RECOMMENDATION FOR USE RFU RST 082

Transcription

1 RFU RST 082 Page 1 of 5 TITLE APPLICATION OF CSM IN THE FRAMEWORK OF THE EC VERIFICATION PROCEDURE SCONRAIL LTD. ORIGINATOR SUBJECT RELATED TO TSI CR LOC&PAS (2011/291/EU) Scope Interpretation of the requirements for the DESCRIPTION AND BACKGROUND EXPLANATION assessor s report in accordance with the CSM to be integrated into the technical file, NoBo activities under TSI CR LOC&PAS 2011/291/EU. It has been brought to the attention of the NoBos that Chapter and of the TSI are difficult to interpret. The requirements of the TSI have been reviewed, see attachment. Conclusion 02/10/2013 Attachment: RFU PROPOSAL The responsibility of setting requirements for the assessment for the Open Points, including those connected to Safety Related Functions as mentioned in TSI LOC-PAS 2011/291/EU , lies with the Member States. The NoBo activities under 2008/57/EC are limited to including the CSM-AB report (only for the items explicitly required by the TSI) into the Technical File (see RFU-RST-011). If the NoBo acts as TSI-AB under TSI LOC-PAS 2011/291/EU , it shall apply the same methodology as defined in CSM-RA 352/2009 for CSM-ABs. DATE OF AGREEMENT AT NB RAIL PLENARY MEETING Introduction COMMISSION DIRECTIVE 2011/18/EU of 1 March 2011 amending Annexes II, V and VI to Directive 2008/57/EC defines in ANNEX III ( ANNEX VI ) VERIFICATION PROCEDURE FOR SUB: 2.4. Technical file The technical file accompanying the EC declaration of verification must contain the following:

2 RFU RST 082 Page 2 of 5. when safe integration is required pursuant Commission Regulation (EC) No 352/2009 (1), the applicant shall include in the technical file the assessor s report on the Common Safety Methods (CSM) on risk assessment referred to in Article 6(3) of Directive 2004/49/EC. The COMMISSION REGULATION (EC) No 352/2009 of 24 April 2009 CSM for risk evaluation and assessment as referred to in Article 6(3)(a) of Directive 2004/49/EC of the European Parliament and of the Council defines in Article 6 Independent assessment : 1. An independent assessment of the correct application of the risk management process described in Annex I and of the results of this application shall be carried out by a body which shall meet the criteria listed in Annex II. Where the assessment body is not already identified by Community or national legislation, the proposer shall appoint its own assessment body which may be another organisation or an internal department. (CSM-AB) 2. Duplication of work between the conformity assessment of the safety management system as required by Directive 2004/49/EC, the conformity assessment carried out by a notified body or a national body as required by Directive 2008/57/EC and any independent safety assessment carried out by the assessment body in accordance with this Regulation shall be avoided. Discussion It is the task of the NoBo to verify, that the respective requirements in the TSIs are fulfilled. Section further defines the safety aspects, which have to be assessed by appropriate methods (broken down for ease of reference into subsections A,B,C..): A) The functions that contribute to meet the essential requirements safety are identified in Section 3.2 of this TSI. (Note: this section refers to the content of Section 4) B) Most of the safety requirements related to these functions are covered by the technical specifications expressed in Section 4.2 (e.g. passive safety, wheels ). C) For the following safety related functions, the technical specifications need to be completed by requirements expressed in terms of safety requirement, for which the demonstration of compliance may use the principles described in the CSM on RA (similarity with reference system(s), application of codes of practice, probabilistic approach): Dynamic behaviour (when active control is utilised), as specified in clause Emergency braking performance (including traction cut off), as specified in

3 RFU RST 082 Page 3 of 5 clause , clause and clause ; the safety requirements are specified in clause Parking braking, as specified in clause , clause and clause ; the safety requirements are specified in clause Brake state and fault indication, as specified in clause Passenger alarm, as specified in clause Control of passenger exterior doors, as specified in clause Electric power supply cut off, as specified in clause Driver s activity control, as specified in clause Fire barriers (other than full cross section partitions), as specified in clause D) Where these functions, identified as safety related, have their safety aspects not sufficiently covered, or no safety specified, this is identified as an open point in the corresponding clause specifying the function. E) Software which is used to fulfil safety related functions shall be developed and assessed according to a methodology adequate for safety related software. F) This applies to software which has an impact on functions identified as safety related in the Section 4.2 of this TSI. Further section applies: Braking Safety requirements (clause ) The demonstration of compliance with the safety requirements expressed in the table 6 of the clause shall be performed as follows:... Note: When defining the test and maintenance requirements, the safety level to be met has to be taken into account by the applicant (consistency); the demonstration of compliance covers also test and maintenance requirements.... All assumptions considered for the mission profile shall be clearly documented in the demonstration. The compliance with the requirement specified for the hazards No 1 and No 2 of the table 6 in clause shall be demonstrated by one of the two following methods: 1. Application of a harmonised criterion expressed in a tolerable hazard rate of 10-9 per hour The applicant shall demonstrate compliance with the harmonised criterion by

4 RFU RST 082 Page 4 of 5 applying Annex I-3 of the CSM on RA. The following principles may be used for the demonstration: similarity with reference system(s); application of codes of practice; application of the probabilistic approach. The applicant shall designate the assessment body supporting the demonstration he will provide: notified body selected for the RST subsystem (OPTION 1a) or assessment body as defined in the CSM on RA (OPTION 1b). The assessment shall be documented in the EC certificate issued by the notified body (OPTION 1a), or in the EC declaration of verification issued by the applicant (OPTION 1b). or 2. Application of a risk evaluation and assessment in accordance with the CSM on RA. (OPTION 2) The EC declaration of verification shall mention the use of this method.... As many applicants feel a difficulty in interpreting the above requirements, the following clarifications are considered: 1) A Safety Related Function is typically implemented by technical functions (e.g. mechanical, electrical, electronical, software) or by procedural means and usually specifically adapted to its operating environment. Section requires the establishment of certain additional safety requirements for design/ validation/ verification/ testing/ operation/ maintenance of Safety Related Functions. These shall be additional to those defined inside the TSI. This concept is well understood by the industry and NoBos, as an individual design solution for a Safety Related Function may require the fulfilment of specifically adapted Safety Requirements. (Refer to EN 50126/ 50128/ 50129/ for more information and guidance) 2) It is understood by the definition in subsection D that any additional safety requirement is automatically defined as an Open Point and therefore not intended to be in the scope of assessment of a NoBo. 3) It is further understood by the definition in subsection E&F that if software is used within the Safety Related Functions - as defined in subsection D - an adequate methodology must be applied at design and assessment. As subsection

5 RFU RST 082 Page 5 of 5 E&F relate to subsection D, this is likewise not intended for the scope of NoBo activities. 4) In relation to section there are three options defined: OPTION 2 uses the CSM-RA approach, assessment by an CSM-AB, evidence to be documented by the applicant as part of the EC Declaration as defined by Directive 2008/57/EC Annex VI clause 2.4 (as amended by 2011/18/EU). OPTION 1b uses an alternative approach to CSM-RA, assessment by an CSM- AB, evidence to be documented by the applicant as part of the EC Declaration as defined by Directive 2008/57/EC Annex VI clause 2.4 (as amended by 2011/18/EU). OPTION 1a uses an alternative approach to CSM-RA, assessment by a NoBo, evidence to be documented by the NoBo as part of the EC Certification in connection with RFU-STR-011 within the Technical File. In this case the NoBo acts as a TSI-AB (under the scope of clause ). The procedures defined by the CSM-RA for the CSM-AB shall be considered as being likewise applicable to the TSI-AB. 5) Note: The listings of Standards for voluntary application by Applicant and NoBo as provided in: the Official Journal of European Union the ERA User Guides for some TSIs the ERA List of applicable Standards for other TSIs may include standards (namely EN 50126, 50128, 50129, 50159) which address the issue of adequate methodology for design and assessment of Safety Related Functions, including the application of software. This must however be understood in the context of TSI CR LOC&PAS 2011/291/EU clause and is therefore in not considered relevant to the scope of activities of a NoBo.