of the two cables installed in
parallel. This is done in order to allow calculate the total amount of cable needed.
Note 2: the following lengths of S joints and cables apply for standard and non-standard gauges
Gauge [mm] Length of cable [m] L1 [m] = L2 [m] Tolerance [m]

250 MCM
891 (2.92 ft) 22 (72.1 ft) 3.9 (12.79 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1435 (4.7 ft) 24 (78.7 ft) 3.6 (11.8 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1676 (5.49 ft) 26 (85.3 ft) 3.5 (11.48 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
Table 7: Electric Joint Installation - Gauge Dependant
2.2 Terminal Bond
Freq. Tuning Unit 2 Cable L Installation of Connection Cables.

F 500 (A, B) or (B, A) and (B, C) or (C, B) are the
Part No. Bond
MCM sets of terminals on the tuning unit
2
X-HWE-A-UMM-0001 9
02/08/11
F7 P699 044 D22B

P699 044 B22K
(F7/F13)
F8 P699 044 D28H

P699 044 B28R
(F8/F14)
F9 P699 044 D24D

P699 044 B24M L L
(F9/F13)
22 m 2.7m F or F
F10 P699 044 D30L 72 ft 8.85ft

(A, B) or (A, B) or
P699 044 B30T (B, A) (B, A)
(F10/F14)
F11 P699 044 D25E

P699 044 B25N
(F11/F13)
F12 P699 044 D31M

P699 044 B31U
(F12/F14)
L L
F13 P699 044 D22B
P699 044 B22K F or F
22 m 2.7m
(F13/F7)
72 ft 8.85ft (C, B) or (C, B) or
(B, C) (B, C)
F14 P699 044 D28H
P699 044 B28R
(F14/F8)
Table 8: Terminal Joint Installation

Note 1: The cable used for the bond - and for the calculation of the required cable length - is type one 500 MCM or two
500 MCM. Here two cables can be installed (multipling the lengths indicated in the table by two) in case of presence of
strong traction currents.
Note 2: the following lengths of terminal joints and cables apply for standard and non-standard gauges
X-HWE-A-UMM-0001 9
02/08/11
Gauge [mm] Length of cable [m] L [m] Tolerance [m]

1 x 500 MCM
891 (2.92 ft) 22 (72 ft) 3.0 (9.84 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1435 (4.7 ft) 22 (72 ft) 2.7 (8.85 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1676 (5.49 ft) 22 (72 ft) 2.6 (8.53 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
Table 9: Terminal Joint Installation - Gauge Dependant
2.3 Short Circuit Bond
Freq. Tuning Unit 3 Cable L [m] Installation of Connection Cables.

F Part No. 250 (A, B) or (B, A) and (B, C) or (C, B) are the
MCM sets of terminals on the tuning unit
F7 P699 044 D22B
P699 044 B22K
(F7/F13)
F8 P699 044 D28H

P699 044 B28R
(F8/F14)
F9 P699 044 D24D F L or L F

P699 044 B24M 1.7 m 4.6 m
(F9/F13)
5.57 ft 15 ft (A, B) or (A, B) or
F10 P699 044 D30L (B, A) (B, A)
P699 044 B30T
(F10/F14)
F11 P699 044 D25E

P699 044 B25N
(F11/F13)
F12 P699 044 D31M

P699 044 B31U
(F12/F14)
3
X-HWE-A-UMM-0001 9
02/08/11
F13 P699 044 D22B L L

P699 044 B22K F or F
1.7 m 4.6 m
(F13/F7)
5.57 ft 15 ft
F14 (C, B) or (C, B) or
P699 044 D28H
P699 044 B28R (B, C) (B, C)
(F14/F8)
Table 10: Short Circuit Bond Installation
Note 1: The cable used for the bond - and for the calculation of the required cable length - is type one 250 MCM In this
case, 500 MCM can be installed in case of presence of strong traction currents.
Note 2: The following lengths of terminal bonds and cables apply for standard and non-standard gauges
Gauge [mm] Length of cable [m] L [m] Tolerance [m]

250 MCM
891 (2.92 ft) 1.2 (3.93 ft) 5.0 (16.4 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1435 (4.7 ft) 1.7 (5.57 ft) 4.6 (15 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
1676 (5.49 ft) 2.0 (6.56 ft) 4.4 (14.4 ft) -0.1 (0.32ft) /+0.1 (0.32ft)
Table 11: Short Circuit Bond Installation - Gauge Dependant
X-HWE-A-UMM-0001 9
02/08/11
3 OPERATION A: CABLE TO RAIL CONNECTION (CEMBRE KIT)

GENERAL DEFINITIONS
For the “progressive distance” positioning, refer to the edge of the tie nearest to the progressive distance indicated in
the schematic layouts.
The edge is defined along which the “progressive distance of the joint” will be fixed with the aid of plastic clamps; the
distances L1 and L2 will be measured starting from the same edge.
Distances L1 and L2, indicated in the tables and in the drawings, are specifically selected so that the two pieces of
cable are perpendicular to the track (and make up the end parts of the joint) at the edge of a tie, to which they will be
fixed using plastic clamps.
Holes will be made in the rails to fasten the Cembre kits (type AR60) and are positioned at a distance of 10 cm (3.9
inches) from the edge of the tie determined by L1 or L2, on the part of the rail head not occupied by the fish plate
fastening the rail to the tie.
The holes in the rails to fix the Cembre kits type AR60 (for fastening the connecting cables in correspondence with the
progressive distance of the joint) are positioned at a distance of 10 cm (3.9 inches) from the edge of the tie chosen as
central axis of the joint, at the part of the rail head not occupied by the fish plate fastening the rail to the tie.
If the terminal parts of the joint given by distances L1 and L2 do not exactly coincide with the edge of a tie, two piles
must be installed in the ballast at equal distance between each other and the rails, perfectly under the cables already
installed. The cables should be fixed to the piles through plastic clamps
The holes in the rails to fix the Cembre AR60 kits should be positioned, also in this case, at a distance of a 10 cm (3.9
inches) from the cable axis (regardless whether to the right or to the left) from the point where axis and rail come
together.
Below are drawings provided for the installation of the Cembre kits AR60 (terminal part of the joint) and AR60 (for
connecting cables in correspondence with the progressive distance of the joint).
X-HWE-A-UMM-0001 9
02/08/11
3.1 Kit Cembre AR60 for S Cable
WIRE “A or C” RAIL CONNECTION (Section 25 mm / 0.98 in)

WITH CEMBRE AR60 KIT
TORQUE 5 Nm (3.69 ft lbs)
16 mm? (0.63 in) WIRE FOR GROUNDING BOX SUPPORT

M987010160V OF THE TU
WIRE TERMINALS TYPE CEMBRE CCS16-M6 E060020103B 1
NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
6” (250 MCM)
Figure 3-1. Fixing Points of the SDTC “S” Bond to the Rails (see Drawing: G69908900AB)
Distances L1 and L2 are measured from the edge of the tie chosen for the installation of the center of the joint. The
fixing hole must be drilled about 10 cm (3.9 inches) from these distances on the side of the rail not occupied by the fish
plate fastening the rail to the tie.
X-HWE-A-UMM-0001 9
02/08/11

CABLE CLIP E03599000Z

(SUPPLIED BY BONCIANI)
2700 (WITH TWO CABLES 250 MCM

16 mm? (0.63 in) WIRE FOR GROUNDING BOX

SUPPORT M987010160V OF THE TU
WIRE TERMINALS TYPE CEMBRE CCS16-M6
E060020103B 1
NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
7” (500 MCM)
Figure 3-2. Fixing Points of the SDTC Terminal Bond to the Rails (See Drawing: G69908900DE)
X-HWE-A-UMM-0001 9
02/08/11
DRILL HOLE Ø 19 mm / 0.74 in
Figure 3-3. Installation of Cembre Kit AR60 (See Drawing: G69908900AB)
X-HWE-A-UMM-0001 9
02/08/11
3.2 Cembre Kit AR60 for TU Cables


NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
6” (250 MCM)
Figure 3-4. Fixing Points of the “S” Bond TU Cables to the Rails (See Drawing: G69908900AB)
Once the edge of the tie to which the connecting cables are to be fixed has been determined, the attachment hole for
these should be drilled at a distance of about 10 cm (3.9 inches) from the edge, at the part of the rail not occupied by
the fish plate fastening the rail to the tie.
X-HWE-A-UMM-0001 9
02/08/11


2700 (WITH TWO CABLES 1X185 mm?) [0.04x7,28 in]


E060020103B 1
NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
7” (500 MCM)
Figure 3-5. Fixing Points of the Terminal Bond TU Cables to the Rails (See Drawing: G69908900DE)
X-HWE-A-UMM-0001 9
02/08/11
DRILL HOLE Ø 19 mm / 0.74 in
Figure 3-6. Installation of the Cembre kit AR60 for TU cables (See drawing: G69908900DE)
3.3 Tools for Drilling Rails
Drilling Rails
Type of Rail Hole Diam. Kit Drill Type Rail Template Position
Rail UIC 60 19 mm (7.48 in) AR60 LD-1P MPAFN UIC60 F(axis drilling)
Table 12: Short Circuit Bond Installation - Gauge Dependant
The template is used to position the drill on the rail and therefore depends on the type of rail to be drilled, in this case
UIC 60.
Systems for electrical rail connection Installation

AR60 HTEP
(FS: CAT.846/961-962) (FS: CAT.846/PROG.963)
Flex. Cu Cable Terminal Hydraulic Tools: HT120 HT131-C RHC131

[sect.] Type Die Set Type Compression
2
25 mm CCS25-M6 MCCS25-C 1
2
0.038 in
(185 mm2) (2A37.26-M12) ME37-C + MK28L-C 1+1
250 MCM
(conductor end + sheath end)
X-HWE-A-UMM-0001 9
02/08/11
The type of terminal and the hydraulic tool used determines the set of compression dies for the conductor or for the
cable sheath.
3.4 Characteristics of the Recommended Tools
3.4.1 Hydraulic tool type HT 131-C

Suitable for compression type electric connectors.
Features two speeds for piston motion: one for quick positioning of the dies to the connector, the other for drilling.
The drilling head can be rotated up to 180° to allow the operator to work in the most convenient position.
Length of Tool : 473 mm (18.62 in)
Fit with a safety valve which will open when the maximum pressure is exceeded and with a pressure release device
that is easily actuated at all times.
The tool is supplied complete with a case to house the tool and 15 die sets.
3.4.2 Hydraulic Nut Shearing Device Type RHTD 3241

Suitable for shearing nuts with hexagonal head dimensions from 32 to 41 mm (1 1/4 in to 1 3/5 in)
This tool is operated by connecting it to a hydraulic pump with 700 bar output.
3.4.3 Hydraulic Pump Type PO 700

Pedal actuated hydraulic pump with two operating speeds. Develops 700 bar pressure. Complete with 3 m (9 ft) high-
pressure flexible hose and female self-locking quick coupler.
Tool case.
In alternative to pump PO 700, use the following:
3.4.4 Portable Electric Hydraulic Pump CPE-0-P12

Driven by a 12 V DC motor. Develops a maximum pressure of 700 bar. The pump can be operated either using a
battery or an external 12 V DC power supply. Comes complete with internal battery charger.
The following accessories are available:
 3 m (9 ft) flexible hose complete with male + female self-locking quick couplers
 Remote control cable
 External 12 V DC supply cable
 Back-up 12 V battery
 Battery charger power cable (110 V - 60 Hz).
 Canvas bag for storing the tool and for carrying accessories.
3.4.5 Wooden Tie Drill Type SD-5P
Engine : Two-stroke combustion
X-HWE-A-UMM-0001 9
02/08/11
Displacement : 48.6 cc
Horsepower : 1.9 hp / 1.4 kW
Fuel : 4% gasoline mixture
Start : Rope pull
Clutch : Automatic centrifuge
Drilling range : up to  20 mm (4 AWG)
Max. drilling thickness : 200 mm (7.87 in)
Weight : 18 Kg (39.6 lb)
Bits used : FS auger type
Advantages
 Low weight
 Well balanced, both for transport and for drilling (single operator)
 No need for stand
 Centrifugal clutch between engine shaft and boring bar (when the engine is started the drill remains still)
 Shock absorber between engine shaft and boring bar (when the engine is started the drill remains still)
 Shock absorber between engine shaft and boring bar for reduced vibration
 Easy adjustment of drilling depth
 Suitable bit protection with a spring operated telescopic guard
 Return chips for easy removal of the bit after operation (lower operator effort required)
 Easy bit release outside if needed
3.4.6 Rail Brill Type LD-1P

Driven by a combustion engine and highly suitable for drilling rails.
Its is very light (18 Kg, 39.7 lbs) and its limited dimensions make is highly suitable for drilling switch tongues.Its drilling
capacity ranges from diameters of 7 to 32 mm (0.27 in 1.25in) with a suitable automatic bit cooling system.
It is particularly suitable for following applications:
 Drilling rails for the installation of track circuits and equipment for the return of traction currents
 Horizontal and vertical drilling for the installation of switches type 46-50-60 UNI and in particular for double
slip points type 40-60 UNI without damaging the track equipment
 Drilling for the installation of snow protection systems for points 46-50-60 UNI
 Drilling for interconnection of the rail heads.
X-HWE-A-UMM-0001 9
02/08/11
4 OPERATION B: INSTALLATION ELECTRIC JOINT CABLES


NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
6” (250 MCM)
Figure 4-1. Layout of the “S” Bond (See Drawing: G69908900AB)
Note: bending radius for 250 MCM cable is 6”.
X-HWE-A-UMM-0001 9
02/08/11
COPPER CABLE AFUMEX 250 MCM
Figure 4-2. Fixing Cembre Cable Terminal Type 2A24. 15-M120V to Cembre Kit AR60 in an S Bond
(See Drawing: G69908900AB)
X-HWE-A-UMM-0001 9
02/08/11




E060020103B 1
NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
7” (500 MCM)
Figure 4-3. Layout of the terminal Bond (See Drawing: G69908900DE)
Note: bending radius for 500 MCM cable is 7”.
X-HWE-A-UMM-0001 9
02/08/11
WIRE TERMINALS TYPE CEMBRE 2A.37.26-m12
Figure 4-4. . Fixing Cembre Cable Terminal Type 2A24. 15-M120V to Cembre Kit AR60 in a S Bond
(See Drawing: G69908900DE)
X-HWE-A-UMM-0001 9
02/08/11
5 OPERATION C: INSTALLATION OF CONNECTING CABLES

GENERAL DEFINITIONS
Please refer to the edge of the tie nearest to the progressive distance indicated in the layout diagrams to determine the
position for the center of the joint.
Once this edge has been determined, fix the connecting cables to the edge together with the two cables of the joint
using plastic clamps.
The holes for the Cembre Kit AR6 for the fixing of the TU connecting cables should be positioned at a distance of 10
cm (3.9 in) from the edge of the tie on which the cables are fixed, at the portion of the rail head rail not occupied by the
fish plates that fasten the rail to the tie.


NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
6” (250 MCM)
Figure 5-1. Layout of the “S” Bond Connecting Cables (See Drawing: G69908900AB)
X-HWE-A-UMM-0001 9
02/08/11
WIRE TERMINALS TYPE CEMBRE CCS25-M12 2
Figure 5-2. Fixing the Cembre Cable Terminal CCS25-M12 to the Cembre Kit AR60 (See Drawing: G69908900AB)
COMB TERMINAL CEMBRE type 2348AV CABLE DIAMETER 18 ÷ 22 mm (0.71” TO 0.87”)

25 Nm / 18.44 ft lbs
CABLE “B” (25 mm ? [1" ?])
ISOLARE IL COLLEGAMENTO CON

NASTRO AUTOAGGLOMERANTE 3M
SCOTCH N. 23
ISOLATE THE CONNECTION WITH 3M
SCOTCH No. 23 SELF- INSULATE CONNECTION WITH
AGGLOMERATING TAPE
Figure 5-3. Fixing the Connecting Cable to the Center of the “S” Bond (See Drawing: G69908900AB)
X-HWE-A-UMM-0001 9
02/08/11



E060020103B 1
NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
7” (500 MCM)
Figure 5-4. Layout of the Terminal Bond Connecting Cables (See Drawing: G69908900DE)
X-HWE-A-UMM-0001 9
02/08/11
WIRE TERMINALS TYPE CEMBRE 2A.37.26-m12
Figure 5-5. Fixing the Cembre Cable Terminals CCS25-M12 and Cembre Type 2A 37.26-M12 to the Cembre Kit AR60
on the Terminal Bond (See Drawing: G69908900DE).
For the terminal joints, fix the connection cables to the Cembre Kits in such a way as to avoid interference with the joint
cable terminal.
5.1 Clip Layout

The clips must be positioned along the rail at a maximum distance of 60 cm (23.6 in) from each other.
X-HWE-A-UMM-0001 9
02/08/11


NUT M6 K36106000T 2
GROWER UNI 1751 – B 6.1-K431061000M 1
6” (250 MCM)
Figure 5-6. 7 Layout of clips to fix the “S” bond and the cables to the rail (See Drawing: G69908900AB)
X-HWE-A-UMM-0001 9
02/08/11
Figure 5-8. Cross-section of the clips to fix the bonds and the cables to the rail (See Drawing: G69908900AB)
5.2 Installation of Terminal Bonds with Center Connection

The SDTC terminal bond uses 1 cable 500 MCM. The cable for connection to the center point of the loop is 2 by
500 MCM and is connected to the center point of the loop using two comb shaped clamps type 2346AV.
The SDTC terminal bond may also use 2 cables 500 MCM when strong traction currents are present. The cable
for connection to the center point of the loop is 4 by 500 MCM and is connected to the center point of the loop using
four comb shaped clamps type 2346AV.
X-HWE-A-UMM-0001 9
02/08/11
6 OPERATION D: INSTALLATION OF THE TUNING UNITS

The drawings refer to the “S” bond, but are analogous for terminal bonds and short circuit bonds.
The tuning unit installation stages are as follows:
Installation of the support and set-up for insertion into the support of the transmitter/receiver cables and for the
connecting cables. The support distance must guarantee that the cable connection to the nearest rail will not be greater
than 5.5 m (18 ft).
Fixing the tuning unit to the support.
Fixing the connecting cable conductors to the joint based on the specifications in Section 3.
Fixing the transmitter/receiver cable conductors according to the specifications given in Table 13 of this section.
Installation in electrified territory

For installation on electrified lines the metal body of the support, and if necessary the shields of the transmitter/receiver
cables, must be connected to the ground system (after having connected them to each other).
The support must have an external terminal for connection to the ground conductor (EC). The shields of the
transmitting/receiving cables can also be connected to this.
The most convenient and functional method depends on how the installation is grounded.
If an underground cable is used all along the line, crimp the EC cable (16mm2, 0.0248 sq. in) from the fixing point
of the tuning unit to the underground cable, or to the nearest junction for this cable.
If metal poles are used for the electric traction, connect the EC cable (16mm2, 0.0248 sq. in) from the fixing point
of the tuning unit to the bolts at the base of the pole nearest to the tuning unit.
If there are metal grounding devices for the electric traction connected to the grounding system, connect the EC
cable (16mm2, 0.0248 sq. in) coming from the fixing point of the tuning unit to the junction of the grounding devices for
the electric traction, as in the previous case.
In any case, no additional ground piles are required near the tuning unit.
Installation in electrified territory
If the installation is not in electrified territory it is not necessary to connect the cable shields to the ground system, since
there is no risk of interference with the electric traction.
The cables must be protected against humidity using sealed boxes.
X-HWE-A-UMM-0001 9
02/08/11
Tuning Unit Tuning Unit Part No. Fix to CN3 the Fix to CN4 the
Frequency Pair cable with cable with
frequency: frequency:
f7 - f9 P699044D20Z f7 f9
P699044B20G
f7 - f11 P699044D21A f7 f11
P699044B21H
f9 - f11 P699044D23C f9 f11
P699044B23L
f9 - f13 P699044D24D f9 f13
P699044B24M
f11 - f13 P699044D25E f11 f13
P699044B25N
f7 – f13 P699044D22B f7 f13
P699044B22K
f8 - f10 P699044D26F f8 f10
P699044B26P
f8 - f12 P699044D27G f8 f12
P699044B27Q
f10 - f12 P699044D29K f10 f12
P699044B29S
f10 - f14 P699044D30L f10 f14
P699044B30T
f12 - f14 P699044D31M f12 f14
P699044B31U
f8 – f14 P699044D28H f8 f14
P699044B28R
f7 - f10 P699044D32N f7 f10
P699044B32V
f8 - f11 P699044D33P f8 f11
P699044B33W
Table 13: Fixing Cables to the Tuning Units 4
4
X-HWE-A-UMM-0001 9
02/08/11
Following are the different types of vertical and horizontal TU mountings.
MAXIMUM LENGTH OF CABLE = 5.5 m (18 ft) MEASURED

FROM THE TRACK CLOSEST TO THE TU
Figure 6-1. Cross-section of the vertical wall tuning box (See Drawing: G69908900AB)

Figure 6-2. Cross-section of the vertical under platform tuning box (See Drawing: G69908900BC)
X-HWE-A-UMM-0001 9
02/08/11

Figure 6-3. Cross-section of the vertical support tuning box (See Drawing: G69908900CD)
Note: when vertical support is close to the track (2 m, 6.5 ft), mount the TU box opposite the track.

UPRIGHT N699044042S 1
Figure 6-4. Cross-section of the horizontal tuning box (See Drawing: G69908700KD)
X-HWE-A-UMM-0001 9
02/08/11
7 OPERATION G: INSTALLATION OF INDOOR EQUIPMENT
7.1 Part Numbers for Room Equipment

The following boards are installed in the room:
Breakdown by Board (coated) Part Number

TxRx Main Box (coated) N897 164 610L ÷ 617T
TxRx Switch Box (coated) N897 164 650D ÷ 657M
Tx Board (transmitter coated) N897 168 510Z ÷ 517G
SDTC Rx Board (receiver coated) N897 164 516H ÷ 523 R
RT Board (train detection coated) N897 092 520B
MODEM HF Board (modem coated) N897 163 510Q
DIAG board N897 093 012M
Mother Board (coated) N897 162 510C
Power Conversion Box 110 V AC P700 338 A30F
Table 14: Part Numbers for Room Equipment
7.2 Room Installation

The room equipment is provided already mounted in cubicles, divided into SDTC cubicles and Cable Arrival cubicles
(or frames). The cubicles are positioned according to the room drawing, custom made for each location and each
contract. All cubicles are factory tested by the MAT (Manufacturing Acceptance Test). Perform the following mounting
operations in the signaling room:
Connect the field cables to the Cable Arrival frame connectors
Connect the power mains 110 V AC to the SDTC cubicles
Ground the cubicles
Connect the indoor cables from the SDTC cubicles with the IXL (interlocking) computer or relays.
The racks are powered with 110 V (± 10%) at 50-60 Hz, from an UPS (Uninterruptible Power Supply).
The power supply cable must have a cross-section of at least 2.5 mm2 (13 AWG) at 110 V AC and must be protected
(upstream) in the system by a bipolar magnetothermal switch with a current value of 10 A curve C (max 10 SDTC).
Values are double for 110 V AC.
The ground point of the rack shall be connected to the ground point of the room using a yellow-green EC (Earthing
Conductor) cable with a cross-section of at least 16 mm2 (0.0248 sq. in) installed in a cable duct, a protective hose or
under the room flooring.
The rack transmitter/receiver cables must be protected against humidity by the application of special resin cones.
The cables must be fastened inside the frame using the cones mounted on bars in the arrival frame cubicle.
X-HWE-A-UMM-0001 9
02/08/11
The cable shielding and armor must be interconnected using a yellow-green EC cable from the resin.
This cable shall have a cross-section of 6 mm2 (0.009 in2) and must be fit with a terminal for connection to the rack
busbar.
7.3 Connection of the Field Cable to the Arrival Cable

Field Cables are connected as shown in the tables, lists and drawings of the track circuit cables in the Arrival Cubicle.
The field cable connecting Tx and Rx from TU to the room equipment are two twisted pairs, shielded and armored, see
specifications 1 and 2. In special cases one twisted pair cable can be installed.
Cable part numbers:
- Two twisted pairs M991709321D
- One twisted pair M991709323F
Cables are usually supplied on reels. The maximum length is about 1000 m (300 ft). Each field section must be sealed
with resin in order to avoid insulation leakage.
The indoor cables connecting the Arrival frame and the SDTC are labeled, as shown in the cable list and signaling
room drawings. Track circuit field signals are connected on the SDTC mother board in the position indicated in Figure
7-1 as CN2 or TX-RX, using MetriMate connectors with lock clips.
Figure 7-1. Upper part of the rear mother board with connectors CN2 and CN5
X-HWE-A-UMM-0001 9
02/08/11
7.4 Connection of Cables between Cubicles

The SDTC cubicles and IXL cubicles are connected by labeled cables. See the cable list and wiring diagrams for the
signaling room. The track circuit output signals plug in to the SDTC mother boards as shown in Figure 7-1 at CN5
named VITAL OUT, using MetriMate connectors with lock clips.
X-HWE-A-UMM-0001 9
02/08/11
8 INSTALLATION VERIFICATION
8.1 Installation Inspection

To check that the installation has been performed properly, fill-in the cable check forms. Record the inspection of the
cables and grounding. See the relevant Quality Control Plan for the forms for each specific contract.
8.2 Connection Inspection

Check the connections in the room. Fill-in the cable forms. Record the inspection of the cables, of the power supplies
and of the grounding system. See the relevant Quality Control Plan for the forms for each specific contract.
X-HWE-A-UMM-0001 9
02/08/11
9 SHIPPING AND PACKING

All equipment is shipped in suitable packaging to protect it from impact during the transport and handling during
installation. Differences can be found for:
Cubicles (racks)
Individual field equipment
Cables
Cubicles are transported on wooden pallets, fixed using belts and protected against dust and elements by plastic
covers. Handle in the factory and in the field using a local pallet truck.
Individual equipment, e.g. Tuning Units, screws, small mechanical accessories, are packaged in paper boxes and
shipped on pallets, when possible.
The cables are generally supplied in skeins (small cross-section, not excessively long) or on wooden reels (large cross-
section and long).
X-HWE-A-UMM-0001 9
PATH Digicode® PSP
APPENDIX D-10 SDTC Test and Commissioning Manual
64 of 80
Test and Commissioning Manual
30/06/11 A. Giovannucci
A. Barbacini D. Giangaspero
P. A. Aisa
BOLOGNA
Confidentiality Category Control Category ALSTOM FERROVIARIA SpA

Riservato Normale Controllato Not Controllato Information Solutions
DISTRIBUTION
Via di Corticella 75, 40128 Italy
Restricted Normal Controlled Not Controlled Tel. +39 051.4163111 - Fax +39 051.4163436
CONFIDENTIAL. Rev. Lang. P ages
Sharing or copying of this document, and use or communication of its contents
is not permitted without prior written authorization. X-HWE-A-UMM-0002 9 eng 72
All rights reserved.
30/06/11
BOLOGNA
REVISIONS
1 Barbacini, 10/07/02 Draft; Gaultier and Gatellier comments

Giovannucci
2 A. Giovannucci 13/12/02 63 Answer to S.I.A. ISA
3 A. Giovannucci 27/08/04 74 TU fixing, regulation, final test. DIAG jumpers
4 A. Giovannucci 30/06/11 71 MM L1
5 A. Giovannucci 29/10/10 69 Revision after Verification Report; change of directionality

measurement; added setup diag. for CEDD; shunt limit 0.32 V for
free track circuit Vrx ≥ 0.9 V; erased REV measurements when
SDTC is used only for train detection; added modem jumpers
settings for Main/Switch; added 110 V Power Conversion
6 A. Barbacini 03/03/11 68 Some parts that were in Italian were translated into English and
added US units.
P.A. Aisa
7 A. Giovannucci 14/03/11 68 Corrected list of Tx Rx box part numbers and TU tuning form
8 P.A. Aisa 25/03/11 68 Modified based on comments received from US application.
P.A. Aisa
9 30/06/11 72 PATH application, new document code
A. Giovannucci
CONFIDENTIAL. Sharing or copying of this document, and use or communication of its Reference Rev. Page/s
contents is not permitted without prior written authorization.
X-HWE-A-UMM-0002 9 2/72
30/06/11
BOLOGNA
SAFETY RULES FOR PERSONNEL

o Safety shoes
o Protective helmet
o Protective gloves
are closed.
X-HWE-A-UMM-0002 9 3/72
30/06/11
BOLOGNA

- Locate emergency switches to be operated in case of an emergency
- Disconnect protection circuits when performing the following activities:
- Cable connection / disconnection
- Subrack connection / disconnection
- Board connection / disconnection
- Software Upgrade
- Always check that the power supply is disconnected when operating on racks
- Never work alone
- Survey the work area and identify any slippery areas, uncovered cables and sharp
edges
- If an accident should occur, avoid involving other employees. Seek first aid
immediately.
Snap-to-banana coiled cord
Alligator clip for heart/chassis

connection
Wrist strap coiled cord
Table 0-1: SAFETY RULES FOR PERSONNEL
X-HWE-A-UMM-0002 9 4/72
30/06/11
BOLOGNA
CONTENTS
SAFETY RULES FOR PERSONNEL............................................................................................................................................. 3

1 INTRODUCTION .................................................................................................................................................................. 10
1.1 SCOPE OF THIS DOCUMENT......................................................................................................................................... 10
1.2 DEFINITIONS AND ACRONYMS..................................................................................................................................... 10
1.3 REFERENCES ................................................................................................................................................................. 11
1.3.1 STANDARDS ............................................................................................................................................................ 11
1.3.2 SDTC DOCUMENTATION........................................................................................................................................ 11
1.4 SMARTWAY DTC DESCRIPTION ................................................................................................................................... 11
1.4.1 OVERVIEW............................................................................................................................................................... 11
1.5 FIELD OF APPLICATION ................................................................................................................................................ 19
1.6 PRELIMINARY INSPECTION .......................................................................................................................................... 20
1.7 SEQUENCE OF TEST AND COMMISSIONING OPERATIONS...................................................................................... 21
1.8 PRECAUTIONS AND REQUIREMENTS ......................................................................................................................... 21
1.9 LIST OF TOOLS............................................................................................................................................................... 22
2 CALIBRATION OF ELECTRICAL JOINT/TUNING UNIT BOX ........................................................................................... 23
2.1 PRELIMINARY INSPECTION .......................................................................................................................................... 23
2.2 SDTC MODULE STARTUP.............................................................................................................................................. 24
2.3 SDTC - TUNING UNIT /ELECTRICAL JOINT CALIBRATION ........................................................................................ 25
2.3.1 LIST OF TOOLS ....................................................................................................................................................... 26
2.3.2 PRELIMINARY OPERATIONS FOR FIELD AND SER............................................................................................. 26
2.3.3 SEQUENCE OF SER OPERATIONS ....................................................................................................................... 27
2.3.4 SEQUENCE OF FIELD OPERATIONS .................................................................................................................... 29
2.3.4.1 Low Impedance Value....................................................................................................................................... 33
2.3.4.2 Switch Diverted Branch TU Tuning ................................................................................................................... 33
2.3.5 CHECK OF JOINT DIRECTIONALITY...................................................................................................................... 35
2.3.5.1 Directionality Test – Special Case .................................................................................................................... 35
3 JUMPER SETTINGS FOR SDTC BOARD CONFIGURATION............................................................................................ 37
3.1 PRELIMINARY OPERATIONS......................................................................................................................................... 37
3.2 LIST OF TOOLS............................................................................................................................................................... 37
3.3 MOTHER BOARD ............................................................................................................................................................ 37
3.4 MODEM BOARD .............................................................................................................................................................. 39
3.5 RX BOARD (N897164….) ................................................................................................................................................ 40
3.6 RT BOARD (N897 092 020H)........................................................................................................................................... 42
4 SDTC REGULATION PROCEDURE.................................................................................................................................... 43
X-HWE-A-UMM-0002 9 5/72
30/06/11
BOLOGNA
4.1 TRACK CIRCUIT PARAMETERIZATION ........................................................................................................................ 43

4.1.1 LIST OF TOOLS ....................................................................................................................................................... 43
4.1.2 USE OF THE PROGRAM ......................................................................................................................................... 43
4.2 TXRX VOLTAGES REGULATION PRINCIPLE ............................................................................................................... 44
4.2.1 TXRX VOLTAGES REGULATION PRINCIPLE ........................................................................................................ 44
4.2.2 LIST OF TOOLS ....................................................................................................................................................... 44
4.2.3 REGULATION PROCEDURE ................................................................................................................................... 46
4.2.3.1 Preliminary SER Procedures ............................................................................................................................ 46
4.2.3.2 Regulation Transmitter Setting.......................................................................................................................... 46
4.2.3.3 Measurements on Receiving Electrical Joint(s) on Main TC ............................................................................. 46
4.2.3.4 Regulation of Receiver(s) Setting(s) ................................................................................................................. 47
4.2.3.5 Output Control................................................................................................................................................... 48
4.2.3.6 DOT .................................................................................................................................................................. 48
4.2.3.7 Reset of Initial Conditions ................................................................................................................................. 48
4.2.3.8 Data Recording ................................................................................................................................................. 48
5 FINAL TESTS....................................................................................................................................................................... 49
5.1 LIST OF TOOLS............................................................................................................................................................... 49
5.2 SHUNT VERIFICATION IN THE TRACK CIRCUIT.......................................................................................................... 49
5.3 SHUNT VERIFICATION IN THE JOINT AREA ................................................................................................................ 50
5.4 PRE-SHUNT VERIFICATION OUTSIDE THE JOINT ...................................................................................................... 51
5.5 CHANGE OF DOT AND DATA RECORDING ................................................................................................................. 51
5.6 CODE VERIFICATION ..................................................................................................................................................... 52
5.7 END OF TEST .................................................................................................................................................................. 52
6 APPENDIX A: CALIBRATION OF ELECTRICAL JOINTS/TUNING UNIT WITHOUT SER EQUIPMENT ......................... 53
6.1 TUNING UNIT/JOINT UNIT CALIBRATION .................................................................................................................... 53
7 APPENDIX B: DIAGNOSTIC BOARD N897093011L-12M.................................................................................................. 57
8 APPENDIX C: MODEM FREQUENCY AND CODE SELECTION (N897163010W) ............................................................ 61
9 APPENDIX D: CODE OF BOARD CONNECTORS ............................................................................................................. 68
10 APPENDIX E: JOINT/TU RECORD FORM.......................................................................................................................... 69
11 APPENDIX F: SDTC REGULATION AND FINAL TEST RECORD FORM ......................................................................... 71
X-HWE-A-UMM-0002 9 6/72
30/06/11
BOLOGNA
FIGURES
Figure 1-1 Cubicle Arrangement.......................................................................................................................................13
Figure 1-2. Rack - Front View...........................................................................................................................................13
Figure 1-3. Rack - Rear View (Power Supply Portion) .....................................................................................................13
Figure 1-4. TxRx Box - Front Panel ..................................................................................................................................14
Figure 1-5. RT Board Front Panel ....................................................................................................................................15
Figure 1-6. MODEM Board Front Panel ...........................................................................................................................16
Figure 1-7. DIAG Board Front Panel ................................................................................................................................18
Figure 2-1. Upper portion of the motherboard with housing for CN2 connector ..............................................................24
Figure 2-2. Impedance of Tuning Unit/Electrical Joint Based on Transmission Frequency.............................................25
Figure 2-3 Rx Board for SDTC (N897 164 ----) ................................................................................................................28
Figure 2-4 MODEM HF_2 SDTC (N897 163 010W) ........................................................................................................29
Figure 2-5 Track Circuits Powered during Commissioning ..............................................................................................30
Figure 2-6 – SDTC Joint / TU Record Form .....................................................................................................................30
Figure 2-7 Layout of tuning unit board (N897120 ----)......................................................................................................31
Figure 2-8 Voltages for directionality tests .......................................................................................................................35
Figure 2-9 Crosstalk Directionality Test Layout................................................................................................................36
Figure 3-1 P3-P4 Setting on the Motherboard..................................................................................................................38
Figure 3-2 Main/Switch Rear Cabling...............................................................................................................................39
Figure 3-3 Rx Board for SDTC (N897164 ----) .................................................................................................................41
Figure 3-4 RT NDV_SDTC (N897 092 020H) ..................................................................................................................42
Figure 4-1 “Vrail_Rx” Voltage and “Irail_Rx” Current Measurement Point .......................................................................47
Figure 4-2 Series Connection of Two Rail Current Meters...............................................................................................47
Figure 5-1 Shunt in the Track Circuit ................................................................................................................................50
Figure 5-2 Shunt Test inside the Electrical S Bond ..........................................................................................................50
Figure 5-3 Pre-shunt Verification ......................................................................................................................................51
Figure 5-4 MODEM and PC Connection to Verify Code ..................................................................................................52
Figure 6-1 Layout of Tuning Unit Board (N897120 ----) ...................................................................................................54
Figure 7-1 Jumper Position on the DIAG Board ...............................................................................................................57
Figure 7-2. RS232 Connection .........................................................................................................................................60
Figure 8-1 MODEM HF_2 for SDTC (N897 163 010W) ...................................................................................................62
Figure 8-2. P1, P2, P3 and P4 jumper settings for SDTC MODEM .................................................................................63
Figure 8-3. Position of jumpers P1, P2, P3, P4, P12, P13, and P14 for MODEM SDTC Main and Switch .....................64
Figure 8-4. Code settings for SDTC MODEM odd channels ............................................................................................65
X-HWE-A-UMM-0002 9 7/72
30/06/11
BOLOGNA
Figure 8-5. Code settings for SDTC MODEM even channels ..........................................................................................66
X-HWE-A-UMM-0002 9 8/72
30/06/11
BOLOGNA
TABLES
Table 0-1: SAFETY RULES FOR PERSONNEL................................................................................................................4
Table 2-1...........................................................................................................................................................................33
Table 3-1...........................................................................................................................................................................41
Table 6-1...........................................................................................................................................................................56
Table 7-1. Selection of Frequency....................................................................................................................................59
Table 8-1. Transmission Codes from C1 to C42 ..............................................................................................................67
X-HWE-A-UMM-0002 9 9/72
30/06/11
BOLOGNA
1 INTRODUCTION

This document describes the test and commissioning methods for the Smartway DTC track circuit for
Metro applications.

CEDD Concentratore Elaboratore Dati Diagnostici (Diagnostic Data Processor Concentrator)
DOT Direction of Traffic
SER Signaling Equipment Room: room containing the equipment. The Technological Office
may be in the station or along the line.
TU Tuning Unit
Rx Receiving
Tx Transmission
iVPI Logic Computer (Computer Based Interlocking)
Normal track Defines the main track where the switch points may be
Switch 1 In a track circuit with one switched branch only, this is clearly the only switched branch of
the track circuit. In a track circuit with two switched branches, this is the switched branch
closest to the joint from which the signal is transmitted on the track.
Switch 2 In a track circuit with two switched branches, this is the switched branch closest to the
joint where the signal is received on the track.
Long cable In a track circuit, this is the longer of the two cables for the two tuning units on the
normal track limiting the track circuit.
Short cable In a track circuit, this is the shorter of the two cables for the two tuning units on the
SER operator Employee working in the Signaling Equipment Room where the SDTC cubicle is located
for the track circuit subject to works.
Field operator Employee working outside the Tuning Unit/Joint Unit.
X-HWE-A-UMM-0002 9 10/72
30/06/11
BOLOGNA
1.3 References
1.3.1 Standards
[1] EN 50129 Railway applications. Communication, signaling and processing systems. Safety
related electronic systems for signaling, February 2003
[2] EN 50121-4 Railway applications. Electromagnetic compatibility. Emission and immunity of the
signaling and telecommunications apparatus. July 2006
[3] EN 50125-3 Railway applications. Environmental conditions for equipment. Equipment for
signaling and telecommunications. January 2003
[4] Protocollo di comunicazione seriale, Norma Tecnica TC.E/S.S.I./0001/002 ed.01/93, Ferrovie
dello Stato - Divisione Tecnologie e Sviluppo di Sistema -
1.3.2 SDTC Documentation


[7] SDTC – Requirements Specification ver. 5– 490502D19SY001
[8] SDTC – Architecture Description ver. 5 – 490371D19HW001
[9] SDTC – Implementation Manual ver. 4 – X-HWE-A-UMM-0004
[10] SDTC – Installation Manual ver. 8 – X-HWE-A-UMM-0001
[11] SDTC – Use and Maintenance Manual ver. 11 – X-HWE-A-UMM-0003
[12] SDTC - Application Conditions ver. 6 - 315302DXXDG002
[13] SDTC – Signal / Noise Test Report ver. 1 – 490371A19TR002
[14] Digicode Cable – Product Specification rev. 2 - X-HWE-A-TCF-0003
[15] Digicode DTC24, Specifica Tecnica Cavi CdB AF ver. 2 - X302DXXST005
1.4 Smartway DTC description
1.4.1 Overview
The Smartway DTC is a track circuit that performs train detection, rail continuity detection and track to
train data transmission functions within a track circuit, safely.
At the Smartway DTC output, the user system is supplied with vital logic signal, which corresponds to the
vacant or occupied status of the track circuit. If a train is present or a rail is interrupted mechanically, the
device indicates that the track circuit is occupied. If there is no train present or the rail is not interrupted,
the device indicates that the track circuit is vacant.
X-HWE-A-UMM-0002 9 11/72
30/06/11
BOLOGNA
In order to enhance system availability in the field, the Smartway DTC may provide diagnostics functions.
In this case, the Smartway DTC can be interfaced, via serial connection, with a portable diagnostic PC or
with a centralized system that collects diagnostics data (for example, the CEDD system).
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RT
RT
RX
RX
RX
RX
RT
TX
RT
TX
TX
TX
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RX
RT
RT
RT
RT
TX
TX
TX
TX
FAN COILS FAN COILS
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RX
RT
RT
RT
RT
TX
TX
TX
TX
MODEM
MODEM
MODEM
MODEM
DIAG
DIAG
DIAG
DIAG
RX
RX
RX
RX
RT
RT
RT
RT
TX
TX
TX
TX
FAN COILS FAN COILS

MODEM
MODEM
TWC RACK
DIAG
DIAG
RX
RX
RT
RT
TX
TX
X-HWE-A-UMM-0002 9 12/72
30/06/11
BOLOGNA
Figure 1-1 Cubicle Arrangement
DIAG Optional
DIAG Optional
Figure 1-2. Rack - Front View
Rear view of power conversion units
Figure 1-3. Rack - Rear View (Power Supply Portion)
Note: 50 V and 10 V are the transmitter power supply fuse positions. Both fuse carriers are enclosed by
the cover but only must contain a 6.3 A fuse.
NOTE: only one fuse must be inserted in the fuse holders at a time.
X-HWE-A-UMM-0002 9 13/72
30/06/11
BOLOGNA
The front panel of Rx board is combined with the Tx board. They are mounted in a box:
POWER: On/off general SDTC power

ADJ.V.RX: Receiver sensitivity
ADJ.V.TX: Transmitter regulation
DIR: direct DOT regulation
(Main and Switch Rx)
REV: reverse DOT regulation
(only in a Switch Rx)
V.TX: Transmitter voltage
V.RX: Receiver filter voltage
FUSE 24LOC: 24 V DC fuse

V.IN: Receiver cable voltage
TEST V.TX: Not used
V.OUT: Transmitter filter output voltage
24V.DIG: 24 V DC power
50 V: Transmitter power front fuse
Figure 1-4. TxRx Box - Front Panel
NOTE: Never insert two jumpers in the upper half of ADJ.V.Tx (positions 1-7), nor in the
lower half (positions 9-15). Always use one jumper in the upper part and one jumper in
the lower part.
X-HWE-A-UMM-0002 9 14/72
30/06/11
BOLOGNA
RT board - front panel:
MSR +
⎬ : Electromagnetic drive magnetic threshold
MSR -
20 KHz : 20 kHz Generator Output
24 V LOC : 24 V service voltage
OUT.MSR : Magnetic threshold output
OUTPUT : Track Relay or Electronic Interlocking System Vital Input
command power.
+ 5V : 5 V service voltage.
- 12V
⎬ : +12 V service voltage.
+ 12V
GND : Voltage ground
N : Normal system.
R : Standby (Reserve) system - Not used.
DELAY 1 : First Delay Unit Output
SW2 : Not used.
SW1 : Not used.
24V.SW : Not used.
Figure 1-5. RT Board Front Panel
X-HWE-A-UMM-0002 9 15/72
30/06/11
BOLOGNA
MODEM board - front panel:
MOD: The 3 red LEDs indicate that the channel set as the Modulator is in
binary form.
BIT1M: Green LED indicating bit transmitted «1».

BIT0M: LED ON indicating bit transmitted «0».
DEM: The 3 LEDs indicate that the channel set as the Demodulator is in
binary form.
CD: Green LED indicating that the Demodulator input voltage greater than 1
V peak.
BIT1D: Green LED indicating bit received «1».
BIT0D: Red LED indicating bit received «0».
GG
LF: Red LED indicating MODEM card configured for DTC24 system.
HF: Red LED indicating MODEM card configured for DTC921 system.
OSC INT: Trimmer for adjustment of frequency emitted by the internal

generator.
F1: Adjustment of coarse frequency of internal oscillator.
F2: Adjustment of fine frequency of internal oscillator.
OSC.EXT: Terminal used to insert an external generator and to read the
frequency of the internal generator.
Figure 1-6. MODEM Board Front Panel
X-HWE-A-UMM-0002 9 16/72
30/06/11
BOLOGNA
X-HWE-A-UMM-0002 9 17/72
30/06/11
BOLOGNA
Diagnostic board - front panel (optional):
+5V: Red LED for power supply.

RST: Green LED indicating reset
Rx: Red LED ON indicating receiving inquiry from PC
Tx: Green indicating transmitting data to PC
SER: Front panel RS232 connector to PC.
RST: Reset button

FAIL: Not used
INSRV: Not used
Figure 1-7. DIAG Board Front Panel
X-HWE-A-UMM-0002 9 18/72
30/06/11
BOLOGNA
1.5 Field of Application

This manual is intended to be a guide for the employees (at least two) in charge of the test and
commissioning phases of the SDTC track circuit (“TC”). This manual is valid for the following boards:

Tuning Unit Board N897 120 140Y ÷ 153N
TxRx Main Box (coated) N897 164 610L ÷ 617T
TxRx Switch Box (coated) N897 164 620W ÷ 630G
Rx Switch Box (coated) N897 164 650D ÷ 657M
The TU are divided into several types according to the combination of TC frequencies. Only the following
are available:
TU Frequencies TU Board Vertical TU Box Horizontal TU Box

Part Number Part Number Part Number
F7 – F9 N897120140Y P699044D20Z P699044B20G

F7 – F11 N897120141Z P699044D21A P699044B21H
F7 – F13 N897120142A P699044D22B P699044B22K
F9 – F11 N897120143B P699044D23C P699044B23L
F9 – F13 N897120144C P699044D24D P699044B24M
F11 – F13 N897120145D P699044D25E P699044B25N
F8 – F10 N897120146E P699044D26F P699044B26P
F8 – F12 N897120147F P699044D27G P699044B27Q
F8 – F14 N897120148G P699044D28H P699044B28R
F10 – F12 N897120149H P699044D29K P699044B29S
F10 – F14 N897120150K P699044D30L P699044B30T
F12 – F14 N897120151L P699044D31M P699044B31U
F7 – F10 N897120152M P699044D32N P699044B32V
X-HWE-A-UMM-0002 9 19/72
30/06/11
BOLOGNA
F8 – F11 N897120153N P699044D33P P699044B33W

The Tx and Rx boards are housed in TxRx boxes, as shown in the following table:
TxRx Box Part Number (coated)

F7 N897 164 610L
F8 N897 164 611M
F9 N897 164 612N
F10 N897 164 613P
F11 N897 164 614Q
F12 N897 164 615R
F13 N897 164 616S
F14 N897 164 617T
F7 / F11 N897 164 620W
F7 / F12 N897 164 621X
F13 / F7 N897 164 622Y
F13 / F8 N897 164 623Z
F14 / F7 N897 164 624A
F14 / F9 N897 164 625B
F14 / F10 N897 164 626C
F14 / F12 N897 164 627D
F13 / F11 N897 164 628E
F13 / F10 N897 164 629F
F14 / F8 N897 164 630G
1.6 Preliminary Inspection

For the track circuit under commissioning, the operations illustrated in this manual assume that all of the
operations listed in the “SDTC - Installation manual” have been performed. These are summarized below:
1. All tuning unit boxes for the track circuit have been installed
2. All track circuit electrical joints have been laid and connected
3. Track circuit connection cables have been laid and connected
4. All transmission/receiver cables between tuning units and the station equipment room SDTC module
have been laid and connected
5. SDTC module for the track circuit under commissioning has been installed
Furthermore, the following assumptions are made:
X-HWE-A-UMM-0002 9 20/72
30/06/11
BOLOGNA
6. Track integrity of the rails in the TC to be commissioned

7. All cable inspection (continuity and insulation test) and grounding completed
8. For the installation of boards in racks, check that the board connector code and the associated code
on the mother board connector comply with the information provided in the table in APPENDIX D:
CODE OF BOARD CONNECTORS § 9.
1.7 Sequence of Test and Commissioning operations

This manual is composed of 5 sections or “work operations”, part to be performed in the field and part to
be performed in the signaling equipment room (SER).
The work operations are summarized below:
A) Calibration of tuning unit/joint unit as a whole (at least two employees), section 2
B) Jumper settings for SDTC board configuration (one employee), section 3
C) Regulation of track circuit voltage via software (at least two employees), section 4
D) Final tests (two employees), section 5
Although operations A and B are sequential to one another, they may be performed at different times.
Operation C can only be performed after having completed the two previous operations. Operation E
concludes the SDTC test and commissioning operations. This facilitates task planning for the
commissioning team. Operation D concerns the track to train transmission and can be performed after the
other operations involved in train detection.
1.8 Precautions and Requirements

The following requirements and precautions are mandatory for any and all interventions performed on this
type of equipment:
− Hazardous voltages may be present in the SDTC cubicles and in the TU boxes. Use extreme
caution when working near or on exposed terminals. Never use wet rags near exposed
electrical terminal.
− Only perform Test and Commissioning when the track circuit under test and the adjacent track circuits
are clear
− Take all necessary safety measures for each and every operation performed at track side.
X-HWE-A-UMM-0002 9 21/72
30/06/11
BOLOGNA
1.9 List of Tools

- 1 pair of walkie-talkie radios or telephones
- Two multimeters (frequency range up to 100 kHz) with alligator clips
- 1 calculator
- “SDTC” record form as shown in Appendix E, F (page 69) for noting the measurements taken and
calculations performed
- Wrenches – size 8 – 10 – 12 mm (5/16", 3/8 or 13/32", 15/32")
- 1 screwdriver and adjustable pliers
- 1 tube of “Silastic” adhesive for the ferrite bar
- Spare ferrite bars (included in the TU)
- 1 screwdriver (not metal) for the ferrite bar
- One multimeter (frequency range up to 100 kHz) with probes for connection to the SDTC module
- 1 rail current meter
- 1 laptop with parameterization software
- 0 - 0.2 - 0.5 ohm shunt, non inductive. To minimize the parasitic inductance of the shunt device, the
sum of the lengths of cable connecting to the rails should be ≤ 1.5 m (4.92 ft).
X-HWE-A-UMM-0002 9 22/72
30/06/11
BOLOGNA
2 CALIBRATION OF ELECTRICAL JOINT/TUNING UNIT BOX

Tuning of the Electrical Joints consists in the tuning the parallel resonant circuit represented by the turn of
the Electrical Joint and the capacity in the tuning unit to the track circuit frequency. This ensures that the
Electrical Joints attain maximum directionality when transferring energy to and from the track.
GENERAL WARNING
It must be known whether the TU being calibrated is connected to the SDTC subrack by the “long cable”
or the “short cable” (for TU’s of switched branch track circuits with two switched branches, reference is
made also to Switch1 TU or Switch2 TU being tuned).
This is to allow the SER operator to direct the calibration signal transmission towards either cable as the
jumpers for the operation refer to only two configurations:
• Transmitter (Tx) connected to long cable;
• Transmitter (TX) connected to short cable.
2.1 Preliminary Inspection

The field operator should perform the following visual inspection:
• Check correct layout of the Electrical Joint (S bond, Terminal bond, Short Circuit bond).
• Make sure that the Electrical Joint’s connection cables are connected correctly to terminals A, B and
C of the tuning unit box.
• Make sure that the transmission/receiving cables are connected correctly to terminals CN3 and CN4.
The SER operator should check:

• CN2 connector (for TxRx cables) to be engaged on the motherboard and the field cable connected to
the arresters and to CN2 SER cable.
X-HWE-A-UMM-0002 9 23/72
30/06/11
BOLOGNA
Figure 2-1. Upper portion of the motherboard with housing for CN2 connector
2.2 SDTC Module Startup

The SDTC module startup procedure to be performed by the SER operator before calibration of the
electrical joints is described below:
• Switch off the SDTC module under test using the power switch at the front of TxRx box and the power
conversion unit power switch
• Set the Tx and Rx adjustment dials to minimum, adjust jumpers to 7-8 and 9-10 for Tx and 3-4 for both
DIR and REV for Rx on the front of the TxRx box
• Insert the fuse in the 50V fuse holder on the back of the module and make sure that the 10V fuse
carrier on the back of the module is EMPTY
X-HWE-A-UMM-0002 9 24/72
30/06/11
BOLOGNA
• Switch on the SDTC module under test using the power switch at the front of TxRx box and the power
If (during calibration) the field voltage received at the tuning unit is too high compared to the reference
values indicated in point 6 on page 29 (10-20 Vrms) despite Tx adjustment dials being at minimum, the
following operations should be performed:
• Switch off the SDTC module under test using the power switch at the front of TxRx box and the power
• Remove the fuse from the 50V fuse carrier on the back of the module and insert it in the 10V fuse
carrier
• Switch on the SDTC module under test using the power switch at the front of TxRx box and the power
2.3 SDTC - Tuning Unit /Electrical Joint Calibration

The parallel resonant circuit, represented by the turn of the Electrical Joint and the capacitor of the tuning
unit, is tuned by varying its impedance so that it is maximized at the track circuit’s carrier frequency. This
is accomplished by a special variable inductor housed in the tuning unit (L5 and L6 for the two channels
concerned, see Figure 2-3).
The resonant circuit of the Tuning Unit/Electrical Joint is fed with a fixed frequency equal to the track
circuit carrier frequency (channel frequency); accordingly, its impedance module is calculated by varying
the position of the ferrite bar of the calibration inductor, seeking the maximum impedance setting.
Warning: Do not use metal screwdrivers and do not keep metal screwdrivers near to the calibration
inductor when performing measurements.
Impedance curve vs. frequency
Max
impedance [Ohm]
Channel carrier Frequency [Hz]

frequency
Figure 2-2. Impedance of Tuning Unit/Electrical Joint Based on Transmission Frequency
X-HWE-A-UMM-0002 9 25/72
30/06/11
BOLOGNA
Generation of Calibration Signal:

The fixed frequency signal for supplying the joint during calibration can be generated in two separate
ways, depending on the status of the system when calibrated:
1. If the SDTC module and the connection cables between that module and the tuning unit box have
already been laid, the calibration signal can be generated by that track circuit and sent to the tuning
unit box by the transmission/receiver cables. This is the most frequent case and it is therefore
established as the default procedure for this manual.
2. If the connection cables or SDTC module or transmission/receiver cables have not been laid,
calibration may be performed using a local amplifier-generator applied to the tuning unit box input at
connectors CN3 or CN4. This case does not frequently occur. However, the procedure can be
performed by only the field operator, as described in APPENDIX A on page 53.
2.3.1 List of Tools

For field operator:
• 1 walkie-talkie radio, or telephone (if the telephone pair is available in the TC cable).
• Two multimeters (frequency range up to 100 kHz) with alligator clips
• 1 calculator
• “SDTC” record sheet as shown in APPENDIX E: JOINT/TU RECORD FORM (page 69) for noting the
measurements taken and calculations performed.
• Manual: “SDTC Installation”
• Manual: “SDTC Testing and Commissioning”
• Wrenches - sizes 8 - 10 -12 (5/16" , 3/8 or 13/32", 15/32")
• 1 screwdriver and adjustable pliers
• 1 tube of “Silastic” adhesive for the ferrite bar
• Spare ferrite bars (included in the TU)
• 1 screwdriver (not metal) for the ferrite bar
For SER operator:

• 1 walkie-talkie radio, or telephone (if the telephone pair is available in the TC cable).
• One multimeter (frequency range up to 100 kHz) with probes for connection to the SDTC module,
diameter 3 mm (1 1/6")
2.3.2 Preliminary Operations for Field and SER

TU+JOINT ON NORMAL TRACK
The field operator should establish whether the cable coming into the tuning unit being calibrated is the
transmitter or receiver and accordingly the SER operator should set correctly the CAVO1 jumper (see
Figure 2-3) so that the transmitted signal is addressed on that cable.
X-HWE-A-UMM-0002 9 26/72
30/06/11
BOLOGNA
2.3.3 Sequence of SER Operations

Transmission of calibration signal in the field:
1. Depending on position of the CAVO1 jumper and on the DOT drive (if present) the signal is transmitted
on the long or on the short cable coming from the tuning unit box being calibrated. Turn off the SDTC
module with the switch at the front of the TxRx board and extract the TxRx box from the module.
Rotate the position of CAV01 jumper by 90°, if necessary, in order to connect the transmitter to the TU
under test.
In the case of a switch diverted branch, exchange the Tx-Rx cables of the main and switch track circuits
as described in the following § 2.3.4.2. Insert the TxRx box in the rack and turn on the module of the track
circuit in which the tuning unit to be calibrated is located. Turn off the 2 neighboring track circuits.
• Transmitter (Tx) connected to long cable, terminal 5-6 of CN2 connector.

Normal configuration of CAVO1 jumper (see Figure 2-3) is:
CAVO1
• Transmitter (TX) connected to short cable, terminal 1-2 of CN2 connector.

Normal configuration of CAVO1 jumper (see Figure 2-3) is:
CAVO1
X-HWE-A-UMM-0002 9 27/72
30/06/11
BOLOGNA
CAVO1 for setting transmission

on long or short cable
Figure 2-3 Rx Board for SDTC (N897 164 ----)
X-HWE-A-UMM-0002 9 28/72
30/06/11
BOLOGNA
P23 on setting 2-3 for

P25B internal generator
insertion
Figure 2-4 MODEM HF_2 SDTC (N897 163 010W)
2. On the MODEM board (Figure 2-4): set the transmitter for internal fixed frequency operation by setting
the P23 jumper on 2-3 (internal modulator excluded).
3. On the MODEM board front plate: connect a multimeter to the EXT OSC test points for frequency
measuring.
4. Set the carrier frequency of the track circuit under review using the F1 coarse regulation and F2 fine
regulation trimmers on the front of the board.
5. It is possible to set up the transmitter using an external frequency generator setting P23 on 2-3 and
P25B open. Connect an external square wave generator with signal amplitude between 5 to 6 Vrms
(rms value measured by a multimeter) and thus supply the module.
6. Adjust the voltage between 10 and 20Vrms on terminals CN3 or CN4 of the tuning unit box (measured
and communicated by field operator) using the ADJ. V.TX frontal adjustment of the transmitter.
7. Wait until the operator terminates calibration. Upon operator confirmation, turn off the SDTC and reset
the P23 jumper to 1-2 on the modem board.
2.3.4 Sequence of Field Operations

1. Make sure that the 2 adjacent track circuits are turned off.
At least 2 adjacent track circuits must be switched off at all ends of the TC under test, see Figure 2-5.
X-HWE-A-UMM-0002 9 29/72
30/06/11
BOLOGNA
TC2 TC4 TC6 TC8 TC10 TC12 TC14

On or off On or off Off Off Off On or off On or off
TC1 TC3 TC5 TC7 TC9 TC11 TC13

On or off Off Off Under test Off Off On or off
Figure 2-5 Track Circuits Powered during Commissioning
2. Fill in the form in APPENDIX E: JOINT/TU RECORD FORM on page 69. Insert the data related to the
track circuit and the Electrical joint+tuning unit box (see Figure 2-6).
Sheet n° Pag. QCP

ALSTOM METRO MILANO LINEA 1
SIGNALLING
Number assigned to
ISxxxxx x of y
track circuit (T.C.)
QCP: QCP_A.doc SCHEDA
Track Circuit – SDTC (single TC) N° di
Date:
QCP: Work: Fromr. xxx+xxx
WBS:
1.A P to. yyy + yyy
o pening Q C P
gg mm 201a
T.C. Frequency (from F7 to
Technical Specification or Drawings
See Exection Design list (Annex 1) and Reference documen list
Company: ALSTOM F14)
FORM FOR RECORDING DATA OF THE TUNING UNIT AND ELECTRICAL JOINT
Frequency used for tuning
DIGICODE SDTC (in Hz)
N°tc FREQ. LOWER DATE: xx/yy/201z N°. Form: N° TC FREQ. HIGHER
Line: Metro Milano Linea 1
FREQUENCY Station : FREQUENCY Number of half revolutions
F: F:
FREQUENCY Chainage Km TU FREQUENCY (180 degrees) of screws
HZ:
HZ:
PN:
xxx+xxx
SN:
starting from initial position,
clockwise and counter-
Screw position: Zrel Screw position: Zrel
V (C81) V (C83) 10 x V(C81)/V(C83) V (C81) V (C83) 10 x V(C81)/V(C83)
clockwise
GIRI GIRI
Finale Finale Proportional value of

maximum impedance, to be
compared with the intervals in
DIRECTIONALITY TX: DIRECTIONALITY TX:
≥ 2.2 Va: ≥ 2.2 Va: Table 2-1
Vb: Vb:
Formula to calculate the impedance of the resonant

circuit
Formula to calculate the impedance of the resonant
circuit
Voltage measured on C83 or
channels 7 to 10 channels 11 to 14 C86 (based on the frequency
F7 Z = Zrel x 6,5 Ohm F11 Z = Zrel x 12,5 Ohm
F8 Z = Zrel x 7,9 Ohm F12 Z = Zrel x 13,8 Ohm considered in the tuning unit)
Note:
Voltage measured on C80 or

Tester sign: C77 (based on the frequency
considered in the tuning unit)
Issued – ALSTOM T. Approved – – Checked for ………….
...............................… ……………………… ...........…….date .........
Figure 2-6 – SDTC Joint / TU Record Form
X-HWE-A-UMM-0002 9 30/72
30/06/11
BOLOGNA
3. On the Tuning Unit board (see Figure 2-7): identify the part of the board working at the track circuit
frequency and:
• If the track circuit frequency is the lower of the two frequencies of the tuning unit, refer to
components CN3, C83, C81, L5 and A9
• If the track circuit frequency is the higher of the two frequencies of the tuning unit, refer to
components CN4, C86, C77, L6 and A10.
4. Remove the ferrite bars of the calibration inductor L5 or L6, and open strap A9 or A10 if closed.
5. Position a voltmeter on the tuning capacitor C81 or C77 and a voltmeter on capacitor C83 or C86,
making sure that the instrument contacts with the capacitor terminals are good (the voltage value read
must be stable).
C86
C77
C80 C81
C83
CN3 CN4
Figure 2-7 Layout of tuning unit board (N897120 ----)
6. If the length of the 25 sq. mm (ca. 3 AWG) cable connecting the TU at the near rail is greater than 3 m
(122.4 inches), decrease the total tuning capacitance by cutting and insulating one of terminal C78 or
C81 capacitors, depending on which half of the TU is being tuned. The second terminal will be cut
when tuning is finished.
X-HWE-A-UMM-0002 9 31/72
30/06/11
BOLOGNA
7. Remove the ferrite core, fill the empty inductance with “SILASTIC” glue, and put the glue on the ferrite
core thread. Insert and screw the ferrite core into the L5 or L6 calibration inductor, adjust it so that it is
in a position where the impedance of the resonant block is maximized. When positioned put glue on
the top of the core and of the inductance.
8. The glue will dry in a few hours. Thereafter, the bar can be screwed and unscrewed easily during
calibration. Put some thread-lock on the ferrite nut in order to fasten it tightly to the inductor while the
adhesive is drying.
• Find the maximum impedance by screwing the bar at discrete clockwise or counter-clockwise 180
degrees revolutions.
• Read the values measured by the two voltmeters (keeping the screwdriver - if metal - far away from
the ferrite bar) and calculate the resonant block impedance (Z1), by calculating the ratio of the
voltage on the tuning capacitor (C81 or C77) to the voltage on the capacitor (C83 or C86) and
multiply by 10.
Note: in reality, the number calculated is proportional to and not equal to the resonant block
impedance.
• Record the bar positions and corresponding value calculated on the “SDTC” record form, shown in
APPENDIX E: JOINT/TU RECORD FORM.
• Turn the left the ferrite bar a half turn and repeat the procedure to calculate the resonant block
impedance.
• If the result is higher than the previous one (Z1), repeat the process by turning the left ferrite bar
one half turn more. Continue in this manner until the calculated resonant block impedance
decreases and then turn back half turn on the right. This is the position of maximum impedance of
the resonant block.
• If the result is lower than the previous one (Z1), turn the ferrite bar one turn on the right and repeat
the procedure to calculate the resonant block impedance (Z2).
1. If this result (Z2) is lower than the initial value (Z1) then turn the ferrite bar back to the left half a
turn, and this position is the maximum impedance of the resonant block.
2. If this result (Z2) is higher than the initial value (Z2) then turn the ferrite bar one half turn more
on the right. Continue in this manner until the calculated result decreases and then turn the
ferrite bar back one half turn to the left. This is the position of maximum impedance of the
resonant block.
9. Check that the maximum impedance value calculated falls within the values allowed in Table 2-1.
10.In case of S bond: measure the directionality as described in the following paragraph.
11.Advise the SER operator that the operations have been completed. The reset the P23 jumper on the
Modem board to 1-2 and the CAVO1 jumper on the Rx board to normal position.
X-HWE-A-UMM-0002 9 32/72
30/06/11
BOLOGNA
CHANNEL CARRIER Values allowed and Values allowed and

FREQUENCY [Hz] calculated as: calculated as:
10xV(C80)/V(C83) 10xV(C80)/V(C83)
10xV(C77)/V(C80) 10xV(C77)/V(C80)
“S” Joint and Short Circuit

Terminal Joint Joint
F7 9500 ≥ 0.7 ≥ 0.6
F8 11100 ≥ 0.7 ≥ 0.6
F9 12700 ≥ 0.7 ≥ 0.6
F10 14300 ≥ 0.6 ≥ 0.6
F11 15900 ≥ 0.6 ≥ 0.6
F12 17500 ≥ 0.6 ≥ 0.6
F13 19100 ≥ 0.6 ≥ 0.6
F14 20700 ≥ 0.6 ≥ 0.6
Table 2-1
For short circuit bond and terminal bond tuning units follow the same rules using only the half of the TU
involved.
After completing the tuning of one half of the TU, tune the other half of the TU, changing to the adjacent
TC. Then move to the other end of the same track circuit, change the Tx position using the CAVO1 jumper
or DOT connector signal, and tune the second half TU of the track circuit. Then continue to the next track
circuit and so on.
2.3.4.1 Low Impedance Value

If the value is not good then the S bond and TU has to be checked:
First check the layout of the cable well close to the rail
Then check the lugs and the connections of the bond cable to the rails
Then check the contact of ABC cables to the rails and to the S
Lastly, check the lugs and the connections of ABC cables inside the TU.
Contacts must be clean.
If cables are good, then proceed to adjust the TC (see § 4). If the Irail current is good and if the shunt test
is good, then the TC operation is acceptable.
In general, the limits of impedance assure the operation up the longest TC and up the more distant TC
(longest cable), as per specifications. If TC can not operate due to Irail current and shunt test, then the TU
and/or the bond have to be replaced.
2.3.4.2 Switch Diverted Branch TU Tuning

For the Switch TU Tuning, disconnect the CN2 Tx-Rx connector on the Switch motherboard, then
disconnect the CN2 connector from the Main SDTC and insert the Switch cable in the CN2 Tx-Rx
X-HWE-A-UMM-0002 9 33/72
30/06/11
BOLOGNA
connector of the Main motherboard. Without applying the DOT signal, rotate the CAVO1 jumper 90° with
respect to the reference point on the silk screen in order to feed the transmitter to the Switch TU.Apply the
same procedure of the Main TU. When the Switch tuning is finished restore the original connections of
CN2 cables on the Main and Switch mother boards.
• Tuning Switch Branch TU: Main transmitter (Tx) connected to the Switch cable, terminal 5-6 of CN2
connector.
Tuning configuration of CAVO1 Main jumper (see Figure 2-3) is:
CAVO1
• For the TRx Switch module loop, the Switch receiver cable is connected to terminal 5-6.
Normal configuration of CAVO1 Switch jumper (see Figure 2-3) is:
CAVO1
X-HWE-A-UMM-0002 9 34/72
30/06/11
BOLOGNA
2.3.5 Check of Joint Directionality

Only for “S” bond electrical joints.
Electrical Joint directionality is expressed by the ratio of the voltage measured at one meter from the joint
(inside the track circuit) to the voltage lost measured at one meter outside the Electrical Joint in the
adjacent track circuit.
Before making any measurements, check track noise by turning off all the track circuits and measure any
noise present and related frequencies.
Perform the measurement when the adjacent track circuits are turned off, or using a spectrum analyzer
with power measurement in the 400 bandwidth centered on the frequency of the track circuit (see Table
2-1 colonna “Carrier Frequency” column). The two voltages can be measured at the end of the tuning
operation.
The following lower values allowed should be observed:
• Directionality on transmission joint ≥ 2.2

• Directionality on receiving joint ≥ 2.2
Note: The directionality of the receiving semi joint is measured as that of the transmitting semi joint, during
the tuning phase of the TU; i.e. applying the transmitter signal by means of CAVO1 or with the DOT
command.
Joint directionality
TX RX
a b c d
TC
TU TU
Vb Vc
DIRtx= DIRrx=
Va Vd
Figure 2-8 Voltages for directionality tests
2.3.5.1 Directionality Test – Special Case

If directionality tests limit of 2.2 at the Tx or at the Rx is not satisfied, check the layout of the S cable close
to the rail.
If the S bond is correctly installed, then check the value of the longitudinal crosstalk, generated by this out
of spec Electrical Joint, in the two adjacent SDTC with the same frequency. To measure the noise, be
sure that the track is clear. Remove the 50V fuse (make sure to turn off the SDTC on the power
conversion unit when operating on the fuse) of the closest TC with the same frequency.
Switch on the TC and measure the crosstalk value at V.Rx on the problematic TC. It must be less than
0.14 V AC. Perform the test on both DOT. Repeat on the second problematic TC.
X-HWE-A-UMM-0002 9 35/72
30/06/11
BOLOGNA
Report the crosstalk value on the SDTC regulation record form.

The value of 0.14 V is the limit of the S/N ratio of SDTC receiver so that it does not drop down (S/N=3.8 at
minimum 0.52 V.Rx signal).
If the 0.14 V AC limit is not obtained, then the bond and the TU must be replaced.
See Figure 2-9 below to perform the test.
TC2 F7 TC4 F9 TC6 F11 TC8 F7 TC10 F9 TC12 F11 TC14 F7 TC16 F9 TC18 F11 TC20 F7
TC on TC with TC on
which the directiona- which the
crosstalk of lity too low crosstalk of
TC14 TC14
(+TC2) is (+TC26) is
measured measured
Figure 2-9 Crosstalk Directionality Test Layout
All track circuits must be switched ON and free from TC2 to TC16 when the crosstalk of TC 14 is
measured on TC8, with 50V fuse removed on TC8 but TC8 power on.
All track circuits must be switched ON and free from TC12 to TC26 when the crosstalk of TC 14 is
measured on TC20, with 50V fuse removed on TC20 but TC20 power on.
X-HWE-A-UMM-0002 9 36/72
30/06/11
BOLOGNA
3 JUMPER SETTINGS FOR SDTC BOARD CONFIGURATION
3.1 Preliminary Operations

The SER operator must know the following:
• Track circuit frequency
• Code to be transmitted on track circuit
• That the track circuit Electrical Joints are calibrated
• Track circuit length
• Length of cable coming from transmission joint
• Length of cable coming from receiver joint (cable length can be estimated from the TC boundaries
kilometric points compared to the SER kilometric point)
• Number of switched branches
• Distances between point joints and IRJ in TC with branches
After turning off the power to the module, the boards are extracted and set out in the following order:
• Mother Board
• MODEM Board
• Box Containing Tx Board + Rx Board
• RT Board
3.2 List of Tools

• 1 multimeter with test probes.
• 1 calculator
• 1 screwdriver
• 1 pliers for jumpers
3.3 Mother Board

In case of a simple TC without diverted branches (Main TC), jumpers P3 and P4 are present. In the
Switch module, P3 and P4 must be removed if the DOT signal is connected to its Main mother board; or if
cables C1 and C2 are present between the Main and Switch modules. The DOT signal changes traffic
direction, i.e. position of Tx and Rx in the TC, with the interlocking command.
X-HWE-A-UMM-0002 9 37/72
30/06/11
BOLOGNA
P3:P4
Figure 3-1 P3-P4 Setting on the Motherboard
Check installation of cable N687056592E, as shown in the figure below, which is used as a connection
between Main and Switch modules so that they can share the same transmitted message:
- C1 is the flag of the SYNC MOD cable to connect on the Main module side (terminals 2-4)
- C2 is the flag of the SYNC MOD cable to connect on the Switch module side (terminals 1-3).
X-HWE-A-UMM-0002 9 38/72
30/06/11
BOLOGNA
C2 C1
Figure 3-2 Main/Switch Rear Cabling
The N687056491V cable is used to change the Rx setting in the Switch module after the DOT change.
The figure also shows the SACEM and DOT cables shared with other modules. For the correct
connection, see the application dependent cabling.
3.4 MODEM Board

When replacing the original board, see APPENDIX C: MODEM FREQUENCY AND CODE SELECTION
(N897163010W) and the application dependent information.
On the Main and Switch module Modem Boards the following Berg jumpers must be set:
Main - P26 and P27 in position 1-2;
Switch P26 and P27 in position 2-3.
X-HWE-A-UMM-0002 9 39/72
30/06/11
BOLOGNA
3.5 RX Board (N897164….)

The Rx board is mounted with the Tx board and only the jumpers installed on its two open sides may be
accessed. The settings on this board concern the equalization of the cable lengths and voltage regulation
of received voltage.
The jumpers on which the operator should intervene are exclusively (see Figure 3-3):
• From P4 to P11: check the set jumpers according to Table 3-1 for equalization of the cable length.
• P1 and P25 for additional regulation of receiver voltage.
• CAVO1 for manual selection of the transmitter position on the track (it can also be related to train
direction). Restore after calibrating electrical joints. There are two cases:
∗ CAVO1 not rotated;
∗ CAVO1 rotated 90° with respect to the PCB silkscreen
Rotate it according to the normal DOT so that the transmitter is in the front of the train.
Note: In the Rx board of a Switch module, the CAVO1 jumper is always rotated 90°.
P1 & P25: Additional regulation

of receiver voltage
P4-P11: Cable equalization

cell setting
CAVO1: Transmission setting on long or

short cable
X-HWE-A-UMM-0002 9 40/72
30/06/11
BOLOGNA
Figure 3-3 Rx Board for SDTC (N897164 ----)

The setup of jumpers P4 to P11 depends on the difference in cable length, as shown in the following
table:
Length Long cable - Length P11 P10 P9 P8 P7 P6 P5 P4

Short cable
0 - 49 m (0-160 ft) 1-2 1-2 1-2 1-2 1-2 1-2 1-2 1-2
50 - 149 m (161 -488 ft) 2-3 2-3 1-2 1-2 1-2 1-2 1-2 1-2
150 - 249 m (489 -816 ft) 2-3 2-3 2-3 2-3 1-2 1-2 1-2 1-2
250 - 349 m (817 -1145 ft) 2-3 2-3 2-3 2-3 2-3 2-3 1-2 1-2
400 m (1312 ft) 2-3 2-3 2-3 2-3 2-3 2-3 2-3 2-3
Table 3-1
Note: Generally, the difference between long cable length and short cable length is approximately equal to
length of the track circuit.
For Switch modules, set all the jumpers P4 to P11 in the 1-2 position.
X-HWE-A-UMM-0002 9 41/72
30/06/11
BOLOGNA
3.6 RT Board (N897 092 020H)

The SER operator should check the following jumpers:
• P2, P4, P6, P10, and P13 present;
∗ P1 (RT) set on 2-3;
• P3, P5, P7, P8, P9, P11, P12 and P14 not present.
P1 set 2-3
Check for jumpers P2,

P4, P6, P10, P13
Figure 3-4 RT NDV_SDTC (N897 092 020H)
X-HWE-A-UMM-0002 9 42/72
30/06/11
BOLOGNA
4 SDTC REGULATION PROCEDURE
4.1 Track Circuit Parameterization

The parameterization software is a software program that defines the regulations of the transmitter and
receiver, according to the TC parameters.
4.1.1 List of Tools

In SER:
• Laptop
• Software program installed in the laptop: program file setdtc.exe and text file setdtc.txt
Setdtc3.zip
4.1.2 Use of the Program

¾ Create a working directory on the PC, e.g. c:\SDTC. Copy the zip file to it. Extract the files and
prepare a DOS command window in that directory. Using a text editor, e.g. Notepad, enter the
parameters of the TC in the file “setDTC.txt”:
Title: SDTC Track Circuit Setup v.3
TC name:
Frequency [7-14]:
Length of main track circuit [m]:
Length of longer cable [m]:
Number of diverted branch switches [0-2]: 0
Length of track diverted branch switch 1 [m]:
Distance from Tx main to switch point 1 irj [m]:
Length of track diverted branch switch 2 [m]:
Distance from point 1 irj to point 2 irj [m]:
Gauge [891-1435-1676 mm]:1435
¾ Save this file

¾ Run the SETDTC program and read the following output on the screen:
Setup v3 TC 38B sw.n:1 Ls1:133m Lt1:109m

F12 17500 Hz g:0.5 S/km Ltc: 140m Lcabl: 1200m (sh:0.50 pw:±10%)
Irail.Rx(A) Vrail.Rx V.Rx(V)
min 0.09 0.33 0.57
max 0.50 0.89
Fuse: 50V Adj.V.Tx: 7-9 Adj.V.Rx: 3-4 P1:3 1/Dg:0.79 1/Dt:0.65
X-HWE-A-UMM-0002 9 43/72
30/06/11
BOLOGNA
¾ The program saves the video output to a file “TC<name>.txt”, located in the same working directory.
The previous file with the same name is overwritten. This file can be printed out using Notepad.
¾ Set the regulations on the rack/s.
Revision history
Version Program Date Notes
1. v1 Setupdtc.exe 27/09/02 Only main TC regulation; only min. values
2. v2 Setdtc2.exe 18/06/03 Added 1st branch regulation; same Tx regulation; increased
Rx regulation; added max values
3. v3 Setdtc3.exe 17/07/03 same as v2, added 2nd branch regulation
4.2 TxRx Voltages Regulation Principle
4.2.1 TxRx Voltages Regulation Principle

After calibration of the Tuning Unit and setting the jumpers on the boards, the track circuit voltage must be
regulated in order to ensure proper operation.
In particular, the regulations that allow the voltage of the transmitter and the gain of the receiver (or
receivers, in the case of switch branches) must be configured.
The transmitter related regulations are:
• Fuse on the back of the Power Conversion unit
• ADJ. V.Tx jumpers on the front of the TxRx box.
The Main receiver regulations are:
• ADJ. V.Rx jumpers on the front of the TxRx box, only DIR
• P1 jumper on the Rx board, in the accessible part of the TxRx box
The Switch branch receiver regulations are:
• ADJ. V.Rx jumpers on the front of the TxRx box, both DIR and REV
• P1 and P25 jumpers on the Rx board, in the accessible part of the TxRx box (P1 is associated with
ADJ.V.Rx DIR and P25 is associated with ADJ.V.Rx REV)
The track circuit voltage regulation requires one SER operator and, at least, one field operator.
The test must be repeated for both DOT. In order to change the DOT it is necessary to control the
command by interlocking (otherwise, a 24 V DC power supply can be connected to CN10 or CN14 of the
Main mother board, +24 V on terminal 4 and 0 V on terminal 1).
4.2.2 List of Tools

In SER:
• Walkie-talkie radio or telephone for communicating with the field operator(s)
X-HWE-A-UMM-0002 9 44/72
30/06/11
BOLOGNA
• 2 multimeters with test probes (one for checking mains voltage)

• Parameterization software on laptop PC
• “SDTC Regulation” record form (see § 11 APPENDIX F: SDTC REGULATION AND FINAL TEST
RECORD FORM)
X-HWE-A-UMM-0002 9 45/72
30/06/11
BOLOGNA
In the field:
• Walkie-talkie radio or telephone for communicating with the SER operator
• 2 multimeters
• Rail current meter P687071000N
• Terminals for connection to rails
4.2.3 Regulation Procedure

Note: the parameterization software is an aid to select the jumper settings (ADJ.V.TX, ADJ.V.RX,
P1, P25). The measurement ranges are to be taken with care, considering an accuracy of the 20%,
due to variations in environmental conditions, differences in installation conditions and variations
in the technical parameters of the sub-systems (cable, joint and track), that are not practical to
measure or estimate.
Vrail_rx and V.RX ranges must be respected in the following regulation procedure, with priority
given to V.Rx.
For Irail_rx the minimum value should only be checked, there is no upper limit.
4.2.3.1 Preliminary SER Procedures

