Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools
supporting the CSM Regulation
[G 2] The outputs of the risk assessment process in the CSM are (after iterations - see Figure 1):
(a) the "system definition" updated with the "safety requirements" issued from the "risk
analysis" and "risk evaluation" activities (see section 2.1.6);
(b) the "apportionment of system requirements" down to the different sub-systems and
components (Phase 5 in Figure 5);
(c) the "hazard record" that registers:
(1) all the identified hazards and the associated safety measures;
(2) the resulting safety requirements;
(3) the assumptions taken into account for the system that determine the limits and
validity of the risk assessment (see point (g) in section 2.1.2);
(d) and in general all the evidence resulting from the application of the CSM: see section 5.
These risk assessment outputs of the CSM correspond to the safety related outputs of the
Phase 4 in the CENELEC V-Cycle, i.e. to the system requirement specification in Figure 5.
[G 3] The system definition updated with the results from the risk assessment and the hazard
record constitute the inputs against which the system is designed and accepted. The
"demonstration of the system compliance with the safety requirements" in the CSM
corresponds to the following phases of the CENELEC V-Cycle (see BOX 3 in Figure 5):
(a) Phase 6 in Figure 5: "design and implementation";
(b) Phase 7 in Figure 5: "manufacture";
(c) Phase 8 in Figure 5: "installation";
(d) Phase 9 in Figure 5: "system validation (including safety acceptance and commissioning)";
(e) Phase 10 in Figure 5: "system acceptance".
[G 4] The demonstration of the system compliance with the safety requirements depends on
whether the significant change is technical, operational or organisational. So, the different
steps in the CENELEC V-cycle in Figure 5 may not be suitable for all significant changes of
the given kind. The V-cycle in Figure 5 needs to be considered accordingly and used with
appropriate judgement of what fits to each specific application (e.g. for operational and
organisational changes, there is not manufacturing phase).
[G 5] This means that the "demonstration of the system compliance with the safety requirements"
in the CSM does not include only the "verification and validation" activities by tests or
simulation. In practice, it covers all the phases "6 to 10" (see list here above and Figure 5) in
the CENELEC V-Cycle. They include the design, manufacture, installation, verification and
validation activities, as well as the associated RAMS activities and the system acceptance.
[G 6] During the "demonstration of the system compliance with the safety requirements", the
general principle is to focus the risk assessment only on the safety related functions and
interfaces of the system. This means that whenever risk and safety assessment activities
are required in the scope of one of the phases in the CENELEC V-Cycle in Figure 5, it
focuses on:
(a) the safety related functions and interfaces;
(b) the sub-systems and/or components involved in the achievement of the safety related
functions and/or interfaces assessed during the higher level risk assessment activities.
[G 7] It results then from the comparison with the classical CENELEC V-Cycle in Figure 5 that:
(a) the CSM covers the phases "1 to 10" and "13" of this V-Cycle. They include the set of
activities required for the acceptance of the system under assessment;
Reference: ERA/GUI/02-2008/SAF Version: 1.1 Page 34 of 105
File Name: Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu