Common Cause Failures (CCF)

Special precautions have to be taken against common cause failures.

It is a single failure that causes a safety function to collaps e.g. a mechanical or logic error in a product as shown below in Figure A.7 from EN 50129.

It can be handled by using redundant systems, inherited charactheristics of components, safety analysis, independent reviews, FRACAS system, etc.



Interpretation

Common causes failures can e.g. be a sleeping tricky error in Function A that cause a dramatic failure in Function B.
If we have installed hundreds of systems we have a possibly accident.

Train fleet example:

Let’s say the developer of a diesel traction system in a train uses the exhaust gas to power a turbo. The turbo powers an air inlet compressor. The compressed air enters the combustion chamber.
A hose clamp on the air tubes are under dimensioned, nevertheless the design passes design reviews and burn-in tests.
The hose clamp is slowly loosened during operation and this causes a decrease of air in the combustion chamber that again causes an overheated exhaust gas that again causes the turbo to overheat and crack and finally cause an oil leakage in the turbo driven power transmission to the compressor located near the exhaust pipe.
The operational staff reports of occasional small fires in the turbo driven power transmission, the maintenance staff discovers the cracked turbo, and it is concluded that cracked turbo's must be changed.
In this case we have an undisclosed common cause failure in the train fleet (the loose hose clamp).
One day, under the right circumstances, the oil leakage will cause a larger fire. If the daily train route furthermore passes a tunnel we might end up with a "fire in train in tunnel" scenario.

Interlocking logic example:

See "Quick guide to safety management based on EN50126"

Next chapter >> 4.6 Safety Integrity Levels (SIL)

Focus on the Source

See "Quick guide to safety management based on EN50126"



Read more...

How to choose an Assessor

The 1'st and 2'nd part in a railway contract can hire an assessor:

- The 1'st part will typically be a supplier, who wants to develop a railway system (a train, a level crossing, an LED lamp etc.) and
- The 2'nd part will typically be an Operator or Infrastructure owner, who wants to buy a railway system.

It is recommendable to choose an assessor in corporation with the Safety authority.

Interpretation

The assessor should have the capacity to perform the required assessor tasks.

The assessor should have the needed independency.

The assessor should have the needed competence.

There can be many candidates.

Please note an approval of a product can be parted into Generic Product (GP), Generic Application (GA) and Specific Application (SA).

Each approval step can have different assessors.

Add 1) For the GP it might be beneficial to use internal assessors as far as possible. If this is not accepted by the relevant safety authority, an external assessor can be hired to ensure the independency.

Add 2) For the GA and SA it might be beneficial to choose a local assessor or someone who is accepted by the local Safety Authority.

Add 3) For the SA it might only be necessary with an assessor for the first installed site.

Focus on the sources (EN 50129:2003)

See "Focus on the sources" in the referenced links.



Read more...

How does the Notified Body fit in?

The Notified Body (NB) is an independent role which is similar to the independent assessor role, but the NB role belongs to the European Interoperability Directives for the TEN network and not to EN 50126. The vision of the interoperability directives is to achieve a free european market and achieve that a train, with the same train driver, can drive from Finland to Italy.

Interoperability

The concept of interoperability is defined in European Directives.
A underlaying documentation layer of Technical Specification for Interoperability, also named "TSI"'s, are affiliated to the directives.

The interoperability concept concerns all the technical functions, which must be implemented in the infrastructure and in the train fleets in order to achieve interoperability.
An example of TSI functionality is the ERTMS/ETCS system. It transmits the signal aspect of the signals into a speed mark at the speedometer of the train. Hereby, it is superfluous for the train drivers to know the signalling aspects in the country the train passes, because the train driver can rely on the mark at the speedometer.
Another example of TSI functionality is the diameter of the toilet flushing pipe. This diameter must have a certain value in order to ensure that the toilet can be emptied in any country.

A Notifed Body is an organization, which makes a Certificate of conformaty of a train or an infrastructure system against the TSI's.

The NB's are appointed by the national safety authority. There are a number of requirements to an organization before it can be appointed as a NB, e.g. it must prove it's independency, it must have the needed technical knowledge and capacity within the scope of the TSI's and it should participate in the standardization work of the Cenelec standards.

Therefore,
- the NB performs an independent assessment of the interoperability functionality against the TSI's and
- the assessor performs an independent assessment of the RAMS management against EN 50126.

It is often seen that a NB works as an independent assessor on railway projects, because they have the independency, capacity and knowledge to be an assessor.

Focus on the sources (Interoperability directives)

The European directives of Interoperability (96/48/EF, 2001/16/EF and 2004/50/EF) are parted into a directive for high-speed trains and for conventionel trains.



Read more...

When is the Assessor independent?

The Assessor should be independent from the Supplier and Customer of the product. The needed "Degree of economical and organizational Independency" is decided by the Safety Authority.



As it can be seen above, from Figure 6 in EN50129:2003, the Assessor can not be a part of the same organisation, in which the Project Manager, Designer, Implementer, Verifier or Validator belongs.

Interpretation

The idea of complete "independence" should be substituted with the more flexible concept: "The degree of economical and organizational independence". This concept can furthermore be simplified in to whether it should be in-house or external assessment.

The in-house assessment-divisions are - due to historical reasons - organizations placed inside the large suppliers e.g. Siemens, Bombardier, Alstohm, Alcatel. Because they are organizations inside the suppliers, they have a low "degree of economical and organizational independence". Nevertheless, the Safety Authorities often allows these divisions as Assessors, because they trust the in-house assessment:

1. The in-house assessment-divisions have a high technical knowledge of the products,
2. the entire reputation of the companies depend on their integrity and
3. the alternative external Assessor-companies are just the same paid by the suppliers, which undermines their independence.

External assessment can be performed by inspection companies like DNV, Lloyds and Tüv, which have a high degree of economical and organizational independency, because they do not have any shareholders, but are owned by a foundation.
Another alternative could be the Advisors like Atkins, which have shareholders, but still have a high degree of economical and organizational independence from the traditionally railway Suppliers, Infrastructure owners and Operators.

As a guideline to the minimum needed degree of independence the following criteria can be used: What is the SIL-level of the products safety functions? And how complex is the Project? This interpretation is shown in the table below.

For SIL1/2 or simple projects, the degree of independence it not so important for the safety. In these cases it is often more convenient (faster, less paperwork) with in-house assessment.
For SIL 3/4 and complex projects, it is necessary with a high degree of independence for safety reasons and external Assessors from Assessor-companies should be involved.

Next chapter >> 5.3 Competence of the Assessor?

Focus on the source (/TR 50126/, "Guide to EN 50126")

In TR 50129 ("guide to EN50129") Draft 2006, chapter 7.1.2, is the word "Organization" interpreted to either an external organization or an autonomous in-house organization:

"In general the Safety Assessor or the Safety Assessment Organisation must be accepted by the safety authority. The safety Assessor could be either a member of the in-house organisation (e.g. Assessment Centre) or an independent external organisation. The degree of the independence of the Assessor from the development and RAMS Process must be proven and accepted by the safety authority in charge of the approval. The Assessment organisation should have an accreditation in accordance with EN 45004.

(The mentioned standard EN 45004 contains some requirements to an in-house department regarding economical and organizational independence from the other departments and some professional skills to the Head of the department.)



Read more...