1、PUBLISHED DOCUMENT PD CLC/TR 50126-2:2007 Railway applications The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) Part 2: Guide to the application of EN 50126-1 for safety ICS 45.020 PD CLC/TR 50126-2:2007 This Published Document was published under t
2、he authority of the Standards Policy and Strategy Committee on 30 April 2007 BSI 2007 ISBN 978 0 580 50488 4 National foreword This Published Document was published by BSI. It is the UK implementation of CLC/TR 50126-2:2007. The UK participation in its preparation was entrusted to Technical Committe
3、e GEL/9, Railway electrotechnical applications. A list of organizations represented on GEL/9 can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Amendments issued sinc
4、e publication Amd. No. Date Comments TECHNICAL REPORT CLC/TR 50126-2 RAPPORT TECHNIQUE TECHNISCHER BERICHT February 2007 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secretaria
5、t: rue de Stassart 35, B - 1050 Brussels 2007 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members. Ref. No. CLC/TR 50126-2:2007 E ICS 45.020 English version Railway applications - The specification and demonstration of Reliability, Availability, M
6、aintainability and Safety (RAMS) - Part 2: Guide to the application of EN 50126-1 for safety Applications ferroviaires - Spcification et dmonstration de la fiabilit, de la disponibilit, de la maintenabilit et de la scurit (FDMS) - Partie 2:Guide pour lapplication de lEN 50126-1 la scurit Bahnanwendu
7、ngen - Spezifikation und Nachweis der Zuverlssigkeit, Verfgbarkeit, Instandhaltbarkeit, Sicherheit (RAMS) - Teil 2: Leitfaden zur Anwendung der EN 50126-1 fr Sicherheit This Technical Report was approved by CENELEC on 2007-01-22. CENELEC members are the national electrotechnical committees of Austri
8、a, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. For
9、eword The European Standard EN 50126-1:1999, which was prepared jointly by the Technical Committees CENELEC TC 9X, Electric and electronic applications for railways, and CEN TC 256, Railway applications, under mode 4 co-operation, deals with the specification and demonstration of Reliability, Availa
10、bility, Maintainability and Safety (RAMS) for railway applications. A guide to the application of EN 50126-1 for safety of railway systems (this CLC/TR 50126-2) and a guide for the application to EN 50126-1 for rolling stock RAM (CLC/TR 50126-3:2006) have been produced to form informative parts of E
11、N 50126-1:1999. Whilst this CLC/TR 50126-2 is applicable to all railway systems, including rolling stock, CLC/TR 50126-3:2006 is applicable to rolling stock RAM only. This Technical Report, which was prepared by WG 8 of the Technical Committee CENELEC TC 9X, forms an informative part of EN 50126-1:1
12、999 and contains guidelines for the application of EN 50126-1 for the safety of railway systems. The text of the draft was submitted to the vote and was approved by CENELEC as CLC/TR 50126-2 on 2007-01-22. - 2 CLC/TR 50126-2:2007Contents Introduction.8 1 Scope.9 2 References11 3 Definitions and abbr
13、eviations.12 3.1 Guidance on the interpretation of terms and definitions used in EN 50126-1 .12 3.2 Additional safety terms .15 3.3 Abbreviations17 4 Guidance on bodies/entities involved and concepts of system hierarchy and safety.17 4.1 Introduction.17 4.2 Bodies/entities involved in a system.18 4.
14、3 Concepts of system hierarchy18 4.3.1 Rail transport system environment and system hierarchy 19 4.4 Safety concepts19 4.4.1 Hazard perspective .19 4.4.2 Risk21 4.4.3 Risk normalising 22 5 Generic risk model for a typical railway system and check list of common functional hazards 23 5.1 Introduction
15、.23 5.2 Generic risk model .23 5.3 Risk assessment process.24 5.3.1 Introduction24 5.3.2 Generic process 24 5.4 Application of the risk assessment process .28 5.4.1 Depth of analysis.29 5.4.2 Preliminary hazard analysis 29 5.4.3 Qualitative and Quantitative assessment30 5.4.4 Use of historical data.
16、31 5.4.5 Sensitivity analysis 32 5.4.6 Risk assessment during life cycle phases.32 5.5 Check-list of common functional hazards and hazard identification 33 5.5.1 Introduction33 5.5.2 Hazard grouping structures.34 5.5.3 Check-list of Hazards 35 6 Guidance on application of functional safety, function
17、al safety requirements and SI targets, risk apportionment and application of SILs36 6.1 Introduction.36 6.2 Functional and technical safety36 6.2.1 System characteristics 36 6.2.2 Railway system structure and safety requirements 37 6.2.3 Safety related functional and technical characteristics and ov
18、erall system safety .37 3 CLC/TR 50126-2:20076.3 General considerations for risk apportionment 38 6.3.1 Introduction38 6.3.2 Approaches to apportionment of safety targets 38 6.3.3 Use of THRs40 6.4 Guidance on the concept of SI and the application of SILs .40 6.4.1 Safety integrity.40 6.4.2 Using SI
19、 concept in the specification of safety requirements42 6.4.3 Link between THR and SIL .46 6.4.4 Controlling random failures and systematic faults to achieve SI.46 6.4.5 Use and misuse of SILs 49 6.5 Guidance on fail-safe systems .51 6.5.1 Fail-safe concept .51 6.5.2 Designing fail-safe systems.52 7
20、Guidance on methods for combining probabilistic and deterministic means for safety demonstration 54 7.1 Safety demonstration .54 7.1.1 Introduction54 7.1.2 Detailed guidance on safety demonstration approaches54 7.1.3 Safety qualification tests65 7.2 Deterministic methods65 7.3 Probabilistic methods
21、.65 7.4 Combining deterministic and probabilistic methods.65 7.5 Methods for mechanical and mixed (mechatronic) systems 66 8 Guidance on the risk acceptance principles.67 8.1 Guidance on the application of the risk acceptance principles 67 8.1.1 Application of risk acceptance principles 67 8.1.2 The
22、 ALARP principle.68 8.1.3 The GAMAB (GAME) principle69 8.1.4 Minimum Endogenous Mortality (MEM) safety principle (EN 50126-1, Clause D.3) 70 9 Guidance on the essentials for documented evidence or proof of safety (Safety case) .71 9.1 Introduction.71 9.2 Safety case purpose.72 9.3 Safety case scope
23、72 9.4 Safety case levels 72 9.5 Safety case phases 74 9.6 Safety case structure75 9.7 Safety assessment .78 9.7.1 The scope of the safety assessor .78 9.7.2 The independence of a safety assessor .78 9.7.3 Competence of the safety assessor79 9.8 Interfacing with existing systems79 9.8.1 Systems deve
24、loped according to the EN 50126-1 process 79 9.8.2 System proven in use79 9.8.3 Unproven systems.80 4 CLC/TR 50126-2:20079.9 Criteria for cross acceptance of systems .80 9.9.1 The basic premise.80 9.9.2 The framework 81 Annex A (informative) Steps of risk assessment process82 A.1 System definition 8
25、2 A.2 Hazard identification.83 A.2.1 Empirical hazard identification 83 A.2.2 Creative hazard identification83 A.2.3 Foreseeable accident identification.83 A.2.4 Hazards .84 A.3 Hazard log 86 A.4 Consequence analysis .87 A.5 Hazard control 87 A.6 Risk ranking88 A.6.1 Qualitative ranking.89 A.6.2 Sem
26、i-quantitative ranking approach89 Annex B (informative) Railway system level HAZARDs - Check lists .92 B.1 General.92 B.2 Example of hazard grouping according to affected persons94 B.2.1 C-hazards Neighbours group.94 B.2.2 C-hazards - Passengers group.95 B.2.3 C-hazards - Workers group.96 B.3 Exampl
27、e of functional based hazard grouping.96 Annex C (informative) Approaches for classification of risk categories 99 C.1 Functional breakdown approach (a).99 C.2 Installation (constituent) based breakdown approach (b) 99 C.3 Hazard based breakdown approach (c) .100 C.4 Hazard causes based breakdown ap
28、proach (d) 101 C.5 Breakdown by types of accidents (e) .102 Annex D (informative) An illustrative railway system risk model developed for railways in UK103 D.1 Building a risk model 103 D.2 Illustrative example of a risk model for UK railways.104 D.2.1 Modelling technology.104 D.2.2 Usage and constr
29、aints.105 D.2.3 Model forecasts .105 Annex E (informative) Techniques & methods 108 E.1 General.108 E.2 Rapid ranking analysis .109 E.3 Structured What-if analysis 109 E.4 HAZOP .110 E.5 State transition diagrams110 E.6 Message Sequence Diagrams .111 E.7 Failure Mode Effects and Criticality Analysis
30、 - FMECA .112 E.8 Event tree analysis .112 5 CLC/TR 50126-2:2007E.9 Fault tree analysis 113 E.10 Risk graph method .114 E.11 Other analysis techniques 115 E.11.1 Formal methods analysis 115 E.11.2 Markov analysis.115 E.11.3 Petri networks115 E.11.4 Cause consequence diagrams115 E.12 Guidance on dete
31、rministic and probabilistic methods115 E.12.1 Deterministic methods and approach115 E.12.2 Probabilistic methods and approach .116 E.13 Selection of tools & methods117 Annex F (informative) Diagramatic illustration of availability concept .119 Annex G (informative) Examples of setting risk acceptanc
32、e criteria 120 G.1 Example of ALARP application 120 G.2 Copenhagen Metro.123 Annex H (informative) Examples of safety case outlines .124 H.1 Rolling stock .124 H.2 Signalling 126 H.3 Infrastructure 128 Bibliography131 Figures Figure 1 Nested sy stems and hierarchy18 Figure 2 Definition of hazards wi
33、th re spect to a system boundary and likely accident.20 Figure 3 Sequence of occurrence of accident, hazard and cause21 Figure 4 Risk assessment flow chart .25 Figure 5 Hazard control flow chart . .26 Figure 6 Safety allocation process . .39 Figure 7 Factors influencing SI 41 Figure 8 Process for de
34、fining a code of practice for the control of random failures48 Figure 9 Process for defining a code of practise for the control of systematic faults 49 Figure 10 Differential risk aversion. .71 Figure 11 Safety case levels . 73 Figure A.1 Risk ranking for events with potential for significantly diff
35、erent outcomes 91 Figure D.1 Illustrative annual safety forecasts generated by an integrated risk model 106 Figure D.2 Illustrative individual risk forecasts generated by an integrated risk model 107 Figure E.1 State transit ion diagram Example .111 Figure E.2 Example of me ssage collaboration diagr
36、am111 Figure E.3 Example of consequenc e analysis using event tree113 Figure E.4 Fault tree analysis Example. .114 Figure F.1 Availability concept and related terms .119 Figure G.1 Risk areas an d risk reducing measures 121 Figure G.2 ALARP result s of options 1 to 4 123 6 CLC/TR 50126-2:2007 Tables
37、 Table 1 Cross-reference between certain life cycle phase activities and clauses of the report10 Table 2 Clauses of the re port covering scope issues .10 Table 3 Comparison of terms (duty holders). 13 Table 4 Structured approach to allo cation of SI (refer to 6.4.2.2) .43 Table 5 THR/SIL relationshi
38、p . .46 Table 6 Possible states of a fail safe system 53 Table 7 Approaches for system safety demonstration . .56 Table 8 Criteria for each of the risk acceptance principles .67 Table 9 List of EN 50129 clauses and their applicability for documented evidence to systems other than signalling 75 Table
39、 A.1 Example of frequency ranking scheme.89 Table A.2 Example of c onsequence ranking scheme .90 Table A.3 Risk ranking matrix90 Table B.1 Railway neighbour c-hazards .94 Table B.2 List railwa y passenger c-hazards . 95 Table B.3 List of railway worker c-hazards . 96 Table B.4 System level hazard li
40、 st based on functional approach97 Table D.1 Sample parametric dat a for a risk forecasting model .105 Table E.1 Failure and ha zard analysis methods .108 Table E.2 Example of a hazard-ranking matrix .109 Table E.3 Hazop guide words .110 Table G.1 Upper and lower ALARP limits . 123 7 CLC/TR 50126-2:
41、2007Introduction EN 50126-1 was developed in CENELEC under a mode 4 co-operation with CEN and is now regularly called up in specifications. In essence, it lists factors that influence RAMS and adopts a broad risk-management approach to safety. The standard also gives examples of some risk acceptance
42、 principles and defines a comprehensive set of tasks for the different phases of a generic life cycle for a total rail system. Use of EN 50126-1 has enhanced the general understanding of the issues involved in dealing with safety and in achieving RAMS characteristics within the railway field. Howeve
43、r, a number of issues have arisen that suggest that there are differences in the way that safety principles and/or requirements of this standard are being interpreted and/or applied to a railway system and its sub-systems. Therefore, the guidelines included are to remove such differences and to enab
44、le a coherent and pragmatic approach, within Europe, for setting safety targets, assessing risks and generally dealing with safety issues. The report is not intended to set any specific safety targets (which will remain the responsibility of the relevant regulatory authorities) but only to provide g
45、uidance on different methods that can be used for setting targets, assessing risks, deriving safety requirements, demonstrating satisfactory safety levels, etc., with examples, where appropriate. The responsibility for accepting the methods to be used and for setting targets remains with the Railway
46、 Authority (RA) in conjunction with the Safety Regulatory Authority (SRA). Furthermore the introduction of the proposed safety directive (European Directive on the development of safety on the Communitys railways through development of common safety targets and common safety methods) should lead to
47、a common safety regulatory regime within Europe. Such a regime will require that there is a common European approach to the methods for setting safety targets and for assessing risks. The Technical Report is intended to cover the full spectrum of railway systems and for use by all the different user
48、 groups of the standard EN 50126-1. User groups may be part of any of the different players (bodies/entities) involved during the life cycle phases of a system, from its conception to disposal. However, this Technical Report deals with only those items covered by the standard EN 50126-1 that are ide
49、ntified by the scope of work and with clarification of areas where EN 50126-1 could be misinterpreted. Clauses in the report are structured to cover clarifications of definitions and concepts and then to reflect the items in the scope and in order of the risk assessment process. But the contents are limited to include guidance and explan
