Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools
supporting the CSM Regulation
A.3.5.8. An example of application of the RAC-TS is provided in section C.15. of Appendix C.
A.3.6.
A.3.6.1.
A.3.6.2.
A.3.6.3.
Application examples for RAC-TS
Introduction
(a) this chapter shows examples how to determine the failure rate for the other hazard
severities and how lower safety requirements than 10 -9 h -1 can be derived. This
document does not prefer nor mandates any particular method. It only shows for
information how the RAC-TS can be used to calibrate some widely used methods. It
needs to be developed further in the Agency work on broadly acceptable risks and risk
acceptance criteria.
(b) indeed, the RAC-TS may be applied directly only to a small number of cases as in
practice, not many functional failures of technical systems lead directly to accidents with
potentially catastrophic consequences. Therefore, in order to apply the criterion to
hazards with non-catastrophic consequences and to determine the target failure rate, it
is possible to perform trade-offs (e.g. by calibrating a risk matrix by this criterion)
between different parameters, e.g. severity vs. frequency.
Example 1: Direct Risk Trade-off
(a) the RAC-TS can be applied easily to scenarios which differ only by a few independent
parameters from the reference conditions defined in the RAC-TS in section 2.5.4. of the
CSM Regulation {Ref. 3};
(b) assume that for a particular parameter p the relationship with risk is multiplicative.
Assume that in the reference condition p* is present while in the alternative scenario p‗
is applicable. In this case only the parameter ratio p*/p‘ is relevant and the rate of
occurrence may be reduced. This procedure may be iterated if the parameters are
independent.
(c) Example:
(1) assume that the actual potential of the catastrophic consequence has been
assessed by expert judgment to be ten times less than the potential under
reference conditions in section 2.5.4 of the CSM Regulation {Ref. 3}. Then the
requirement would be 10 -8 h -1 instead of 10 -9 h -1 .
(2) assume an additional safety barrier by another technical system (independent of
the consequences), which is effective in 50% of cases, is identified;
(3) then the safety requirement would be 5*10 -7 h -1 (i.e. 0.5*10 -8 h -1 ) instead of 10 -9 h -1 .
Example 2: Risk Matrix Calibration
(a) in order to use properly the RAC-TS in a risk matrix, the matrix has to relate to the
correct system level (comparable to that provided in section A.3.5. in Appendix A).
(b) the RAC-TS defines one field in the risk matrix as tolerable which corresponds to the
coordinate (catastrophic severity; 10 -9 h -1 frequency of occurrence): see red field in
Table 5. All fields that relate to a higher frequency have to be labelled "intolerable". It is
to note that only in case of credible direct potential for a catastrophic consequence the
frequency of accidents is the same as the functional failure frequency.
(c) then the rest of the matrix can be filled out, but effects like risk aversion or scaling of the
categories have to be taken into account. In the simplest case of linear decadal scaling
(as shown in the Table 5 by the arrow) the field that way labelled "acceptable" by the
RAC-TS is extrapolated in a linear way to the rest of the matrix. This means that all
fields in the same diagonal (or below the diagonal) are also labelled "acceptable". The
fields below can also be labelled "acceptable".
Reference: ERA/GUI/02-2008/SAF Version: 1.1 Page 66 of 105
File Name: Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu