RIS RIS-2700-RST. Rail Industry Standard for Verification of Conformity of Engineering. Change to Rail Vehicles. Rail Industry Standard

Transcription

1 RIS This document contains one or more pages which contain colour Published by: Copyright 2016 Rail Safety and Standards Board Limited RIS-2700-RST Engineering Change to Rail Vehicles Issue One: March 2016 Rail Industry Standard

2 Issue record Issue Date Comments One March 2016 Original document. Replaces GMRT2000 issue three, GMRT2001 issue two, PS issue one and GEGN8565 issue one. This RIS takes the relevant text of the above documents and places it in the context of the prevailing industry legislation affecting verification of conformity of rail vehicles. Superseded or replaced documents The following Railway Group documents are superseded or replaced, either in whole or in part as indicated: Superseded documents GMRT2000 issue three Engineering Acceptance of Rail Vehicles GMRT2001 issue two Design Scrutiny for the Engineering Acceptance of Rail Vehicles PS issue one Specification for Vehicle Acceptance and Conformance Certification Bodies GEGN8565 issue one Guidance on the Retention of Design Information, Validation of Technical Change and Configuration Management Sections superseded Date when sections are superseded All 04/06/2016 All 04/06/2016 All 04/06/2016 All 04/06/2016 Supply GMRT2000 issue three, GMRT2001 issue two, PS issue one and GEGN8565 issue one cease to be in force and are withdrawn as of 04 June The authoritative version of this document is available at Enquiries on this document can be forwarded to Page 2 of 53

3 Contents Section Description Page Part 1 Introduction Purpose of this document Application of this document Health and safety responsibilities The structure of this document Copyright Approval and authorisation of this document 6 Part 2 Guidance on Verification in the Rail Industry Introduction Role of the Proposer and the Assessment Party Extent of verification and degree of independence Applicable requirements Principle of due diligence 12 Part 3 Role of Independent Verification Verification roles and independence Role and Independence of Assessment Party Competence requirements 17 Part 4 Verification Processes Introduction Preparation for assessment Design conformity Construction conformity Reporting the assessment work Interim or temporary verification 30 Part 5 Documentation and Records Categorisation of records Documentation to support certification Management of vehicle history files 32 Part 6 Issuing Certification Attestation statement Completing verification Issue and distribution Alteration, suspension and withdrawal 36 Appendices Appendix A Competence Guidelines for Personnel Involved with the Verification Process 37 Appendix B Reduced Design Conformity 40 Appendix C Limitations 43 Appendix D Requirements for Testing 44 Appendix E Layout for a Technical File 48 Definitions 50 References 52 Page 3 of 53

4 Tables Table 1 Summary of the responsibilities of the Proposer and the RU 9 Figures Figure 1 Diagram illustrating the extent of verification and degree of independence 10 Figure 2 Summary of the considerations when designating an Assessment Party 16 Figure 3 Design conformity process 22 Figure 4 Construction conformity process 26 Page 4 of 53

5 Part 1 Introduction 1.1 Purpose of this document The purpose of this Rail Industry Standard (RIS) is to set out a process which can be adopted by organisations that are undertaking projects that require verification of conformity of an engineering change to rail vehicles against applicable requirements and by organisations that carry out the verification work In particular, this RIS can be used as a regime to demonstrate conformity with Railway Group Standards (RGSs) applicable to rail vehicles The following vehicle types are considered to be outside the scope of this document: a) On-track machines (OTMs) travelling and working modes (alternative process outlined in RIS-1710-PLT). b) On-track plant (OTP) (alternative process outlined in RIS-1710-PLT). c) Vehicles registered for operation outside Great Britain (GB) prior to the implementation of the Railways (Interoperability) Regulations (RIR) 2006 (requirements covered by RIR 2011 (as amended), Cross-Acceptance agreements or UIC503). Aspects of Part 4 of this document can however provide methods that can be adopted as part of the verification of the above vehicle types. 1.2 Application of this document A member of may choose to adopt all or part of this document through internal procedures or contract conditions. Where this is the case, the member of will specify the nature and extent of application Therefore, specific compliance requirements and dates have not been specified since these will be the subject of internal procedures or contract conditions. 1.3 Health and safety responsibilities Users of documents published by are reminded of the need to consider their own responsibilities to ensure health and safety at work and their own duties under health and safety legislation. does not warrant that compliance with all or any documents published by is sufficient in itself to ensure safe systems of work or operation or to satisfy such responsibilities or duties. 1.4 The structure of this document This document is set out as a series of requirements, in some cases followed by relevant guidance. The guidance is indicated by prefixing the paragraph number with the letter G Part 2 of the document introduces the principles of verification in the rail industry, as set out in other parts of this document Part 3 provides requirements and guidance on the degree of independence when undertaking verification work Part 4 provides requirements and guidance on the methodology for the verification processes to assess design conformity and construction conformity Part 5 provides requirements and guidance on the compilation of verification records Part 6 provides requirements and guidance on the production of an attestation statement. Page 5 of 53

6 1.5 Copyright Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group documents may be reproduced. 1.6 Approval and authorisation of this document The content of this document was approved by Rolling Stock Standards Committee on 15 January This document was authorised by on 20 January Page 6 of 53

7 Part 2 Guidance on Verification in the Rail Industry 2.1 Introduction The purpose of verification, in its widest sense, is to objectively confirm that an organisation has met its responsibilities in terms of complying with relevant legislation and regulations (including those relevant to safety), its own management systems, and associated requirements or processes that it may be required to, or has decided to, adopt. G Legislation relevant to verification of conformity of engineering change to rail vehicles includes: a) The Railways and Other Guided Transport Systems (Safety) Regulations (ROGS) 2006 (as amended) (implementing the Railway Safety Directive 2004/49/EC). b) RIR 2011 (as amended) (implementing the Railway Interoperability Directive 2008/57/EC). c) Commission Implementing Regulation No 402/2013/EU (as amended) establishing a Common Safety Method for Risk Evaluation and Assessment (CSM RA). d) Commission Implementing Regulation No 445/2011/EU concerning Entities in Charge of Maintenance (ECM). G Guidance relevant to the above legislation includes: a) Office of Rail and Road (ORR) guidance on the application of ROGS and CSM RA. b) guidance notes on the CSM RA GEGN8640 through to GEGN8645. c) The ATOC Guide to Vehicle Change (ATOC/EC/GN/002). d) Commission Recommendation 2014/897/EU For engineering changes to rail vehicles (modifications) that are not deemed renewed or upgraded as defined in RIR 2011 (as amended) the level of verification is managed by the Proposer of the change. G G For projects that are for new, renewed and upgraded vehicles or structural subsystem(s) RIR 2011 (as amended) sets out where third party verification is required. Renewal and upgrading are specifically defined types of modifications under RIR 2011 (as amended) and in this context do not mean any wider definitions that can be used in industry. Further explanation on modifications can be found in clauses 110 to 116 of Commission Recommendation 2014/897/EU on matters related to the placing in service and use of structural subsystems and vehicles under Directives 2008/57/EC and 2004/49/EC Under ROGS 2006 (as amended), railway undertakings (RUs) are required to have an approved Safety Management System (SMS), which includes details of its change management process, including carrying out risk evaluation and implementing risk control measures this includes changes made to rolling stock (vehicles) that it operates and compliance with any applicable requirements (see 2.4) and other associated standards, for example GERT8270. Page 7 of 53

8 2.1.4 The requirements and guidance contained within this RIS are intended for the verification of conformity of an engineering change where no process exists within a standard or other normative document containing applicable requirements (see 2.4) which applies to the project. The requirements and guidance of this RIS may be applied in the following situations: a) A rail vehicle engineering change project for which RIR 2011 (as amended) does not apply. b) When a Designated Body (DeBo) is engaged to verify conformity against National Technical Rules (NTRs) as part of a project which is in scope of RIR 2011 (as amended). c) To verify conformity with a code of practice when it is chosen as the risk assessment principle when applying the full risk management process prescribed in the CSM RA Various principles associated with verification of conformity of engineering change to rail vehicles are explained below to put the content of this RIS into context. 2.2 Role of the Proposer and the Assessment Party In the context of this RIS, the roles of the Proposer and Assessment Party are described as follows: a) Proposer responsible for initiating and undertaking the engineering change project, providing evidence of compliance and specifying the verification requirements, including the appointment of an Assessment Party. b) Assessment Party responsible for undertaking the verification of conformity of the engineering change project, in accordance with the defined verification requirements and with an appropriate degree of independence. G G The descriptions in a) and b) are referring to roles. It can in fact be the same organisation that undertakes both of these roles. The Proposer can be: a) An RU. b) An alternative organisation nominated by an RU (an authorised representative); in such a case, the accountability remains with the RU. c) A manufacturer or installer of an engineering change. d) A vehicle owner / keeper, where vehicle enhancements (for example, interior refreshment) are being undertaken either as part of a lease agreement or to prepare the vehicles for leasing to a new or alternative RU. e) An ECM, responsible for the safe maintenance state of the vehicle(s). G G G The role of the RU as the train operator, responsible for safely reintroducing the vehicle(s) into service following completion of the engineering change, is outside the scope of this RIS. However, it is summarised in to place it into context. An explanation of the types of Assessment Party and their degree of independence is provided in Part 3. The responsibilities of the Assessment Party are generally limited by the scope of the verification work, not the scope of the engineering change. Page 8 of 53

9 2.2.2 Consultation with affected parties can assist with appropriate exchange of information regarding the engineering change project, taking into account the likely risks, complexity and impact of the proposed change. G Where there are multiple stakeholders, a lack of engagement can lead to a situation whereby design information is not fully shared or updated The responsibilities of the Proposer and the RU (as train operator) are summarised in the following table: Description Task Output Potential associated tasks Responsibility of the Proposer Undertaking the actual engineering change affecting the vehicle Conform with the applicable requirements Attestation statement (produced by the Assessment Party) see Part 6 Other verification activities outside the scope of this RIS. Update vehicle records (see Part 5) Responsibility of the RU Reintroducing the vehicle(s) to operational service following the engineering change Confirming that the vehicle(s) remain operationally safe (SMS processes) Safety acceptance Technical compatibility at route level (methodology set out in GERT8270). Mandatory data update (advise RSL) Table 1 Summary of the responsibilities of the Proposer and the RU G G G The highlighted (shaded) Task / Output indicates the scope of this RIS within the wider context of verification and approvals processes within the UK rail industry. Depending on the scale of the engineering change project and the extent of verification required (see 2.3), it can be the case that some or all of the other aspects outlined in Table 1 are not relevant. An analogy to aid understanding of the principle outlined in Table 1 is given as follows: a) Undertaking the actual engineering change affecting the vehicle completes the engineering change work within the maintenance shed and places the vehicle within the depot / shed yard. b) Reintroducing the vehicle to operational service takes the vehicle from the depot / shed yard out onto the GB mainline network. G The role of the Proposer as described in this RIS is not as extensive as the proposer as described in the CSM RA, as the latter also has responsibility for implementing the change that has been subject to the application of the CSM RA. Page 9 of 53

10 2.3 Extent of verification and degree of independence The Verification Triangle (Figure 1) illustrates the extent of verification and degree of independence. The Verification Triangle Formal scheme (such as RIR 2011) applies Substantial (very occasional projects) Medium (some projects) Increasing degree of independence better suited to Third Party Assessment verification Extent of verification increases as scale and / or risk of project increases (indicated by width of triangle) Lesser degree of independence suitable for Second Party Assessment Minor (many such projects) Inconsequential (no verification requirement) First Party direct sign-off Figure 1 Diagram illustrating the extent of verification and degree of independence Page 10 of 53

11 G G The key principle highlighted is that the extent of verification increases in proportion to the scale and / or risk of the engineering change being undertaken. Risks associated with engineering change can arise from a number of factors, including: a) Scale of the change and its impact on the existing vehicle (interfaces). b) Complexity and novelty of the design and / or use of technology. c) Consequence of failure, error or omission d) Effect on the design configuration and interfaces with existing systems. e) The proposed installation programme (who? where? capability?). f) Involvement of supplier(s) of critical materials, components and / or services (competence / assurance arrangements). g) Any transient phases of the project, such as testing and controlled trials. G G G G Typically, the level of risk increases with the scale of the engineering change; but there can be examples where a small scale change involves a disproportionately high risk (for example, a change in brake block type or a software update). The converse can also be true where a large-scale change is otherwise routine in nature (for example, a vehicle interior refurbishment using already proven / accepted materials and fittings). It is expected that the Proposer would have considered such risks when devising the engineering change. The Assessment Party may challenge any assumptions to be sure that the risk profile for the engineering change project is understood and accepted. A greater degree of independence is usually associated with an engineering change project where the scale and / or risk is greater; however, this does not necessarily have to be the case. For example, a large organisation undertaking a substantial engineering change can have sufficient engineering resources such that it can also undertake the verification work without compromising the requirements for independence (see Part 3). For engineering changes that are towards the upper end of the Verification Triangle, a greater synergy with defined verification processes (such as those required under RIR 2011 (as amended)) is considered to be beneficial. 2.4 Applicable requirements Verification is undertaken against the defined / agreed list of applicable requirements for the engineering change project. G Applicable requirements are contained within standards and other normative documents as set out in G , some of which can include a verification process by which conformity with the requirements of the document concerned are to be assessed. Where no such process is indicated, this RIS can provide suitable methods. Page 11 of 53

12 G The applicable requirements can include: a) NTRs relevant to the engineering change being undertaken; for rail vehicles these are typically contained within rolling stock RGSs. The verification processes outlined in this RIS are particularly suitable for these types of documents. b) Technical Specifications for Interoperability (TSIs). Where the engineering change is being undertaken on a vehicle that has an authorisation under RIR 2011 (as amended) (see G c)), there can be an impact on the criteria within a TSI that define the basic design characteristics of the rolling stock subsystem. This is explained further in 2014/897/EU. c) Euro-Norms (ENs) contain requirements covering specific component or systems on rail vehicles. These can be referenced directly in the TSIs. d) Voluntary railway industry standards (for example RISs) can contain requirements which an organisation has chosen to adopt. e) There can also be other standards and normative documents, including non-railway specific requirements that need to be considered or further voluntarily requirements (for example, customer requirements). G As part of their licence conditions and Statement of National Regulator Provisions (SNRP), RUs are required to comply with the relevant RGSs (condition 9). 2.5 Principle of due diligence Both ROGS 2006 and RIR 2011 (as amended) include the defence of due diligence in terms of compliance with the requirements of the legislation. G In respect of engineering change, for an organisation s actions to be regarded as duly diligent, it is considered reasonable for the extent of verification involved to be proportionate to the scale and / or risk from the engineering change being undertaken (see 2.3.1). Page 12 of 53

13 Part 3 Role of Independent Verification 3.1 Verification roles and independence The following guidance is provided on the issue of independence when undertaking verification work. G Verification work is categorised as first, second or third party as follows (refer also to the Verification Triangle diagram in 2.3.1): a) Third party undertaken by a different company (separate legal entity), therefore offering full independence. Suitable for medium changes and recommended for substantial changes. b) Second party a separate department or separate personnel of the same company (legal entity) as the Proposer, therefore offering limited independence. Suitable for minor and medium changes; possible for substantial changes if the appropriate level of peer review and independence is available. c) First party effectively a self-declaration and therefore no degree of independence involved. Only suitable for engineering changes of an inconsequential nature. G G The level of independence is indicated by whoever issues the attestation statement (see Part 6) at the completion of the verification work. Guidance on the degree of independence required for the verification of conformity of an engineering change project is given in G Role and Independence of Assessment Party Role of the Assessment Party An Assessment Party shall be designated to verify conformity of an engineering change project to a rail vehicle(s) to an appropriate level of independence. G A flowchart summary of the considerations when designating an Assessment Party is provided at the end of this section 3.2, see Figure First party verification For a first party verification, the Proposer shall approve the work without the need for independence. G G G Many examples of engineering change typically occur towards the lower end of the Verification Triangle diagram (see 2.3.1), and therefore the extent of verification required may be similarly proportionate. Where an engineering change can be classified as not being affected by any applicable requirements, defined as inconsequential within the context of this RIS, independent verification activity is not required. Where it is considered that a simple first party assessment is sufficient, a nominated engineer / manager within the Proposer s organisation may sign off the engineering change to take direct responsibility for the verification of conformity of the engineering change project. Page 13 of 53

14 The decision that the verification of conformity of an engineering change project is to be regarded as first party shall be recorded, together with the rationale behind the decision. G The ORR s guidance on the CSM RA emphasises that, where a decision is taken that a change is not significant and thus no independent assessment is required, that decision is required to be recorded, together with the rationale behind the decision Second party verification If a second party approach to verification is to be adopted, then the Proposer shall manage the verification work such that the required degree of independence is maintained. G G G G A second party approach to verification can include using internal resources from a separate and identifiable part of the organisation and which are otherwise independent of the engineering change work being carried out; this constitutes the Assessment Party for the project. This approach may also include contracting out elements of the assessment work to an independent body (provided that the ultimate verification remains in the name of the Proposer). Where an independent body is contracted to undertake elements of the assessment work, such a body can be any organisation that the Proposer has undertaken assurance checks on and considers suitable (see 3.3.3). This is distinct from the guidance on full, third party independent bodies given in G to G Guidance on the degree of independence and the link between the extent of verification and the risk profile of the engineering change project is given in G to G It is recommended to consult with any other interested parties on the approach to verification, where appropriate (for example, the vehicle owner if the Proposer is the RU) The documented management system of the Proposer shall include the processes that control the verification work. G G Under the terms of ROGS, an RU is granted a safety certificate by the ORR on the basis of having a suitable SMS, which includes processes for change management. An ECM for freight wagons is certificated on the basis of having a suitable maintenance system, which includes processes for change management. Other organisations, such as a vehicle owner / keeper or manufacturer, can operate in accordance with an ISO9001 Quality Management System (QMS) which can include change management. The following factors are relevant when considering the suitability of an SMS / QMS (or equivalent) to support a 'second party' verification: a) Does the Proposer have access to personnel of the appropriate competence to carry out verification work? b) Are the nominated personnel independent of the work that has been carried out? Independence would be compromised if the personnel designated to verify conformity of an engineering change project were also involved in the generation of submitted evidence in support of the verification. Page 14 of 53

15 c) Do the timescale and resource implications for the project allow such internal resources to be deployed? d) Is there a documented process to cover the verification activities required (for example, audit, inspection, peer review, etc)? e) Are there procurement arrangements to cover the use of external resources to undertake some / all of the assessment work in support of verification? G This does not preclude designated assessors and / or verifiers from undertaking other activities for the company or related organisation, provided that these activities do not compromise the objectivity and impartiality of the verification work Third party verification If a third party approach to verification is to be adopted, then an Assessment Party that is a different company (separate legal entity) from the Proposer shall be appointed to undertake the full verification work The Proposer shall confirm that the Assessment Party has the required capability to meet the scope of verification and that the principle of independence is not compromised. G G G G G G The third party independent body with a recognised accreditation (for example ISO17065, ISO17020 Type A) to undertake such work provides the greatest assurance of capability. In the UK, the United Kingdom Accreditation Service (UKAS) is the organisation with authority to issue such accreditations. Under the various legislative frameworks outlined in G , third party independent bodies such as Notified Bodies (NoBos), DeBos or Assessment Bodies (AsBos) are accredited against a defined scope of work. This may be taken as suitable evidence of independence and competence to undertake verification work as outlined below. This also provides a degree of assurance over confidentiality. In particular, a DeBo, accredited by UKAS under RIR 2011 (as amended), is deemed to be a suitable organisation to undertake third party verification work (subject to its scope of accreditation covering the type of vehicle(s) concerned) as they have a recognised accreditation as competent to verify conformity with NTRs. For a third party independent body with a UKAS accreditation, the schedule of accreditation can be checked on the UKAS website ( to confirm that the body has the required capability to meet the scope of verification. In the context of this RIS, third party independent bodies holding an accreditation as a NoBo, DeBo or AsBo are not acting as such when undertaking verification work that is outside of the formal certification scheme for which such an accreditation is held. The principle of independence can be compromised, particularly in cases where the independent body is related to a common body or by another organisational relationship that can conflict with their independence of judgement and integrity in relation to their verification activities. In certain circumstances, personal relationships or previous career history can compromise the required independence. Page 15 of 53

16 G G In circumstances where a related organisation of the third party verification body has been involved with the design and / or installation of the engineering change (often referred to as a turn key approach), independence can be compromised. The guidance given in G b) is considered to be relevant in this instance. An approach under the terms of this RIS whereby an independent body undertakes all the assessment work, but the Proposer then issues the attestation statement under their own SMS, is regarded as a variant of the second party approach within the context of this RIS. Start Does the change involve applicable requirements? G No Self certification Yes Remit for assessment Is preference to use a third party certification body? G to G Yes Does the RU have suitable inhouse capacity? G Yes No Full verification by a third party certification body (such as a DeBo) Yes Assurance checks of Independent Body Is use of an Independent Body involved? G No RU 2 nd party Certification Figure 2 Summary of the considerations when designating an Assessment Party Page 16 of 53

17 3.3 Competence requirements Personnel designated to undertake verification of conformity of engineering change projects shall be competent to undertake such work. G G G The ability of an Assessment Party to be able to manage their competence requirements under a third party approach to verification may be assumed if they have a recognised accreditation under the EN45xxx / ISO17xxx series of European / International standards. The ability to manage the competence requirements of a second party approach to verification may be demonstrated by inclusion of such competency management processes in the SMS / QMS (or equivalent) of the Proposer. The different roles within verification (for example, assessor, technical expert and signatory) have different competency requirements The competence of the designated personnel to undertake verification of conformity of engineering change projects shall be demonstrable and appropriate to the risk profile of the engineering change project (see G ). G G The creation and maintenance of competence records provides suitable evidence that the Proposer was duly diligent in selecting personnel to undertake verification work. Further guidance on competence and the extent to which it is considered appropriate is given in Appendix A of this RIS When sub-contracting with an independent body or person to undertake aspects of the verification work (for example, as set out in G ), as part of the procurement arrangements, the following elements shall be addressed: a) Evaluate and select such a sub-contractor on the basis that they have the requisite competence to undertake the work, and knowledge, skills and experience in the specific technical areas concerned, including experience of the applicable requirements involved. And b) Contract documents to provide a defined scope of work, containing all relevant data for the work required. G G The type and extent of control exercised depends on the requirements of the service, including consideration of the level of risk involved. Retention of the records of the competence / capability checks provides suitable evidence to support the verification work undertaken. Page 17 of 53

18 Part 4 Verification Processes 4.1 Introduction Generic requirements Application of verification processes shall: a) Confirm that the engineering change, as designed, complies with the applicable requirements (design conformity). And / or b) Confirm that the engineering change has been undertaken (installed or manufactured) in accordance with the verified design, thereby ensuring that conformity is maintained at the build stage (construction conformity). G In the context of this RIS, the verification process consists of two elements: a) Assessment being the process of reviewing the details of the engineering change against the applicable requirements. And b) Certification being the process of reviewing the outcome of the assessment work and producing an attestation statement (see Part 6). G G An engineering change project may only require one of the two verification elements, design conformity or construction conformity; for example where a modification programme is the same engineering change as a previous programme and the design has already been subject to verification; or where, for example, the engineering change is a proposal to amend the maintenance plan for the vehicles such that there is no installation / manufacture element (see 4.3.2). The purpose of construction conformity is to confirm that the engineering change, as installed, is in accordance with the engineering change as designed: a) Provided that the design has been verified to conform to the applicable requirements then, if the change is installed / manufactured in accordance with the design, the vehicle(s) will continue to conform with the applicable requirements following the completion of the engineering change. And b) There have been numerous examples over the years where, through a variety of reasons (for example, economy, time constraints, lack of competence, poor quality control), engineering changes have not been installed as designed, leading to potentially non-compliant vehicles. G Verification of conformity for components separate from rail vehicles is covered by other product certification / acceptance regimes (for example, an Interoperable Constituent as defined in a TSI). However, this Part 4 may be used for the verification of a component where it is being considered within the vehicle system for which it is intended (for example, a new type / design of component or alternative material to perform an identical function within the vehicle, similar in performance or weight to its predecessor). Page 18 of 53

19 4.1.2 Conformity assessment modules The principles set out in Commission Decision 2010/713/EU shall be followed where this is appropriate for the engineering change project. G G G Commission Decision 2010/713/EU sets out an approach for the assessment and certification of conformity to be undertaken by a NoBo when assessing a project within the scope of the Interoperability Directive. Verification of conformity of engineering change applies to projects undertaken subsequent to a new authorisation under RIR 2011 (as amended) and continues throughout the lifetime of the vehicle. Use of the modules when verifying conformity of engineering change projects that are outside RIR 2011 (as amended) allows for a consistent approach to assessments and the creation of a comprehensive records regime. For engineering changes that are towards the upper end of the Verification Triangle diagram (see 2.3.1), a greater synergy with the verification processes defined under RIR 2011 (as amended) is considered to be beneficial. 4.2 Preparation for assessment Agreeing the work The scope of verification, including the applicable requirements, and extent of verification shall be agreed between the Proposer and the Assessment Party. G G Defining, and clarifying where necessary, the scope of verification at the start of the project ensures that the requirements are clearly understood at the outset. This is equally important whether a third party or second party approach is being used. It is good practice for the scope of verification to include: a) A technical description of the engineering change being undertaken, including the objective of the engineering change project expressed in measurable performance terms. b) The anticipated approach to the verification work. c) Which party will be responsible for undertaking the various aspects. G G G As well as verifying conformity with the applicable requirements, the impact of the engineering change(s) on other elements of the vehicle(s), including the existing conformity with applicable requirements, may need to be considered as part of the verification process. This includes consideration of TSI requirements where previously confirmed as compliant under RIR 2011 (as amended) (see G b). The scope of verification can affect the data and information required for the assessment of technical compatibility at route level in accordance with GERT8270; however, any reassessment using GERT8270 is not in scope of the verification activities covered by this RIS. Defining the scope of verification prior to any engineering change being undertaken enables the Assessment Party to identify where it does not have the required capability to undertake the verification, thereby allowing the Proposer to consider an alternative approach. Page 19 of 53

20 G G Guidance on the link between the extent of verification and the risk profile of the engineering change project is given in G to G It is the responsibility of the Proposer to ensure that the Assessment Party and any other independent body(ies) have the required competence to undertake the work (see 3.3.3) Assessment shall be based on supplied data and information defining the engineering change. Information supplied relating to the technical condition of the vehicle(s) shall accurately represent the current design configuration status. G Typical supplied information includes, but is not limited to: a) Details of which rail vehicle(s) or component(s) are affected. b) Details of the area(s) that are to be subject to, or affected by, the engineering change. c) The technical documentation related to the change (for example, drawings, specifications and test results). d) Related technical information (for example, current design configuration data, technical file, previous certificates). e) List of applicable requirements that are relevant to the change. f) Evidence of compliance with the applicable requirements. g) Hazard / risk assessment documentation. G G It is important to confirm which party (such as the Proposer, owner / keeper, manufacturer, authorised representative) is responsible for supplying what information. The terms design configuration and design operating state are considered to be synonymous To maintain independence, the Assessment Party shall not generate data and information defining the engineering change which it then uses as part of the assessment. G G G There is a need to establish a clear demarcation line between the information supplied by the Proposer and the scrutiny of that information by the Assessment Party. For the Assessment Party to generate such information as an alternative to it being supplied by the Proposer would compromise the principle of independence. This does not however preclude the Assessment Party from challenging / clarifying the information supplied. In the second party model this does not preclude the Proposer generating data that is then used by other suitably competent persons within the Proposer s organisation designated to undertake the assessment work, provided that the principle of individual independence is not compromised (see G b). For clarification, does not preclude the Assessment Party undertaking testing, the results of which it then uses to verify compliance with applicable requirements. Page 20 of 53

21 4.2.2 Planning the work The Assessment Party shall prepare a verification plan outlining the intended assessment activities consistent with the scope of verification. G The purpose of the verification plan is to: a) Outline assessment activities which are relevant and appropriate to the scope of verification. b) Confirm the applicable requirements against which verification is to be undertaken. c) Identify the scope and depth of the assessment of design conformity required for each applicable requirement and the intended approach (for example, desktop clause-by-clause, comparison analysis or type testing). d) Identify the approach to the assessment of construction conformity to confirm that the engineering change has been installed as per the agreed design (for example, witnessing, audit, checks of sub-suppliers). e) Confirm the competence and resource requirements (for example, personnel, measuring equipment, sub-contracted services). G G G The situation can occur where multiple engineering change projects are being undertaken at the same time; for example, where there is an interior refurbishment programme being undertaken to a fleet of vehicles and a mandatory system upgrade is subsequently initiated involving the same vehicles. The order in which each engineering change is undertaken on each vehicle in the fleet can be different and hence the current design configuration status of each vehicle needs to be carefully controlled. Where multiple engineering change projects are being undertaken at the same time, it is good practice for the Proposer to ensure that all Assessment Parties carrying out verification relative to the vehicle(s) are aware of all other work in hand affecting conformity with applicable requirements. Where there are multiple engineering change projects being undertaken at the same time, this can constitute a significant change as defined in the CSM RA through considering the principle of additionality Assessment of the engineering change against the applicable requirements shall then be undertaken in accordance with the verification plan. Page 21 of 53

22 4.3 Design conformity Assessment of design conformity shall verify that the engineering change meets the applicable requirements as outlined in the flowchart shown in Figure 3. Guidance is provided below against each element of the flowchart. Start Is full design scrutiny required? G Yes Full, desk-top scrutiny against applicable requirements * G No Provide additional evidence No Has all evidence been provided? G Reduced design scrutiny * Appendix B Yes Can design be modified? No Yes Does design comply with applicable requirements? G No Yes Deviation and / or limitation (Appendix C) * G Is testing required? G Yes Agree test specification and carry out tests * Appendix D No No *Record events in decision log G Does design comply with applicable requirements? G Yes Report details of design assessment Highlight any critical areas G Figure 3 Design conformity process Page 22 of 53

23 G G Appendix B defines types of engineering changes to rail vehicles for which full design scrutiny, as set out in G , may not be required. Design scrutiny is regarded as a specific phase within the overall process of design conformity. Established industry practice for design scrutiny has been to systematically evaluate and document submitted design evidence against each of the applicable requirements in turn. A clause-by-clause approach is recommended for larger-scale changes. The following factors are relevant to the task of design scrutiny: a) The general principle is that undertaking an engineering change to a vehicle provides an opportunity to move the vehicle towards full conformity with the relevant applicable requirements, without adverse impact on adjacent equipment and systems. b) This recognises that the original design will have been designed against the prevailing requirements of the time and may not fully conform with the current applicable requirements. To make the design fully conform within the changes proposed might be uneconomic. c) Where a design describing an engineering change (the new design) is offered for assessment and it is based on a previous design (the base design) which can be demonstrated to be a currently approved design, then the assessment work may be limited to assessing the differences between the new design and the base design, while taking into account any impact on existing equipment and systems that may be affected. d) Repairs undertaken to collision damaged vehicles may not require full design conformity (or subsequent construction conformity). This is explained in Appendix B. e) See (G ) for further information in relation to evidence to be submitted. G G G G It is good practice for key events to be recorded in a decision log (or similar) as assessment work progresses so that there is an auditable trail of the decisions made and the reasoning behind them. This can be used to support the compilation of the assessment report (see 4.5.1). Design scrutiny may not be regarded as complete until appropriate evidence is established against each individual element of the applicable requirements such that the degree of conformity can be determined. Where non-conformities with the applicable requirement(s) are identified, it is good practice for the Assessment Party to explain the reasoning and / or rationale behind non-conformities being raised to allow the Proposer to fully consider the options for resolution. It is considered to be a duty of care for any safety concerns, which are outside the scope of the assessment, to be identified and highlighted. However, they are not in themselves a reason for refusing to complete the verification. Alternatives to amending the design include a deviation or proposing a limitation on operation: a) The recommended approach is to achieve compliance with the applicable requirements through the design process; a deviation is therefore regarded as a last resort alternative and requires a valid justification. b) In the case of RGSs published by, the process for obtaining a deviation is described in the RGS Code and the Standards Manual. Page 23 of 53

24 c) In the case of TSIs, the process for derogations, which are equivalent to deviations, is described in Regulation 14 of RIR 2011 (as amended); this is however considered an unlikely option within the context of this standard. d) Further requirements and guidance for limitations are contained in Appendix C. G Vehicle or component testing can be a time-consuming exercise and many of the applicable requirements indicate that design conformity may be demonstrated through calculation. Typically, testing is undertaken where there is a specific requirement to do so or where conformity with the applicable requirements can only be demonstrated by undertaking tests. Further requirements and guidance for undertaking testing are contained in Appendix D. G In order to demonstrate independence, it is good practice for the person / organisation carrying out the testing to report the results accurately, clearly, unambiguously and objectively, so as not to overtly influence the subsequent considerations of the Assessment Party in terms of conformity with the relevant applicable requirement(s). This guidance is considered more relevant for engineering change projects towards the upper end of the Verification Triangle diagram (see 2.3.1). G It is good practice for the assessment of design conformity to highlight any areas which are considered to be critical to the assessment of construction conformity and / or affect the maintenance documentation; that is, those issues that might not otherwise be identified as part of a subsequent assessment. Examples of such areas might include, but not exclusively so, the following: a) Areas of the vehicle body requiring tight manufacturing tolerances because of swept envelope implications on gauging construction consideration. b) Specified materials which the vehicles must be constructed from to ensure correct performance in safety-critical areas construction consideration. c) Brake performance which is close to the applicable braking curve maintenance consideration. d) Welding in high-stressed areas construction consideration Changes involving vehicle maintenance plans Where changes to a maintenance plan for an existing vehicle are to be subject to verification, the assessment of conformity shall be undertaken in a similar manner to the desktop scrutiny phase of design conformity. G A change to a vehicle maintenance plan can be initiated for two reasons: a) A design-based change impacts on maintenance. And b) The change is in itself a change to the maintenance plan; that is, not design led. Page 24 of 53

25 G G G G G G Under the former GMRT2000 process, three separate categories of conformity assessment were identified, namely design, construction and maintenance. The current conformity assessment modules outlined in Commission Decision 2010/713/EU do not provide a separate maintenance assessment process; instead, maintenance is considered to be an element of design assessment. Part (b) of an ECM maintenance system is the maintenance development function. This includes managing changes to a maintenance plan for an existing vehicle. At the time of publication of this RIS, this is mandatory for freight vehicles. For vehicles which have previously been authorised under RIR 2006 (as amended), the RU will have obtained from the manufacturer a maintenance design justification file and the maintenance documentation which describes how to conduct maintenance activities. GMRT2004 sets out requirements for vehicle maintenance plans. This includes the requirements for a maintenance design justification file and the maintenance documentation. The same principles set out in Part 3.2, in regards to first, second or third party verification, and the desktop element of the flowchart in may be applied to the assessment of conformity of a change to a vehicle maintenance plan: a) Specifically, G to G are considered applicable, with the word design replaced by maintenance or maintenance plan to describe the process. b) With respect to the need for testing, this is not normally applicable for a change to a vehicle maintenance plan. An exception could be a controlled trial of amended maintenance arrangements to selected vehicles in a fleet. Page 25 of 53