1. Guide for the application of the CSM design targets (CSM-DT)
Annex 5 Example 1: Emergency brake control
29-30/11/2016, ERA workshop, Valenciennes
Olivier CASTELLANI
SNCF – Rolling Stock – Project Manager for High Speed Train international homologation

2. Summary System Definition of the technical system under assessment
List of functions of the technical system under assessment
Scope, assumptions and limits of the risk assessment
Hazard Identification and classification
Applicability of CSM DT
Setting up of applicable category of CSM DT
Allocated quantitative requirements, and alternative solutions or cases
Conclusions from the risk assessment and allocation of CSM DT category

3. System Definition of the technical system under assessment
Emergency brake triggered:
In case of driver’s command
In case of safety equipment command (e.g. ERTMS)
The safety equipment monitor:
Speed limitations
Lineside signals
Driver’s activity …
The emergency brake command is sent to all actuators, which brake for each bogey/axle/wheel (e.g. through brake pads)

4. List of functions of the technical system under assessment
The technical system under assessment is composed of 3 sub-functions:
Issue the command (safety equipment, e.g. speed control, signal acknowledgment and obedience, …)
Transmit the command to actuators
Actuate the braking devices (braking blocks, magnetic braking devices, …)

5. Scope, assumptions and limits of the risk assessment
Only safety equipment will be considered.
It is considered that only one single type of safety equipment is active (e.g. either you are in ERTMS driving mode, or in KVB driving mode, both cannot be active at the same time).
None of the “safety equipment” stated above are studied as individual safety equipment in this example.
Only the technical components installed inside the rolling stock are considered in this function.

6. Hazard Identification and classification
Functional FMEA
Function
Functional Failure modes
Technical local consequence
(Hazard)
Consequences for train
Emergency brake
Does not start
Emergency brake not issued
No braking
Starts when not asked to
Inopportune emergency brake
Train is stopped, operation is hindered
Does not stop when asked to
Emergency brake stays active
Stops when not asked to
Incomplete emergency brake
Incomplete braking (braking distance not respected)
Delay in response
Delay in emergency braking
Braking distance not respected
Degraded output (e.g. wrong output value)
Partial braking command

7. Hazard Identification and classification
Extract of Functional FMEA (merge of identical Technical local consequence)
Technical local consequence
(Hazard)
Consequences for train
Potential accident
Potential for at least 1 fatality?
Accident limited to a specific area of the train
Associated CSM-DT
Emergency brake not issued
No braking
Collision, derailment
Yes No
1,00E-09
Inopportune emergency brake
Train is stopped, operation is hindered
None (no safety impact, as long as no train is accepted to circulate on the line where this train is stopped) NA
Emergency brake stays active
Incomplete emergency brake
Braking distance not respected
Delay in emergency braking
Partial braking command

8. Applicability of CSM DT
Extract of Functional FMEA (merge of identical Technical local consequence)
Technical local consequence
(Hazard)
Consequences for train
Potential accident
Potential for at least 1 fatality?
Direct consequence?
Emergency brake not issued
No braking
Collision, derailment
Yes
Inopportune emergency brake
Train is stopped, operation is hindered
None (no safety impact, as long as no train is accepted to circulate on the line where this train is stopped) NA
Emergency brake stays active
Incomplete emergency brake
Braking distance not respected
Delay in emergency braking
Partial braking command
CSM-DT not applicable

9. Setting up of applicable category of CSM DT
Extract of Functional FMEA (merge of identical Technical local consequence)
Technical local consequence
(Hazard)
Consequences for train
Potential accident
Potential for at least 1 fatality?
Accident limited to a specific area of the train
Associated CSM-DT
Emergency brake not issued
No braking
Collision, derailment
Yes No
1,00E-09
Incomplete emergency brake
Braking distance not respected
Delay in emergency braking
Partial braking command
As “Braking distance not respected” is largely dependent on the train (e.g. number of bogeys), this example will focus on “No braking”

10. Allocated quantitative requirements, and alternative solutions or cases
Solution 1 : “simple” design based on the use of one technical system
The components Q(ECH)URG, RB(IS)Q(ECH)URG and VE-URG are components already used in other trains, and thus whose failure rate is known
The CSM-DT cannot be reached with this solution 1 => solution rejected
≈10-7 / h
>> 10-9 / h

11. Allocated quantitative requirements, and alternative solutions or cases
Solution 2 : duplication of solution 1 (redundancy)
The CSM-DT can be reached with this solution 2 => solution acceptable
Is it necessary to duplicate all components? (e.g. safety equipment which are already at 10-9 / h)
λ ≤ 10-9 / h
&
λ ≈ 10-7 / h

12. Allocated quantitative requirements, and alternative solutions or cases
Solution 3 : solution 1 taking into account lineside signalling
The CSM-DT can be reached with this solution 3 => solution acceptable
However, mutual recognition not assured, and only applicable in presence of lineside signaling
λ ≈ 10-9 / h
&
λ ≈ 10-7 / h

13. Conclusions from the risk assessment and allocation of CSM DT category
Allocation of CSM-DT has allowed to cancel one of the possible designs
2 other designs are possible:
Train which may operate in several countries => use solution 2
Train which will use lineside signaling, and only operate in a single country (or mutual recognition of the driver’s “efficiency” between the countries where the train will operate) => use solution 1, which is less expensive
However, if later operation in another country is studied, cross acceptance is not assured
CSM-DT, if used in early design, will impact the design choices, including depending on the project’s strategy (multiple countries? Lineside signaling? Type of safety equipment? …)

14. Thank you for your attention!
Questions?
For further information,
visit our website: 