1. ECM revision working party Safety critical components Introduction
J-M Dechamps, Safety Unit

2. Key topics Purpose of the presentation
Introduce ‘safety critical components’
Provide some elements for defining safety critical components
Key points of the presentation
Legal base
Way the Agency proceeded
Summary of key contributions
What is a component?
What could mean criticality?

3. 1. Legal base: Agency Regulation
Agency Regulation 2016/796: Art 19 (l):
“The Agency shall: …
(l) address, where appropriate, recommendations to the Commission in relation to safety-critical components.”
Remark: Different but complementary to art 19(k) related to Interchangeable Spare parts.
(k) address recommendations to the Commission in relation to harmonised standards to be developed by European standardisation bodies and standards relating to interchangeable spare parts which may improve the level of safety and interoperability of the Union rail system;
Conclusion: No definition of safety critical components.

4. 1. Legal base: Interoperability Directive
‘Annex III: Essential requirement
1. General
1.1 safety
The design, construction or assembly, maintenance and monitoring of safety-critical components, and more particularly of the components involved in train movements, must be such as to guarantee safety at the level corresponding to the aims laid down for the network, including those for specific degraded situations.’
Conclusion: No definition of safety critical components but components involved in train movement are included.

5. 1. Legal base: Safety Directive (1)
Article 29
Report and further Union action By 16 December 2017, the Commission shall report to the European Parliament and to the Council on the actions taken with a view to achieving the following objectives:
(a) the obligation for manufacturers to mark with an identification code the safety-critical components circulating on the European rail networks, ensuring that the identification code clearly identifies the component, the name of the manufacturer and the significant production data;
(b) the full traceability of the safety-critical components, the traceability of their maintenance activities and the identification of their operational life; and
(c) the identification of common mandatory principles for the maintenance of those components.
Conclusion: No definition of safety critical components but European Commission must report! And railway actors must take actions.

6. 1. Legal base: Safety Directive (2)
“ANNEX III
Requirements and assessment criteria for organisations applying for an ECM certificate or for a certificate in respect of maintenance functions outsourced by an entity in charge of maintenance
10. Maintenance activities — a structured approach to ensure:
— that all maintenance activities affecting safety and safety-critical components are identified and correctly managed and that all the necessary changes to those maintenance activities affecting safety are identified, properly managed based upon the return of experience and the application of Common Safety Methods for risk assessment in accordance with point (a) of Article 6(1) and properly documented;…”
Conclusion: No definition of safety critical components but ECM is in charge to manage maintenance activities related to safety critical components.

7. 1. Legal base: Conclusions
No definition of safety critical components nor common understanding.
 1st priority: Propose a common definition or common understanding
Agency and European Commission (EC) must take initiatives and report on initiatives.
Maintenance of safety critical components is a duty of ECM
 Profit of revision of ECM certification to identify common maintenance principles.

8. 2. Way the Agency has proceeded
Informal requests in July 2016 for contributions to CEN/CENELEC, 1 voluntary ECM, 1 voluntary IM.
Requests to NSAs and ECM certification bodies in September 2016 for national rules/practises
Contributions from 8 NSAs: Netherlands, UK, Germany, Ireland, Spain, Sweden, Italy, Romania.
Contributions from 1 Austrian accredited certification body.
Request to RBs after presentation in NRB meeting in December 2016.
Comparison with Civil aviation: CS-25: Certification specifications and Acceptable Means of compliance for Large Aeroplanes (Amendment 18 of 22/06/2016).
CS Equipment, systems and Installations. (subpart F -Equipment page 165)
AMC System design and Analysis (page 679)
The Agency issued a preliminary report in December 2016 addressed to the EC, RISC and to the ECM revision working party (see extranet)

9. 3. Summary of key contributions (1)
Economic: No additional administrative burden on railway actors nor additional cost.
Components
Components used in the functions: ‘Guiding the train’, ‘transmit the braking’, ‘doors management’ seem to be good candidates to the status safety critical.
Components should also include materials, tools and equipments used for maintenance
Predefined list
In some MS, there are predefined lists of safety critical components in national rules or in national standards or in national technical documents. Generally, those lists are considered as non- exhaustive by national authorities. Added value but informing?

