Guidance for Use of CSM Recommendation - ERA - Europa

European Railway Agency
Collection of examples of risk assessments and of some possible tools
supporting the CSM Regulation
(a) Ziegler, P., Kupfer, L., Wunder, H.: "Erfahrungen mit der Risikoanalyse ESTW (DB AG)",
Signal+Draht, 10, 2003, 10-15, and;
(b) Bock, H., Braband, J., and Harborth, M.: "Safety Assessment of Vital Control and
Display Functions in Electronic Interlockings, in Proc. AAET2005 Automation,
Assistance and Embedded Real Time Platforms for Transportation", GZVB,
Braunschweig, 2005, 234-253.
C.14.
C.14.1.
C.14.2.
C.14.3.
C.14.4.
C.14.5.
Example of an explicit Risk acceptance criterion for FFB Radiobased
Train Operation in Germany
Remark: this example of risk assessment was not produced as a result of the application of
the CSM process; it was carried out before the existence of CSM. The purpose of the
example is:
(a) to identify the similarities between the existing risk assessment methods and the CSM
process;
(b) to give traceability between the existing process and the one requested by the CSM;
(c) to provide justification of the added value of performing the additional steps (if any)
required by the CSM.
It must be stressed that this example is given for information only. Its purpose is to help the
reader understanding the CSM process. But the example itself shall not be transposed to or
used as a reference system for another significant change. The risk assessment shall be
carried out for each significant change in compliance with the CSM Regulation.
A risk analysis in accordance with the CENELEC standards was carried out for a totally new
operating procedure that had been envisaged (but never introduced) in Germany for
conventional railway lines. The concept consisted in operating trains safely only through
radio-based (route and train) control. As there were not existing codes of practice
(acknowledged engineering rules) and reference systems for such a new system, explicit risk
estimation was conducted in order to demonstrate the safety of the new procedure. It was
necessary to show that the level of risk to a passenger due to the new system would not
exceed an acceptable risk value (explicit risk acceptance criterion).
This explicit risk acceptance criterion was estimated on the basis of statistics of accidents in
Germany that had been attributable to signalling and control systems, and its plausibility was
also checked against the MEM criterion. Such demonstration of safety conforms with the
German EBO requirement of having "the same level of safety" in case of deviations from
engineering rules. The risk analysis also was followed up and assessed by the national
safety authority (EBA).
This risk assessment example shows how a global explicit criterion (for the third risk
acceptance principle in the CSM) can be derived for new systems with no applicable codes
of practice nor any reference system. The risk analysis that was subsequently carried out for
the new system is based on the CENELEC standards and thus corresponds well with the
CSM process. The risk assessment in the example fulfils the requirements from the CSM,
but there is no reference to hazard record management neither to demonstration of the
compliance of the system under assessment with the identified safety requirements.
Further information on this risk analysis can be found in: Braband, J., Günther, J., Lennartz,
K., Reuter, D.: "Risikoakzeptanzkriterien für den FunkFahrBetrieb (FFB)", Signal + Draht,
Nr.5, 2001, 10-15
Reference: ERA/GUI/02-2008/SAF Version: 1.1 Page 95 of 105
File Name: Collection_of_RA_Ex_and_some_tools_for_CSM_V1.1.doc
European Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu