Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools
supporting the CSM Regulation
(d) use of a reference system [section 2.4]:
The system before the change (loop) is judged to have an acceptable level of safety. It
is thus used as "reference system" to derive the safety requirements for the radio infill
sub-system.
(e) explicit risk estimation and evaluation [section 2.5]:
(1) the differences between the "loop" and "radio infill+GSM" sub-systems are analysed
by explicit risk estimation and evaluation. The following new hazards are identified
for the "radio infill + GSM" sub-system:
(i) transmission by hackers of unsafe information in the air gap since the "radio
infill+GSM" is an open transmission sub-system;
(ii) delayed transmission or transmission of memorised data packets in the air gap;
(2) explicit risk estimation and use of RAC-TS for the Radio Infill Controller part;
(f) use of codes of practice [section 2.3]:
(1) the EN 50159-2 standard ("Railway Applications: Part 2: Safety related
communication in open transmission systems") provides the safety requirements for
controlling the new hazards to an acceptable level, e.g.:
(i) data encrypting and protection;
(ii) message sequencing and time stamping;
(2) use for example of EN 50 128 standard for the software development of the Radio
Infill Controller;
(g) demonstration of the system compliance with safety requirements [section 3]:
(1) follow up of the implementation of the safety requirements through the development
process of the "radio infill + GSM" sub-system;
(2) verification that the system, as designed and installed, is compliant with the safety
requirements;
(h) hazard management [section 4.1]:
The identified hazards, the safety measures and the resulting safety requirements
issued from the risk assessment and the application of the three risk acceptance
principles are registered and managed in a hazard record.
(i) independent assessment [Article 6]:
An independent assessment by a third party is also carried out in order:
(1) to check that the risk management and risk assessment are correctly done;
(2) to check that the technical change is suitable and will maintain the same level of
safety as before the change.
C.7.6.
The example shows that the three risk acceptance principles required by the common safety
method are used in a complementary way to define the safety requirements for the system
under assessment. The risk assessment in the example fulfils all the requirements from the
CSM summarised in Figure 1, including the hazard record management and independent
safety assessment by a third party.
Reference: ERA/GUI/02-2008/SAF Version: 1.1 Page 81 of 105
File Name: Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu