SIST-TP CLC/TR 50126-2:2007

SLOVENSKI STANDARD
SIST-TP CLC/TR 50126-2:2007
01-september-2007
Železniške naprave – Specifikacija in prikaz zanesljivosti, razpoložljivosti,
vzdrževalnosti in varnosti (RAMS) – 2. del: Vodilo za uporabo EN 50126-1 za
varnost
Railway applications - The specification and demonstration of Reliability, Availability,
Maintainability and Safety (RAMS) -- Part 2: Guide to the application of EN 50126-1 for
safety
Bahnanwendungen - Spezifikation und Nachweis der Zuverlässigkeit, Verfügbarkeit,
Instandhaltbarkeit, Sicherheit (RAMS) -- Teil 2: Leitfaden zur Anwendung der EN 50126-
1 für Sicherheit
Applications ferroviaires - Spécification et démonstration de la fiabilité, de la disponibilité,
de la maintenabilité et de la sécurité (FDMS) -- Partie 2:Guide pour l’application de l’EN
50126-1 à la sécurité
Ta slovenski standard je istoveten z: CLC/TR 50126-2:2007
ICS:
29.280 (OHNWULþQDYOHþQDRSUHPD Electric traction equipment
45.020 Železniška tehnika na Railway engineering in
splošno general
SIST-TP CLC/TR 50126-2:2007 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST-TP CLC/TR 50126-2:2007

---------------------- Page: 2 ----------------------

SIST-TP CLC/TR 50126-2:2007


TECHNICAL REPORT
CLC/TR 50126-2

RAPPORT TECHNIQUE
February 2007
TECHNISCHER BERICHT

ICS 45.020


English version


Railway applications -
The specification and demonstration of Reliability, Availability,
Maintainability and Safety (RAMS) -
Part 2: Guide to the application of EN 50126-1 for safety



Applications ferroviaires -  Bahnanwendungen -
Spécification et démonstration Spezifikation und Nachweis
de la fiabilité, de la disponibilité, der Zuverlässigkeit, Verfügbarkeit,
de la maintenabilité Instandhaltbarkeit, Sicherheit (RAMS) -
et de la sécurité (FDMS) - Teil 2: Leitfaden zur Anwendung
Partie 2:Guide pour l’application der EN 50126-1 für Sicherheit
de l’EN 50126-1 à la sécurité







This Technical Report was approved by CENELEC on 2007-01-22.

CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the
Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain,
Sweden, Switzerland and the United Kingdom.





CENELEC
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung

Central Secretariat: rue de Stassart 35, B - 1050 Brussels


© 2007 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members.
Ref. No. CLC/TR 50126-2:2007 E

---------------------- Page: 3 ----------------------

SIST-TP CLC/TR 50126-2:2007
CLC/TR 50126-2:2007 - 2 -
Foreword
The European Standard EN 50126-1:1999, which was prepared jointly by the Technical Committees
CENELEC TC 9X, Electric and electronic applications for railways, and CEN TC 256, Railway applications,
under mode 4 co-operation, deals with the specification and demonstration of Reliability, Availability,
Maintainability and Safety (RAMS) for railway applications.
A guide to the application of EN 50126-1 for safety of railway systems (this CLC/TR 50126-2) and a guide for
the application to EN 50126-1 for rolling stock RAM (CLC/TR 50126-3:2006) have been produced to form
informative parts of EN 50126-1:1999. Whilst this CLC/TR 50126-2 is applicable to all railway systems,
including rolling stock, CLC/TR 50126-3:2006 is applicable to rolling stock RAM only.
This Technical Report, which was prepared by WG 8 of the Technical Committee CENELEC TC 9X, forms
an informative part of EN 50126-1:1999 and contains guidelines for the application of EN 50126-1 for the
safety of railway systems.
The text of the draft was submitted to the vote and was approved by CENELEC as CLC/TR 50126-2 on
2007-01-22.
---------------

