ERA guide for application of the Common Safety Methods ... - Europa

European Railway AgencyGuide for the application of the CSM Regulation 2.2.3. As a criterion, risks resulting from hazards may be classified as broadly acceptablewhen the risk is so small that it is not reasonable to implement any additional safetymeasure. The expert judgement shall take into account that the contribution of all thebroadly acceptable risks does not exceed a defined proportion of the overall risk.[G 1] It is the responsibility of the proposer to evaluate whether the risk associated with eachidentified hazard is broadly acceptable, as well as to ensure that the assessment isperformed by competent experts (see definitions in points [G 2](b) and (c) in Article 3).[G 2] Given that a detailed risk quantification cannot always be possible during the hazardidentification phase, in practice an expert judgement can enable to decide whether theconsidered hazard could be associated with a broadly acceptable risk in the following cases:(a) either if the hazard frequency of occurrence is judged to be sufficiently low due to e.g.physical phenomena (10) (such as fall of meteorites on the track) regardless of thepotential severity;(b) or/and if the potential severity of the hazard consequence is judged to be sufficientlylow, regardless of the hazard frequency of occurrence.[G 3] If hazards with different levels of detail are identified (i.e. high level hazards on one hand,and detailed sub-hazards on the other hand), the proposer will take action to ensure thatthey are correctly classified at least into hazards associated with broadly acceptable risk andhazards associated with risks that are not considered as broadly acceptable. This will includemeasures to ensure that the contribution of all hazards associated with broadly acceptablerisk(s) does not exceed a given proportion of the overall risk at the system level.2.2.4. During the hazard identification, safety measures may be identified. They shall beregistered in the hazard record according to section 4.[G 1] Additional explanation is not judged necessary.2.2.5. The hazard identification only needs to be carried out at a level of detail necessary toidentify where safety measures are expected to control the risks in accordance with oneof the risk acceptance principles mentioned in point 2.1.4. Iteration may thus benecessary between the risk analysis and the risk evaluation phases until a sufficientlevel of detail is reached for the identification of hazards.[G 1] The level of detail required for the hazard identification depends on the system to beassessed.[G 2] As set out in Figure 3, the iterative risk assessment process starts with the system definition(see section 2.1.2) that is used as the basis for the hazard identification phase. "High levelhazards", associated with "high level functions", can be considered first. Then:(a) if the risks associated with these "high level hazards" are controlled to an acceptablelevel by safety measures covered within the system definition or by new identified(10) If the reason for the low frequency is that the hazard is incredible due to laws of physics, then thehazard and the argument for low frequency needs to be registered in the hazard record Reference: ERA/GUI/01-2008/SAF Version: 1.1 Page 36 of 54File Name: Guide_for_Application_of_CSM_V1.1.docEuropean Railway Agency ● Boulevard Harpignies, 160 ● BP 20392 ● F-59307 Valenciennes Cedex ● France ● Tel. +33 (0)3 27 09 65 00 ● Fax +33 (0)3 27 33 40 65 ● http://www.era.europa.eu