Before beginning regulation, the operator should collect all the track circuit characteristic data
needed by the program in order to perform the calculations. Specifically:
• Track circuit frequency number
• Number of switch branches
• Length of track circuit, diverted branches (from the insulating rail joints) and cables
Moreover, in order to avoid interference, all adjacent track circuits should be turned off, whether they
are on the normal track or on switched branches, see Figure 2-5 page 30.
Lastly, the operator should transmit the normal modulated frequency signal of the track circuit, as
done in the last point of the calibration of the Joint/Tuning Unit.
Note: when performing the initial set up of the track circuit, section 4.2.3.3 should be performed
before 4.2.3.4; when resetting the track circuit, section 4.2.3.4 should be performed before 4.2.3.3.
4.2.3.2 Regulation Transmitter Setting

Turn off the module and apply the jumper setting ADJ.V.TX to the transmitter and use the fuse location
given by the parameterization software on the power conversion unit.
Note: Do not insert two jumpers in the 1-7 half or in the 9-15 half in order to avoid short circuiting
the output transformer and damaging it.
4.2.3.3 Measurements on Receiving Electrical Joint(s) on Main TC

Turn on the module and measure the Vrail_Rx voltage and the Irail_Rx current near the electrical bond, as
indicated in Figure 4-1.
X-HWE-A-UMM-0002 9 46/72
30/06/11
BOLOGNA
Irail_rx
from transmitter
Vrail_rx point
1m
Figure 4-1 “Vrail_Rx” Voltage and “Irail_Rx” Current Measurement Point
Check the value measured for Irail_Rx against the minimum calculated value. If the value is less than the
minimum, check the power line, equipment, Tx cable, joint and track. If necessary increase, step by step,
the Tx setting to increase the Irail_Rx value. The minimum Tx regulation is 7-9, the maximum Tx
regulation is 1-15, with fine regulation in range 1 to 7 and coarse regulation in the range 9 to 15.
Note: check the current in the rail only on the main TC, not in the diverted switch branches.
Irail_rx is measured using rail current meter P687071000N connected to a voltmeter. The rail
current meter is placed on the rail where the measurement is performed. Read the voltage by taking
into account that the value of the rail current is twice the value of the voltage read (e.g., if
V=80 mV then I=160 mA).
If there is high current noise on the rails, two rail current meters can be used connected in series, as
shown in the following figure.
ITC ITC
V meter
1 V = 1 Amp
Figure 4-2 Series Connection of Two Rail Current Meters

Attention: the reading in this connection is twice the reading of only one rail current meter, so 100 mV AC
= 200 mA AC.
4.2.3.4 Regulation of Receiver(s) Setting(s)

Set up the receiver regulation (or receivers, if there are switched branches), according to the ADJ.V.RX ,
P1 (and P25) output given by the parameterization software. Compare the measured value for V.RX with
the calculated value range.
X-HWE-A-UMM-0002 9 47/72
30/06/11
BOLOGNA
The V.RX measured value should be within the range given by the parameterization software and:
¾ If the track condition is DRY, V.RX should be in the upper half of the range
¾ If the track condition is WET, V.RX should be in the lower half of the range
If not, change jumper position on ADJ.V.RX first, and if required P1 (and P25). The minimum
setting for ADJ.V.RX is 3-4, the maximum is 1-6, with fine regulation in the range of 1 to 3, and
coarse regulation in the range of 4 to 6. The minimum setting for P1 and P25 is 5, the maximum is
1.
The value for V.RX at minimum ballast value and at nominal mains power supply is 0.57 V. If the mains
are not 110 V AC but are, for example, 110+10%, then the limit must be increased by the same ratio, so
0.57+10%=0.63 V.
4.2.3.5 Output Control

After set-up of transmitter and receiver, check on the front panel of the RT board that the DELAY1,
OUTMSR and OUTPUT LED are on. The OUTPUT test point is from 11 V DC to 19 V DC.
4.2.3.6 DOT
Change the DOT using a ASCV command (if not present connect +24V on terminal 4 and 0V on terminal
1 of connector CN10 or CN14 on the main mother board) and repeat the previous measurements in §
4.2.3.3, 4.2.3.4, and 4.2.3.5. Record the value measure on the “SDTC Regulation” record form and check
it against calculated values with the parameterization software.
Note: Do not perform any REV measurements when the SDTC is not used for the SACEM to train
transmission and DOT is not controlled by the interlock.
4.2.3.7 Reset of Initial Conditions

At the end of the procedure, the normal operation conditions should be re-established in the SER. Turn
on, where applicable, all the adjacent track circuits that had been turned off.
Make sure that in the normal DOT, as determined by interlocking, the Tx joint is in front of the normal train
traffic direction, otherwise change the position of CAVO1 jumper in the Rx board, as described in § 3.5 RX
Board (N897164….).
4.2.3.8 Data Recording

Record the voltages and current on the Regulation Record Form as shown in the sheet in APPENDIX F:
SDTC REGULATION AND FINAL TEST RECORD FORM.
X-HWE-A-UMM-0002 9 48/72
30/06/11
BOLOGNA
5 FINAL TESTS
With SDTC regulation in its final phase, the final tests are performed under normal operation conditions:
• Track circuit regulated and modulated signal transmitted
• Adjacent track circuits turned on, regulated and modulated signal transmitted
• Both DOT only for SACEM transmission
The final tests are performed by one SER operator and one or more field operators.
Testing must be repeated in both DOT for SACEM transmission. Change the DOT using an ASCV
command (if not present connect +24 V on terminal 4 and 0 V on terminal 1 of connector CN10 or CN14
on the main mother board) and repeat the previous measurements. Both DOT tests result must be written
on the “SDTC Test” record form.
TRACK CIRCUIT OCCUPATION: this event is signaled by the ASCV or Relay Drop, i.e. the "output LED
on the front of the RT board turns off.
5.1 List of Tools

In SER:
• 2 multimeters (frequency range up to 100 kHz) with test probes (for checking Tx voltage)
• Calculator
• “SDTC Final Test” record form
In field:
• Shunt resistance of 0 Ω, 0.2 Ω and 0.5 Ω. To minimize the parasitic inductance of the shunt device,
the sum of the cable length connecting to the rails should be ≤ 1.5 m (4.92 ft).
• Terminals for connection to rails
5.2 Shunt Verification in the Track Circuit

A non inductive resistor of 0.5 Ohm connected between the rails in any position of the track circuit,
excluding the joint area, should cause:
1. Track circuit occupation and
2. A decrease in the voltage to receiver (voltage V.RX on the TxRx box) under
290 mV if V.RX on the free track circuit is < 0.9 V
320 mV if V.RX on the free track circuit is ≥ 0.9 V
These values refer to a situation with nominal mains voltage. If this is not the case, the measured
values should be normalized appropriately by changing the ADJ V.RX, P1 and P25 jumpers (P25 for
X-HWE-A-UMM-0002 9 49/72
30/06/11
BOLOGNA
switch only). The value of 290 (320) mV refers to the nominal mains power voltage. If the mains are
not 110 V AC but are, for example, 110-10%, then the limit must be reduced by the same ratio; so
290 - 10% = 260 mV.
Note: the shunt test must be carried out at each end of the TC, and in both DOT (direction of traffic) when
SACEM transmission is present.
TX RX
1m 1m
shunt: 0.5 Ohm
TU TU
Figure 5-1 Shunt in the Track Circuit
5.3 Shunt Verification in the Joint Area

This test should be performed for all S-bond joints in the track circuit.
A non-inductive resistor of 0.2 Ω connected between the rails within the length of the joint should
cause the occupation of at least one of the two adjacent track circuits.
0 .2 O h m
Shunt
Figure 5-2 Shunt Test inside the Electrical S Bond
X-HWE-A-UMM-0002 9 50/72
30/06/11
BOLOGNA
5.4 Pre-shunt Verification Outside the Joint

This test should be performed for all S-bond joints in the track circuit.
A short circuit (shunt of 0 Ω value) between the rails at a distance of within one or two meters (39" to 78")
from the external edge of the joint should not:
1. Cause track circuit occupation or
2. Decrease the voltage at the receiver, i.e. V.RX voltage on TxRx box below 480 mV. If this is not the
case, the receiver regulation should be checked and modified in order to increase the V.RX voltage.
Perform the 0.5 Ohm shunt test verification inside the track circuit once again.
The value of the 480 mV pre-shunt test refers to the nominal mains power voltage, and, if the mains
are not 110 V AC but are, for example, 110+10%, then the limit must be increased by the same ratio,
so 480 + 10 % = 530 mV.
va ca n t
0 Oh m S hun t
TC
1 ÷ 2 m (3 9 to 7 8 in )
Figure 5-3 Pre-shunt Verification
5.5 Change of DOT and Data Recording

Change the DOT, with the SACEM present, by interlocking or by applying +24V on terminal 4 and 0V on
terminal 1 of connector CN10 or CN14 on the mother board. Repeat the measurement and record the
results on the “SDTC Final Test” sheet form. See APPENDIX F: SDTC REGULATION AND FINAL TEST
RECORD FORM.
X-HWE-A-UMM-0002 9 51/72
30/06/11
BOLOGNA
5.6 Code Verification

Check the codes the modems are transmitting using the internal serial port of the modem connected to a
laptop. Make certain that they comply with the assigned TC codes. Refer to Table 8-1 of APPENDIX C:
MODEM FREQUENCY AND CODE SELECTION (N897163010W) to verify compliance.
In order to check the TC code, turn off the SDTC, extract the MODEM board, connect a non-inverting
male-female RS232 cable (see the following Figure 5-4) from the MODEM CN1 connector to the PC
connector (CN1 is on the left uppermost part of MODEM board, see Figure 8-1).
D 9 pin
D 9 pin
female male 1 1
Non Inverting 2 2
3 3
4 4
To PC To MODEM 5
6
5
6
7 7
8 8
9 9
Figure 5-4 MODEM and PC Connection to Verify Code
Run the Hyper Terminal program on the PC. Create a new connection. Select COM1 (or the COM
available for the cable) for the connection. Configure communications as 4800 bit/s, 8 bit, no parity, 1 stop
bit, and hardware flow control. The Hyper Terminal window will display the continuous sequence of bytes
sent by MODEM on the track and echoed on the PC. For example, in the case of code C22,
corresponding to E28B, the PC will display:
8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 02 02 1F FF 00
8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 8B E2 02 02 1F FF 00
…
The last 5 bytes in each row are for checking the protocol, so they are not to be taken into consideration.
Record the code given by the laptop on the “SDTC Final Test” record form.
5.7 End of Test

Make sure that in the normal DOT, as determined by interlocking, the Tx joint is in front of the normal train
traffic direction (see §4.2.3.7 Reset of Initial Conditions).
X-HWE-A-UMM-0002 9 52/72
30/06/11
BOLOGNA
6 APPENDIX A: CALIBRATION OF ELECTRICAL JOINTS/TUNING UNIT

WITHOUT SER EQUIPMENT
This chapter illustrates the calibration procedure for the tuning unit/joint if the transmission/reception
cables or station/technological office equipment have not been laid.
In this case, one field operator at the tuning unit can perform all operations. The need for heavy bulky
equipment (oscillator + power amplifier) in the field represents a disadvantage for this solution.
TOOLS NEEDED IN THE FIELD
• A variable frequency (ranging from 0 to 30 kHz) sine-wave signal generator, with a min. peak-to-peak
10V output signal
• A power amplifier to be connected to the signal generator, with at least 50 VA power, operating in the
0-30kHz frequency range with a min. 20Vrms output signal
• Two multimeters (frequency range up to 100 kHz) with alligator clips
• 1 calculator
• Material for noting the measurements and calculations made.
• Manual: “SDTC Installation”
• 1 tube of “Silastic” adhesive for the ferrite bar
• Spare ferrite bars (included in the TU)
• 1 screwdriver (not metal) for the ferrite bar
• Wrenches – size 8 – 10 – 12 mm (5/16", 3/8 or 13/32", 15/32")
• 1 screwdriver and adjustable pliers
6.1 Tuning Unit/Joint Unit Calibration

1. Make sure that the 2 adjacent track circuits are turned off.
2. The field operator sets the signal generator to the frequency of the tuning unit/joint unit to be calibrated
based on the track circuit frequency.
3. The power amplifier receives that signal at the input and supplies either the CN3 or CN4 terminal of the
TU in output (depending upon the channel involved, see Section 5) with a voltage range from 10 to 20
Vrms.
4. On the Tuning Unit board (see Figure 6-1): identify the part of the board working at the track circuit
frequency and:
• If the track circuit frequency is the lower of the two frequencies of the tuning unit, refer to
components CN3, C83, C81, L5 and A9
• If the track circuit frequency is the higher of the two frequencies of the tuning unit, refer to
components CN4, C86, C77, L6 and A10.
5. Remove the ferrite bars of the calibration inductor L5 or L6, and open strap A9 or A10 if closed.
X-HWE-A-UMM-0002 9 53/72
30/06/11
BOLOGNA
6. Position a voltmeter on the tuning capacitor C81 or C77 and a voltmeter on capacitor C83 or C86,
making sure that the instrument contacts with the capacitor terminals are good (the voltage value read
must be stable).
L6
C86
C77
A10
L5
C81
C80
C83 A9
CN3 CN4
Figure 6-1 Layout of Tuning Unit Board (N897120 ----)
7. If the length of the 25 sq. mm (ca. 3 AWG) cable connecting the TU at the near rail is greater than 3 m
(122.4 inches), decrease the total tuning capacitance by cutting and insulating one of terminal C78 or
C81 capacitors, depending on which half of the TU is being tuned. The second terminal will be cut
when tuning is finished.
8. Remove the ferrite core, fill the empty inductance with “SILASTIC” glue, and put the glue on the ferrite
core thread. Insert and screw the ferrite core into the L5 or L6 calibration inductor, adjust it so that it is
in a position where the impedance of the resonant block is maximized. When positioned put glue on
the top of the core and of the inductance.
9. The glue will dry in a few hours. Thereafter, the bar can be screwed and unscrewed easily during
calibration. Put some thread-lock on the ferrite nut in order to fasten it tightly to the inductor while the
adhesive is drying.
• Find the maximum impedance by screwing the bar at discrete clockwise or counter-clockwise 180
degrees revolutions.
X-HWE-A-UMM-0002 9 54/72
30/06/11
BOLOGNA
• Read the values measured by the two voltmeters (keeping the screwdriver - if metal - far away from
the ferrite bar) and calculate the resonant block impedance (Z1), by calculating the ratio of the
voltage on the tuning capacitor (C81 or C77) to the voltage on the capacitor (C83 or C86) and
multiply by 10.
Note: in reality, the number calculated is proportional to and not equal to the resonant block
impedance.
• Record the bar positions and corresponding value calculated on the “SDTC” record form, shown in
APPENDIX E: JOINT/TU RECORD FORM.
• Turn the left the ferrite bar a half turn and repeat the procedure to calculate the resonant block
impedance.
• If the result is higher than the previous one (Z1), repeat the process by turning the left ferrite
bar one half turn more. Continue in this manner until the calculated resonant block impedance
decreases and then turn back half turn on the right. This is the position of maximum
impedance of the resonant block.
• If the result is lower than the previous one (Z1), turn the ferrite bar one turn on the right and
repeat the procedure to calculate the resonant block impedance (Z2).
1. If this result (Z2) is lower than the initial value (Z1) then turn the ferrite bar back to the left
half a turn, and this position is the maximum impedance of the resonant block.
2. If this result (Z2) is higher than the initial value (Z2) then turn the ferrite bar one half turn
more on the right. Continue in this manner until the calculated result decreases and then
turn the ferrite bar back one half turn to the left. This is the position of maximum
impedance of the resonant block.
10.Check that the maximum impedance value calculated falls within the values allowed in Table 6-1.
11.For the S bond, the directionality can be measured as described in the section 2.3.5.
12.Advise the SER operator that the operations have been completed. The reset the P23 jumper on the
Modem board to 1-2 and the CAVO1 jumper on the Rx board to normal position.
X-HWE-A-UMM-0002 9 55/72
30/06/11
BOLOGNA
CHANNEL CARRIER Values allowed and Values allowed and

FREQUENCY calculated as: calculated as:
[Hz] 10xV(C80)/V(C83) 10xV(C80)/V(C83)
10xV(C77)/V(C80) 10xV(C77)/V(C80)
“S” Joint and Short Circuit

Terminal Joint Joint
F7 9500 ≥ 0.7 ≥ 0.6
F8 11100 ≥ 0.7 ≥ 0.6
F9 12700 ≥ 0.7 ≥ 0.6
F10 14300 ≥ 0.6 ≥ 0.6
F11 15900 ≥ 0.6 ≥ 0.6
F12 17500 ≥ 0.6 ≥ 0.6
F13 19100 ≥ 0.6 ≥ 0.6
F14 20700 ≥ 0.6 ≥ 0.6
Table 6-1
For short circuit bond and terminal bond tuning units follow the same rules using only the half of the TU
involved.
X-HWE-A-UMM-0002 9 56/72
30/06/11
BOLOGNA
7 APPENDIX B: DIAGNOSTIC BOARD N897093011L-12M
P3-P4
SW1
P5
P10-P16
P7
P9
P17
P18
Figure 7-1 Jumper Position on the DIAG Board
X-HWE-A-UMM-0002 9 57/72
30/06/11
BOLOGNA
Setup of the DIAG board

Diagnostic board can be inserted or extracted without turning off the SDTC module.
1) Extract the DIAG board and perform the following set-up:
• For RS232 serial connection to portable lap top -
• P5 and P7 in position 1-2 (select the RS232 port on the front panel)
• P3 and P4 in position 2-3 if the cable is non-inverting
• Refer to Figure 7-2 for RS232 cable and connector D9
• For a RS422 to CEDD serial connection -
• P7 in position 2-3
• P17 and P9 in position 1-2 in all DIAG boards, except the first and the last on the line to the CEDD
• P17 and P9 in position 2-3 in the first and last board (line terminations)
2) Select the channel frequency moving the P10÷P16 jumpers as shown in Table 2.
CHANNEL P10 P11 P12 P13 P14 P15 P16

7 2-3 2-3 2-3 1-2 2-3 2-3 2-3
8 1-2 2-3 2-3 1-2 1-2 2-3 2-3
9 2-3 1-2 2-3 1-2 2-3 1-2 2-3
10 1-2 1-2 2-3 1-2 1-2 1-2 2-3
11 2-3 2-3 1-2 1-2 2-3 2-3 1-2
12 1-2 2-3 1-2 1-2 1-2 2-3 1-2
13 2-3 1-2 1-2 1-2 2-3 1-2 1-2
14 1-2 1-2 1-2 1-2 1-2 1-2 1-2
L7/11 2-3 2-3 2-3 1-2 2-3 2-3 1-2
L7/12 2-3 2-3 2-3 1-2 1-2 2-3 1-2
L13/7 2-3 1-2 1-2 1-2 2-3 2-3 2-3
L13/8 2-3 1-2 1-2 1-2 1-2 2-3 2-3
L14/7 1-2 1-2 1-2 1-2 2-3 2-3 2-3
L14/9 1-2 1-2 1-2 1-2 2-3 1-2 2-3
L14/10 1-2 1-2 1-2 1-2 1-2 1-2 2-3
L14/12 1-2 1-2 1-2 1-2 1-2 2-3 1-2
L13/11 2-3 1-2 1-2 1-2 2-3 2-3 1-2
L13/10 2-3 1-2 1-2 1-2 1-2 1-2 2-3
X-HWE-A-UMM-0002 9 58/72
30/06/11
BOLOGNA
Table 7-1. Selection of Frequency
3) Select the SDM address using the SW1 selector
Address 1 2 3 4 5 6 7 8
01 ON OFF OFF OFF OFF OFF OFF OFF
02 OFF ON OFF OFF OFF OFF OFF OFF
03 ON ON OFF OFF OFF OFF OFF OFF
04 OFF OFF ON OFF OFF OFF OFF OFF
05 ON OFF ON OFF OFF OFF OFF OFF
06 OFF ON ON OFF OFF OFF OFF OFF
07 ON ON ON OFF OFF OFF OFF OFF
08 OFF OFF OFF ON OFF OFF OFF OFF
09 ON OFF OFF ON OFF OFF OFF OFF
0A OFF ON OFF ON OFF OFF OFF OFF
etc.
4) Insert the P18 jumper if the SDTC vital output is 24 V DC. DO NOT insert P18 if the vital output is 12 V
DC.
5) Connect the network cables on the rear Mother boards to CN11 and CN12 following the CEDD-D
connection drawings in the SER.
X-HWE-A-UMM-0002 9 59/72
30/06/11
BOLOGNA
PC DIAG
D 9 pin
D 9 pin 1 1
male
female Inverting 2 2 RD
3 3 TD
4 4
5 5 GND
PC To DIAG 6 6
7 7
SER conn. 8 8
9 9
Note: A null-mode cable can be used.
D 9 pin
D 9 pin
male 1 1
female Non Inverting 2 2
3 3
4 4
PC To DIAG 5
6
5
6
7 7
8 8
9 9
Figure 7-2. RS232 Connection
X-HWE-A-UMM-0002 9 60/72
30/06/11
BOLOGNA
8 APPENDIX C: MODEM FREQUENCY AND CODE SELECTION (N897163010W)

The channel and code selection jumpers are set on the modem board.
Jumper P23, moved during joint calibration, should be returned to 1-2.
The jumpers on which the SER operator should intervene are exclusively:
• P1 P2 P3 P4 for modulator channel selection
• P12 P13 P14 for demodulator channel selection
• P10 P11 for transmission code selection
Checks are envisaged for the correct settings of the remaining jumpers.
The modem board is shown below.
X-HWE-A-UMM-0002 9 61/72
30/06/11
BOLOGNA
Connector CN1 for code verification

P1, P2, P3, and P4 for
modulator channel selection
P10 and P11: Channel

code selection
Jumper in P7; P8
and P9 empty
Jumper in P19; P20

Jumper in and P21 empty
P18; P16 and
P17 empty
P12, P13, and P14 for

demodulator channel selection
P23: Reset on 1-2
P25B: Empty when

using external generator
P25: Check for presence

of jumpers
Figure 8-1 MODEM HF_2 for SDTC (N897 163 010W)
X-HWE-A-UMM-0002 9 62/72
30/06/11
BOLOGNA
P1 P4 P1 P4
F7 : F8 :
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
P1 P4 P1 P4
F9 : F10 :
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
P1 P4 P1 P4
F11 : F12 :
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
P1 P4 P1 P4
F13 : F14 :
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
Figure 8-2. P1, P2, P3 and P4 jumper settings for SDTC MODEM
X-HWE-A-UMM-0002 9 63/72
30/06/11
BOLOGNA
TX7-RX11 : P1 P4 TX7-RX12 : P1 P4
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
TX13-RX7 : P1 P4
TX13-RX8 : P1 P4
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
TX14-RX7: P1 P4
TX14-RX9: P1 P4
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
TX14-RX10 : P1 P4
TX14-RX12: P1 P4
P2 P2
P3 P3
P12 P12
P13 P13
P14 P14
Figure 8-3. Position of jumpers P1, P2, P3, P4, P12, P13, and P14 for MODEM SDTC Main and Switch
X-HWE-A-UMM-0002 9 64/72
30/06/11
BOLOGNA
F7
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C19: 7 7 C20: 7 7 C21: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F9
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C25: 7 7 C26: 7 7 C27: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F11
P10 P11 P10 P11 P10 P11

1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C31: 7 7 C32: 7 7 C33: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F13
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C37: 7 7 C38: 7 7 C39: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
Figure 8-4. Code settings for SDTC MODEM odd channels
X-HWE-A-UMM-0002 9 65/72
30/06/11
BOLOGNA
F8
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C22: 7 7 C23: 7 7 C24: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F10
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C28: 7 7 C29: 7 7 C30: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F12
P10 P11 P10 P11 P10 P11

1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C34: 7 7 C35: 7 7 C36: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
F14
P10 P11 P10 P11 P10 P11
1 1 1 1 1 1
3 3 3 3 3 3
5 5 5 5 5 5
C40: 7 7 C41: 7 7 C42: 7 7
9 9 9 9 9 9
11 11 11 11 11 11
13 13 13 13 13 13
15 15 15 15 15 15
Figure 8-5. Code settings for SDTC MODEM even channels
X-HWE-A-UMM-0002 9 66/72
30/06/11
BOLOGNA
P10 P11
1 3 5 7 9 11 13 15 1 3 5 7 9 11 13 15
Code
C1 29D6 1 1 1 0 1 0 0 1 0 0 0 1 0 1 1 0
C2 2A7C 1 0 1 1 1 1 0 0 0 0 0 1 0 1 0 1
C3 2B27 0 0 0 1 1 0 1 1 0 0 0 1 0 1 1 1
C4 2DE1 1 1 0 1 0 0 1 0 0 0 0 1 1 1 1 0
C5 2CBA 0 1 1 1 0 1 0 1 0 0 0 1 1 1 0 0
C6 2E4B 1 0 0 0 0 1 1 1 0 0 0 1 1 1 0 1
C7 3C66 1 0 0 1 1 0 0 1 0 0 1 1 1 1 0 0
C8 48F3 1 1 1 1 0 0 1 1 0 1 0 0 0 1 0 0
C9 4B59 1 0 1 0 0 1 1 0 0 1 0 0 0 1 1 1
C10 4E35 0 0 1 1 1 0 1 0 0 1 0 0 1 1 0 1
C11 5974 1 0 1 1 1 0 0 0 0 1 1 0 0 1 1 0
C12 5B85 0 1 0 0 1 0 1 0 0 1 1 0 0 1 1 1
C13 5D43 1 0 0 0 0 0 1 1 0 1 1 0 1 1 1 0
C14 6393 0 1 1 0 0 0 1 1 0 1 0 1 0 0 1 1
C15 6555 1 0 1 0 1 0 1 0 0 1 0 1 1 0 1 0
C16 67A4 0 1 0 1 1 0 0 0 0 1 0 1 1 0 1 1
C17 70E5 1 1 0 1 1 0 1 0 0 1 1 1 0 0 0 0
C18 74D2 1 1 1 0 0 0 0 1 0 1 1 1 1 0 0 0
C19 7589 0 1 0 0 0 1 1 0 0 1 1 1 1 0 1 0
C20 7623 0 0 0 1 0 0 1 1 0 1 1 1 1 0 0 1
C21 8AB9 0 1 1 1 0 1 1 0 1 0 0 0 0 1 0 1
C22 8BE2 1 1 0 1 0 0 0 1 1 0 0 0 0 1 1 1
C23 8E8E 0 1 0 0 1 1 0 1 1 0 0 0 1 1 0 1
C24 9A65 1 0 0 1 1 0 1 0 1 0 1 0 0 1 0 1
C25 9CA3 0 1 0 1 0 0 1 1 1 0 1 0 1 1 0 0
C26 9E52 1 0 1 0 0 0 0 1 1 0 1 0 1 1 0 1
C27 A1D9 1 1 1 0 0 1 1 0 1 0 0 1 0 0 1 0
C28 A273 1 0 1 1 0 0 1 1 1 0 0 1 0 0 0 1
C29 A4B5 0 1 1 1 1 0 1 0 1 0 0 1 1 0 0 0
C30 B05E 1 0 1 0 1 1 0 1 1 0 1 1 0 0 0 0
C31 B469 1 0 0 1 0 1 1 0 1 0 1 1 1 0 0 0
C32 B532 0 0 1 1 0 0 0 1 1 0 1 1 1 0 1 0
C33 B698 0 1 1 0 0 1 0 0 1 0 1 1 1 0 0 1
C34 C356 1 0 1 0 1 0 0 1 1 1 0 0 0 0 1 1
C35 C4CB 1 1 0 0 0 1 1 1 1 1 0 0 1 0 0 0
C36 C63A 0 0 1 1 0 1 0 1 1 1 0 0 1 0 0 1
C37 C761 1 0 0 1 0 0 1 0 1 1 0 0 1 0 1 1
C38 D2D1 1 1 1 0 0 0 1 0 1 1 1 0 0 0 0 1
C39 D38A 0 1 0 0 0 1 0 1 1 1 1 0 0 0 1 1
C40 D417 0 0 1 0 1 0 1 1 1 1 1 0 1 0 0 0
C41 D54C 1 0 0 0 1 1 0 0 1 1 1 0 1 0 1 0
C42 E836 0 0 1 1 1 0 0 1 1 1 0 1 0 1 0 0
Testing C0FC 1 1 1 1 1 1 0 0 1 1 0 0 0 0 0 0
Table 8-1. Transmission Codes from C1 to C42
The jumpers on P10 and P11 are inserted in correspondence to the zeros. Columns are ordered based on
the Berg jumpers on the printed circuit.
X-HWE-A-UMM-0002 9 67/72
30/06/11
BOLOGNA
9 APPENDIX D: CODE OF BOARD CONNECTORS
Board Connectors Mechanical Code

