Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools
supporting the CSM Regulation
[G 4] The receiving actor responsible for the implementation, the verification and validation of the
received or new safety measures registers in its own hazard record all the related hazards
with the associated safety measures (both the imported and jointly identified ones).
[G 5] When a safety measure is not fully validated, a clear restriction of use (e.g. operational
mitigation measures) needs to be elaborated and registered in the hazard record. Indeed, it
is possible that technical/design safety measures are:
(a) not correctly implemented, or;
(b) not completely implemented, or;
(c) intentionally not implemented, for example because different safety measures are
implemented instead of the ones registered in the hazard record (e.g. for cost
purposes). As they are not validated, such safety measures need to be clearly identified
in the hazard record. And evidence/justification needs to be provided why the safety
measures implemented instead (16) are appropriate, as well as a demonstration that with
the replacing safety measures the system complies with the safety requirements;
(d) etc.
In these cases the related technical/design safety measures cannot be verified and validated
during the hazard management. The related hazard(s) and safety measures need then to
remain open in the hazard record in order to avoid the misuse of the safety measures for
other systems by the application of the "similar reference system" risk acceptance principle
[G 6] Usually the "not correctly" and/or "not completely" implemented safety measures are
detected early in the system life-cycle and corrected before the system acceptance.
However, if detected too late for a correct and complete technical safety measure
implementation, the organisation responsible for the implementation and management needs
to identify and register in the hazard record clear restrictions of use for the system under
assessment. These restrictions of use are often operational application constraints for the
system under assessment.
[G 7] It could also be useful to register in the hazard record whether the associated safety
measures will be correctly implemented at a later stage of the system life-cycle or whether
the system will continue to be used with the identified restrictions of use. It could be also
useful to register in the hazard record the justification for not implementing
correctly/completely the associated technical safety measures.
[G 8] The actor who receives the restrictions of use:
(a) imports all of them in its own hazard record;
(b) ensures that the conditions of use of the system under assessment are compliant with
all the received restrictions of use;
(c) verifies and validates that the system under assessment complies with these restrictions
of use
[G 9] Depending on the decisions agreed by the involved organisations:
(a) either the related technical safety measures are implemented correctly in the design at a
later stage.
The organisation exporting the restrictions of use continues to track the correct technical
implementation of the associated safety measures. Consequently, the related safety
(16) If different safety measures are implemented instead of the initially specified ones, they need to be
also registered in the hazard record.
Reference: ERA/GUI/02-2008/SAF Version: 1.1 Page 53 of 105
File Name: Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu