CLC TR 50126-2-2007 Railway applications - The specification and demonstration of Reliability Availability Maintainability and Safety (RAMS) - Part 2 Guide to the application of EN.pdf

1、PUBLISHED DOCUMENTPD CLC/TR 50126-2:2007Railway applications The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) Part 2: Guide to the application of EN 50126-1 for safetyICS 45.020g49g50g3g38g50g51g60g44g49g42g3g58g44g55g43g50g56g55g3g37g54g44g3g51g40g

2、53g48g44g54g54g44g50g49g3g40g59g38g40g51g55g3g36g54g3g51g40g53g48g44g55g55g40g39g3g37g60g3g38g50g51g60g53g44g42g43g55g3g47g36g58PD CLC/TR 50126-2:2007This Published Document was published under the authority of the Standards Policy and Strategy Committee on 30 April 2007 BSI 2007ISBN 978 0 580 50488

3、 4National forewordThis Published Document was published by BSI. It is the UK implementation of CLC/TR 50126-2:2007. The UK participation in its preparation was entrusted to Technical Committee GEL/9, Railway electrotechnical applications.A list of organizations represented on GEL/9 can be obtained

4、on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.Amendments issued since publicationAmd. No. Date CommentsTECHNICAL REPORT CLC/TR 50126-2 RAPPORT TECHNIQUE TECHNISCHER BERICHT Februa

5、ry 2007 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secretariat: rue de Stassart 35, B - 1050 Brussels 2007 CENELEC - All rights of exploitation in any form and by any means r

6、eserved worldwide for CENELEC members. Ref. No. CLC/TR 50126-2:2007 E ICS 45.020 English version Railway applications - The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) - Part 2: Guide to the application of EN 50126-1 for safety Applications ferrovi

7、aires - Spcification et dmonstration de la fiabilit, de la disponibilit, de la maintenabilit et de la scurit (FDMS) - Partie 2:Guide pour lapplication de lEN 50126-1 la scurit Bahnanwendungen - Spezifikation und Nachweis der Zuverlssigkeit, Verfgbarkeit, Instandhaltbarkeit, Sicherheit (RAMS) - Teil

8、2: Leitfaden zur Anwendung der EN 50126-1 fr Sicherheit This Technical Report was approved by CENELEC on 2007-01-22. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ic

9、eland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. Foreword The European Standard EN 50126-1:1999, which was prepared jointly by the Technical Committees CENELEC TC 9X

10、, Electric and electronic applications for railways, and CEN TC 256, Railway applications, under mode 4 co-operation, deals with the specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) for railway applications. A guide to the application of EN 50126-1 for

11、safety of railway systems (this CLC/TR 50126-2) and a guide for the application to EN 50126-1 for rolling stock RAM (CLC/TR 50126-3:2006) have been produced to form informative parts of EN 50126-1:1999. Whilst this CLC/TR 50126-2 is applicable to all railway systems, including rolling stock, CLC/TR

12、50126-3:2006 is applicable to rolling stock RAM only. This Technical Report, which was prepared by WG 8 of the Technical Committee CENELEC TC 9X, forms an informative part of EN 50126-1:1999 and contains guidelines for the application of EN 50126-1 for the safety of railway systems. The text of the

13、draft was submitted to the vote and was approved by CENELEC as CLC/TR 50126-2 on 2007-01-22. - 2 CLC/TR 50126-2:2007Contents Introduction.8 1 Scope.9 2 References11 3 Definitions and abbreviations.12 3.1 Guidance on the interpretation of terms and definitions used in EN 50126-1 .12 3.2 Additional sa

14、fety terms.15 3.3 Abbreviations17 4 Guidance on bodies/entities involved and concepts of system hierarchy and safety.17 4.1 Introduction.17 4.2 Bodies/entities involved in a system.18 4.3 Concepts of system hierarchy18 4.3.1 Rail transport system environment and system hierarchy 19 4.4 Safety concep

15、ts19 4.4.1 Hazard perspective .19 4.4.2 Risk21 4.4.3 Risk normalising 22 5 Generic risk model for a typical railway system and check list of common functional hazards 23 5.1 Introduction.23 5.2 Generic risk model .23 5.3 Risk assessment process.24 5.3.1 Introduction24 5.3.2 Generic process 24 5.4 Ap

16、plication of the risk assessment process .28 5.4.1 Depth of analysis.29 5.4.2 Preliminary hazard analysis 29 5.4.3 Qualitative and Quantitative assessment30 5.4.4 Use of historical data.31 5.4.5 Sensitivity analysis 32 5.4.6 Risk assessment during life cycle phases.32 5.5 Check-list of common functi

17、onal hazards and hazard identification 33 5.5.1 Introduction33 5.5.2 Hazard grouping structures.34 5.5.3 Check-list of Hazards35 6 Guidance on application of functional safety, functional safety requirements and SI targets, risk apportionment and application of SILs36 6.1 Introduction.36 6.2 Functio

18、nal and technical safety36 6.2.1 System characteristics 36 6.2.2 Railway system structure and safety requirements 37 6.2.3 Safety related functional and technical characteristics and overall system safety .37 3 CLC/TR 50126-2:20076.3 General considerations for risk apportionment 38 6.3.1 Introductio

19、n38 6.3.2 Approaches to apportionment of safety targets 38 6.3.3 Use of THRs40 6.4 Guidance on the concept of SI and the application of SILs .40 6.4.1 Safety integrity.40 6.4.2 Using SI concept in the specification of safety requirements42 6.4.3 Link between THR and SIL .46 6.4.4 Controlling random

20、failures and systematic faults to achieve SI.46 6.4.5 Use and misuse of SILs 49 6.5 Guidance on fail-safe systems .51 6.5.1 Fail-safe concept .51 6.5.2 Designing fail-safe systems.52 7 Guidance on methods for combining probabilistic and deterministic means for safety demonstration 54 7.1 Safety demo

21、nstration .54 7.1.1 Introduction54 7.1.2 Detailed guidance on safety demonstration approaches54 7.1.3 Safety qualification tests65 7.2 Deterministic methods65 7.3 Probabilistic methods .65 7.4 Combining deterministic and probabilistic methods.65 7.5 Methods for mechanical and mixed (mechatronic) sys

22、tems 66 8 Guidance on the risk acceptance principles.67 8.1 Guidance on the application of the risk acceptance principles 67 8.1.1 Application of risk acceptance principles 67 8.1.2 The ALARP principle.68 8.1.3 The GAMAB (GAME) principle69 8.1.4 Minimum Endogenous Mortality (MEM) safety principle (E

23、N 50126-1, Clause D.3) 70 9 Guidance on the essentials for documented evidence or proof of safety (Safety case) .71 9.1 Introduction.71 9.2 Safety case purpose.72 9.3 Safety case scope 72 9.4 Safety case levels 72 9.5 Safety case phases 74 9.6 Safety case structure75 9.7 Safety assessment .78 9.7.1

24、The scope of the safety assessor .78 9.7.2 The independence of a safety assessor .78 9.7.3 Competence of the safety assessor79 9.8 Interfacing with existing systems79 9.8.1 Systems developed according to the EN 50126-1 process 79 9.8.2 System proven in use79 9.8.3 Unproven systems.80 4 CLC/TR 50126-

25、2:20079.9 Criteria for cross acceptance of systems .80 9.9.1 The basic premise.80 9.9.2 The framework 81 Annex A (informative) Steps of risk assessment process82 A.1 System definition 82 A.2 Hazard identification.83 A.2.1 Empirical hazard identification 83 A.2.2 Creative hazard identification83 A.2.

26、3 Foreseeable accident identification.83 A.2.4 Hazards .84 A.3 Hazard log 86 A.4 Consequence analysis .87 A.5 Hazard control 87 A.6 Risk ranking88 A.6.1 Qualitative ranking.89 A.6.2 Semi-quantitative ranking approach89 Annex B (informative) Railway system level HAZARDs - Check lists .92 B.1 General.

27、92 B.2 Example of hazard grouping according to affected persons94 B.2.1 C-hazards Neighbours group.94 B.2.2 C-hazards - Passengers group.95 B.2.3 C-hazards - Workers group.96 B.3 Example of functional based hazard grouping.96 Annex C (informative) Approaches for classification of risk categories 99

28、C.1 Functional breakdown approach (a).99 C.2 Installation (constituent) based breakdown approach (b) 99 C.3 Hazard based breakdown approach (c) .100 C.4 Hazard causes based breakdown approach (d) 101 C.5 Breakdown by types of accidents (e) .102 Annex D (informative) An illustrative railway system ri

29、sk model developed for railways in UK103 D.1 Building a risk model 103 D.2 Illustrative example of a risk model for UK railways.104 D.2.1 Modelling technology.104 D.2.2 Usage and constraints.105 D.2.3 Model forecasts .105 Annex E (informative) Techniques the operator of the system; the maintainer(s)

30、 of one or more parts of the system; etc. Such splits are based on either statutory instruments or contractual agreements. Such responsibilities should therefore be clearly stated at the earliest stages of a system lifecycle. Sometimes the users of EN 50126-1 have misinterpreted the term authority.

31、To clarify the term, it is emphasised that a railway authority in the sense of EN 50126-1 is NOT the regulator or the government. See Table 3 for equivalent terms for duty holders used in EN 50126-1 and the EU Safety Directive: Table 3 Comparison of terms (duty holders) EN 50126-1 EU Safety Directiv

32、e railway authority infrastructure manager railway undertaking safety regulatory authority safety authority railway support industry supplier manufacturing industry 13 CLC/TR 50126-2:20073.1.8 risk (3.34) EN 50126-1 defines this term as: the probable rate of occurrence of a hazard causing harm and t

33、he degree of severity of that harm. This is often misinterpreted to mean: The probable rate of occurrence of a hazard that may cause harm and the degree of severity of that harm. The problem is that the occurrence of a hazard is not equivalent to an occurrence of harm. In order to make risks compara

34、ble with each other it is important to consider the probability that a hazard actually leads to harm. For example, if the barriers at a level crossing do not close when commanded (hazard) this does not automatically lead to a crash between a train and a car (i.e. accident or occurrence of harm). Cor

35、rect interpretation: the rate of occurrence of accidents and incidents resulting in harm (caused by a hazard) and the degree of severity of that harm. Mathematically this is represented as: Risk = Rate (of accidents) x Degree of Severity (of harm) Consequently, in Table 4 of EN 50126-1 (frequency-co

36、nsequence-matrix) the title in the left column frequency of occurrence of a hazardous event” has to be read as frequency of occurrence of an accident (caused by a hazard)” Also see 3.2.9 3.1.9 safety (3.35) EN 50126-1 defines safety as: freedom from unacceptable risk of harm. This could be misleadin

37、g, because the aspect harm is already included in the term risk as defined in 3.1.8 above. To avoid misunderstandings the shortened definition freedom from unacceptable risk” is more appropriate 3.1.10 safety integrity (3.37) EN 50126-1 defines the term as: the likelihood of a system satisfactorily

38、performing the required safety functions under all the stated conditions within a stated period of time. Generally, safety relies on adequate measures to prevent or tolerate faults (as safeguards against systematic failure) as well as on adequate measures to control random failures. In this sense, s

39、afety integrity means that the qualitative measures (to avoid systematic failures) should be balanced with the quantitative targets (to control random failures). 3.1.11 systematic failures (3.42) EN 50126-1 defines this term as: failures due to errors in any safety lifecycle activity, within any pha

40、se, which cause it to fail under some particular combination of inputs or under some particular environment condition Wording used in the definition of this term in EN 61508 gives an alternative explanation, even though there is no actual difference in the meaning between the two. EN 61508 defines i

41、t as: failure related in a deterministic way to a certain cause, which can only be eliminated by a modification of the design or of the manufacturing process, operational procedures, documentation or other relevant factors NOTE 1 Corrective maintenance without modification will usually not eliminate

42、 the failure cause. NOTE 2 A systematic failure can be induced by simulating the failure cause. NOTE 3 Examples of causes of systematic failures include human error in the safety requirements specification; the design, manufacture, installation, operation of the hardware; the design, implementation,

43、 etc. of the software. NOTE 4 Failures in a safety-related system are categorised as random failures or systematic failures. 14 CLC/TR 50126-2:20073.1.12 tolerable risk (3.43) EN 50126-1 defines this term as: the maximum level of risk of a product that is acceptable to the Railway Authority (RA). Th

44、e RA is responsible for agreeing the risk acceptance criteria and the risk acceptance levels with the Safety Regulatory Authority (SRA) and for providing these to the Railway Support Industry (RSI) (see 5.3.2). Usually, it is the SRA or the RA by agreement with the SRA that defines risk acceptance l

45、evels. Risk acceptance levels currently depend on the prevailing national legislation or national/other regulations. In many countries risk acceptance levels have not yet been established and are still in progress and/or under consideration 3.2 Additional safety terms This clause lists useful additi

46、onal safety terms that are not defined in EN 50126-1 but are used in the report and provide better understanding of the principles and concepts in EN 50126-1. 3.2.1 accident an unintended event or series of events that results in death, injury, loss of a system or service, or environmental damage EN

47、 50129 3.2.2 collective risk the risk from a product, process or system to which a population or group of people (or the society as a whole) is exposed 3.2.3 commercial risk the rate of occurrence and the severity of financial loss, which may be associated with an accident or undesirable event 3.2.4

48、 deterministic a characteristic of a system whose behaviour can be exactly predicted because all its causes are either known or are the same as for a proven equivalent system 3.2.5 environmental risk the rate of occurrence and the severity of the extent of contamination and/or destruction of the nat

49、ural habitat which may arise from an accident 3.2.6 equivalent fatality a convention for combining injuries and fatalities into one figure for ease of processing and comparison 3.2.7 fault, error, failure These terms are closely related with each other although they have different meanings. In order to avoid misunderstandings, it is recommended to consider the differences between these terms. A failure is the termination of the ability of an item to perform a required function. IEC 60050 (1