1. Guide for the application of the CSM design targets (CSM-DT)
Annex 5 Example 4: Transmission of traction and brake command
29-30/11/2016, ERA workshop, Valenciennes
Marc GEISLER
DB AG, DB Systemtechnik, Head of Safety and Risk Assessment

2. Introduction / Disclaimer
The example focusses only on the application of CSM-DT at a RST project.
Before applying the CSM-DT,
the significance of the change was assessed,
it was decided that the risks are not broadly acceptable and
that the hazards are to be controlled by “explicit risk estimation”.
Disclaimer
The illustrated example does not contain all details. It cannot thus be fully comprehensive. Several assumptions are taken to show how the allocation of CSM-DT can be done. In a real system, much more influencing parameters, scenarios and interactions must be considered in order to finally derive a complete and consistent set of safety requirements. The resulting figures and quantitative outcomes are thus purely fictive.
The design of the technical system is carried out in compliance with specific safety and quality processes, commensurate with the allocated CSM-DT class/category, to control appropriately the systematic failures. Moreover the safe integration is not considered in the example.

3. Summary System Definition of the technical system under assessment
List of functions of the technical system under assessment
Hazard Identification and classification
Allocation of CSM DT
Consideration of existing Safety Barriers
Conclusions from the risk assessment and allocation of CSM DT

4. 1. System Definition of the technical system under assessment (1/2)
Function under assessment „Transmit traction and brake demand“
The Master Controller is a control element used by the operator to activate the driving cab, define the direction of movement and set a throttle notch position
The cab is activated by the operator when inserting a key into the controller. The key must be moved forward or backward to set a direction of motion. There is a throttle handle which controls 8 power levels delivered to traction motors. Moving the throttle handle forwards gives traction power while moving the handle backwards gives a dynamic brake effort.

5. 1. System Definition of the technical system under assessment (2/2)
The technical function comprises a lot of sub-functions. The presented example considers only a part of all elements.
Only the functionality of the Master Controller used to control the traction demand requested by the train driver is considered within the example.
The status of the train direction control switch is defined based on information from interfaces 1 to 4.

6. 2. List of functions of the technical system under assessment
The function “F1 Define Set Point” has interfaces to “T_direction control switch”, “T_onboard network” and “S_status direction control switch” for receiving or sending information (data transfer).
The results of the assessment of the failure modes and the resulting 5 hazards are
Untimely traction demand and
Strong jerk
Function
Interface
Source
Information
Target
Transmit traction and brake demand 1
T_Master controller
I_Throttle 1-8
F1 Define set point 2
T_direction control switch
I_V oder R 3
T_onboard network
I_74 V 4
I_traction set point
S_status direction control switch

7. 4. Hazard Identification and classification
Inter-face
Source
Information
Target
Failure mode
Hazard
Classification 1
T_Master controller
I_Throttle 1-8
F1 Define set point
Set point is not defined
No traction demand
No safety consequences
Set point is defined continuously
Untimely traction demand
Safety consequences possible (Haz1) 2
T_direction control switch
I_V oder R
Safety consequences possible (Haz2)
Set point is defined wrongly
Wrong side movement
Not considered in the specific situation 3
T_onboard network
I_74 V
Safety consequences possible (Haz3) 4
I_traction set point
S_status direction control switch
Safety consequences possible (Haz4)
Set point is defined too high
Strong jerk
Safety consequences possible (Haz5)
Set point is defined too low
No sufficient acceleration

8. 4. Allocation process for CSM-DT – as defined in reg
4. Allocation process for CSM-DT – as defined in reg. 2015/1136 for Hazard 1
given
given
given
given

9. 4. Allocation process for CSM-DT – as defined in reg
4. Allocation process for CSM-DT – as defined in reg. 2015/1136 for Hazard 4
given
given
not given,
because of specific
operational
pre-conditions
given

10. 4. Justification of allocation for Hazard 4
Affected People
The parameter „Large number of people is affected“ is fulfilled.
The parameter resulting in „Multiple Fatalities“ is not fulfilled.
Both parameter are linked by an „AND“-gate  both parameter must be true.
1E-9
1E-7
Def. (23) & §2.5.5(a)
number
of people
Large
???
case a
Def. (35) & §2.5.5(b)
Very small
number
of people
If only a very small number of people is affected, multiple fatalities
cannot result
case b
Resulting
Severity
At least one fatality
Multiple fatalities
Only for hazard 1 the most demanding design target is required as the untimely traction demand could lead to overspeed and resulting in a collision or derailment and therefore resulting in a large number of fatalities. For hazard 4 specific scenarios are assumed, that the speed is that low, that the consequences are limited.
Applying the pairwise comparison the resulting requirement is 1E-7 as the resulting risk is much lower than in case (a) but comparable with case (b).

11. 4. Allocation of CSM DT for each hazard taking into account “direct”, “affected” and “severity”
Initial Allocation by Proposer‘s team
Haz
Credible potential for direct consequences?
Accident typically results in at least one fatality
Typically a large number of people is affected?
Accident typically results in multiple fatalities?
CSM-DT 1
yes
1E-9 2 no
N/A
1E-7 3 4 5
Classification
by ERA
Haz
Credible potential for direct consequences?
Typically a large number of people is affected?
Accident typically results in multiple fatalities?
Typically a very small number of people is affected?
Accident typically results in at least one fatality
CSM-DT 1
yes no
N/A
1E-9 2
1E-7 3 4 5

12. 5. Consideration of existing Safety Barriers
The overall safety requirement of the function “transmit traction and brake demand” needs to take into account the operational specificities, such as the active barriers, the operational conditions, the operational rules etc.
A single failure of the Master Controller does not directly lead to an accident.
A less demanding safety requirement can be setup for the Master Controller than for the overall “transmit traction and brake demand” function…

13. 5. Consideration of existing Safety Barriers
The following barriers can prevent the failure of the Master Controller to result directly in the identified accident :
two independent Brake Pressure Sensors (if braking is used, then the pressure will be detected, and the traction will be cut off automatically);
Brake Controller and Power Supply (the brake controller cuts automatically (via the power supply contactor) the traction when a pressure sensor detects a braking).
For the purposes of the example,
it is assumed that :
the Brake Pressure sensors work with a safety performance of 90%, and
the Brake Controller and the Power Supply work with a safety performance of 50%

14. 6. Conclusions from the risk assessment and allocation of CSM DT
The allocation of CSM-DT is depending on influencing pre-conditions regarding
System Surrounding
Operation
External Safety Barriers
For one Main Function the allocation of CSM-DT to its Sub Functions can result in different classes
In case external Safety Barriers exist, the initially allocation design requirement can be lowered, mutual recognition is not automatically given in that case.
There is no overlap between the defined classes of CSM-DT
The applicability of CSM-DT has been proven!
CSM-DT, if used in early design, will impact the design choices, including depending on the project’s strategy

15. Thank you for your attention!
Questions?
For further information,
visit our website: 