10. 3. Summary of key contributions (2)
Predefined list
A list of obvious components like wheelsets for which there is no discussion would remain very limited. For instance, for the component ‘suspension spring’, it is less obvious because it depends firstly on the mechanical architecture ensuring the function ‘guiding the train’.
Process approach: Components should be categorised as safety critical as output of a commonly agreed process applied to all train and infrastructure components. This process must still be defined and be risk-based.

11. 3. Summary of key contributions (3)
Safety criticality = function (design, operational context, environment, safety objectives, maintenance context, changes, time)
Therefore an exhaustive predefined list is impossible to achieve. A good approach could be to impose to RUs and ECMs to implement a process of identifying those components.
For maintainers criticality of components depends also of the necessary skills for technicians/workers to inspect, check and take decisions for continuing use or replacing. For instance, NDTs impose specific skills and a hierarchical control of continuous suitability of the testing methods and process.
Statistics of incidents and accidents and more generally safety performance may also be used for defining criticality. In one MS, those statistics have been used by authorities

12. 3. Summary of key contributions (3)
Economic aspects. Criticality should also be linked to economic aspects. In railway a train is considered as safe if it is stopped (except in winter conditions or hot summer when it is stopped for a long time in the middle of nowhere). Delays in traffic should also be considered as element influencing the criticality. For instance recurrent unavailability may lead to short-cuts in operational process.
Enlarge perspective: PrEN 50126:2015 parts 1 and 2 (RAMS analysis), civil aviation approach (CS 25), other industrial standards such as IEC 61508:2010 , methodology such as FMECA should be considered. Approach used in nuclear and chemical industrial sector (‘SEVESO’) may also be considered.
CS25 = Certification Specifications and Acceptable Means of Compliance for Large Aeroplanes (EASA Amendment 18 of 22 June 2016)
IEC 61058:2010: Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems (E/E/PE, or E/E/PES).
FMECA : Failure Mode, Effects, and Criticality Analysis

13. 4. What is a component?
Functions (e.g. braking) are materialised by technical systems
A technical system may be composed of technical subsystems that are composed of basic elements: Components and connections
For E/E/PE technical systems: Basic components may be chips (themselves composed of transistors), electrical devices (e.g. switch), electronic components ( e.g. condensators), wires, cardboard and … software. To assemble all those basic components: Complex architecture.
When the architecture of technical systems become more complex, it becomes difficult to consider individually all the basic components
Proposal for common understanding: To cope with complexity aspects, the term ‘components‘ in ‘safety critical components’ within the EU railway legal framework means:
A technical system performing a function (at least); or
A technical subsystem performing a subfunction when the combination of subfunctions cover a function; or
an individual basic component when it is convenient for (mechanical) systems with low complexity.

14. 5. What could mean criticality? (1)
There are various approach. Here are some examples
‘Criticality by danger’: “A single failure (hazard) of a technical system leads to a catastrophic accident (effect)”.
- Main disadvantage: It may lead to non-sustainable additional cost when the failure is unlikely
‘Criticality based on risk evaluation’:
Risk : Likelihood X severity
Likelihood is also dependant of barriers (preventing)
Severity is also dependant of mitigating measures
Considered as critical when high likelihood and low severity or low likelihood and high severity.

15. 5. What could mean criticality? (2)
Approach FMECA (Failure Mode, Effects and Criticality Analysis) used, among other, in EN IEC and CS 25.
Criticality = D* L *S
D: Detection possibility of (precursors to) failure mode,
L: Likelihood,
S: Severity of the effects (consequences)
Detection possibility may be defined in 4 levels:
1 evident: Automatic alarm or information system
2 possible: Need intervention of a person (technical inspection, maintenance staff, driver, on-board staff)
3 Probable: Needs a dismounting or a specific testing system (NDTs in maintenance) )
4 impossible: No possibility of any detection before failure.
Note: This slide presents a voluntary simplified approach for non-specialists.

16. 5. What could mean criticality? (3)
‘Criticality in operation’
Insufficient staff awareness of limits of technical control systems.
necessary staff expertise to apply mitigating measures.
‘Criticality in maintenance’:
Criticality may depend also on
performing maintenance tasks;
Controlling maintenance tasks;
taking decisions (return to operation, repair, replace)
Organisation of ECM
- Control of tools (e.g. calibration)