Guide for the application of the CSM design targets (CSM-DT) Annex 5 Example 1: Emergency brake control 29-30/11/2016, ERA workshop, Valenciennes Olivier CASTELLANI SNCF – Rolling Stock – Project Manager for High Speed Train international homologation

Summary System Definition of the technical system under assessment List of functions of the technical system under assessment Scope, assumptions and limits of the risk assessment Hazard Identification and classification Applicability of CSM DT Setting up of applicable category of CSM DT Allocated quantitative requirements, and alternative solutions or cases Conclusions from the risk assessment and allocation of CSM DT category

System Definition of the technical system under assessment Emergency brake triggered: In case of driver’s command In case of safety equipment command (e.g. ERTMS) The safety equipment monitor: Speed limitations Lineside signals Driver’s activity … The emergency brake command is sent to all actuators, which brake for each bogey/axle/wheel (e.g. through brake pads)

List of functions of the technical system under assessment The technical system under assessment is composed of 3 sub-functions: Issue the command (safety equipment, e.g. speed control, signal acknowledgment and obedience, …) Transmit the command to actuators Actuate the braking devices (braking blocks, magnetic braking devices, …)

Scope, assumptions and limits of the risk assessment Only safety equipment will be considered. It is considered that only one single type of safety equipment is active (e.g. either you are in ERTMS driving mode, or in KVB driving mode, both cannot be active at the same time). None of the “safety equipment” stated above are studied as individual safety equipment in this example. Only the technical components installed inside the rolling stock are considered in this function.

Hazard Identification and classification Functional FMEA Function Functional Failure modes Technical local consequence (Hazard) Consequences for train Emergency brake Does not start Emergency brake not issued No braking Starts when not asked to Inopportune emergency brake Train is stopped, operation is hindered Does not stop when asked to Emergency brake stays active Stops when not asked to Incomplete emergency brake Incomplete braking (braking distance not respected) Delay in response Delay in emergency braking Braking distance not respected Degraded output (e.g. wrong output value) Partial braking command

Hazard Identification and classification Extract of Functional FMEA (merge of identical Technical local consequence) Technical local consequence (Hazard) Consequences for train Potential accident Potential for at least 1 fatality? Accident limited to a specific area of the train Associated CSM-DT Emergency brake not issued No braking Collision, derailment Yes No 1,00E-09 Inopportune emergency brake Train is stopped, operation is hindered None (no safety impact, as long as no train is accepted to circulate on the line where this train is stopped) NA Emergency brake stays active Incomplete emergency brake Braking distance not respected Delay in emergency braking Partial braking command

Applicability of CSM DT Extract of Functional FMEA (merge of identical Technical local consequence) Technical local consequence (Hazard) Consequences for train Potential accident Potential for at least 1 fatality? Direct consequence? Emergency brake not issued No braking Collision, derailment Yes Inopportune emergency brake Train is stopped, operation is hindered None (no safety impact, as long as no train is accepted to circulate on the line where this train is stopped) NA Emergency brake stays active Incomplete emergency brake Braking distance not respected Delay in emergency braking Partial braking command CSM-DT not applicable

Setting up of applicable category of CSM DT Extract of Functional FMEA (merge of identical Technical local consequence) Technical local consequence (Hazard) Consequences for train Potential accident Potential for at least 1 fatality? Accident limited to a specific area of the train Associated CSM-DT Emergency brake not issued No braking Collision, derailment Yes No 1,00E-09 Incomplete emergency brake Braking distance not respected Delay in emergency braking Partial braking command As “Braking distance not respected” is largely dependent on the train (e.g. number of bogeys), this example will focus on “No braking”

Allocated quantitative requirements, and alternative solutions or cases Solution 1 : “simple” design based on the use of one technical system The components Q(ECH)URG, RB(IS)Q(ECH)URG and VE-URG are components already used in other trains, and thus whose failure rate is known The CSM-DT cannot be reached with this solution 1 => solution rejected ≈10-7 / h >> 10-9 / h

Allocated quantitative requirements, and alternative solutions or cases Solution 2 : duplication of solution 1 (redundancy) The CSM-DT can be reached with this solution 2 => solution acceptable Is it necessary to duplicate all components? (e.g. safety equipment which are already at 10-9 / h) λ ≤ 10-9 / h & λ ≈ 10-7 / h

Allocated quantitative requirements, and alternative solutions or cases Solution 3 : solution 1 taking into account lineside signalling The CSM-DT can be reached with this solution 3 => solution acceptable However, mutual recognition not assured, and only applicable in presence of lineside signaling λ ≈ 10-9 / h & λ ≈ 10-7 / h

Conclusions from the risk assessment and allocation of CSM DT category Allocation of CSM-DT has allowed to cancel one of the possible designs 2 other designs are possible: Train which may operate in several countries => use solution 2 Train which will use lineside signaling, and only operate in a single country (or mutual recognition of the driver’s “efficiency” between the countries where the train will operate) => use solution 1, which is less expensive However, if later operation in another country is studied, cross acceptance is not assured CSM-DT, if used in early design, will impact the design choices, including depending on the project’s strategy (multiple countries? Lineside signaling? Type of safety equipment? …)

Thank you for your attention! Questions? For further information, visit our website: www.cer.be 