NEW CENELEC STANDARDS & CSM-RA
AGENDA New EN 501xx Standards What is new/changed/improved The use of CENELEC in CSM-RA process
CENELEC & CSM-RA TIMELINE EN61508 EN61508 ENV50126 EN50126 EN50128 EN50129 EN50128 EN50126 EN50129 1995 1999 2000 2001 2003 2010 2011 TR50126-3 2018 TR50126-2 2006 2007 TSI 2010 2012 2015 CSM-RA 352/2009 CSM-RA 402/2013 CSM-RA 1136/2015
System Level OVERVIEW OF CURRENT RAILWAY SAFETY STANDARDS EN 50126 The Specification and Demonstration of Reliablity, Availablity, Maintainability and Safety (RAMS) 1999 Guidance 2007 TR 50126-2 Guide to the application of EN 50126 for safety TR 50126-3 Guide to the application of EN 50126 for rolling stock 2006 SubSystem (Product) EN 50129 Communication, signalling and processing systems Safety related electronic systems for signalling EN 50128 Communications, signalling and processing systems - Software for railway control and protection systems 2003 2011 2001 Guidance 2007 TR 50506-1 Guide to the application of EN 50129 Part 1: Cross Acceptance 2008 TR 50506-2 Guide to the application of EN 50129 Part 2: Safety Assurance
OVERVIEW OF NEW RAILWAY SAFETY STANDARDS System Level EN 50126 The Specification and Demonstration of Reliablity, Availablity, Maintainability and Safety (RAMS) Guidance EN 50126-2 Systems Approach to Safety SubSystem (Product) EN 50129 Communication, signalling and processing systems Safety related electronic systems for signalling EN 50128 Communications, signalling and processing systems - Software for railway control and protection systems 2018 2011 Guidance 2007 TR 50506-1 Guide to the application of EN 50129 Part 1: Cross Acceptance 2008 TR 50506-2 Guide to the application of EN 50129 Part 2: Safety Assurance
SAFETY STANDARDS RELATIONSHIPS Entire Railway system EN 50126 General standard (generic) EN 61508 FUNCTIONAL SAFETY OF ELECTRICAL/ELECTRONIC/PROGRAMMABLE ELECTRONIC SAFETY-RELATED SYSTEMS Specific sector / application Railway sub-system / Product EN 50129 System HW+SW EN 50128 SW IEC 61551 Process Sector Safety System Standard for Safety Instrumented Systems Designers, Integrators and Users IEC 62061, Safety of machinery Functional safety of electrical/ electronic/ programmable control systems Where no other sector/ application exists Railway signalling Other sectors (e.g. machinery / process control) Other Railway Applications Adapted after EN 50129 / IEC WG group
RAILWAY SAFETY STANDARDS - SUBSYSTEM SC9X / S-509 EN 50126-1 & 2 Railway Applications - The Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) SC9XA EN 50129 Communication, signalling and processing systems Safety related electronic systems for signalling 2018 SC9XB EN 50155 Electronic equipment used on rolling stock SC9XC EN 50562 Process, measures and demonstration of safety for electric traction systems 2018 EN 50128 Communications, signalling and processing systems - Software for railway control and protection systems 2011 EN 50657 Rolling stock applications - Software on board ofrolling stock, excluding railway control and protection applications Signalling Rolling Stock Fixed Installation
EN 50126 OLD & NEW IN COMPARISON Similarities System approach for RAMS Risk based approach RAMS lifecycle Safety demonstration principles New/changed More mature and consistent CSM-RA approach Multilevel system approach (hierarchies) Aligned risk evaluation Safety demonstration Safety requirements Spec. Guidance integrated part Clear linkage to TSI Improved/detailed Clear hazard identification and classification Classification of safety requirements Method to derive THR from statistics Safety Case structure Modularity Handling of product/generic / specific Application Safety Apportionment methods Key system safety roles & responsibilities
EN 50126-1 General 1: Scope 2: Normative reference 3: Terms & Definition 4: Abbreviation 5: Railway RAMS 6: Management of Railway RAMS general requirements Annex D Guidance on system definition New Annex B Examples of parameters for railway 7: RAMS Life cycle 8: Safety Case New Annex C Risk Management Calibration and risk acceptance categories Annex A RAMS Plan New Normative Informative Bibliography