---------------------- Page: 4 ----------------------

SIST-TP CLC/TR 50126-2:2007
- 3 - CLC/TR 50126-2:2007
Contents
Introduction.8
1 Scope.9
2 References.11
3 Definitions and abbreviations.12
3.1 Guidance on the interpretation of terms and definitions used in EN 50126-1 .12
3.2 Additional safety terms.15
3.3 Abbreviations.17
4 Guidance on bodies/entities involved and concepts of system hierarchy and safety.17
4.1 Introduction.17
4.2 Bodies/entities involved in a system.18
4.3 Concepts of system hierarchy.18
4.3.1 Rail transport system environment and system hierarchy .19
4.4 Safety concepts.19
4.4.1 Hazard perspective .19
4.4.2 Risk.21
4.4.3 Risk normalising .22
5 Generic risk model for a typical railway system and check list of common functional hazards .23
5.1 Introduction.23
5.2 Generic risk model .23
5.3 Risk assessment process.24
5.3.1 Introduction.24
5.3.2 Generic process .24
5.4 Application of the risk assessment process .28
5.4.1 Depth of analysis.29
5.4.2 Preliminary hazard analysis .29
5.4.3 Qualitative and Quantitative assessment.30
5.4.4 Use of historical data.31
5.4.5 Sensitivity analysis .32
5.4.6 Risk assessment during life cycle phases.32
5.5 Check-list of common functional hazards and hazard identification .33
5.5.1 Introduction.33
5.5.2 Hazard grouping structures.34
5.5.3 Check-list of “Hazards”.35
6 Guidance on application of functional safety, functional safety requirements and SI targets,
risk apportionment and application of SILs.36
6.1 Introduction.36
6.2 Functional and technical safety.36
6.2.1 System characteristics .36
6.2.2 Railway system structure and safety requirements .37
6.2.3 Safety related functional and technical characteristics and overall system safety .37

---------------------- Page: 5 ----------------------

SIST-TP CLC/TR 50126-2:2007
CLC/TR 50126-2:2007 - 4 -
6.3 General considerations for risk apportionment .38
6.3.1 Introduction.38
6.3.2 Approaches to apportionment of safety targets .38
6.3.3 Use of THRs.40
6.4 Guidance on the concept of SI and the application of SILs .40
6.4.1 Safety integrity.40
6.4.2 Using SI concept in the specification of safety requirements.42
6.4.3 Link between THR and SIL .46
6.4.4 Controlling random failures and systematic faults to achieve SI.46
6.4.5 Use and misuse of SILs .49
6.5 Guidance on fail-safe systems .51
6.5.1 Fail-safe concept .51
6.5.2 Designing fail-safe systems.52
7 Guidance on methods for combining probabilistic and deterministic means for safety
demonstration .54
7.1 Safety demonstration .54
7.1.1 Introduction.54
7.1.2 Detailed guidance on safety demonstration approaches.54
7.1.3 Safety qualification tests.65
7.2 Deterministic methods.65
7.3 Probabilistic methods .65
7.4 Combining deterministic and probabilistic methods.65
7.5 Methods for mechanical and mixed (mechatronic) systems.66
8 Guidance on the risk acceptance principles.67
8.1 Guidance on the application of the risk acceptance principles .67
8.1.1 Application of risk acceptance principles .67
8.1.2 The ALARP principle.68
8.1.3 The GAMAB (GAME) principle.69
8.1.4 Minimum Endogenous Mortality (MEM) safety principle (EN 50126-1, Clause D.3) .70
9 Guidance on the essentials for documented evidence or proof of safety (Safety case) .71
9.1 Introduction.71
9.2 Safety case purpose.72
9.3 Safety case scope .72
9.4 Safety case levels .72
9.5 Safety case phases .74
9.6 Safety case structure.75
9.7 Safety assessment .78
9.7.1 The scope of the safety assessor .78
9.7.2 The independence of a safety assessor .78
9.7.3 Competence of the safety assessor.79
9.8 Interfacing with existing systems.79
9.8.1 Systems developed according to the EN 50126-1 process .79
9.8.2 System proven in use.79
9.8.3 Unproven systems.80

---------------------- Page: 6 ----------------------

SIST-TP CLC/TR 50126-2:2007
- 5 - CLC/TR 50126-2:2007
9.9 Criteria for cross acceptance of systems .80
9.9.1 The basic premise.80
9.9.2 The framework .81
Annex A (informative) Steps of risk assessment process.82
A.1 System definition .82
A.2 Hazard identification.83
A.2.1 Empirical hazard identification .83
A.2.2 Creative hazard identification.83
A.2.3 Foreseeable accident identification.83
A.2.4 Hazards .84
A.3 Hazard log .86
A.4 Consequence analysis .87
A.5 Hazard control .87
A.6 Risk ranking.88
A.6.1 Qualitative ranking.89
A.6.2 Semi-quantitative ranking approach.89
Annex B (informative) Railway system level HAZARDs - Check lists .92
B.1 General.92
B.2 Example of hazard grouping according to affected persons.94
B.2.1 “C-hazards” – Neighbours group.94
B.2.2 “C-hazards” - Passengers group.95
B.2.3 “C-hazards” - Workers group.96
B.3 Example of functional based hazard grouping.96
Annex C (informative) Approaches for classification of risk categories .99
C.1 Functional breakdown approach (a).99
C.2 Installation (constituent) based breakdown approach (b) .99
C.3 Hazard based breakdown approach (c) .100
C.4 Hazard causes based breakdown approach (d) .101
C.5 Breakdown by types of accidents (e) .102
Annex D (informative) An illustrative railway system risk model developed for railways in UK.103
D.1 Building a risk model .103
D.2 Illustrative example of a risk model for UK railways.104
D.2.1 Modelling technology.104
D.2.2 Usage and constraints.105
D.2.3 Model forecasts .105
Annex E (informative) Techniques & methods .108
E.1 General.108
E.2 Rapid ranking analysis .109
E.3 Structured What-if analysis .109
E.4 HAZOP .110
E.5 State transition diagrams.110
E.6 Message Sequence Diagrams .111
E.7 Failure Mode Effects and Criticality Analysis - FMECA .112
E.8 Event tree analysis .112

---------------------- Page: 7 ----------------------

SIST-TP CLC/TR 50126-2:2007
CLC/TR 50126-2:2007 - 6 -
E.9 Fault tree analysis .113
E.10 Risk graph method .114
E.11 Other analysis techniques .115
E.11.1 Formal methods analysis .115
E.11.2 Markov analysis.115
E.11.3 Petri networks.115
E.11.4 Cause consequence diagrams.115
E.12 Guidance on deterministic and probabilistic methods.115
E.12.1 Deterministic methods and approach.115
E.12.2 Probabilistic methods and approach .116
E.13 Selection of tools & methods.117
Annex F (informative) Diagramatic illustration of availability concept .119
Annex G (informative) Examples of setting risk acceptance criteria .120
G.1 Example of ALARP application .120
G.2 Copenhagen Metro.123
Annex H (informative) Examples of safety case outlines .124
H.1 Rolling stock .124
H.2 Signalling .126
H.3 Infrastructure .128
Bibliography.131

Figures
Figure 1 – Nested systems and hierarchy.18
Figure 2 – Definition of hazards with respect to a system boundary and likely accident.20
Figure 3 – Sequence of occurrence of accident, hazard and cause.21
Figure 4 – Risk assessment flow chart.25
Figure 5 – Hazard control flow chart .26
Figure 6 – Safety allocation process .39
Figure 7 – Factors influencing SI.41
Figure 8 – Process for defining a code of practice for the control of random failures.48
Figure 9 – Process for defining a code of practise for the control of systematic faults.49
Figure 10 – Differential risk aversion.71
Figure 11 – Safety case levels .73
Figure A.1 – Risk ranking for events with potential for significantly different outcomes .91
Figure D.1 – Illustrative annual safety forecasts generated by an integrated risk model .106
Figure D.2 – Illustrative individual risk forecasts generated by an integrated risk model .107
Figure E.1 – State transition diagram – Example.111
Figure E.2 – Example of message collaboration diagram.111
Figure E.3 – Example of consequence analysis using event tree.113
Figure E.4 – Fault tree analysis – Example.114
Figure F.1 – Availability concept and related terms .119
Figure G.1 – Risk areas and risk reducing measures .121
Figure G.2 – ALARP results of options 1 to 4 .123

---------------------- Page: 8 ----------------------

SIST-TP CLC/TR 50126-2:2007
- 7 - CLC/TR 50126-2:2007

Tables
Table 1 – Cross-reference between certain life cycle phase activities and clauses of the report.10
Table 2 – Clauses of the report covering scope issues .10
Table 3 – Comparison of terms (duty holders).13
Table 4 – Structured approach to allocation of SI (refer to 6.4.2.2) .43
Table 5 – THR/SIL relationship .46
Table 6 – Possible states of a fail safe system .53
Table 7 – Approaches for system safety demonstration .56
Table 8 – Criteria for each of the risk acceptance principles .67
Table 9 – List of EN 50129 clauses and their applicability for documented evidence to systems other
than signalling .75
Table A.1 – Example of frequency ranking scheme.89
Table A.2 – Example of consequence ranking scheme .90
Table A.3 – Risk ranking matrix.90
Table B.1 – Railway neighbour “c-hazards” .94
Table B.2 – List railway passenger “c-hazards”
...