This measure refers to 3 key phases in the response action: immediate safety actions on site and reporting the circumstances; on-site management of an incident and provision of support responding bodies; and restoration of routine operation.

Safety
An uncategorised incident with casualties can be divided into three phases:

1st phase: immediate safety actions on site and reporting the circumstances
• Initial on site safety actions by the train crew applying protection of the site to prevent other trains or people being put   at risk.
• Reporting of casualties or of an incident that has caused stoppage of train traffic – reporting usually depends on the location of the train, and is most often undertaken by the driver
• Managing train traffic – complete stoppage of train traffic at the site or operation in degraded mode, based on the incident characteristics, the infrastructure capacity and the IM’s technical capabilities at the specific segment of the tracks
• Arrival of first responders to the site. The IM and RU have staff available on a 24/7 basis covering the entire network, enabling an incident response manager to arrive as quickly as possible. The initial response organisations dispatch municipal or regional responding bodies to the incident site with the arrival of railway police staff dependent on the network deployment and availability of their teams.
• Initial actions at the site include providing initial support and assistance to passengers, including attending to the injured and evacuating them to hospitals, and ensuring safety at the site.

2nd phase: on-site management of an incident and provision of support responding bodies
• Provision of medical assistance to any injured staff and evacuation to hospital
• RU actions aimed at promoting the welfare of passengers and staff until they can be moved from the site either onboard the train involved or detrained and moved to a location with other rail or bus transport;
• Investigation of the incident by the police – an investigation whose purpose is very simple and clear: "To verify whether or not a third party was involved in the incident." If the involvement of a third party is suspected, the police investigation, as with any suspected homicide, will be detailed and usually very time consuming;
• Instructions of the police and based on agreement reached between the police and the on-site IM representative. This will take into account the need for incident site safety, the particular characteristics of the incident, whether it is possible to cover the body, the infrastructure and the IM’s technical capabilities in the specific segment of the tracks.
• Technical assistance and engineering works – these will be supplied by the IM’s technical teams on matters relating to the infrastructure, and by the RU’s technical teams when involving technical issues relating to the trains.

3rd phase: restoration of routine operation
After receiving approval from the police, the IM will take the necessary steps to resume routine operation. Resumption of routine operation includes the following actions, among others. In cases of fatality:
• Removing the body from the site;
• Cleaning the site and the train;
• Repairing the infrastructure and basic repair of the train;
• Implementing safety arrangements, to allow train traffic to resume;
• Identifying faults and infrastructure repairs that are not critical for the safe operation of trains and do not need to be executed immediately (such as infrastructure in the area of the tracks).

Incident response time
The incident response time of IMs  , RUs   and external incident responders can be shortened by use of the following systems and solutions:

Information sharing platforms
• Information sharing platforms serving relevant responders, for the real time transfer of essential information among them, for example:
• Geo-data concerning the incident site and the track access points;
• Information on the circumstances of the incident and the possible involvement of third parties, which is essential for police work;
• Critical actions during the course of the response – relating to safety, assistance required by passengers, evacuation.

Business process and information management
Specially designated systems for incident management that utilize the business process – from the response procedure to manual and automatic actions of the entities involved on behalf of the IM. These greatly assist the achievement of systematic, orderly incident management that is based on the predefined emergency plan and procedures. These systems are highly useful in the execution of automated actions, such as sending alphanumeric messages, images or video among the on-site and off-site incident managers. They also contribute to incident debriefing and arriving at conclusions regarding the effectiveness of response of each responder and of all the involved responders working together.

Mobile devices
Incident response managers (incident manager, technical entities, mobile units) mostly communicate using basic devices – cellular phones operating on the regular commercial network or on GRM-R, or use smartphones, which enable the execution of a variety of actions, such as automatically sending messages, navigating, providing geo-data, disseminating and receiving images and video files. This also includes business process applications, enabling the execution of ad-hoc tasks and receiving an updated situational picture. Widespread use is made of digital cameras to record evidence, e.g. the position of a body, means of access to the railway, before anything is touched, moved or repaired.

Forward facing CCTV  
Forward facing on train CCTV   cameras can provide the police with critical information required for its investigation concerning the circumstance of the incident. They enable determination with a high degree of certainty whether or not a third party was involved. For maximum effectiveness the images would need to be readily accessible on site or even better off site as well. Importantly this decision could be made quickly reducing the time for investigation hence service restoration to a minimum. Unlike the information recorded by OTDRs the data collected by forward facing CCTV   could involve images of individuals and be subject to application of data protection requirements. From a police investigation point of view preservation of evidence integrity is also essential.

Interoperable protocols for information sharing
The issue of standard and interoperability protocols for information sharing is linked to a significant extent to section above. The basic assumption is that the IM, RU and the various responders do not utilize identical IT systems; therefore, standard and interoperability protocols would allow information sharing among them all, with each operating in his own IT environment.

Such standards and interoperability are critical with regard to the following:
• Geo-data;
• Information sharing at a particular instance, or a continuous flow of information that provides a situational picture of the incident;
• Sharing of video and audio files.

Within the framework of this research, we have learned that IMs   use Web platforms and off the shelf products to share information concerning an incident and the response actions taken.