EN 50126-2 General 1: Scope 2: Normative reference 3: Terms & Definition 4: Abbreviation Bibliography 8: Risk Assessment Annex A ALARP, GAME, MEM 9: Specification of system safety requirements 5: Safety Process Annex B Using failure and accident statistics to derive a THR 10: Apportionment of functional safety integrity requirements Annex C Guidance on SIL Allocation 7: Organisation and independence of roles 11: Design & Implementation 6: Safety Demonstration Annex D Safety Target Apportionment methods Normative Informative
PRODUCTS IN CENELEC PROCESS EN 50126 Provide the overall process for development of products Lifecycle Hazard identification and management Safety requirements identification and apportionment Safety target (THR, TFFR, SIL) Implementation evidence Documentation 50129/50128 Provide the process for development of products Tailored system/hardware/software development process Detailed analysis of failure and hazard control SIL demonstration Product specific implementation evidence Product specific documentation
EN 50129 General 1: Scope 2: Normative reference 3:Definition 4: Overview Bibliography 5: Requirements for Developing electronic systems Annex E SIL-based techniques 6: Requirements for external elements Annex C HW component failure modes Annex A Safety Integrity Level (SIL) 7: Safety Case Annex B Management of faults 8: Acceptance and subsequent phases Annex F Programmable Components Normative Informative
CSM-RA VERSUS EN50126 CSM-RA Focus on a change Significance Emphasis on hazard identification & control Hazard normally controlled by well known measures Independent safety assessor as NSA proxy EN 50126 Can be applied for changes and products Always applicable Life cycle approach in hazard identification and control Generic control of hazards Verification and validation process Independent safety assessor to ensure process Functional Safety & Safety Integrity RAM (dependability)
CSM-RA IN SHORT Preliminary System Definition Significant Change? No Justify and document decision Significance evaluation CSM-RA relevant? Concept Design Implementation Yes System Definition (Scope, Functions, Interfaces, etc.) Hazard Identification ( What can happen?, When?, Where?, How? Etc.) Hazard Classification Risk Assessment Risk Analysis System Definition The Change in short EN50126 System definition (How critical?) Broadly Yes Justify and Acceptable document decision Risk? No Selection of Risk Acceptance Criteria Hazard identification What is the risk? EN50126 EN50126 Codes of Practice Application of Code of Practice Similar Reference System(s) Similarity Analysis with Reference System(s) Explicit Risk Estimation Identification of Scenarios & associated Safety Measures Qualitative Safety Critera? Quantitative Risk evaluation How to control risk EN50126 Hazard Record Estimate Estimate Frequency Severity Estimate Risks Risk Acceptance Control risk EN50126 EN50129/EN50128 Risk Evaluation Comparison with Criteria Comparison with Criteria Comparison with Criteria No No Acceptable Acceptable Risks? Risks? Yes Yes Safety Requirements (i.e. the Safety Measures to be implemented) Demonstration of the compliance with the safety requirements No Acceptable Risks? Yes Safety documentation Risk was in control EN50126 EN50129/EN50128 Safety Documentation
CSM-RA SUPPORTED BY EN50126 CSM-RA The Legal framework System definition The Good Process EN 50126 Hierarchical system definition model Detailed risk management process & evaluation principles The systematic process Risk Management process Require systematic process Require documentation for hazard control Standard lifecycle to be tailored to project Detailed risk management process Engineering process requirements Provide the principles for safety documentation Safety Case structure Verification & Validation process
1 Concept EN 50126 LIFECYCLE COMPARED TO CSM-RA PROCESS 2 System definition and Operational Context 10 System Acceptance 11 Operation and Maintenance 12 De-commissioning and Disposal 3 Risk Analysis and Evaluation 4 Specification of System Requirements 9 System Validation Prelim. System Definition Significant? CSM-RA Risk Assessment 5 Architecture and Apportionment of System Requirements 6 Design and Implementation 7 8 Manufacture Integration Independent Safety Assessment Code of Practice System Definition Hazard Identification and classification Similar Reference System Risk Evaluation vs risk acceptance criteria Safety Requirements Risk Analysis Explicit Risk Estimation Hazard Management Demonstration of Compliance with Safety Requirement
Legal framework Contractual Arrangement Railway Duty Holder s responsibility Proposer Hazard System Definition Risk analysis Risk evaluation System requirements Safety Measures & Safety requirements Code Of practice Reference system Functional/technical/context Hazard CSM-RA Additional Hazards Application Conditions CENELEC Actor Supplier s Responsibility Hazard analysis Demonstration of compliance System Sub System Products
SYSTEM DEFINITION Contextual Requirements The operational environment Functional Requirements What the system shall do Technical Requirements Ensure the system function
Code Of Practice Reference system Explicit Risk Evaluation CENELEC Hazard HAZARD IDENTIFICATION & ACCEPTANCE Hazard Code of Practice (1) Hazard HZ Lack of Hazards Code of Practice (3) HZ HZ Hazard HZ HZ Code of Practice (2) Hazard HZ HZ HZ Interface Hazards Interface Hazards HZ Hazard Reference Hazard Interface Hazards HZ System definition
EXAMPLE Hazards CSM-RA Trains too close - > separate EN50126 Block sections Indicate free/occupied Hazard related to Generic Appl. Axle counter indicate free while occupied Hazard related to Specific Appl. Specific Appl. Generic Application SC Specific EN50129 EN50128 Failures/Hazards in Product Generic Product SC
Proposer s Hazard Record Safety Demonstration CSM-RA CENELEC System Defintion CLOSE Safety Dcoumentation CSM-RA CENELEC Log Register CENELEC Allocation of hazards Specific Appl. Safety Case(s) EN50126 System Defintion Implementation Generic Appl. Safety Case(s) EN50126 EN50129 Supplier Hazard Log Register Specifc log Generic Product Safety Case(s) EN50129 EN50128
APPLICATION OF CENELEC STANDARDS ON SYSTEM/SUBSYSTEM LEVEL Hazards identified in CSM-RA Hazard Hazard Hazard SystemIntegration Hardware SUb System Software EN 50126 systematic process EN 50129 System Integration EN 50128 Software development process SIL requirement EN 50129 Hardware development process
HAZARD RATES & SIL - PRINCIPLE Safety functionality Hazards Hazard not controlled by system Hazard not fully mitigated System Failure Hazard rate Functional Hazard rate Safety Integrity (SIL) Functional Safety System
SAFETY INTEGRITY SIL Qualitative Measures SIL Quantitative Target (TFFR) SIL Qualitative Measures Defined in sector specific standard EN50129/ EN50128 Quality Management Conditions Safety Management Conditions Technical Safety Measures Compliance to the Safety Integrity measures SIL 4 3 2 1 Demonstration of Quantitative Targets Tolerable Functional Failure Rate 10-9 < TFFR < 10-8 10-8 < TFFR < 10-7 10-7 < TFFR < 10-6 10-6 < TFFR < 10-5 Compliance to Basic Integrity measures
CSM-RA & SAFETY CASE CSM-RA System definition What is done System description QA System description QA Audit CENELEC Executive summary Introduction 1 Definition of System 2 Quality Management Report Risk Management Hazard Record Safety Plan Safety Management Audit Hazard Log (activities) Hazard Log (register) 3 Safety Management Report 4 Technical Safety Report 5 Related Safety Cases Safety requirements Evidence of implementation Safety Analysis 6 Conclusion
Concept 1 Feedback on RAMS into risk analysis Operation, Maintenance Performance Monitoring 11 System Definition and Operational Concept Risk Analysis and evaluation 2 3 Safety Case System Acceptance 10 Decommissioning Specification of System Requirements 4 System Validation 9 1 2 Architecture & Apportionment of Sys. Req 5 Integration 8 Control of RAMS Requirements Design and Implementation 6 Manufacture 7
V & V INDEPENDENCE ARRANGEMENTS SIL 4 / SIL 3 (Vital) Project Management Design Verifier Validator OR Project Management Independent of project Independent of project Design Verifier Validator Independent Safety Assessor Independent Safety Assessor SIL 2 / SIL 1 Basic Integrity Design Project Management Verifier Validator Independent Safety Assessor
CENELEC & CSM-RA New EN 50126 & EN 50129 No Contradiction with CSM-RA but a good Code of Practice for the process CENELEC -> provide the good practice Fill-in on products
THANK YOU QUESTIONS? STIG MUNCK SGM@RAMBOLL.DK +45 5161 6375 New CENELEC StandardS NEW CENELEC STANDARDS CSM-RA & CSM-RA