TxRx F7 CD1: 4 – 9 – 10; CD3: 2 – 5 – 6;
TxRx F8 CD1: 4 – 9 – 11; CD3: 2 – 5 – 7;
TxRx F9 CD1: 4 – 9 – 12; CD3: 2 – 5 – 8;
TxRx F10 CD1: 4 – 10 – 11; CD3: 2 – 5 – 9;
TxRx F11 CD1: 4 – 10 – 12; CD3: 2 – 5 – 10;
TxRx F12 CD1: 4 – 11 – 12; CD3: 2 – 5 – 11;
TxRx F13 CD1: 5 – 6 – 7; CD3: 2 – 5 – 12;
TxRx F14 CD1: 5 – 6 – 8; CD3: 2 – 6 – 7;
TxRx F7 / F11 CD1: 4 – 9 – 10; CD3: 2 – 5 – 10;
TxRx F7 / F12 CD1: 4 – 9 – 10; CD3: 2 – 5 – 11;
TxRx F13 / F7 CD1: 5 – 6 – 7; CD3: 2 – 5 – 6;
TxRx F13 / F8 CD1: 5 – 6 – 7; CD3: 2 – 5 – 7;
TxRx F14 / F7 CD1: 5 – 6 – 8; CD3: 2 – 5 – 6;
TxRx F14 / F9 CD1: 5 – 6 – 8; CD3: 2 – 5 – 8;
TxRx F14 / F10 CD1: 5 – 6 – 8; CD3: 2 – 5 – 9;
TxRx F14 / F12 CD1: 5 – 6 – 8; CD3: 2 – 5 – 11;
TxRx F13 / F11 CD1: 5 – 6 – 7; CD3: 2 – 5 – 10;
TxRx F14 / F8 CD1: 5 – 6 – 8; CD3: 2 – 5 – 7;
RT CD4: 2 – 4 – 7;
MODEM CD 5: 2 – 4 – 5
DIAG CD10: 2 – 3 – 9
X-HWE-A-UMM-0002 9 68/72
30/06/11
BOLOGNA
10 APPENDIX E: JOINT/TU RECORD FORM

The following page shows the record form that can be used to collect and file data related to the
calibration of the tuning unit-electrical joint.
X-HWE-A-UMM-0002 9 69/72
30/06/11
BOLOGNA
Sheet n° Pag. QCP

ALSTOM SIGNALLING
ISxxxxx x of y
QCP: QCP_A.doc FORM
Track Circuit – SDTC (single TC) N° di
Date:
QCP: Work: Fromr. xxx+xxx
WBS: o pe ning Q C P
1.A P to. yyy + yyy
gg mm 201a
Technical Specification or Drawings
Company: ALSTOM
See Exection Design list (Annex 1) and Reference documen list
FORM FOR RECORDING DATA OF THE TUNING UNIT AND ELECTRICAL JOINT
DIGICODE SDTC
N°tc FREQ. LOWER DATE: xx/yy/201z N°. Form: N° TC FREQ. HIGHER
Line: Metro Milano Linea 1
FREQUENCY Station : FREQUENCY
F: F:
FREQUENCY Chainage Km TU FREQUENCY
HZ: xxx+xxx HZ:
PN: SN:
Screw position: Zrel Screw position: Zrel

TURNS TURNS
Final Final
DIRECTIONALITY TX: DIRECTIONALITY TX:

≥ 2.2 Va: ≥ 2.2 Va:
Vb: Vb:
Formula to calculate the impedance of the resonant Formula to calculate the impedance of the resonant
circuit circuit
channels 7 to 10 channels 11 to 14
Note:
Tester sign:
Issued – ALSTOM T. Approved – – Checked for ………….

...............................… ……………………… ...........…….date .........
X-HWE-A-UMM-0002 9 70/72
30/06/11
BOLOGNA
11 APPENDIX F: SDTC REGULATION AND FINAL TEST RECORD FORM

The following page shows the record form that can be used to collect and file data related to the regulation
and final test of the track circuit.
X-HWE-A-UMM-0002 9 71/72
30/06/11
BOLOGNA
FORM FOR RECORDING DATA OF COMMISSIONING AND PERIODICAL TEST

Line : TC n° : le ngth. TC m.: Le ngth ca ble Da ta Code
Sta tion: Fre q. TC: Ch. km TX: Tx ca ble : Mode m
Km: NR De via te : Ch. km RX: Rx ca ble : DIGICODE SDTC
Le ntgh Sw . 1: Dist. Tx -Sw . 1:
Le ntgh Sw . 2: Dist. Sw . 1-Sx . 2:
0.5 Ohm shunt inserted

V. Residual Sw1 with
V. Residual Sw2 with

V. Residual RX with
SHUNT Rx / Tx
DATE of commissioning / periodic test
Pre Shunt 0 Ohm

Shunt 0.2 Ohm
T uning Unit
ADJ RX (JUMPERS)
ADJ TX (JUMPERS)
<= 320 mV / 290 mV
<= 320 mV / 290 mV
<= 320 mV / 290 mV

SWITCH 2 (Point 2)
SWITCH 1 (Point 1)
Irail RX = 2 x Vrcm
V 20 kHz (Delay 1)
TU Tx CN3 or CN4
Note: Filter Boxes
Centro S giunto
TESTER SIGN
DOT DIR/REV
V. OUT PUT
50 V / 10 V
>= 480 mV
P1 / P25
Vrail RX
V. RX
MAIN
V. TX
X-HWE-A-UMM-0002 9 72/72
PATH Digicode® PSP
APPENDIX D-11 SDTC Maintenance Manual
65 of 80
Use and Maintenance Manual
24/08/11
A. Barbacini A. Giovannucci D. Giangaspero
P. A. Aisa
BOLOGNA

Riservato Normale Controllato Not Controllato Information Solutions
DISTRIBUTION
Restricted Normal Controlled Not Controlled Tel. +39 051.4163111 - Fax +39 051.4163436
CONFIDENTIAL. Rev. Lang. P ages
Sharing or copying of this document, and use or communication of its contents
is not permitted without prior written authorization. X-HWE-A-UMM-0003 12 eng 43
24/08/11
BOLOGNA
REVISIONS
1 A. Barbacini 6/09/2002 31 Issue
2 A. Barbacini 15/12/2002 33 Revision
3 A. Giovannucci 12/02/2004 34 Included DIAG test sw
4 Barbacini 22/11/2005 34 Correct mistake in text
India Metro version. Short occupation, crossover,

5 A. Giovannucci 15/09/06 35 DIAG sw revision, rail and loop current, periodic
decrease
A. Giovannucci
6 19/01/07 35 Coldiag sw review
P. La Notte
A. Barbacini First Italian version based on “SDTC maintenance

7 05/06/08 34
manual revs 4 and 6” dated 22/11/05
8 A. Giovannucci 04/11/10 33 Fixed after Validation Report; 2 A fuse in 24 LOC;

added 110 V power conversion
9 03/03/11 38
Some parts that were in Italian were translated into
A. Barbacini
English and added US units.
P.A. Aisa
P.A. Aisa Modifications based on comments received from US

10 04/05/11 42 application; added jumper list (par. 3.4).
A. Barbacini
11 P.A. Aisa 30/06/11 42 PATH application, new document code
A. Giovannucci
12 A. Giovannucci 24/08/11 43 Fixed jumper list
X-HWE-A-UMM-0003 12 2/43
24/08/11
BOLOGNA
CONTENTS
1 INTRODUCTION ........................................................................................................................................................................ 5
1.1 SCOPE OF THIS DOCUMENT .............................................................................................................................................. 5
1.2 DEFINITIONS AND ACRONYMS .......................................................................................................................................... 5
1.3 REFERENCES ....................................................................................................................................................................... 6
1.3.1 STANDARDS ................................................................................................................................................................. 6
1.3.2 SDTC-DIGICODE DOCUMENTATION ......................................................................................................................... 6
1.3.3 HUMAN SAFETY REGULATIONS ................................................................................................................................ 7
2 GENERALITIES ......................................................................................................................................................................... 9
2.1 INSTALLATION, ADJUSTING AND COMMISSIONING ...................................................................................................... 9
2.2 LIST OF TOOLS .................................................................................................................................................................... 9
2.3 LIST OF TOOLS .................................................................................................................................................................... 9
2.4 CONNECTING CABLES ..................................................................................................................................................... 11
2.5 SAFETY PROCEDURES ..................................................................................................................................................... 12
3 LEDS, TEST POINTS AND JUMPERS ................................................................................................................................... 13
3.1 TX-RX BOX .......................................................................................................................................................................... 13
3.1.1 LEDS ............................................................................................................................................................................ 14
3.1.2 TEST POINTS .............................................................................................................................................................. 14
3.2 RT BOARD ........................................................................................................................................................................... 15
3.2.1 LEDS ............................................................................................................................................................................ 16
3.2.2 TEST POINTS .............................................................................................................................................................. 16
3.3 MODEM BOARD .................................................................................................................................................................. 17
3.3.1 LEDS ............................................................................................................................................................................ 18
3.3.2 TEST POINTS .............................................................................................................................................................. 19
3.4 JUMPER SETTINGS............................................................................................................................................................ 20
4 OPERATING CONDITIONS .................................................................................................................................................... 24
4.1 SYSTEM OPERATION ........................................................................................................................................................ 24
4.2 BLOCK DIAGRAM............................................................................................................................................................... 24
4.3 FIELD MAINTENANCE........................................................................................................................................................ 27
4.3.1 REPLACING S-BOND, TU ........................................................................................................................................... 27
4.4 FIELD MAINTENANCE........................................................................................................................................................ 27
4.4.1 REPLACING RACK MODULES................................................................................................................................... 27
4.4.2 ELECTRONIC FAULTS ............................................................................................................................................... 28
5 DIAGNOSTIC BOARD ............................................................................................................................................................. 33
5.1 SETUP OF THE DIAG BOARD ........................................................................................................................................... 34
5.2 PC DIAG SOFTWARE ......................................................................................................................................................... 35
5.2.1 LIST OF TOOLS ........................................................................................................................................................... 35
5.2.2 USE OF THE PROGRAM ............................................................................................................................................ 35
X-HWE-A-UMM-0003 12 3/43
24/08/11
BOLOGNA
6 PERIODIC MAINTENANCE .................................................................................................................................................... 39

7 MAINTENANCE LEVELS ........................................................................................................................................................ 40
8 MEASURING INSTRUMENTS AND TOOLS .......................................................................................................................... 41
9 APPENDIX A – FAILURE REPORT........................................................................................................................................ 42
FIGURES
Figure 4-1. SDTC Block Diagram ...............................................................................................................................25
Figure 4-2. Block Diagram of the SDTC – Diverted Branch .......................................................................................26
Figure 4-3 Power Conversion Unit..............................................................................................................................28
Figure 5-1 DIAG Board - Front Panel .........................................................................................................................33
Figure 5-2. RS232 Link ...............................................................................................................................................35
TABLES
Table 1-1. SAFETY RULES FOR PERSONNEL..........................................................................................................8
Table 2-1. Room Equipment list .................................................................................................................................10
Table 2-2. TU Equipment list ......................................................................................................................................10
Table 2-3. TxRx Equipment List .................................................................................................................................11
Table 5-1. Selection of Frequency ..............................................................................................................................34
Table 5-2. CEDD Address ..........................................................................................................................................34
Table 5-3 Revision History..........................................................................................................................................38
X-HWE-A-UMM-0003 12 4/43
24/08/11
BOLOGNA
1 INTRODUCTION
This document describes the SDTC maintenance. Specifically, it describes how to locate a faulty
component/board, how to replace it, return the track circuit into service and what periodical checks
must be carried out in order to maximize availability of the system.

Ballast Transverse conductance of track expressed in Siemens per km
SER Signaling Equipment Room: room containing the equipment. The Technological Office
may be in the station or along the line.
Electric Joint End of track circuit having no insulating rail joint
RT Train Detection: board containing Comparator, RMS and Delay circuits
iVPI Logic Computer (Computer Based Interlocking)
DOT Direction Of Traffic
Tx Transmission
Rx Reception
CEDD Concentratore Elaboratore Dati Diagnostici (Diagnostic Data Processor Concentrator)

TU Tuning Unit
Module Half of a rack, containing one SDTC set made by 1 Tx + Rx board, 1 Modem board, 1
RT board
Rack Metal structure containing two modules (19” wide)
Cubicle Metal structure containing more racks
Normal track Defines the main track where the switch points may be
Switch 1 In a track circuit with one switched branch only, this is clearly the only switched branch
of the track circuit. In a track circuit with two switched branches, this is the switched
branch closest to the joint from which the signal is transmitted on the track.
Switch 2 In a track circuit with two switched branches, this is the switched branch closest to the
joint where the signal is received on the track.
Short cable In a track circuit, this is the shorter of the two cables for the two tuning units on the
SER operator Employee working in the Signaling Equipment Room where the SDTC cubicle is located
for the track circuit subject to works.
Field operator Employee working outside the Tuning Unit/Joint Unit.
Long cable In a track circuit, this is the longer of the two cables for the two tuning units on the
X-HWE-A-UMM-0003 12 5/43
24/08/11
BOLOGNA
1.3 References
1.3.1 Standards
[1] EN 50129 Railway applications. Communication, signaling and processing systems. Safety
related electronic systems for signaling, February 2003
[2] EN 50126-1 Railway applications. The specification and demonstration of reliability, availability,
maintainability and safety (RAMS). Basic requirements and generic process. September 1999
[3] EN 50128 Railway applications. Communications, signaling and processing systems. Software
for railway control and protection systems. March 2001
[4] IEC 61508-4 Functional safety of electrical/electronic/programmable electronic safety-related

systems - Part 4: Definitions and abbreviations. December 1998
[5] EN 50121-4 Railway applications. Electromagnetic compatibility. Emission and immunity of the
signaling and telecommunications apparatus. July 2006
[6] EN 50125-3: Railway applications. Environmental conditions for equipment. Equipment for
signaling and telecommunications July 2006
[7] MIL-HDBK 217F, Military Hand-Book, Reliability prediction of electronic equipment, 1993
[8] UIC/ORE Report A155.3/12 Failure Catalogue for Electronic Components, April 1988
[9] Protocollo di comunicazione seriale, Norma Tecnica TC.E/S.S.I./0001/002 ed.01/93, Ferrovie

dello Stato - Divisione Tecnologie e Sviluppo di Sistema –
1.3.2 SDTC-Digicode Documentation

[11] Smartway Digital Track Circuit – Project Plan – 490371A19SY0011
[12] SDTC – Requirements Specification, ver. 5 – 490502D19SY001
[13] SDTC – Architecture Description, ver. 5 – 490371D19HW001
[14] SDTC – Implementation Manual, ver. 5 – X-HWE-A-UMM-0004
[15] SDTC – Installation Manual, ver. 8 – X-HWE-A-UMM-0001
[16] SDTC - Application Conditions ver. 6 - 315302DXXDG002
[17] SDTC – Test and Commissioning Manual, ver. 9 – X-HWE-A-UMM-0002
[18] Digicode Cable – Product Specification rev. 2 - X-HWE-A-TCF-0003
[19] Digicode DTC24, Specifica Tecnica cavi CdB AF, ver. 2 - X302DXXST005
X-HWE-A-UMM-0003 12 6/43
24/08/11
BOLOGNA
1.3.3 Human Safety Regulations

o Safety shoes
o Protective helmet
o Protective gloves
are closed.
X-HWE-A-UMM-0003 12 7/43
24/08/11
BOLOGNA
 Localize emergency switches to be operated in case of an emergency
 Disconnect protection circuits when performing the following activities:
 Cable connection / disconnection
 Subrack connection / disconnection
 Board connection / disconnection
 Software Upgrade
 Always check that the power supply is disconnected when operating on racks
 Never work alone
 Survey the work area and identify any slippery areas, uncovered cables and sharp
edges
 If an accident should occur, avoid involving other employees. Seek first aid
immediately.
S n a p - t o -b a n a n a c o ile d c o r d
A llig a t o r c lip f o r h e a r t / c h a s s is
c o n n e c t io n
W r is t s t r a p c o ile d c o r d
Table 1-1. SAFETY RULES FOR PERSONNEL
X-HWE-A-UMM-0003 12 8/43
24/08/11
BOLOGNA
2 GENERALITIES
The SDTC system is a fail-safe system. Any faults result in an occupied track circuit signal, from which
only limited additional information can be determined.
Although preventive maintenance is not required, periodic inspections and measurements are
recommended in order to keep the system available. This is particularly true for field equipment which
is subject to harsh environmental conditions. Maintenance to maximize the availability of joints, cables,
short circuits, rail connections etc. is recommended.
To troubleshoot possible faults, simple initial diagnosis is provided by the LED indicators and at the
pre-defined measuring points which are easily accessible. The measuring points also allow you to
carry out tests and to obtain reference values. If the system is equipped with a Diagnostic board, the
values of characteristic voltages and currents can be displayed on the monitor of a PC or stored on a
hard disk.
2.1 Installation, Adjusting and Commissioning

After the track circuit has been installed following directions provided in the document
SDTC Installation manual [15]
then adjusted on based on the document
SDTC Test & Commissioning manual [17]
it is ready for operation. Always make sure that the characteristic parameters of each TC have been
recorded on the calibration forms attached to the latter manual. A copy of this form must be placed in
the SDTC cubicle, or stored in the SER, as a reference for future inspections.
2.2 List of Tools

- 1 pair of walkie-talkie radios or telephones
- Two multimeters (frequency range up to 100 kHz) with alligator clips
- 1 calculator
- “SDTC” record forms, see Appendix E and F of the SDTC Test & Commissioning Manual [17], to
record the measurements and calculations made.
- Wrenches – size 8 – 10 – 12 mm (5/16”, 3/8 or 13/32”, 15/32”)
 1 screwdriver and adjustable pliers
 1 tube of “Silastic” adhesive for the ferrite rod
- Spare ferrite rods (included in the TU)
- 1 screwdriver and adjustable pliers
- One multimeter (frequency range up to 100 kHz) with probes for connection to the SDTC module
- 1 rail current meter
- 1 laptop with parameterization software and DIAG Test software
- 0 - 0.2 - 0.5 ohm shunt, non inductive. To minimize the parasitic inductance of the shunt device,
the sum of the lengths of cable connecting to the rails should be  1.5 m (4.92 ft).
2.3 List of Tools

This manual is valid for the following boards:
X-HWE-A-UMM-0003 12 9/43
24/08/11
BOLOGNA

Tuning Unit Board N897 120 140Y ÷ 153N
TxRx Box (coated) N897 164 610L ÷ 617T
Table 2-1. Room Equipment list
The TU are divided into several types according to the combination of TC frequencies. Only the
following are available:
Horizontal TU
TU Board Vertical TU Box
TU Frequencies Box
Part Number Part Number
Part Number
F7 – F9 N897120140Y P699044D20Z P699044B20G
F7 – F11 N897120141Z P699044D21A P699044B21H
F7 – F13 N897120142A P699044D22B P699044B22K
F9 – F11 N897120143B P699044D23C P699044B23L
F9 – F13 N897120144C P699044D24D P699044B24M
F11 – F13 N897120145D P699044D25E P699044B25N
F8 – F10 N897120146E P699044D26F P699044B26P
F8 – F12 N897120147F P699044D27G P699044B27Q
F8 – F14 N897120148G P699044D28H P699044B28R
F10 – F12 N897120149H P699044D29K P699044B29S
F10 – F14 N897120150K P699044D30L P699044B30T
F12 – F14 N897120151L P699044D31M P699044B31U
F7 – F10 N897120152M P699044D32N P699044B32V
F8 – F11 N897120153N P699044D33P P699044B33W
Table 2-2. TU Equipment list
X-HWE-A-UMM-0003 12 10/43
24/08/11
BOLOGNA
The Tx and Rx boards are housed in TxRx boxes, as shown in the following table:
TxRx Box Part Number (coated)

F7 N897 164 610L
F8 N897 164 611M
F9 N897 164 612N
F10 N897 164 613P
F11 N897 164 614Q
F12 N897 164 615R
F13 N897 164 616S
F14 N897 164 617T
F7 / F11 N897 164 620W
F7 / F12 N897 164 621X
F13 / F7 N897 164 622Y
F13 / F8 N897 164 623Z
F14 / F7 N897 164 624A
F14 / F9 N897 164 625B
F14 / F10 N897 164 626C
F14 / F12 N897 164 627D
F13 / F11 N897 164 628E
F13 / F10 N897 164 629F
Table 2-3. TxRx Equipment List
2.4 Connecting Cables

S bond and terminal bond cables are connected to the rail using a Cembre kit with lug bolted on with a
nut. See the instructions in the Installation Manual [15].
Cables from Tuning Units to electric bonds are connected using a lug on the TU bolts.
The cable between the TU and the room are connected to the TU using a lug on the terminal jumper
bolts. See the design cable drawings in the wiring diagram.
The cable between the TU and the room are connected to the room arrival frame using a lug on the
terminal jumper bolts. See the design cable drawings in the wiring diagram and station signaling room.
The interior cables between arrival frame and SDTC cubicles are connected using labelled cables.
See the design cable drawings of the station signaling room. The track circuit signal cables are
inserted on SDTC mother board connectors using MetriMate connectors having lock clips. See the T&C
Manual [17].
The mains power supply, 110 V AC, is connected to the cubicles. See the cable lists and cable
drawings of the station signaling room. Power supply feeds a rear three pole connector on the power
conversion box, see Installation Manual [15].
The SDTC cubicle and interlocking (e.g. iVPI) cubicle are connected using labeled cables. See the
cable lists and cable drawings of the station signaling room. The SDTC output cables are inserted on
SDTC mother board connectors using MetriMate connectors having lock clips. See the T&C Manual [17].
X-HWE-A-UMM-0003 12 11/43
24/08/11
BOLOGNA
2.5 Safety Procedures

For human safety, follow the standard procedures. Please see § 1.3.3 and the safety procedure
against electrocution. In terms of the room equipment, check in advance that the mains power supply
230/110 V AC complies with regulations and that metal parts that may be subject to elevated
voltage are grounded correctly. Follow the standard regulations for the train electrical power supply
25 kV AC 50 Hz, 3 kV DC, or 750 V DC depending on the application for the field equipment. Always
carefully check in advance that all large metal parts are grounded.
All maintenance activities must be performed under conditions of safety for the maintenance operator.
They must be provided with Personal Protection Equipment, i.e.:
- Safety shoes
- High visibility clothing
- Protective helmet
- Protective gloves
Moreover, all maintenance teams must be equipped with and carry a medical safety box. When
operating in the tunnel other devices are needed, such as breathing apparatus, portable lights,
communication phones, etc. Please refer to the local railway/metro procedure.
The maintenance operations are divided into two types: in the room or room and field (track). In the
first case the maintenance operation will be in touch with central supervision room in order to
communicate his presence and to switch off the alarm, if present. In the second case, employees will
be divided into at least two groups, one in the field and one in the room, in communication with each
other and with the Central Supervision Room by phone. The Central Supervision Room will provide
them permission to enter in the track side. Please refer to the local railway/metro procedure.
All room equipment, the cable shield and armor, and the metal parts in the field (except in the DC train
power area) are normally connected to the ground (earth). Before performing any operation, check the
integrity of the ground wires (green/yellow) and check the integrity of cable insulation measuring
system (if present).
In 25 kV AC 50 Hz traction area all ground wires are connected to the ground line buried conductor. In
the 3 kV DC or 750 V DC traction area refer, for example, to the RFI IS728 standard that requires
metal parts in the traction area nearest to the impedance bond or the rail itself to be grounded. The
cable shields and armor are not grounded, neither in the field nor in the room, but grounding points are
accessible. During maintenance operations on parts connected to the cable, i.e. arrival cable frame in
the room and tuning unit in the field, it is necessary to connect the shield and armor to the cable.
The protection rating of the TU is IP55, when closed. The protection rating of the cubicle in the room is
IP41, with the cubicle doors closed.
X-HWE-A-UMM-0003 12 12/43
24/08/11
BOLOGNA
3 LEDS, TEST POINTS AND JUMPERS
3.1 Tx-Rx Box

The front panel of the Rx board is combined with the Tx board. They are mounted in a box:
POWER: on/off general SDTC power

ADJ.V.RX: receiver sensitivity
ADJ.V.TX: transmitter regulation
DIR: direct DOT regulation
(Main and Switch Rx)
REV: reverse DOT regulation
(only in a Switch Rx)
V.TX: transmitter voltage
V.RX: receiver filter voltage
FUSE 24LOC: 24 V DC fuse

V.IN: receiver cable voltage
TEST V.TX: not used
V.OUT: transmitter filter output voltage
24V.DIG: 24 V DC power
50 V: transmitter power front fuse
NOTE: Never insert two jumpers in the upper half of ADJ.V.Tx (positions 1-7), nor in
the lower half (positions 9-15). Always use one jumper in the upper part and one
jumper in the lower part.
X-HWE-A-UMM-0003 12 13/43
24/08/11
BOLOGNA
3.1.1 LEDs
The following LEDs are located on the front of the box that houses the two boards:
50 V: 50 V DC /10 V DC Power supply for the power amplifier
24 V DIG: 24 V DC power supply for the selective amplifier.
3.1.2 Test Points

Test points at the front of the box:
V.TX: voltage at the secondary of the power amplifier output transformer. This is the same that was
adjusted with the ADJ.VTX selector located above the test points. Caution: the wave measured at the
V.TX test points is not sinusoidal but square.
V.OUT: voltage at the Tx-cable.
50 V: DC Power supply for the power amplifier
V.RX: voltage at the input of the amplification stage of the signal after the passive reception filter. This
is the same that was adjusted with the ADJ.VRX selector located above the test points.
V.IN: voltage on the cable side winding of the receiver-cable matching transformer. Caution: this
voltage may be affected by disturbance coming from the field which can alter the reading.
TEST V.TX: not used
24 V DIG: used for measuring the 24 V DIG power supply
X-HWE-A-UMM-0003 12 14/43
24/08/11
BOLOGNA
3.2 RT Board
Front panel
MSR +
 : Electromagnetic drive magnetic threshold
MSR -
24 V LOC : 24 V service voltage
OUTPUT : Track Relay or Electronic Interlocking System

Vital Input command power.
+ 5V : 5 V service voltage.
- 12V
 : +12 V service voltage.
+ 12V
GND : Voltage ground
N : Normal system.
R : Standby (Reserve) system - Not used.
SW2 : Not used.
SW1 : Not used.
24V.SW : Not used.
X-HWE-A-UMM-0003 12 15/43
24/08/11
BOLOGNA
3.2.1 LEDs
24 V LOC : presence of 24 V service power supply
OUTPUT : Track Relay or Electronic Interlocking System Vital Input command power.
+5 V LOC : presence of 5 V service power supply
- 12V
 : presence of 12 V service power supply.
+ 12V
N : Always ON.
R : Always OFF.
24V.SW : Not used.
3.2.2 Test Points
MSR +
 : Electromagnetic drive magnetic threshold
MSR -
24 V LOC : 24 V DC service power supply
OUTPUT : Track Relay or Electronic Interlocking System Vital Input command power.
+ 5V : 5 V DC service power supply.

- 12V
 : +12 V DC service power supply.
+ 12V
GND : Power supply ground
SW2 : Not used.
SW1 : Not used.
X-HWE-A-UMM-0003 12 16/43
24/08/11
BOLOGNA
3.3 MODEM Board

Front panel
MOD: the 3 red LEDs indicate that the channel set as the Modulator
is in binary form.
BIT1M: green LED indicating bit transmitted «1».

BIT0M: LED ON indicating bit transmitted «0».
DEM: the 3 LEDs indicate that the channel set as the Demodulator
is in binary form.
CD: green LED indicating that the Demodulator input voltage

greater than 1 V peak.
BIT1D: green LED indicating bit received «1».
BIT0D: red LED indicating bit received «0».
LF: red LED indicating MODEM card configured for DTC24 system.
HF: red LED indicating MODEM card configured for DTC921
system.
OSC INT: trimmer for adjustment of frequency emitted by the

internal generator.
F1: adjustment of coarse frequency of internal oscillator.
F2: adjustment of fine frequency of internal oscillator.
OSC.EXT: terminal used to insert an external generator and to read
the frequency of the internal generator.
X-HWE-A-UMM-0003 12 17/43
24/08/11
BOLOGNA
3.3.1 LEDs
The MOD 1, 2, and 4 LEDs indicate the channel selected on the modulator with jumpers P1, P2, and
P3.
Channel MOD1 MOD2 MOD4

7 0 0 0
8 1 0 0
9 0 1 0
10 1 1 0
11 0 0 1
12 1 0 1
13 0 1 1
14 1 1 1
The DEM 1, 2, and 3 LEDs indicate the channel selected on the modulator with jumpers P12, P13,
and P14.
Channel MOD1 MOD2 MOD4
7 0 0 0
8 1 0 0
9 0 1 0
10 1 1 0
11 0 0 1
12 1 0 1
13 0 1 1
14 1 1 1
BIT1M, BIT0M: bit transmitted by the modulator.

BIT1D, BIT0D: bit received by the demodulator.
CD: carrier detection, indicates that the demodulator input voltage is greater than the demodulator
operation threshold (1 Volt peak).
X-HWE-A-UMM-0003 12 18/43
24/08/11
BOLOGNA
3.3.2 Test Points

There are two test points (EXT OSC) on the front panel for the connection to a frequency generator for
calibration of the electric joint.
In addition to the external generator, the board can be configured connected to an internal generator.
The frequency of the internal generator is adjusted using an appropriate screw driver on the two panel
trimmers.
In detail:
 F1 is used for the coarse adjustment of the frequency,
 F2 is used for the fine adjustment of the internal oscillator frequency.
X-HWE-A-UMM-0003 12 19/43
24/08/11
BOLOGNA
3.4 Jumper Settings

The following table provides the description of the jumpers and the settings.
The jumper setting can be:
 Configuration: USE for configuration
 Fixed: DO NOT USE for configuration, leave in the DEFAULT position described.
SDTC Board Configuration Jumpers Fixed Jumpers

(These jumpers CAN BE MODIFIED) (DO NOT modify these jumpers)
Name Description
Tx DO NOT modify any jumpers
P1, P25 Vrx adjustment,
additional
regulation of
receiver voltage;
position 5 more
gain, position 1
less gain; P1 for
DIR regulation;
P25 for REV
regulation (T&C §
3.5)
P4 to P11 Cable equalization;
pairs P4-P5, P6-
P7, P8-P9, P10-
Rx P11; each pair 330
ft of cable when
both in 2-3 (T&C §
3.5)
CAVO 1 Exchange Tx and
Rx pairs (T&C §
2.3.3).
Main position 0° -
rotated during the
TU calibration.
Switch position
rotate 90° (T&C §
2.3.4.2)
DO NOT MODIFY the remaining jumpers
X-HWE-A-UMM-0003 12 20/43
24/08/11
BOLOGNA

P14 Select Vital Output
range
Jumper OFF when
output to
interlocking (iVPI);
Jumper OFF when
output to relay
Circuit not used P5, P13 ON
Circuit not used P6, P7, P8, P12 OFF
RT
Select delay P3 OFF
network for Tx data
Select delay shift P10 ON
for Tx data
Select delay shift P9, P11 OFF
for Tx data
For testing P4, P2 ON
By pass for circuit P1: 2-3
not used
P1, P2, P3, P4 Configuration
frequency Tx (T&C
§ 8)
P12, P13, P14 Configuration
frequency Rx (T&C
§ 8)
P26 Select Tx data
from Main module
On MODEM Main
board P26 in
position 1-2
Modem On MODEM
Switch board
P26 in position
2-3
Select data source P6: Pos 11 (COD)
PLL circuit P7, P8, P9: only P7 ON
manufacturing test
PLL circuit P16, P17, P18: only P18 ON
manufacturing test
P10, P11 Bit code
configuration (T&C
§ 8)
X-HWE-A-UMM-0003 12 21/43
24/08/11
BOLOGNA

Select P19, P20, P21: only P19
demodulator
recovery clock
Watch dog trigger P21A: ON
P27 Select
COD/Sacem data
modulator
On MODEM Main
board P27 in
position 1-2
On MODEM
Switch board
remove P27
P23 Select internal
frequency
generator
Pos 1-2 Normal
function
Pos 2-3 for
electrical joint
calibration
For testing P25: ON
Select external P25B: ON (enabled for internal
frequency oscillator, not for external oscillator)
generator
Circuit P1, P2: ON
manufacturing test
Select inverting/not
inverting RS232
cable
P3, P4: In position
1-2 inverts RS232
cable
DIAG
In position 2-3
does not invert
RS232 cable
Select
RS2323/422
communication
P7: 1-2 for RS232
P7: 2-3 for RS422
X-HWE-A-UMM-0003 12 22/43
24/08/11
BOLOGNA

Select normal P5: 1-2
operation/TxRx
loop on RS422
P9, P17 Select RS422 pair
termination
resistors
2-3 in the end of
RS422 line (last
DIAG line), for all
others in 1-2
Watch dog trigger P6: ON
Select P8: 1-2
external/internal
memory
P10-P16 Configuration
frequency of Track
Circuit (T&C § 7)
Select Vital Output P18 ON
range
24 V-ON/12 V-OFF
P3 P4 Select regulation
taps from Main
module
Mother Board Close jumpers P3

and P4 in the
MAIN module and
open them in the
Switch module
Circuit P1 ON
manufacturing test
Tuning Unit
Circuit P5 OFF
manufacturing test
X-HWE-A-UMM-0003 12 23/43
24/08/11
BOLOGNA
4 OPERATING CONDITIONS
4.1 System Operation

SDTC is an audio frequency track circuit. This means that a train or other vehicle is detected by
transmitting audio frequency signals with a specific protection code on the track. If, once received on
the other side of the section, this signal meets all of the defined criteria, the section is declared clear. If
a train or vehicle drives into the section concerned, it will cause a short circuit and, as a consequence,
the track circuit will be defined occupied. For detailed technical information, refer to the following
documents:
SDTC Architecture Description [13]
This document describes the design and working principles, as well as the constraints and basic
principles of engineering.
SDTC Installation manual [15]
This document describes the installation of bonds, T.U. in the field.
SDTC Testing & Commissioning manual [17]
This document describes the test and commissioning of both filed and SER equipment.
4.2 Block Diagram

Figure 4-1 shows the SDTC functional blocks for a track circuit on a straight line, i.e. a track circuit on
a main line.
X-HWE-A-UMM-0003 12 24/43
24/08/11
BOLOGNA
T.U . T.U .
ZLC R x Po in t
Tx - R x S w itch
Filt er Tx Bo ard R x Bo ard

Filte r
A m plifie r Am p lifier
Mo d em B oa rd
CD
S wit ch
d e tec tor
MS K
D e m od u la to r
C PFS K M SK C o de X TA L
M o du lato r M o du lato r g en e ra to r o scilla to r
S A CE M
b a se ba n d
R T B oa rd
D
Fr e e (1 ) /
O ccu p .(0 )
De lay
n et w.
D C o m pa rato r
R it 2
R MS R it 1
Am p lif ier Ge ne ra to r
2 0 kH z
Figure 4-1. SDTC Block Diagram
When a point diverted branch is added to a main line track circuit, then the following block diagram is
added to the one for the main line:
X-HWE-A-UMM-0003 12 25/43
24/08/11
BOLOGNA
L.I.U.
T.U.
Filter Tx Loop Rx Point

Board Board Filter
Amplifier Amplifier
Modem Point
Board
MSK
Demodulator
CPFSK XTAL
Modulator oscillator

SACEM
Code Generator
base band
RT Point D
Free (1) / Board
Occup.(0) Delay D Comparator
netw.
Rit 2
RMS Rit 1
Generator
Amplifier
20 kHz
Figure 4-2. Block Diagram of the SDTC – Diverted Branch
X-HWE-A-UMM-0003 12 26/43
24/08/11
BOLOGNA
The point diverted branch SDTC equipment is similar that for the TC main line rack module and
occupies the same rack space.
Please refer to the “SDTC Architecture Description” [13] for a description of SDTC operation.
4.3 Field Maintenance

Potential causes of failures on the track are listed below:
 Inefficient or defective insulating joints
 Ground connections that cause involuntary connections or short circuits
 Point rods that cause a short circuit between the rails
 Support plates in points
 Loose cables in and to the track
 Faulty rail connections
 Cut or damaged S-Bond cables
4.3.1 Replacing S-bond, TU

If the S-bond, TU must be replaced, please refer to the SDTC Installation Manual and SDTC Testing
and Commissioning Manual.
4.4 Field Maintenance
4.4.1 Replacing Rack Modules

Before changing any elements, turn off rack power to the rack that contains the modules to be
replaced. This is easily done either by turning off the front panel switch or the rear power conversion
switch.
A standard screwdriver can be used to unscrew the modules. Before replacing any rack modules, pay
careful attention to the board jumper configuration, following the SDTC Testing & Commissioning
Manual and the calibration forms. The maintenance personnel must fill out the Failure Report attached
to this Manual. If a Tx-Rx module must be replaced, follow the instructions below:
 Check that the new module has the same channel (frequency) as the original one by checking the
part number of the module
 Set the ADJ. V.TX and ADJ V.RX front panel jumpers in their original positions
 Set the P1 and P25 internal jumpers in their original positions
 Set P4 to P11 in its original position, according to T&C Manual, Section 3.5
 Set the CAVO1 jumper to its original position, according to T&C Manual Section 3.5
 Check that the value of V.OUT is similar to that reported on the calibration form
 Check that V.RX>0.5 Vrms
 Perform a shunt test on the track
If a RT board must be replaced, check the OUTPUT voltage and perform a shunt test on track.
If a MODEM board must be replaced, set the channel selection (P1, P2, P3; P4, P12, P13 and P14)
and protection code (P10 and P11) selection jumpers to their original positions, according to Appendix
C of the T&C Manual. Furthermore:
X-HWE-A-UMM-0003 12 27/43
24/08/11
BOLOGNA
 Set P27 and P26 in position 1-2 on the main module MODEM
 Set P27 and P26 in position 2-3 on the switch module MODEM
For more details refer to the SDTC Testing & Commissioning Manual.
4.4.2 Electronic Faults

SDTC is fit with a number of LEDs that provide a very rapid, rough indication of the probable origin of
the problem. The TC signal is generated in the SER equipment by a modulator circuit. It is then
amplified and sent along the track through a filter, a cable and a Tuning Unit. It is received by the
receiving Tuning Unit and sent to the SER by cable. There the signal is filtered, checked both in
amplitude and bit pattern (after demodulation) and, on based on the result of the checks, a clear track
circuit signal is given. It is always possible to see if the receiving circuit generates a clear or occupied
status with the OUTPUT LED. Please see Par. 3.2.1 (when lit, it means the status is clear).
Power Supply Check

The following situations may occur:
1. No power supply: check that the switches (front and rear) are in position 1
2. Check that the rear Power Conversion fuses are not open, see Figure 4-3
220 V line
fuse
50 V
POWER CONVERSION 0
1
10 V
Figure 4-3 Power Conversion Unit
Note: the transmitter power fuse on the rear Power Conversion box must be inserted
in the 10 V or 50 V position, according to the commissioning procedure. Once the fuse
is positioned, it absolutely must not be removed. If the fuse must be replaced, check
the 50 V DC voltage to ensure that it is close to the value recorded on the calibration
form.
X-HWE-A-UMM-0003 12 28/43
24/08/11
BOLOGNA
3. Check of the front equipment fuses. If the front panel power LED is not lit, check if the
corresponding fuse is open.
Fuse 50V DC6.3 A 250 V
Fuse 24V Loc 2 A 250 V
Fuse 24V Dig 1 A 250 V
Fuse 12V DC1 A 250 V (this fuse is in the Tx-Rx box, symbol F3)
Check the power values at the front panel test points:
50 V = 47  58 V DC
24V Loc = 22  26 V DC
24V Dig = 24  28 V DC
+12 = 11.8  12.2 V DC
- 12 = -12.2  -11.8 V DC
+5 = 4.9  5.1 V DC
Note: the power line voltage must be 110 V AC ± 10%
If the supply voltage is low despite all the fuses being OK, replace the Tx-Rx module.
If the +5 V fails, try to replacing the RT board.
The main signals from the SDTC are V.RX, V.OUT and OUTPUT. If there is a fault, perform the
following actions.
X-HWE-A-UMM-0003 12 29/43
24/08/11
BOLOGNA
OUTPUT not present

If the V.RX signal is present and greater then 0.5 Vrms but the OUTPUT is not present, check if the
DELAY1 LED is lit up. If not lit, check the MODEM front panel showing the dynamic operation of the
board, i.e. BIT1M and BIT0M LEDs flashing, CD green LED on and steady, and BIT1D and BIT0D
LEDs flashing. If this is not the case, replace the MODEM board. If the MODEM is working, but
DELAY1 does not light up, replace the MODEM board.
If the DELAY1 LED is lit but OUT.MSR does not light, then either the output stage of the RX filter or
the 20 kHz generator have failed; otherwise the magnetostatic relay may have failed. Check that the
MSR+ and MSR- voltages are greater then 11 V DC. If this voltage is not present, then the RX filter
output stage has failed. Replace the Tx-Rx module.
Check that the 20 kHz test points are greater than 27 Vrms. If this is not the case, then replace the RT
board.
If the OUT.MSR LED lights up and the relative test points have voltages from 5.1 to 6.8 V DC but the
OUTPUT is not present, the DELAY2 module has failed. Replace the RT board.
V.RX is not present

 If the track circuit is free, this signal must be greater than 0.5 Vrms. If all other checks are good
but still the voltage is low, try measuring the current in the rail using a rail current meter. Move
from the Tx end to the Rx end of the TC, on both rails in order to discover if there is a particular
point where there may be a concentrated leakage of TC current to ground.
 Check that V.IN signal has an amplitude in the range of about 1 Vrms using a band pass portable
tunable filter, for example the KROHN-HITE 3700 Filter, or, if possible, switch off the nearest track
circuits.
 If V.IN is not present, check the signal on the cable frame using the band pass filter. If the Rx
signal is not present on cable frame, check if the Tx signal is present on the cable frame. If Tx is
not present either, V.OUT must be double-checked. If Tx is present on the cable frame, check if
the signal reaches the transmitting tuning unit via cable; then check the receiving tuning unit.
 If the fault is external, check the voltage on the TU: the voltage on CN3 or CN4 must be similar to
the voltages on the cable frame. If not, the Rx or Tx cable may be faulty. Measure the loop
resistance of the pair by disconnecting it from the TU and in the SER. Check the voltage ratio
V(C80)/V(C83) against the record on the TU sheet. If it is not the same, check the A-B-C
connection to the rail and check the S-bond cable. If faulty, replace TU or cables. Note that all of
the track side voltages must be measured using a band pass filter or by turning off the 2 nearest
track circuits.
V.OUT is not present

Check if V.TX signal is present. If not, replace MODEM board.
If the V.TX signal is present and V.OUT is less then the value recorded during commissioning, the TX
filter has failed. Replace Tx-Rx module.
X-HWE-A-UMM-0003 12 30/43
24/08/11
BOLOGNA
Short time occupation - BAND WIDTH CHECK
When there is repeated short time occupation, this procedure can be used to check the bandwidth of
the Tx-Rx filters.
- On the Modem board select the P23 jumper to transmit the carrier frequency of the TC, as in the
TU tuning procedure.
- Vary the F1 and F2 trimmers on the front panel of the Modem. Find the maximum value of V.RX; it
should be near the carrier frequency +/- 250 Hz.
- Do not record the value of the V.RX test points.
- Calculate the –3 dB cut-off value as the maximum value times 0.707 = square root (2)/2
- Vary the F1 and F2 trimmers. Determine the two cut-off frequencies which correspond to the – 3
dB values at V.RX.
- Calculate the band width as the differences between the last two frequencies.
- Restore the P23 jumper on the Modem.
The band width must be in the range of 900 to 1100 Hz. If the bandwidth is less than 800 Hz, both TU
of that TC must be checked. Follow the instructions provided in the T&C Manual. If the TU are good,
the Tx-Rx boards must be replaced and checked in the lab. Follow the single board FAT procedure
provided below.
DELAY1 FLICKERING CHECK

This procedure checks the data bandwidth of the Modem receiver if there is flickering (ups and downs
at very low frequency) or other spot drops on the TC.
- Replace the Modem TC board with a spare: do not use or modify the current TC Modem board.
Remove the front panels on the right side of the Modem to access the board.
- In normal operation, rotate the RT4 trimmer slowly in one direction using a small screwdriver until
the Delay1 LED turns off.
- Remove the field signal from the frame cable in the SER. Open the Rx or the Tx cable (it is better
operate on the Rx cable, if easily accessible on the frame).
- Note the frequency value between test point A9 and GND. It should be about 400 Hz.
- Restore the field signals to the frame cable, both Tx and Rx.
- Rotate the RT4 trimmer slowly in opposite direction until the Delay1 LED turns on and then off
again.
- Remove the field signal from the frame cable in the SER. Open the Rx or the Tx cable.
- Note of the frequency value between test point A9 and GND, it should be about 400 Hz; more than
400 Hz if the previous value was less, or vice versa.
- Restore the RT4 trimmer to 400 Hz, then restore the field cables and check that Delay1 LED turns
on.
- The operating range frequency should be between 395 to 408 Hz. If not, check the Tx-Rx and the
TU’ filter bandwidth as described in the previous paragraph.
X-HWE-A-UMM-0003 12 31/43
24/08/11
BOLOGNA
If any other checks or replacements do not change the TC situation, insert the current TC modem
board. Remove the field signals to the frame cable and change the RT4 trim until the average value of
the two operating frequencies found during the flickering check is reached. Note of the value of the A9
frequency on the TC sheets, restore the field signals, seal the RT4 screw with a paint drop, and check
the TC operation for at least 30 minutes.
X-HWE-A-UMM-0003 12 32/43
24/08/11
BOLOGNA
5 DIAGNOSTIC BOARD
The diagnostic board displays some of the main SDTC values via a PC connected to the front RS232
port or via the CEDD central system connected to the rear RS422.
Front Panel of DIAG board (optional):
+5V: red LED for power supply.

RST: green LED indicating reset
Rx: red LED ON indicating receiving inquiry from PC
Tx: green indicating transmitting data to PC
SER: front panel RS232 connector to PC.
RST: reset button

FAIL: not used
INSRV: not used
Figure 5-1 DIAG Board - Front Panel
X-HWE-A-UMM-0003 12 33/43
24/08/11
BOLOGNA
5.1 Setup of the DIAG Board

1) Extract the DIAG board and perform the following set-up:
 For RS232 serial connection to portable lap top -
 P5 and P7 in position 1-2 (select the RS232 port on the front panel)
 P3 and P4 in position 2-3 if the cable is non-inverting
 Refer to Figure 5-2 for RS232 cable and connector D9
 For a RS422 to CEDD serial connection -
 P7 in position 2-3
 P17 and P9 in position 1-2 in all DIAG boards, except the first and the last on the line to the
CEDD
 P17 and P9 in position 2-3 in the first and last board (line terminations)
 Select the channel frequency moving the P10P16 jumpers as shown in  Table 5-1.
CHANNEL P10 P11 P12 P13 P14 P15 P16

7 2-3 2-3 2-3 1-2 1-2 2-3 2-3
8 1-2 2-3 2-3 1-2 1-2 2-3 2-3
9 2-3 1-2 2-3 1-2 2-3 1-2 2-3
10 1-2 1-2 2-3 1-2 1-2 1-2 2-3
11 2-3 2-3 1-2 1-2 2-3 2-3 1-2
12 1-2 2-3 1-2 1-2 1-2 2-3 1-2
13 2-3 1-2 1-2 1-2 2-3 1-2 1-2
14 1-2 1-2 1-2 1-2 1-2 1-2 1-2
Table 5-1. Selection of Frequency
Note: the 1-2 position is shown on the silkscreen by a thick line.
2) Set the SDM address using the SW1 switches, with an address that is not equal to 0, e.g.
01 hexadecimal, as in Table 5-2
1 2 3 4 5 6 7 8
01 ON OFF OFF OFF OFF OFF OFF OFF
02 OFF ON OFF OFF OFF OFF OFF OFF
03 ON ON OFF OFF OFF OFF OFF OFF
etc.
Table 5-2. CEDD Address
4) Do not insert P18, in case of ASCV/CLC, with vital output at 12 V DC.

5) Insert the DIAG card.
X-HWE-A-UMM-0003 12 34/43
24/08/11
BOLOGNA
PC DIAG
D 9 pin D 9 pin
1 1
male
female Inverting 2 2 RD
3 3 TD
4 4
5 5 GND
To PC To DIAG 6 6
7 7
SER conn. 8 8
9 9
Note: A null-mode cable c an be used.
D 9 pin
D 9 pin
female male 1 1
Non Inverting 2 2
3 3
4 4
To PC To DIAG 5 5
6 6
7 7
8 8
9 9
Figure 5-2. RS232 Link
5.2 PC DIAG software

The PC DIAG software is a program that determines and displays, on the PC monitor, the main
measurements made using the DIAG board on a SDTC module.
5.2.1 List of Tools

 Laptop or desktop with RS232 port, or RS2332 via USB port
 RS232 serial cable
 Software program installed on the laptop: program file coldiag4.exe and text file colcfg.txt
Coldiag4.zip
5.2.2 Use of the Program

Create a working directory on the PC, e.g. c:\DIAG. Copy, using the Word “copy” command, the zip file
from this document to the directory. Extract the two compressed files.
Note: these files must be in the same directory, and must have a valid MS-DOS name and path with 8
character maximum for each name. It is recommended to use “colcfg.txt”.
X-HWE-A-UMM-0003 12 35/43
24/08/11
BOLOGNA
PC Set-up
Connect the PC’s COM1 or COM2 serial port to the SER port on the front of the DIAG board using an
inverting (or non-inverting) female-male cable.
The coldiag4.exe program can be executed on a PC computer at a DOS prompt window, or using
Windows 9x- 2000-XP. The program shows the diagnostic measurements on the PC monitor. The
operator can configure, print to LPT1 printer (not available in W2000-XP), save to a text file, or exit
using the keyboard.
Video image from coldiag4.exe:
ALSTOM Transport S.p.A.
SDTC
- Diagnostic board measurements -
Channel: 8 Date: 7/ 4/2002

V.TX : 33.3 V ADJ.VTX: 3-13 Time: 12.34.33
Itx : 0.22 A rms Power : 225 V AC

Ifet : 0.91 A pck 50V : 55.8 V
24V DIG: 25.7 V
24V LOC: 24.4 V
+12 : 12.0 V
-12 :-11.9 V
+5 : 4.95 V
Temp : 26 °C
Comp : 6.0 V
20 kHz: 30.4 V AC
RIT1 : 25.6 V DC
OUT.MSR: 6.84 V Rack: 1
OUTPUT: 13.3 V s.no.: 1 SDM - Add.: 01
P18: absent Oper.: ag TX: ACK RX: ACK
diag.txt
Config: <C> File: <F> Print: <P> Exit: <ESC>
Displayed values accuracy is ± 5%. Temperature accuracy is ± 5 °C (9 °F). The video displays current
date and time.
Communication between PC and DIAG is working when the series of Tx and Rx messages end every
about 1 second with TX: ACK RX: ACK at bottom right-hand side of the monitor. If link is down then
“RX: --” will appear. In this case, check the cable and the DIAG jumper settings. In particular, check
the match of the SW1 Address DIAG setting and the program SDM Address configuration.
X-HWE-A-UMM-0003 12 36/43
24/08/11
BOLOGNA
Moreover, it is necessary to report the ADJ.VTX and P18 jumper settings on the PC program by
configuring it off-line, using “colcfg.txt”, or configuring it on-line, by pressing <C> on keyboard. Note: if
these jumpers do not match, then the diagnostic values V.TX and OUTPUT will not be correct.
When the operator presses “<C>“ on the keyboard, he accesses the configuration menu and can
modify the PC serial port COM1 or COM2, the SDM diagnostic address, the serial number of SDTC
rack and DIAG card under test, the operator name, the transmission adjust, the name and the
directory of record text file. The default values are set initially: these values are indicated as “current”,
and may be accepted by operator by pressing <ENTER> on the keyboard. The values established off
line in the “colcfg.txt” configuration file can not be modified during the on-line configuration session. To
allow on-line configuration, delete the “colcfg.txt” file (all parameters) or leave the item being changed
blank in the “colcfg.txt” file.
Video image from on-line configuration:
ALSTOM Transport
SDTC
- Diagnostic board measurements -
- Diagnostic configuration parameters -
Press <ENTER> to accept the current values
Communication Port COM [1-2] (current: 1)

SDM Address [1-255] (current: 1)
Rack Serial Number (current: 00A)
DIAG Serial Number (current: 001)
Operator (current: ag)
Transmitter configuration
ADJ.VTX top [1, 3, 5, 7] (current: 3)
ADJ.VTX down [9, 11, 13, 15] (current: 13)
Directory of Record file (current:)

File name (current: diag.txt):
If the directory from which “coldiag4.exe” is executed also contains the “colcfg.txt” file, then the
program acquires the set configurations during initialization. This way it is not necessary to perform
repetitive operations, for example to enter the name of operator each time during on-line configuration.
The values (for example the serial number) that need to be changed must be left blank in the
“colcfg.txt” file. Any text editor can be used to modify this file, for example “Notepad”, as shown in the
following sample “Colcfg.txt” file:
- Configuration Parameters of Diagnostic - coldiag*.exe ver.3 12/02/04

Left blank for configuration during execution.
Port COM [1..2]: 1

SDM Address [1..255]: 1
Rack Serial Number: 00A
DIAG Serial Number: B
DIAG Version [0, A]: A
Digicode type [1->DTC24, 2->DTC921, 3->SDTC]: 3
Operator: ag
ADJ.VTX top [1, 3, 5, 7]: 7
ADJ.VTX down [9, 11, 13, 15]: 11
SW1 - Jump P4 [1, 3, 5, 7, 9, 11 - only DTC]: 1
SW2 - Jump P2 [1, 3, 5, 7, 9, 11 - only DTC]: 1
Output 12/24 V - Jump DIAG P18 [0-absent (12V), 1-inserted (24V)]: 0
Record File [.txt / matr / cest]:
Directory [.\]:
X-HWE-A-UMM-0003 12 37/43
24/08/11
BOLOGNA
Revision History
Version Program Date Note

1. v.2 coldiag.exe 26/02/03 Taken from DTC24 version; inserted Rev A for new DIAG
part number revision
2. v.3 coldiag3.exe 12/02/04 Overlap of V.OUT with channel
3. v.4 coldiag4.exe 12/12/05 Powers black background; MSR removed
Table 5-3 Revision History
X-HWE-A-UMM-0003 12 38/43
24/08/11
BOLOGNA
6 PERIODIC MAINTENANCE
After a one year interval, the following preventive maintenance operations must be performed:
1. Visual inspection of the electric joints. They must be in good condition (clips fixing cables to the rail,
connections to the rail and to the TU).
2. Check of the voltage in the positions indicated in the manuals for testing & commissioning. due to
climatic conditions and particularly the ballast condition. Compare the values found with the values
recorded on commissioning. If significant differences are found that cannot be justified by climatic
conditions and, especially, if the external values are found to be at the limits, failure may occur. The
cause of this needs to be investigated.
3. Check if a non-inductive 0.5 Ohm resistance interposed in any position on the track circuit (except
for the zone of the electric joints) results in occupancy of the track circuit. Check if a non-inductive
resistance of 0.2 Ohm interposed inside the zone of the electric joint causes occupancy of at least
one of the track circuits.
4. Check if a short circuit inserted at 1 ÷ 2 m (3 to 6 ft) distance from the electric joint causes
occupancy of the following track circuit. If the track circuit occupies, check whether the calibration
of the track circuit is correct and that there are no defective components in the tuning units.
5. Measure the rail current 1 m (39”) after the short circuit in order to check the minimum transmission
current (100mA) value.
X-HWE-A-UMM-0003 12 39/43
24/08/11
BOLOGNA
7 MAINTENANCE LEVELS
For efficient troubleshooting, the following maintenance levels are defined:
1st level customer’s troubleshooting department
nd
2 level ALSTOM local site maintenance service
rd
3 level ALSTOM Ferroviaria S.p.A. ITALY
CUSTOMER’S TROUBLESHOOTING DEPARTMENT

In this department failures are resolved at module level. In other words, one or several faulty modules
can be traced and replaced. Besides, at this level, the customer should be able to detect cable failures
and unplugged cables. The customer’s troubleshooting department can also check whether an
occupied state indication results from involuntary short circuits or problems in/on the track. Faulty
modules are sent back to the manufacturer. Include all pertinent information: section number, date of
replacement and any distinctive characteristics (where appropriate). See the «failure report»
attached.
Basic knowledge of the system, an understanding of the LED indications and measured values is
sufficient for this purpose. This basic information and understanding are gained from the instructions
dealing with what precedents are provided in agreement with the customer. Furthermore, the
customer is provided with the documents in which the information required can be found.
ALSTOM LOCAL SITE MAINTENANCE SERVICE

This service level is able to solve failures at modular level as well as more complex situations due to
its greater theoretical knowledge of the system. The factory will provide this service level long-
distance support. The local site maintenance service also performs measurements according to
factory instructions to obtain necessary information for troubleshooting. After performing replacement
at a modular level, the faulty module is sent to the factory for repair. Information about the track circuit
number, the date and any distinctive characteristics are included. lf the problem was not caused by a
fault, a written report will also be forwarded to the factory including date, track circuit, action and/or
origin in addition to possible distinctive characteristics.
To provide this information, the local site staff will be involved in the execution of the project as much
as possible and if need be, the staff concerned will be provided with the necessary knowledge.
ALSTOM IN ITALY
Alstom Italy intervenes when there are failures that cannot be solved either by the customer or by the
local ALSTOM staff. The company provides telephone support to the local site and will take action on
site if need be. Furthermore, all possible faulty elements are sent to the factory for evaluation and the
decision for repair at a component level is made.
X-HWE-A-UMM-0003 12 40/43
24/08/11
BOLOGNA
8 MEASURING INSTRUMENTS AND TOOLS

In order to be able to perform measurements, the necessary measuring equipment and related tools
are supplied. To perform voltage measurements or to display simple signal waveforms, a digital
multimeter (FLUKE 867B or equivalent) can be used. Where required, a spectrum analyzer (for
example the portable DL2200 or Crystal “CoCo 80-2”) can be used.
Rail current can be measured using the Rail Current Meter, part number P687071000N, included in
the supply. This device is a current-voltage transducer, whose transfer ratio is 1 mVrms= 2 mArms. It
must be connected to a multimeter. Remember: since electric joints do not perfectly separate track
circuits, more than one frequency is usually present in a track circuit. To perform correct rail current
measurements either switch off adjacent track circuit transmitters or interpose a filter between the Rail
Current Meter and the multimeter.
A standard screwdriver is sufficient to remove boards and modules from the SDTC rack.
A complete set of tools is needed to remove cables or TU in the field.
X-HWE-A-UMM-0003 12 41/43
24/08/11
BOLOGNA
9 APPENDIX A – FAILURE REPORT

Use of the following form to provide the information required about the faulty board when sending it to
the manufacturer.
X-HWE-A-UMM-0003 12 42/43
24/08/11
BOLOGNA
FAILURE REPORT
Date/Data :____/____/_____ Form # / Foglio n° :_____

Filled-in by / Compilato da : Signature/Firma
Failure date / Data del malfunionamento _____/______/______
Failure found by / Malfunzionamento segnalato da
Customer / Cliente : Name / Nome: ____________________

Alstom Service Group/Cantiere Alstom Name / Nome ____________________
Faulty part / Oggetto della segnalazione
Board / Scheda ALSTOM Part No:
Actuator / Attuatore Codice ALSTOM :________________________
Power supply / Alimentatore

Other ___________________ Serial Number:
Numero di Serie ________________________
Failure description / Descrizione del malfunzionamento :

_____________________________________________________________________________________________________
_____________________________________________________________________________________________________
__________________________________________________________________
Failure is / Il malfunzionamento è :
Continuous/ Continuo
Repetitive / Ripetitivo
Periodic every / Periodico ogni: _________________________________
Random / Casuale
Specific failure conditions / Condizioni particolari del malfunzionamento, se esistono.

_____________________________________________________________________________________________________
_____________________________________________________________________________________________________
___________________________________________________________
The faulty part is from / L’oggetto del malfunzionamento proviene da :

Station / Stazione ___________________________
Equipment type / Tipo di impianto ___________________________
Owner / Proprietario ___________________________
Address / indirizzo ____________________________________________
Failure occurred when / Guasto rilevato quando
Equipment was under laboratory test / Apparecchiature in test do lab.

During installation / In fase di installazione
Installed in field /Dopo l’attivazione
X-HWE-A-UMM-0003 12 43/43
PATH Digicode® PSP
APPENDIX D-12 SDTC Implementation Manual

66 of 80
PATH Digicode® PSP
APPENDIX D-13 SDTC Applications Conditions
67 of 80
SDTC
~~. LS
F. MEMMO V.ORNELLI S. STANGHELLINI
21/07/11 SDTCSafety POI Safety TIS Products Bologna Site
Assurance Safety Internal Safety
Manager Assurance Assessor
Manager O. GIANGASPERO
A.GIOVANNUCCI
Bologna Site
Design Leader
Engineering
DATA REIlATIO CONTROlLATO APPROVATO AUTOruzzATO

BOLOGNA
DATE ESTABLISHED CHECKED APPROVED AUTHORIZED

DISTRIBUZIONE Riservato Normale Control/ato Not Control/ato Information Solutions
DISTRIBUTION D
Restricted
~
Normal
D
Controlled
~
Not Controlled
Tel. 051.4163111 - Fax 051.4163436
e
Ne vietata la ripraduziane, la cansegna a terzi a camunque la diffusiane senza il
CONFIDENTIAL. preventiva consenso scritta di ALSTOM. Rev. Lang. Pagels
Tutti i diritti sona riservati.
of this document, use and communication of its content are
written ALSTOM authorization.
7 en 28
abcd SDTC
21/07/11
BOLOGNA Application Conditions
REVISIONI
REVISIONS

A. Giovannucci,
1 P. Capatti 09/01/09 12 First Emission.
A. Giovannucci,
2 P. Capatti 20/04/10 14 Updating due to Validation Report findings.
F. MEMMO New release due to upgrade of following documents:

SDTC Safety
Assurance Manager - Implementation, Installation, T&C and Maintenabce
3 13/12/10 27 Manual.
A.GIOVANNUCCI
- Updated versions of PHA and HA.
Design Leader
F. MEMMO
SDTC Safety
Assurance Manager Application Conditions no. AC.2, AC.18, AC.19 and AC.20
4 05/04/11 27 modified.
A.GIOVANNUCCI
Design Leader
F. MEMMO
SDTC Safety Application Condition no. AC.20 modified.
5 Assurance Manager 15/04/11 28 Chapter 2.3 modified to include “8” shaped loop and
A.GIOVANNUCCI 200bit/s SDTC configuration.
Design Leader
F. MEMMO Updating due to:

SDTC Safety - New revisions of manuals
6 Assurance Manager 24/06/11 28
- New revision B of TX boards and TX/RX box
A.GIOVANNUCCI
Design Leader
F. MEMMO
SDTC Safety DIAG_2 board included (p/n N897093511D). See [9] and
Assurance Manager §2.3.1 for details.
7 21/07/11 28
A.GIOVANNUCCI
Design Leader
diffusione senza il preventivo consenso scritto di alstom ferroviaria S.P.A. 315302DXXDG002 7
abcd SDTC
21/07/11
CONTENTS
1 INTRODUCTION .................................................................................................................................................................... 5
1.1 PURPOSE AND SCOPE .................................................................................................................................................... 5
1.3 REFERENCES ................................................................................................................................................................... 5
2 SDTC OVERVIEW .................................................................................................................................................................. 7
2.1 DEFINITION OF INTERFACES .......................................................................................................................................... 7
2.2 FIELDS OF APPLICATION ................................................................................................................................................ 8
2.3 SUBSYSTEM IDENTIFICATION ........................................................................................................................................ 8
2.3.1 IDENTIFICATION OF PROCESSING UNIT PARTS................................................................................................. 10
2.3.2 IDENTIFICATION TRACK SIDE EQUIPMENT ......................................................................................................... 13
2.3.3 IDENTIFICATION OF SOFTWARE .......................................................................................................................... 16
2.4 TECHNICAL CHARACTERISTICS .................................................................................................................................. 16
3 APPLICATION CONDITIONS .............................................................................................................................................. 18
3.1 GENERAL APPLICATION CONDITIONS ........................................................................................................................ 18
3.2 TRACK TO TRAIN TRANSMISSION ............................................................................................................................... 21
3.3 INSTALLATION, MAINTENANCE AND CONFIGURATION ........................................................................................... 22
3.4 DISTURBANCE IMMUNITY ............................................................................................................................................. 24
3.5 IXL OUTPUT INTERFACE CONDITIONS ........................................................................................................................ 24
3.6 USE OF IMPEDANCE BONDS ........................................................................................................................................ 26
3.7 COMPATIBILITY WITH LOW FREQUENCY TC USING FILTER BOX DEVICE ............................................................. 26
3.8 RAIL INTERCONNECTION CONDITIONS ...................................................................................................................... 28
abcd SDTC
21/07/11
FIGURE INDEX
Figure 1 – SDTC application contexte .......................................................................................................................... 7

Figure 2 – SDTC Interfaces .......................................................................................................................................... 8
Figure 3 – SDTC boards without diverted branches...................................................................................................10
Figure 4 – Frequency and code setting on 2 tracks ...................................................................................................23
Figure 5 – Frequency and code setting on 4 tracks ...................................................................................................23
Figure 6 – Diverted Branches connected in series with Main Branches (with low frequency TC). ............................27
TABLE INDEX
Table 1 – Track circuit with 1 diverted branch ............................................................................................................19

Table 2 – Track circuit with 2 diverted branches ........................................................................................................20
Table 3 – Track circuit with 2 nested branches ..........................................................................................................20
abcd SDTC
21/07/11
1 INTRODUCTION
1.1 Purpose and scope

The SDTC (Smartway Digital Track Circuit) abbreviation identifies the versions of DIGICODE product for Metro
application.
The purpose of this document is to indicate the Application Conditions to be respected during the Installation,
Commissioning, Maintenance and Operation phases, in order to guarantee the safe and correct functioning of the
SDTC products.

AC Alternate Current
CEDD-D Concentratore Elaboratore Dati Diagnostici per Digicode (Maintenance and Diagnostic System)
DC Direct Current
DIGICODE Family of Audio-frequency track circuit products, manufactured by ALSTOM
EJ Electric Joint
IB Impedance Bond
IXL Interlocking
PU Processing Unit
SER Signalling Equipment Room
TC Track Circuit
TU Tuning Unit
ZLC Zone Logic Computer
1.3 References
ID Document
CENELEC EN 50125-3 Railway applications: Environmental Conditions for signalling and

[1]
telecommunications, January 2003
CENELEC EN50121-3 Railway applications: EMC. Part 3-1 / Part 3-3: Rolling Stock – Train and complete
[2]
vehicle / Apparatus, July 2006
ALSTOM, Audio-Frequency Track Circuit DIGICODE DTC24 and DTC921/SDTC - Interference mask,
[3]
7431500-HWE-A-TCF-0001, rev. 4
[4] SDTC, Implementation Manual 490371A19MP001, Rev. 5
[5] SDTC, Use and Maintenance Manual, 490371D19MI001, Rev. 11
abcd SDTC
21/07/11
ID Document
[6] SDTC, Test and Commissioning Manual, 490371A19MI002 Rev. 9
[7] SDTC, Installation Manual, 490371A19MI001 Rev. 8
[8] CONNESSIONE INDUTTIVA INGLOBATA 300A - Specifiche di taratura e collaudo, HW6506021992, rev. 2
[9] SDTC Schemes and Part List, 315302DXXDG001 Rev. 6
[10] Smartway DTC System, SDTC - Digicode Product Safety Case, 49052DI9VV001, rev. 3
abcd SDTC
21/07/11
2 SDTC OVERVIEW
SDTC is an electronic product of the DIGICODE family that realizes the following safety functions when connected
to a track circuit (TC):
1. train detection;
2. broken rail detection
3. track to train transmission, when the train occupies the track circuit.
On output towards IXL system, SDTC provides the indication of the Clear/Occupied state of the Track Circuit. In
case of broken rail SDTC provides the occupied indication.
An example of application context of the SDTC product is showed in the following figure.
ELECTRICAL JOINT ELECTRICAL JOINT
FIELD
TECHNICAL ROOM
ATC/ATP Data IXL OUTPUT DOT
ATC / ATP INTERLOCKING DIAGNOSTIC

(e.g. SACEM) (e.g. ZLC/VPI or Relay) SYSTEM
(e.g. CEDD-D)
Figure 1 – SDTC application contexte
2.1 Definition of Interfaces

The SDTC interfaces are the following (ref. Figure 2 and Figure 1):
• Power supply: the SDTC is powered by 220Vac +/-10%, 50Hz or 110Vac +/-10%, 50/60Hz at 100 VA;
• Field TU: the SDTC is connected via cable to 2 tuning units, at the receiving and transmitting sides of the track
circuit;
• Field LIU: the transmission of ATP/ATC (e.g. SACEM) message on the diverted branches uses the loop
interface unit;
abcd SDTC
21/07/11
• IXL output: is a signal at 12 VDC rated value, on 400 Ohm equivalent ZLC N/R vital input, or 24 VDC rated
voltage at the coil of standard 1600 Ohm relay, when track circuit is clear; rated voltage is 0Vdc when track
circuit is occupied;
• Diagnostic: to the diagnostic system to collect the functional state of the electronic boards and the main track
signal parameters;
• User interface: led and test point are available to visual check and to measurement checks; mechanical
User Diagnostic
TU-1 / LIU
IXL output
SDTC
ATP/ATC data
(e.g. SACEM) TU-2
Power Supply
Figure 2 – SDTC Interfaces
2.2 Fields of Application

SDTC product can be used in railway and metro lines, electrified or not.
Compatibility with the electric traction system shall be verified for each specific application, referring to the SDTC
Interference Mask document [3], to the EN50121-3 standard [2] and to the electromagnetic emissions of the
specific application environment.
2.3 Subsystem Identification

As shown in the Figure 3 and in case of a Track Circuit without diverted branches, SDTC is composed by the
following boards (or LRUs):
Processing Unit (no diverted branch - all boards located all located in the same rack):
• TX/RX MAIN BOX including:
o TX Board
o RX MAIN Board
• RT Board
• Modem Board
• DIAG Board
• Empty Rack
abcd SDTC
21/07/11
Field equipment
• Tuning Unit
• LIU
• Filter Box
To manage a track circuit containing points an additional Process Unit assembly for each point is needed,
including the following boards:
Processing Unit (diverted branch - all boards located in the same rack):
• TX/RX SWITCH BOX including:
o TX Board - only if it is present the LIU loop for sending information to the train into the diverted
branch
o RX SWITCH Board
• RX SWITCH BOX including:
o RX SWITCH Board
• RT Board
• Modem Board
• DIAG Board
• Mother board
• Empty rack
SDTC has three different Hardware configurations:

• BL1 - not described in this document but included in the Safety Case rev. 3 (ref. [10]) - no more
applicable to production;
• BL2 - with 400 bit/s coded message data rate and fast reaction time;
• BL3 - with 200 bit/s coded message data rate, improved noise immunity and slow reaction time.
BL2 and BL3 share common field equipment.
The following paragraphs provide the hardware structure of the SDTC product and the identification of each part.
Each part is univocally identified by an alphanumeric code.
abcd SDTC
21/07/11
EJ EJ
TU TU
TX - RX Switch RX Board
TX Board
Generated Received digicode

digicode signal signal
Modem Board
Denied Received digicode

digicode signal
signal
RT Board
SACEM Free/Occupied
Message
Figure 3 – SDTC boards without diverted branches
2.3.1 Identification of Processing Unit parts

TxRx MAIN Box (CASSETTO TX_RX__SDTC_MAIN)
N897 164 610L rev. A and rev. B TX RX_SDTC_GRUPPO_07 BL2, BL3
N897 164 611M rev. A and rev. B TX RX_SDTC_GRUPPO_08 “
N897 164 612N rev. A and rev. B TX RX_SDTC_GRUPPO_09 “
N897 164 613P rev. A and rev. B TX RX_SDTC_GRUPPO_10 “
N897 164 614Q rev. A and rev. B TX RX_SDTC_GRUPPO_11 “
N897 164 615R rev. A and rev. B TX RX_SDTC_GRUPPO_12 “
N897 164 616S rev. A and rev. B TX RX_SDTC_GRUPPO_13 “
abcd SDTC
21/07/11

N897 164 617T rev. A and rev. B TX RX_SDTC_GRUPPO_14 “
Rev. A is valid since 26-04-2005 - Rev. B is valid since 10-05-2011 – Rev. A and B are interchangeable parts.
TxRx SWITCH Box (CASSETTO TX_RX_SDTC_SWITCH)

N897 164 620W rev. A and rev. B CASS_SDTC_TX_07_RX_11_SWITCH BL2, BL3
N897 164 621X rev. A and rev. B CASS_SDTC_TX_07_RX_12_SWITCH “
N897 164 622Y rev. A and rev. B CASS_SDTC_TX_13_RX_07_SWITCH “
N897 164 623Z rev. A and rev. B CASS_SDTC_TX_13_RX_08_SWITCH “
N897 164 624A rev. A and rev. B CASS_SDTC_TX_14_RX_07_SWITCH “
N897 164 625B rev. A and rev. B CASS_SDTC_TX_14_RX_09_SWITCH “
N897 164 626C rev. A and rev. B CASS_SDTC_TX_14_RX_10_SWITCH “
N897 164 627D rev. A and rev. B CASS_SDTC_TX_14_RX_12_SWITCH “
N897 164 628E rev. A and rev. B CASS_SDTC_TX_13_RX_11_SWITCH “
N897 164 629F rev. A and rev. B CASS_SDTC_TX_13_RX_10_SWITCH “
N897 164 630G rev. A and rev. B CASS_SDTC_TX_14_RX_08_SWITCH “
Rx SWITCH Box (CASSETTO RX__SDTC_SWITCH )

N897 164 650D CASS_ RX_SDTC_SWITCH_07 BL2, BL3
N897 164 651E CASS_ RX_SDTC_SWITCH_08 “
N897 164 652F CASS_ RX_SDTC_SWITCH_09 “
N897 164 653G CASS_ RX_SDTC_SWITCH_10 “
N897 164 654H CASS_ RX_SDTC_SWITCH_11 “
N897 164 655K CASS_ RX_SDTC_SWITCH_12 “
N897 164 656L CASS_ RX_SDTC_SWITCH_13 “
N897 164 657M CASS_ RX_SDTC_SWITCH_14 “
TX Board (TX__SDTCD)
N897 168 510Z rev. A and rev. B TX __07__HF_3 Finished board - BL2, BL3
N897 168 511A rev. A and rev. B TX __08__HF_3 “
N897 168 512B rev. A and rev. B TX __09__HF_3 “
N897 168 513C rev. A and rev. B TX __10__HF_3 “
abcd SDTC
21/07/11

N897 168 514D rev. A and rev. B TX __11__HF_3 “
N897 168 515E rev. A and rev. B TX __12__HF_3 “
N897 168 516F rev. A and rev. B TX __13__HF_3 “
N897 168 517G rev. A and rev. B TX __14__HF_3 “
RX MAIN board (RX__SDTC_MAIN)

N897 164 516H RX_07_SDTC_MAIN Finished board - BL2, BL3
N897 164 517K RX_08_SDTC_MAIN “
N897 164 518L RX_09_SDTC_MAIN “
N897 164 519M RX_10_SDTC_MAIN “
N897 164 520N RX_11_SDTC_MAIN “
N897 164 521P RX_12_SDTC_MAIN “
N897 164 522Q RX_13_SDTC_MAIN “
N897 164 523R RX_14_SDTC_MAIN “
RX SWITCH board (RX__SDTC_SWITCH)

N897 164 524S RX_07_SDTC_SWITCH Finished board - BL2, BL3
N897 164 525T RX_08_SDTC_ SWITCH “
N897 164 526U RX_09_SDTC_ SWITCH “
N897 164 527V RX_10_SDTC_ SWITCH “
N897 164 528W RX_11_SDTC_ SWITCH “
N897 164 529X RX_12_SDTC_ SWITCH “
N897 164 530Y RX_13_SDTC_ SWITCH “
N897 164 531Z RX_14_SDTC_ SWITCH “
RT SDTC (RT_NDV_3_SDTC)
N897 092 520B RT_NDV_3_SDTC Finished board - BL2 only
DTR0000253565 RT_NDV_4_SDTC Finished board - BL3 only
abcd SDTC
21/07/11
MODEM SDTC
N897 163 510Q MODEM_HF_2_SDTC Finished board - BL2 only
DTR0000253566 MODEM_HF_3_SDTC Finished board - BL3 only
DIAG SDTC
1
N897 093 511D DIAG_2_VERN Finished board - BL2, BL3
N897 093 012M DIAG_SDTC Finished board - BL2, BL3
DIAG_ SDTC and DIAG_2_VERN are interchangeable parts (the boards have the same SW, see § 2.3.3).
Mother board SDTC (MB_SDTC)

N897 162 510C MB_SDTC Finished board - BL2, BL3
Empty Rack with mother boards

P700 338 K00G CEST.CDB DIGITALE SDTC BL2, BL3
Power Conversion Unit

P700 338 A20V CASSETTO POWER CONV._2 220 VAC 50 Hz input - BL2, BL3
P700 338 A30F CASSETTO POWER CONV_110V 110 VAC 50-60 Hz input - BL2, BL3
2.3.2 Identification Track Side equipment

BL2 and BL3 SDTC configurations share common field equipment.
Tuning Unit - vertical position (CAS_SINT_921_Fxx-Fyy_HF_3_VERTICALE)

P699 044 D20Z CASS_SINT_921_F07_F09_HF_3_VERTICALE
P699 044 D21A CASS_SINT_921_F07_F11_HF_3_VERTICALE
P699 044 D22B CASS_SINT_921_F07_F13_HF_3_VERTICALE
P699 044 D23C CASS_SINT_921_F09_F11_HF_3_VERTICALE
P699 044 D24D CASS_SINT_921_F09_F13_HF_3_VERTICALE
1
For DIAG_2_VERN board (p/n N897093511D) the “MSR measure” is always out of scale.
abcd SDTC
21/07/11

P699 044 D25E CASS_SINT_921_F11_F13_HF_3_VERTICALE
P699 044 D26F CASS_SINT_921_F08_F10_HF_3_VERTICALE
P699 044 D27G CASS_SINT_921_F08_F12_HF_3_VERTICALE
P699 044 D28H CASS_SINT_921_F08_F14_HF_3_VERTICALE
P699 044 D29K CASS_SINT_921_F10_F12_HF_3_VERTICALE
P699 044 D30L CASS_SINT_921_F10_F14_HF_3_VERTICALE
P699 044 D31M CASS_SINT_921_F12_F14_HF_3_VERTICALE
P699 044 D32N CASS_SINT_921_F07_F10_HF_3_VERTICALE
P699 044 D33P CASS_SINT_921_F08_F11_HF_3_VERTICALE
Tuning Unit - horizontal position (CAS_SINT_921_Fxx-Fyy_HF_3_ORIZZONTALE)

P699 044 B20G CASS_SINT_921_F07_F09_HF_3_ORIZZONTALE
P699 044 B21H CASS_SINT_921_F07_F11_HF_3_ORIZZONTALE
P699 044 B22K CASS_SINT_921_F07_F13_HF_3_ORIZZONTALE
P699 044 B23L CASS_SINT_921_F09_F11_HF_3_ORIZZONTALE
P699 044 B24M CASS_SINT_921_F09_F13_HF_3_ORIZZONTALE
P699 044 B25N CASS_SINT_921_F11_F13_HF_3_ORIZZONTALE
P699 044 B26P CASS_SINT_921_F08_F10_HF_3_ORIZZONTALE
P699 044 B27Q CASS_SINT_921_F08_F12_HF_3_ORIZZONTALE
P699 044 B28R CASS_SINT_921_F08_F14_HF_3_ORIZZONTALE
P699 044 B29S CASS_SINT_921_F10_F12_HF_3_ORIZZONTALE
P699 044 B30T CASS_SINT_921_F10_F14_HF_3_ORIZZONTALE
P699 044 B31U CASS_SINT_921_F12_F14_HF_3_ORIZZONTALE
P699 044 B32V CASS_SINT_921_F07_F10_HF_3_ORIZZONTALE
P699 044 B33W CASS_SINT_921_F08_F11_HF_3_ORIZZONTALE
Tuning board (C.SINT_921_HF_BOARD)

N897 120 140Y C.SIN_HF_3_F07_F09
N897 120 141Z C.SIN_HF_3_F07_F11
N897 120 142A C.SIN_HF_3_F07_F13
N897 120 143B C.SIN_HF_3_F09_F11
N897 120 144C C.SIN_HF_3_F09_F13
N897 120 145D C.SIN_HF_3_F11_F13
abcd SDTC
21/07/11

N897 120 146E C.SIN_HF_3_F08_F10
N897 120 147F C.SIN_HF_3_F08_F12
N897 120 148G C.SIN_HF_3_F08_F14
N897 120 149H C.SIN_HF_3_F10_F12
N897 120 150K C.SIN_HF_3_F10_F14
N897 120 151L C.SIN_HF_3_F12_F14
N897 120 152M C.SIN_HF_3_F07_F10
N897 120 153N C.SIN_HF_3_F08_F11
Boxes for Tuning Unit

P699044B01M CdS per SDTC (mont. orizzontale) Horizontal mounting
P699044D01D CdS per SDTC (mont. verticale) Vertical mounting
Loop Interface Unit LIU_GR07

P699044C50Y Cass_Loop_Iterf_Unit GR07
Filter Box (CASSETTA FILTRI)

P699 044 G00D CASSETTA FILTRI
Tuning Box Loop 8 (CASSETTA ACCORDO 8)

DTR0000253567 CASSETTA ACCORDO 8 Loop 8 shaped
Electrical Joints
P699043A00Q POSA GIUNTO "S" DTC921 S bond
P699087A00R GIUNTO "S" DI LINEA MM1-VERTICALE A MURO Vertical mounting
P699087B00Z GIUNTO "S" DI LINEA MM1-VERT.SOTTOBANCH. Vertical mounting
P699049A00M POSA GIUNTO TERM. DTC921 Terminal joint
P699049A01N POSA GIUNTO TERM. DTC921 Terminal joint 2 loops
P699087E00A GIUNTO TERMINALE-VERTICALE SOTTOBANCHINA Terminal joint under the platform
P699087D00S GIUNTO TERMINALE-VERTICALE A MURO Terminal joint on the wall long distance
abcd SDTC
21/07/11

P699050A00Y GIUNTO CORTO CIR.DTC921/E Short Circuit joint
P699087L00H GIUNTO 8 VERTICALE A MURO Loop 8 shaped
2.3.3 Identification of Software
Board/Item Name Part Number

MODEM Software MPEPROM87C51 CODCDB96_1.0 T807 091 110R
DIAG Software 27C256/DIACDB96_2.3 1 T807 093 310G
Table 1 – MODEM and DIAG Software Identification
2.4 Technical characteristics

The technical characteristics of the SDTC are as follows:
• TC length: from 20 to 400 m
• Transversal conductance: from 0 to 0.5 S/km (2 Ω·km) --> LTC=400 m

from 0 to 1 S/km (1 Ω·km) --> LTC=320 m
0÷0.3 S/km (3.3 Ω·km) wayside to train transmission
• Maximum shunt resistance 0.5 Ohm
• Overlap length 7 m (joint length)
• Maximum distance between SER and TC connections

4.5 km if LTC=350 m, Ballast 0.5 S/km (2 Ω·km)
2.0 km if LTC=400 m, Ballast 0.5 S/km (2 Ω·km)
•
2
Cable type 2x1.5 mm , 40 nF/km, shielded
• Minimum axle current: 100 mA at 0.3 S/km ballast (3.3 Ω·km)
• Data transmission speed: 400 bit/s for train detection (BL2 SDTC Hardware configuration)
200 bit/s for train detection (BL3 SDTC Hardware configuration)
500 bit/s for ATC/ATP system (e.g. for SACEM data)
abcd SDTC
21/07/11
• Broken Rail check throughout track circuit: implemented
• Maximum number of points in one TC 2
• Power supply 220 Vac ±10% at 50 Hz

110 Vac ±10% at 50 Hz to 60 Hz
• Power consumption 95 VA (average value)
• Temperature range -25°/+70° in the SER

-40°/+80° in the field
• Frequency carriers (n.°8) 9.5-11.1-12.7-14.3-15.9- 17.5-19.1-20.7 kHz
• Modulation (generated by SDTC) MSK ±100 Hz at 400 bit/s (SDTC-BL2)

FSK ±100 Hz at 200 bit/s (SDTC-BL3)
• Modulation (track/train transmission) CPFSK ±100 Hz at 500 bit/s (in case of SACEM system)
• ATC/ATP data input 24 V on 2200 Ω, insulation 1000 Vac (in case of SACEM sys.)
• Occupation delay lower than 200 ms with shunt applied on the TC

lower than 2.2 s with 400 bit/s not valid coded message (SDTC-BL2)
lower than 3.8 s with 200 bit/s not valid coded message (SDTC-BL3)
• Clearing delay lower than 2 s (not safety with 400 bit/s rate (SDTC-BL2)
lower than 3.5 s (not safety) with 200 bit/s rate (SDTC-BL3)
greater than 1.7 s (safety) with 400 bit/s rate (SDTC-BL2)
greater than 3 s (safety) with 200 bit/s rate (SDTC-BL3)
• Vital Output towards IXL 12 VDC on 400 Ω (nominal value)

18 VDC on 500 Ω (nominal value)
24 VDC on 1600 Ω (nominal value)
• DOT 24 VDC on 1500 Ω - insulation 2000 VDC

Transient occupied indication equal to 0.8 s after DOT change
• Diagnostic RS232 front or RS422/485 rear connector

at 9600 bit/s, packet data protocol
abcd SDTC
21/07/11
3 APPLICATION CONDITIONS
The present chapter provides the list of all Application Conditions concerning the Configuration, Installation,
Commissioning, Maintenance and Operation phases of the SDTC products.
They are divided in:
• General Application Conditions (see §3.1),
• Track to train transmission (see §3.2),
• Installation, Maintenance and Configuration Application Conditions (see §3.3),
• Immunity to Disturbances (see §3.4),
• IXL Output Interface Conditions (see §3.5),
• Use of Impedance Bonds (see §3.6),
• Compatibility with low frequency TC (see §3.7),
• Rail Interconnections Conditions (see §3.8).
3.1 General Application Conditions
SDTC - AC.1 Technical Features

Safety Related: NO
• Track Circuit Length: 20 to 400 m;
• “S” EJ Length: 7.2 m;
• “Terminal” EJ Length: 1.5 m;
• Maximum number of diverted branch: 2;
• Remote feeding: 4.5 km if TC length = 350m, 2.0 km if TC length = 400m; with Ballast
conductivity: 0.5 S/km (equivalent to 2 Ohm x km); see Installation Manual [7], for details;
• Remote feeding: 4.5 km if TC length = 280m, 2.0 km if TC length = 320m; with Ballast
conductivity: 1 S/km (equivalent to 1 Ohm x km); see Installation Manual [7], for details;
• Maximum TU-rail cable length: 5.5 m;
• Maximum altitude: 1800 m a.m.s.l.;
• Occupation of downstream TC, within 5 m from the leading edge of the “S” joint.
Maintenance and Diagnostic functionalities are available through optional CEDD-D system.
abcd SDTC
21/07/11
SDTC - AC.2 Maximum Shunt Resistance

Safety Related: YES
• Maximum shunt resistance outside Tuning Zone: 0.5 Ohm.
Inside the Tuning Zone the train detection maximum shunt resistance degrades; therefore the
signalling design rules (e.g. light signal positioning, ATP braking curve, fouling point, etc.) shall
consider the Tuning Zone as a “not shunting area”.
The Tuning zone is defined as 3.6 m before and 3.6 m after the centre of the electrical joint (the
length of the EJ is fixed equal to 7.2 m in the AC.1).
TC1 TC2
Detection gap of 7.2 m long
SDTC - AC.3 Diverted Branch Maximum Length

Safety Related: NO
Description: Track circuits in point zone can have different configuration with a maximum of 2 branches.
The Technical Application Conditions are:
• To allow a correct operation of track circuit in points, the length of the main branch is in
relation with the length(s) of the diverted branch(es). In Table 1, Table 2 and Table 3 some
specific cases for minimum ballast value of 2 ohm x km are provided.
• The length of the diverted branch is the distance between the Insulated Rail Joints of the
point and the track connections of the Tuning Unit.
Main branch Diverted branch

L2
L1 (m) L2 (m)
300 20
210 60
L1
150 100
Table 1 – Track circuit with 1 diverted branch
abcd SDTC
21/07/11
Main branch Diverted Diverted

L2 branch 1 branch 2
L1 (m)
L2 (m) L3 (m)
L1 160 20 20
110 60 60
L3
65 100 100
Table 2 – Track circuit with 2 diverted branches

1 2
L1 (m)
L2 L2 (m) L3 (m)
L3 180 40 20
125 60 40
L1
80 100 20
Table 3 – Track circuit with 2 nested branches
SDTC - AC.4 Power Supply

Safety Related: NO
Description: The power supply shall be:
• 220 V or 230 V ± 10%, 50 Hz ±2%
• 110 V ± 10%, 50/60 Hz ±2%
• Power Consumption: 50-140 VA.
abcd SDTC
21/07/11
SDTC - AC.5 Environmental Conditions

Safety Related: NO
Description: The operating temperature range shall be:
• -25°C to +70°C with relativity humidity less than 95% RH for the indoor equipments;
• -40°C to +80°C with relativity humidity less than 95% RH for the outdoor equipments.
Mechanical Vibration limits for outdoor equipments are:
• Frequency Vibration range from 0 Hz to 2000 Hz with 0.002 g^2/Hz.
EMC limit are in compliance with EN 50121-4 standard
SDTC - AC.6 Traction return conditions in point zone

Safety Related: NO
Description: For regularity reasons, the switch and stock rails and also the crossing of the point machines
shall be connected between themselves by conductive cables to ensure the continuity to the
electric traction.
The frame of the point machine and the other actuator devices mechanically connected to the
rails shall be insulated with respect to the earth.
SDTC - AC.7 Protection of the power supply line

Safety Related: YES
Description: The power supply line that feds the Indoor Equipments shall be protected against the short
circuits, the overloads and the current leakage to the earth circuit, using a magneto-thermal
switch with differential protection (circuit breaker).
3.2 Track to train transmission
SDTC - AC.8 Track to train message

Safety Related: NO
Exported to: ATC/ATP Systems
Description: Following constraints shall be respected :
- data transmission speed: 500 bit/s;
- 24 V on 2200 Ohm;
- insulation 1000 Vac.
abcd SDTC
21/07/11
SDTC - AC.9 Protection of the ATC/ATP Message

Safety Related: YES
Exported to: ATC/ATP System
Description: The message received from the ATC/ATP system (e.g. SACEM system) shall be protected by
coding.
SDTC - AC.10 Decoding of ATC/ATP Message

Safety Related: YES
Exported to: ATC/ATP System
Description: The trainborne equipment shall demodulate the signal and check the correctness of ATC/ATP
message (e.g. SACEM message).
3.3 Installation, Maintenance and Configuration
SDTC - AC.11 Jumper Configuration and Regulation

Safety Related: YES
Exported to: Configuration, Installation, Maintenance and Commissioning phases.
Description: The SDTC configuration could be carried out by the adequate setting of the jumpers available
on the MODEM Boards and on the other boards.
The setting of such jumpers is described by the related procedures provided by the T&C Manual
(ref. [6]).
Also the adjustment and the tuning of the output voltage and of the frequency shall be carried
out accordingly to the procedures described in the Installation and User and Maintenance
Manuals (ref. [7] and [5]).
These documents shall be strictly respected during the installation and the commissioning
phases of the SDTC products.
SDTC - AC.12 Frequency and Code Configuration

Safety Related: YES
Exported to: Configuration, Installation, Maintenance and Commissioning phases
Description: In order to ensure:
- the correct frequency and code setting;
- the correct disposal of devices in the rack and the correct racks wiring;
it is mandatory that the instructions, the procedures and the constraints provided by
Implementation Manual (ref.[4]) shall be strictly respected.
It is remarked that adjacent Track Circuits shall have different values of Code and Frequency
(see Figure 4 and Figure 5).
abcd SDTC
21/07/11
... f1 f3 f5 f1 f3 f5 f1 f3 f5 f1 f3 f5 ...
... c1 c7 c13 c2 c8 c14 c3 c9 c15 c1 c7 c13 ...
... f2 f4 f6 f2 f4 f6 f2 f4 f6 f2 f4 f6 ...
... c4 c10 c16 c5 c11 c17 c6 c12 c18 c4 c10 c16 ...
Figure 4 – Frequency and code setting on 2 tracks
Figure 5 – Frequency and code setting on 4 tracks
SDTC - AC.13 Installation and Maintenance

Safety Related: YES
Description: The safe and correct functioning of the SDTC products is affected by the correct execution of
the Installation, Commissioning and Maintenance operations, so the it is mandatory that the
instructions, the procedures and the constraints provided by Installation, Commissioning and
Maintenance Manuals (ref. [5], [6] and [7]) shall be strictly respected.
SDTC - AC.14 Protection against unauthorized access

Safety Related: YES
Exported to: Installation and Maintenance phases
Description: The installation of SDTC equipments shall foresee the adoption of technical measures in order
to protect them against the sabotage and vandalism acts.
In particular, the Indoor Equipments shall be installed into locals with restricted access and the
Outdoor Equipments (Tuning Units) shall be installed within cases that could be opened only
using tools and instruments.
abcd SDTC
21/07/11
SDTC - AC.15 Operator Safety

Safety Related: YES
Description: All metallic parts of Processing Units and Field Equipment shall be permanently connected to
the earth. At least during Maintenance phases, all cable shields shall be connected to the earth.
SDTC - AC.16 Disposal

Safety Related: NO
Exported to: Decommissioning and disposal phases
Description: No specific rules should be followed during SDTC disposal. Only generic procedures for
electronic equipments disposal must be applied.
3.4 Disturbance Immunity
SDTC - AC.17 Immunity to Traction Disturbances

Safety Related: NO
install the subsystem and it shall be ensured during its functioning.
Description: Compatibility with the electric traction system shall be verified for each specific application,
referring to the SDTC Interference Mask document [3], to the EN50121-3 standard [2] and to the
electromagnetic emissions of the specific application environment.
Infact the worst disturbances mask tolerable by the SDTC equipment is defined in the document
[3] and in case of higher values of traction disturbances a not reliable scenario related to SDTC
functioning could arise.
3.5 IXL Output Interface Conditions
SDTC - AC.18 Constraints for Vital Relay Interfacing

Safety Related: YES
Description: The following constraints are related to Vital Relay interfacing with input resistance of 1600 Ω:
The following constraints are related to US Vital Relay interfacing (Safetran #400500 biased-
neutral type, equivalent to the ALSTOM A62-125 type):
• series coils connection shall be used (500 Ohm);
abcd SDTC
21/07/11
SDTC - AC.19 Constraints for Electronic Interlocking Interface

Safety Related: YES
Description: The following constraints are related to an Interlocking interface with ZLC system (400 Ω
equivalent):
The following constraints are related to iVPI vital input port interfacing:
• Both single iVPI vital input port and two ports in parallel connection is allowed;
SDTC - AC.20 Reaction Times and Logic Integration

Safety Related: YES
Description: SDTC provides the occupancy indication on output, with the following timing constraints:
• In case of shunted Track Circuit, occupation delay lower than 0.2 s
• In case of not valid coded message received from Track Circuit, occupation delay lower
than 2.2 s, with 400 bit/s rate (BL2 configuration)
• In case of not valid coded message received from Track Circuit, occupation delay lower
than 3.8 s, with 200 bit/s rate (BL3 configuration)
SDTC provides the clearing indication on output, with the following timing constraints:
• Clearing delay (not safety) lower than 2 s with 400 bit/s rate (BL2 configuration);
• Clearing delay (not safety) lower than 3.5 s with 200 bit/s rate (BL3 configuration);
• Clearing delay (safety) greater than 1.7 s with 400 bit/s rate(BL2 configuration);
• Clearing delay (safety) greater than 3 s with 200 bit/s rate (BL3 configuration);
Accordingly, minimal TC length shall be defined. TC length depends on both train speed and
train length:
• TC length shall ensure the train presence on the shorter TC for at least the maximum
value of the occupation delay, at the maximum train speed.
• All TC lengths safety related shall be dimensioned taking into account the maximum TC
occupation delay.
abcd SDTC
21/07/11
3.6 Use of Impedance Bonds
SDTC - AC.21 Connection of Electrical Substation to the rails

Safety Related: No
Description: The connection of Electrical Substation to the rails shall be carried out by means of impedance
bonds, in order to keep the traction current as much balanced as possible between the two rails,
so to avoid undue occupation of the track circuits ahead caused by electrical trains emitting
harmonics at the frequency band of SDTC.
SDTC - AC.22 Impedance Bond minimum distance

Safety Related: YES
Description: In case of use of Impedance Bonds, the following constraints shall be applied about the
distance between two impedance bonds:
• the Impedance Bonds shall be spaced not less than 700 m one each other, so no double
impedance bond connection shall be made inside one track circuit, only one is permitted;
• for regularity reasons, the distance between the Impedance Bond direct connection and the
centre of “S” bond should be greater than or equal to 10 m (using the IB type LS300A for
Metro applications (see [8]).
SDTC - AC.23 Connection to earth of the Terminal Joint central point

Safety Related: YES
Description: The central point of a Terminal Joint can be connected to additional earth conductor only if no
other connection to earth are present within the same Track Circuit. The same restriction is valid
for the short circuit joints.
3.7 Compatibility with low frequency TC using Filter Box device
SDTC - AC.24 Filter Box device

Safety Related: YES
install the subsystem and it shall be ensured during its functioning.
Description: SDTC and low frequency TC can operate in parallel using the Filter Box devices.
All the specific instructions included in the Installation Manual [7] shall be followed.
abcd SDTC
21/07/11
SDTC - AC.25 Low frequency TC on opposite phase

Safety Related: YES
Description: In order to detect a fault on Filter Box device, adjacent low frequency TC shall be powered with
opposite phase values.
SDTC - AC.26 Diverted Branch and Main Branch Maximum Length with low frequency TC
Safety Related: YES
Description: In case of coexistence of SDTC and low frequency TC (ref. Figure 6):
• the maximum length of Diverted Branch in a series connection shall be less than or
equal to 36 m. Accordingly, trains shorter than 36 m shall not to be used;
• the maximum length of Main Branch shall be less than or equal to 250 m with one
diverted branch;
• the maximum length of Main Branch shall be less than or equal to 150 m with 2
diverted branch;
• cable length between SER and TU shall be less than or equal to 2 km;
• the broken rail detection function is provided only for the series connected rail and not
for the other rail.
1+782
1+835
1+864
cdb156bis cdb156
f10 (C30) f12 (C36)
2x1x185 mmq
CBA CBA CBA
T R T R R T
f8/f10 f10/f12 f8/f12
D26F D29K D27G
2x1x185 mmq
f9/f11 f7/f11
D23C D21A
R T R T
CBA ABC
cdb155 cdb157
f11 (C32) f7
Figure 6 – Diverted Branches connected in series with Main Branches (with low frequency TC).
abcd SDTC
21/07/11
3.8 Rail Interconnection conditions
SDTC - AC.27 Connection of double tracks by cross-bonds

Safety Related: YES
Exported to: Installation and Maintenance phases.
Description: In presence of a double track, the up and down lines shall be never connected by direct
cross-bonds. In this case the connection is allowed only by the use of Impedance Bonds.
PATH Digicode® PSP
APPENDIX D-14 SDTC Qualification Test Description (AREMA

standard)
68 of 80
PATH Digicode® PSP
APPENDIX D-15 SDTC Qualification Test Report (AREMA

standard)
69 of 80
PATH Digicode® PSP
APPENDIX D-16 SDTC Type Test Report

70 of 80
PATH Digicode® PSP
APPENDIX D-17 SDTC Extra Test Type Test Report

71 of 80
PATH Digicode® PSP
APPENDIX D-18 Train Stop Testing Report
72 of 80
PATH Digicode® PSP
APPENDIX D-19 iVPI Interface Test Report
73 of 80
PATH Digicode® PSP
APPENDIX D-20 Vital Relay Interface Test Report
74 of 80
PATH Digicode® PSP
APPENDIX D-21 120 VAC Operation Test Report
75 of 80
PATH Digicode® PSP
APPENDIX E-Training Material

1. APPENDIX E1- Installation Training.
2. APPENDIX E2- Testing and Commissioning Training.
3. APPENDIX E3- Maintenance Training.
76 of 80
PATH Digicode® PSP
APPENDIX E-1 Installation Training

77 of 80
PATH Digicode® PSP
APPENDIX E-2 Testing and Commissioning Training

78 of 80
PATH Digicode® PSP
APPENDIX E-3 Maintenance Training

79 of 80
PATH Digicode® PSP
APPENDIX F – ISA Report
80 of 80
1151 Pittsford-Victor Rd., Suite 200
Pittsford, NY 14534
Phone: 585-203-1095
FAX: 585-203-1094
Date: February 27, 2012
To: Douglas Dreisbach
From: Tony LaPolla
Subj: ISA Report on Assessment of Alstom Digicode Track Circuit Safety Case
Ref: RSC-PTH-00026
cc: E. Altinbilek (PATH), J. Twombly (RSC)
In support of PATH’s plans to install the Alstom Signaling Digicode® microprocessor-based track circuit,
and in compliance with 49 CFR 236 Subpart H and in accordance with PATH’s Railroad Safety Program
Plan, PATH is submitting a Product Safety Plan (PSP) for this Digicode® Track Circuit product to the
FRA. Included as an appendix to the PATH PSP is the Product Safety Plan (PSP) for the Alstom
Smartway Digital Track Circuit (SDTC) Product Line which includes the Digicode® Track Circuit. The
appended Alstom SDTC PSP includes many proprietary documents in support of the safety case. These
proprietary documents were available for review by PATH, or its representatives, only at Alstom locations.
At PATH’s request, Rail Safety Consulting (RSC) acting as PATH’s Independent Safety Assessor (ISA)
spent several days during December 2011 and February 2012 at Alstom Signaling’s Rochester location
reviewing this proprietary documentation.
The primary objectives of this RSC activity were to confirm 1) that at the “product” level all hazards of the
Alstom Signaling SDTC ® digital track circuit being deployed on PATH’s property are closed, and 2) that
all conditions related to the application of the product that could precipitate a hazard were identified and
comprehensively communicated to PATH and its application design & installation contactor(s) for
appropriate hazard analysis, identification, mitigation, and acceptable closure.
In addition, a secondary objective was to assess the safety analysis and safety verification and validation
(V&V) activities as described in Alstom’s SDTC Safety and V&V Plan (SVVP). Specifically, this activity
was to assess the SVVP against industry standards and its effectiveness to assure a comprehensive and
complete safety program.
In response to the objectives described above RSC assesses that:
 all product level hazards were identified and adequately closed.

 all safety related application conditions pertinent to the PATH application have been verified
to be correctly included in the Alstom SDTC PSP Rev 2.1 and thus provided to PATH and its
contractors responsible for SDTC design, installation, and maintenance.
 that the SDTC safety analysis and V&V activities were effective to assure a comprehensive
and complete safety program.
In addition to RSC’s focused review, this SDTC product was certified by a European Independent Safety
Assessor; RSC was provided the SDTC ISA Final Assessment Report, produced by this ISA, for review
and reference.
Page 1

FRA 2012 0075 0002 - Attachment - 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FRA 2012 0075 0002 - Attachment - 1

Uploaded by

Copyright:

Available Formats

Port Authority Trans-Hudson

Submitted in fulfillment of 49 CFR Part 236, Subpart H, § 236.907

Date Revision Description

23 Communication of Hazards [§ 236.907 (d)] .................................................................................................... 33

APPENDIX E-2 Testing and Commissioning Training ......................................................................................... 78

1.3.1 Manufacturer’s Reference Documentation

1.3.2 Document Organization

 Section 10 provides a hazard mitigation analysis as required by 236.907 (a) (8).

1.4.1 Abbreviations and Acronyms

ATC Automatic Train Control

3 Digicode® Product Description [§ 236.907 (a) (1)]

PROJECT Independent Safety

Program Management Team

Figure 3-1 PATH ATC Project Team

The Field Circuits include:

4 PATH Operation [§ 236.907 (a) (2)]

Figure 4-1: PATH Route Map

5 Operational Concept Description [§ 236.907 (a) (3)]

6 Safety Requirements [§ 236.907 (a) (4)]

7 Safety Architecture [§ 236.907 (a) (5)]

8 Hazard Log [§ 236.907 (a) (6)]

9 Risk Assessment [§ 236.907 (a) (7)]

10 Hazard Mitigation Analysis [§ 236.907 (a) (8)]

11 Safety Assessment Verification and Validation Process [§ 236.907 (a) (9)]

12 Safety Assurance Concepts [§ 236.907 (a) (10)]

13 Human Factors Analysis [§ 236.907 (a) (11)]

14 Training [§ 236.907 (a) (12)]

15 Test Procedures and Test Equipment [§ 236.907 (a) (13)]

16 Applicability of Subparts A – G [§ 236.907 (a) (14)]

17 Security [§ 236.907 (a) (15)]

18 Warnings and Warning Labels [§ 236.907 (a) (16)]

19 Initial Implementation Testing [§ 236.907 (a) (17)]

20 Post Implementation Testing and Record Retention [§ 236.907 (a) (18)]

21 Safety Critical Assumptions [§ 236.907 (a) (19)]

22 Incremental and Predefined Changes [§ 236.907 (a)(20)]

There are no predefined changes for Digicode.

23 Communication of Hazards [§ 236.907 (d)]

APPENDIX A – FRA TEST – PATH TEST PROCEDURE

Port Authority Trans – Hudson Corporation

Track Circuit Test

APPENDIX B – PATH Hazard Log

APPENDIX B-1 PATH Hazards

Haz 03 Alstom N/A PATH Specific Hazard

NOTE: This hazard is the same as the existing product.

NOTE: This hazard is the same as the existing product.

NOTE: This hazard is the same as the existing product.

APPENDIX B-2 PATH Digicode® Application Conditions

These documents shall be strictly

 Appendix D-11 SDTC Maintenance

 The PATH FRA test procedures in

 Appendix D-12 SDTC

IXL Output without load: < 30V DC.

AC.22 In case of use of Impedance Bonds, Impedance bonds, if used, will be a

APPENDIX C – PATH DOCUMENTS

APPENDIX C-1 PATH Form ST-1

If inspection and test shows polarity to be proper, mark OK in polarity column.

Test Form: ST 1 Rev. 1 8/25/04

APPENDIX C-2 PATH Book of Rules

Amended Through 1/1/00

The rules, provisions and position descriptions

arrow pointing upward ( ↑ ) that indicates that

doors on that side of the train shall be opened first.

platform ( ← or → ) indicates that doors on that