Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools supporting the CSM Regulation
Table 7 : Example of a Manufacturer's hazard record for an onboard control command sub-system.
N°
HZD
5 HAZOP
report
R X
6 HAZOP
report
R X
etc.
Origin Hazard description Additional information
the track without the
onboard sub-system
active and without line
side signalling
Maximum speed of train
set displayed to the
driver too high (Vmax)
Train is leaving without
driver machine interface
transition location. In case of absence of
acknowledgement, there is an automatic application of
the train brakes by the onboard control command subsystem.
The information displayed on the driver's interface is
monitored by the SIL 4 onboard control command subsystem
that applies the emergency brakes in case of
discrepancy between display and expected value.
In case of non compliance of with the movement
authority the onboard sub-system control command
sub-system applies the emergency brakes
Actor in
charge
Railway
Undertaking
Manufacturer
Safety Measure
sub-system do not enter the relevant
track.
Define a procedure for the traffic
management.
Ensure the driver training for
entering a trackside ATP fitted area
Develop a SIL 4 onboard control
command sub-system
Loss of redundant architecture of onboard sub-system Manufacturer Develop a SIL 4 onboard control
command sub-system
Used Risk
Acceptance
Principle
Explicit Risk
Estimation
Explicit Risk
Estimation
Explicit Risk
Estimation
Exported
Yes
Yes
Yes
Status
section C.16.4.2. in
Appendix C
Ccontrolled
(exported to RU)
Refer also to
section C.16.4.2. in
Appendix C
Safety Case
demonstrating a SIL 4
sub-system assessed
by an Independent
Safety Assessor
Safety Case
demonstrating a SIL 4
sub-system assessed
by an Independent
Safety Assessor
C.16.4. Example of a hazard record for transferring information to other actors
C.16.4.1 This section gives in an example a hazard record for transferring to other actors the identified hazards and associated safety measures that a
considered actor cannot implement. Refer to point [G 1] in section 4.1.1.
This example is the same one as the example in section C.16.3. in Appendix C. The only difference is that all the internal hazards and safety measures
that could be controlled by the considered actor are removed.
C.16.4.2. The last column in Table 8 is used to fulfil the requirement in section 4.2 of the CSM Regulation. There are different solutions to achieve it. One way
may be to refer to the evidence used by the actor receiving the exported safety information. Another way could be to have a meeting between the two
Reference : ERA/GUI/02-2008/SAF Version : 1.1 Page 101 of 105
File Name : Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu