Annex I Description of Work

Transcription

1 Grant agreement for Project no Project acronym: SEVENTH FRAMEWORK PROGRAMME TRANSPORT Annex I Description of Work Project full title: Modular Urban Transport Safety and Security Analysis Grant agreement No. Date of preparation of Annex I: Date of approval of Annex I by Commission: MODSafe Annex I DoW Page 1 of 74

2 List of Beneficiaries Beneficiary Number Beneficiary name Beneficiary short name Country Date enter project Date exit project 1 TÜV Rheinland InterTraffic TRIT Germany 1 48 GmbH 2 TÜV Rheinland Consulting TRC Germany 1 48 GmbH 3 Société Technique pour AREVA France 1 48 l'energie Atomique 4 Budapest University of Technology and Economics BME Hungary Bombardier (Signal) GmbH BTSERCS Germany Institut National de Recherche sur les INRETS France 1 28 Transports et leur Sécurité 7 Alstom Transport SA Alstom France Régie Autonome des RATP France 1 48 Transports Parisiens 9 Technische Universität TUD Germany 1 48 Dresden 10 Union Internationale des UITP Belgium 1 48 Transports Public 11 Association of the UNIFE Belgium 1 48 European Railway Industry 12 Université de Valenciennes UVHC France 1 48 et du Hainaut-Cambrésis 13 Thales Rail Signalling Thales RSS Canada 1 48 Solutions Inc. 14 KITE Solutions s.n.c. KITE Italy Dimetronic SA Dimetronic Spain Rail and Bus- Consultants R&B Germany 1 48 GmbH 17 Ansaldo STS France Ansaldo France Transports Metropolitans TMB Spain 1 48 de Barcelona S.A. 19 TelSys GmbH TelSys Germany London Underground LU United 1 48 Limited Kingdom 21 Université de Technologie UTC France 1 48 Compiègne 22 Metro de Madrid S.A. MMA Spain Institut Français des IFSTTAR France Sciences et Technologies des Transports, de l Amenagement et des Reseaux 24 KITE Solutions S.R.L. KITE Italy MODSafe Annex I DoW Page 2 of 74

3 Table of Contents A.1 Overall budget breakdown for the project... 4 A.2 Project summary... 5 A.3 List of beneficiaries... 6 B.1 Concept and objectives, progress beyond state-of-the-art, S/T methodology and work plan... 7 B.1.1 Concept and project objectives... 7 B.1.2 Progress beyond the state of the art... 8 B.1.3 S/T methodology and associated work plan... 8 B Overall strategy and general description... 8 B Timing of work packages and their components B Work package list / overview B Deliverables list B Work package descriptions B Efforts for the full duration of the project B List of milestones and planning of reviews B.2 Implementation B.2.1 Management structure and procedures B Project management B The Executive Branch B The Consensus and Strategy Branch B Decision-making structure B.2.2 Beneficiaries B.2.3 Consortium as a whole B.2.4 Resources to be committed B.3 Potential impact B.3.1 Strategic impact B.3.2 Plan for the use and dissemination of foreground B.4 Ethical issues B.5 Consideration of gender MODSafe Annex I DoW Page 3 of 74

4 PART A - Budget breakdown and project summary A.1 Overall budget breakdown for the project MODSafe Annex I DoW Page 4 of 74

5 A.2 Project summary MODSafe Annex I DoW Page 5 of 74

6 A.3 List of beneficiaries Beneficiary Number Beneficiary name Beneficiary short name Country Date enter project Date exit project 1 TÜV Rheinland InterTraffic TRIT Germany 1 48 GmbH 2 TÜV Rheinland Consulting TRC Germany 1 48 GmbH 3 Société Technique pour AREVA France 1 48 l'energie Atomique 4 Budapest University of Technology and Economics BME Hungary Bombardier (Signal) GmbH BTSERCS Germany Institut National de Recherche sur les INRETS France 1 28 Transports et leur Sécurité 7 Alstom Transport SA Alstom France Régie Autonome des RATP France 1 48 Transports Parisiens 9 Technische Universität TUD Germany 1 48 Dresden 10 Union Internationale des UITP Belgium 1 48 Transports Public 11 Association of the UNIFE Belgium 1 48 European Railway Industry 12 Université de Valenciennes UVHC France 1 48 et du Hainaut-Cambrésis 13 Thales Rail Signalling Thales RSS Canada 1 48 Solutions Inc. 14 KITE Solutions s.n.c. KITE Italy Dimetronic SA Dimetronic Spain Rail and Bus- Consultants R&B Germany 1 48 GmbH 17 Ansaldo STS France Ansaldo France Transports Metropolitans TMB Spain 1 48 de Barcelona S.A. 19 TelSys GmbH TelSys Germany London Underground LU United Kingdo 1 48 Limited 21 Université de Technologie UTC France 1 48 Compiègne 22 Metro de Madrid S.A MMA Spain Institut Francais des IFSTTAR France Sciences et Technologies des Transports, de l Amenagement et des Reseaux 24 Kite Solutions S.R.L. KITE Italy MODSafe Annex I DoW Page 6 of 74

7 B.1 Concept and objectives, progress beyond state-of-the-art, S/T methodology and work plan B.1.1 Concept and project objectives The European Urban Guided Transport sector (Lightrails, Metros, but also Tramways and Regional Commuter trains) is still characterized by a highly diversified landscape of Safety Requirements, Safety Models, Responsibilities and Roles and Safety Approval, Acceptance and Certification Schemes. While a certain convergence in architectures and systems can be observed (e.g. through MODURBAN but also through larger procurements like OURAGAN in Paris or PPP- Refurbishments in London) the safety life cycle still differs from country to country and sometimes even within one country. Furthermore security items are considered more and more as vital for the urban transport sector. In some cases these items are linked to the safety of the urban transport systems. In this context safety is seen as everything dealing with the methods and techniques to avoid accidents. Security is concerned with the protection of persons and the system from criminal acts. In contrast to the Mainline Railway Domain, where European CENELEC Standards such as EN 50126, and 50129, European Research Projects and Networks like SAMNET or SAMRAIL and finally the establishment the European Railway Agency in Valenciennes have helped and are still helping to streamline and normalize the safety sector, the urban guided transport sector is until today only in some aspects participating in this normalization development. In some other respects, the urban situation is even getting more difficult and challenges for the ultimate responsible, the operators and industries, are rather increasing: Interoperability is not supporting convergence as driving force, since a tramway operating in e.g. Nantes has no interoperability requirements with the subway system of Budapest. Interchangeability of components is, however, a driving force to reduce procurement costs and commercial risks, but turns out to be technically even more challenging than interoperability. Operators are local organizations that are compared to large Mainline Railway Operators relatively small companies, often not having the capacity to support a full qualified safety team. At the same time, operators acknowledge that in the future they shall adhere to the railway CENELEC Standards EN 50126, EN and EN 50129, which means the operator himself has to pilot the Safety Requirements cycle (Safety Paradigms such as GAMAB, SIL tables, Hazard and Risk Analysis etc.) which is often not possible for the understaffed organizations. Strong local histories have led in the past to particular local safety concepts, requirements and acceptance schemes from city to city, and practices used on high capacity corridors such as in London or Paris are sometimes not applicable to cities like Dresden. Urban Guided Transportation has often been the trendsetter in technology application, driverless or unmanned operation projects of subway trains for example like in Paris, Nuremberg or Budapest will for a long time not find an equivalence in a Mainline Railway. On the other hand, the related safety life cycle is much more complex for these systems than, say, for a Mainline Interlocking System in Railways. Also, the CENELEC Standards have helped urban transport operators to better understand the full safety life cycle of guided transport technology, but requires special application guidelines for Urban Guided Transport projects. MODSafe Annex I DoW Page 7 of 74

8 At the Authority Level, Urban Transport Systems do often not justify state level organisations similar to Railways. Applying simply the rules of railways would lead, as indicated above, to increasing structural costs while leaving latest technology issues unresolved. Recently, increasing security threads emerge on the horizon and are being tackled at city level, harmonization or even systematic exchange between several cities, or even European Countries, is not practised for many reasons today. Furthermore, security technology requirements follow in general other approaches than for safety (e.g. signalling) systems, leaving the question of normalization and approval issues open. For supply industries, costs are driven high by certifying individually for each operator and sometimes even developing specialties for an operator that would not be required for a very similar operator in another city. At the same time, it is the European Supply Industry that owns a strong world wide market share but is under competition pressure with new economic powers. At least their original home market should increase the competitiveness by avoiding unnecessary certification costs. The commission has reacted to these challenges of their member state s urban transport operators and industries by publishing a Call for Tender in the FP7 on Urban Guided Transport Safety and Security, which contains all essential keywords to build a Safety Analysis and Model Reference for the future for Urban Guided Transport projects. B.1.2 Progress beyond the state of the art As outlined above the diverse state of the art will be analysed, merged into harmonized and agreed joint safety packages and extended by still missing elements to strengthen excellence of European surface transport. By this process the MODSafe team endeavours to provide for the first time a coherent and agreed Hazards Analysis and Risk Analysis. Also, beyond today s scattered landscape the MODSafe team will for the first time define agreed Safety Requirements for the safety related functions of an urban guided transport system. In order to achieve this Safety Requirements Allocation it will be necessary to construct also for the first time a Functional and Object Safety Model of an urban guided transport system. This model will in turn be based on current European Projects (MODURBAN AND MODTRAIN) and by this further use the outcomes of these projects and value them. Also, in order to improve future Cross Acceptances in the urban guided transport field an agreed process and layout for Generic Safety Cases for urban guided transport safety systems will be provided through research of MODSafe for the first time. By these innovations MODSafe as a structured European surface transport research project suggests to include and integrate the complete state of the art in the field and generate on this basis -without producing redundancies- in each Working Package major new products for the first time that are economically required by the sector and highly innovative at the same time. B.1.3 B S/T methodology and associated work plan Overall strategy and general description The overall work plan structure that we have foreseen is graphically supported by the below representation. It shall be noted, that the arrangement of the work packages is not simply a list, but arranged into a V-Model-like structure as requested per EN 50126, meaning that on the left side we arranged the active Safety Analysis and Model tasks while on the right branch we arranged all those tasks that relate to Verification, Testing, Validation, Approval, Acceptance, Certification etc. Our project proposal addresses the full Safety Life Cycle of an urban guided transport project rather than only some dedicated tasks. MODSafe Annex I DoW Page 8 of 74

9 WP 12: Dissemination & Exploitation WP 11: Financial & Contractual Management Figure 1: Overview over the MODSafe tasks, arranged into a V-Model like structure In the centre of the descending and rising branches we arranged the envisioned Urban Guided Transport Safety Model. The security related tasks are currently arranged as task structure below the V-Model, meaning that it interacts at the realization level rather than at any individual element of the traditional safety life cycle. All partial analyses will be based on previous analyses of MODURBAN and current state of the art analysis. Since some of the key proponents (e.g. TU Dresden, INRETS, RATP and Bombardier) are also involved in the current works of the ERA and related research projects, care will be taken to also involve recent knowledge of the mainline Railway Safety Domain, such as e.g. breaking down safety requirements from a higher level into component levels or Safety Management Paradigms. The European CENELEC Standards are suggesting a complete Safety Life Cycle approach for guided transport systems which will be taken fully into account where appropriate (e.g. Technical Safety Report structure or RAMS arbitration) and interpretation will be delivered where the standard as such appears inappropriate. Equally important, safety legal instruments and directives active in the Member States and often implemented since many decades (e.g. Germany, Hungary and France) will be mirror imaged with the CENELEC Standards to provide for avenues of interpretation and/or adaptation of the respective instruments. On the legal perspective, national regulations vary the most today. Some countries like Germany employ legally installed local authorities (TAB) on the level of the federal states - and accompany with own safety experts the local operators in safety acceptance and certification. Other countries shift these responsibilities in more diverse responsibility repartitioning to district or region levels with state and operator institutions interfering (e.g. France). Again other countries authorize large operators (e.g. London Underground) to supervise and manage/supervise the safety life cycle on their own. MODSafe Annex I DoW Page 9 of 74

10 While it appears difficult to justify the implementation of a Europe wide authority interfering with the safety life cycle of urban projects, the central objective of all Work Packages of MODSafe will be to yield Cross Acceptance of once proven and certified technologies in one country to another country of the European Community. Only if a harmonized and accepted Hazards and Risk Analysis and a joint Safety Requirements/Safety Integrity Level Database are available and the roles of the safety team members (e.g. Independent Safety Assessment) and the structure of Safety Cases/Safety files are clearly delineated and harmonized, the smooth cross acceptance of at least generic systems (and generic applications) appear feasible. Furthermore, we intend to structure all Work Packages Deliverables and Outputs such that their future application by the respective industries is straightforward, simple to comprehend and modify so that in the future even for a first certification of a new technology the efforts and manpower needs shall be considerably reduced. The project will be started with focussing on Automatic Train Control (ATC)/ Automatic Train Protection (ATP) considering the interactions of vehicles and infrastructure (including the interfaces to the system integration and other subsystems like the vehicle, brake systems, auxiliary systems etc.). This will be the initial focus, but not to explicitly exclude other subsystems or the safety case of whole systems for future adaptation of the proposed methods. Furthermore, an overall system approach will be followed along the entire project. B Timing of work packages and their components Below the timing of the work packages is indicated. It shall be noted, that approximately in the middle of the project a Substantial Milestone is implemented. The conclusive and agreed results of the work (e.g. list of hazards, safety requirements) before this substantial milestone are considered mandatory for the possible work continuation beyond the milestone. In addition to the milestone and individual WP-handovers the activities conducted with WP10 will ensure the coherence of the entire project and of all activities carried out within it. It is a fundamental requirement to avoid a separation between WPs or beneficiaries. It is expected, that the tasks defined for WP10 will sufficiently ensure this. The contractually ruled reporting to the EC is foreseen in the following defined steps: P1: 1 18 month P2: month P3: month MODSafe Annex I DoW Page 10 of 74

11 MODSafe Annex I DoW Page 11 of month #: : Financial and Contractual TÜV Rheinland Consulting Management kick off final deliverable 12: Dissemination and Exploitation UITP 1: Description of the State of the Art 2:MODSafe Hazard and Risk Analysis 3: Hazard Control and Safety Response Analysis 4: Common Safety Requirements 5: Functional and Object Oriented Safety Model 6: Safety Life Cycle Responsibilities 7: Acceptance, Approval, Certification 8: Level of sophistication and relevant technology of security surveillance systems 9: Global approach for integrated security needs kick off 1 kick off 1 kick off 10. Systen Approach / Consolidation 1 2 kick off INRETS final deliverable Univ. Dresden 2 kick off UITP 2 kick off 1 kick off 1 kick off 1 2 kick off 1 2 kick off 1 2 kick off RATP Univ. Dresden TÜV Rheinland InterTraffic Univ. Budapest UITP draft final deliverable Bombardier UITP final deliverable final deliverable final deliverable deliverables 7.1, 7.2 deliverables 9.1, 9.2 Univ. Budapest final deliverable final deliverable UITP w. Industry participatin RATP UITP final deliverable final deliverable final deliverable final deliverable

12 B Work package list / overview Work package No Work package title Type of Activity 1 Lead beneficiary No 2 Person- Months 3 Start Month 4 End Month 1 Determination of the RTD 6 16,90 M 1 M 12 State of the Art 2 MODSafe Hazards and RTD 9 40,5 M 1 M 29 Risks Analysis 3 Hazard Control and RTD 5 35 M 15 M 48 SafetyResponse Analysis 4 Common Safety RTD M 6 M 40 Requirements 5 Functional and Object RTD 9 37,5 M 7 M 28 oriented Safety Model 6 Safety Life Cycle RTD 1 26,25 M 7 M 28 Responsibilities 7 Acceptance, Approval, RTD 4 28,7 M 7 M 42 Certification 8 Level of sophistication RTD 10 29,35 M 9 M 48 and relevant technology of security surveillance systems 9 Global approach for RTD 10 16,75 M 8 M 42 Integrated security needs 10 System Approach / RTD 8 91,05 M 1 M 48 Consolidation 11 Financial and MGT 2 23,5 M 1 M 48 Contractual Management 12 Dissemination and OTH 10 25,75 M 1 M 48 Exploitation TOTAL 398,25 1 Codes: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable in this call. 2 Number of the participant leading the work in this work package. 3 The total number of person-months allocated to each work package. 4 Measured in months from the project start date (month 1). MODSafe Annex I DoW Page 12 of 74

13 B Deliverables list Del. no. Deliverable Name D1.1 First Draft State of the art on Safety responsibilities and Certification D1.2 Final report State of the art on Safety responsibilities and Certification D2.1 First List of Hazards, Preliminary Hazard Analysis (PHA) D2.2 Consistency Analysis and Final Hazard Analysis WP no. Lead beneficiary Estimated indicative personmonth Nature 5 Dissemi nation Level ,8 R RE M 6 Delivery Date ,5 R PU M ,2 R PU M ,2 R PU M 17 D2.3 MODSafe Risk Analysis ,1 R PU M 29 D3.1 Preliminary Hazard Control and ,5 R RE M 39 Safety Measures Analysis D3.2 Final Hazard Control and Safety ,5 R PU M 48 Response Measures Analysis D4.1 State of the Art Analysis and Compilation of Results from Previous Projects ,4 R PU M 14 D4.2 Analysis of Common Safety Requirements Allocation for MODSafe continuous Safety Measures and Functions D4.3 Analysis of On Demand Functions and Systematic Failures D5.1 Urban Guided Transport Object Safety Model D5.2 Functional and Combined Object/Functional Guided Transport Model D5.3 Safety Attributes Allocation Matrix D6.1 Survey of current safety life cycle approaches D6.2 Comparison of current safety life Cycle approaches D6.3 Proposal of a common safety life Cycle approach D7.1 Review of current AAC procedures ,8 R PU M ,8 R PU M ,8 R PU M ,2 R PU M ,5 R PU M ,5 R PU M ,5 R PU M ,8 R PU M R PU M 12 5 Codes: R = Report, P = Prototype, D = Demonstrator, O = Other 6 Codes: PU = Public PP = Restricted to other programme participants (including the Commission Services). RE = Restricted to a group specified by the consortium (including the Commission Services). CO = Confidential, only for members of the consortium (including the Commission Services). 7 Measured in months from the project start date (month 1). MODSafe Annex I DoW Page 13 of 74

14 Del. no. Deliverable Name WP no. Lead beneficiary Estimated indicative personmonth Nature 5 Dissemi nation Level 6 Delivery Date 7 D7.2 List of elementary activity modules R PU M 18 D7.3 Generic model of AAC processes R PU M 30 D7.4 Proposal of typical optimized R PU M 42 AAC process D8.1 Review of existing means and R RE M 21 measures for security systems D8.2 Guiding principles for the case by case definition of preliminary requirements for technology procurement and application ,2 R RE M 30 D8.3 Guiding principles for security and emergency prevention and management ,8 R RE M 48 D9.1 Hazard scenarios related to ,9 R RE M 18 security aspects D9.2 Database for classification of ,2 R RE M 30 risks associated to security D9.3 Proposals for mitigating security risks and threats ,9 R RE M 42 D10.1 First consensus building report R CO M 12 D10.2 Second consensus building R CO M 24 report D10.3 Third consensus building report R CO M 36 D10.4 Final consensus building report ,3 R CO M 48 D10.5 MODSafe Glosary R CO M 48 D11.1 Periodic and Final Reports ,5 R CO M 18, 30, 48 D11.2 Quality plan O CO M 6 D11.3 Annual Meeting Documentation O CO M 12, M 24, M 36, M 48 D12.1 Basic installation of the Website ,5 O CO M 3 D12.2 Dissemination plan ,4 O CO M 3 D12.3 Report on dissemination activities D12.4 Final report on dissemination activities D12.5 Final report on the activities of the SUG ,5 O CO M ,9 R CO M ,5 R CO M 48 MODSafe Annex I DoW Page 14 of 74

15 B Work package descriptions Work package number 1 Start date or starting event: M 1 Work package title Determination of the State of the Art Activity Type 8 RTD Participant id Acronym INRETS TRIT UVHC UTC LU Person-months per beneficiary: 12 0, ,25 Objectives A number of European projects have addressed various facets of guided transport safety. This WP1 will provide an overview of safety approaches to urban transport, which will integrate and address safety requirements needed for coping with the new technical, administrative, regulation and certification arrangements. INRETS will lead the work package and the other participants will contribute, verify and validate. Description of work This WP1 will review the state of the art in safety and will identify how the safety approaches are used in a large number of European Member States and compare among themselves and with those used in other safety critical industries. This work will evaluate and analyse existing approaches and available material concerning safety aspects in urban guided transport systems. Two tasks are identified : Task 1.1: Description of elements (principles, standards, regulations, new technologies, kind of systems, competencies etc.) which are used in the European States. This task is an input and a preliminary work for the WP6 and will be based on the state of the art of existing practices and national regulations. Major urban transport operators and main national safety authorities will be consulted. The outcome of relevant European (e.g. MODURBAN) and national projects will be analysed. Task 1.2: Review of existing certification processes including the security dimension (connection with WP8 and 9). This work will be performed in relation with notified bodies and safety authorities. Deliverables D 1.1 First draft State of the art on safety responsibilities and certification (M 6) D 1.2 Final report State of the art on safety responsibilities and certification (M 12) 8 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 15 of 74

16 Work package number 2 Start date or starting event: M 1 Work package title MODSafe Hazard and Risk Analysis Activity Type 9 RTD Participant id Acronym TUD TelSys RATP UITP LU BME TRIT MMA Person-months per beneficiary: , ,5 0,5 Objectives Compilation of an agreed and harmonized Urban Guided Transport Hazards and Risk Analysis. TUD will lead the work package and other participants will contribute, verify and validate. Description of work Task 2.1: Provision of a First List of Hazards/Preliminary Hazards Analysis Compilation and further extension of existing Hazard Analyses of transport operators, supply industries, research institutions and previous projects (MODURBAN, UGTMS), consolidation of the various analyses into one accepted Preliminary Hazards Analysis Database, Table Format and Fault Tree. The list of hazards including the harmonization of hazards as derived from different operational use cases will be defined. The list will be checked against demands/requirements in different countries (e.g. GTR55, STRMTG proposition). Task 2.2: Consistency of the Final Hazards Analysis Besides harmonization and consolidation of existing and available railway and urban hazard analyses, it is a main objective of this task to complete the analysis such, that no residual or even exotic combination of possible hazards in a guided transport system escapes our analysis. Previous analyses dealt often with hazard structures controlled by Train Control and Signalling Systems; operational hazards (e.g. evacuation), security effects (e.g. fire brigade dispatching), material effects (e.g. rolling stock failures), degraded operations effects (e.g. driving on sight, manual temporary speed restrictions, auxiliary route settings etc.), staff safety, maintenance safety etc. have not sufficiently been taken into account. Our MODSafe Hazard Analysis shall therefore go beyond the state-of-the-art of hazard analyses and incorporate all hazards arising from above mentioned sources. Task 2.3: MODSafe Risk Analysis The agreed Final Hazards Analysis represents the fundamental data base for a Consequence and Risk Analysis. First, every identified hazard will be subject to a consequence analysis involving amongst others: - Operating Mode - Possible resulting accidents and circumstances - Likely Severity - Possible or likely barriers - Exposure of Risk Groups to possible accident - Other barriers of frequency limiting effects 9 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 16 of 74

17 From these factors, the risk of an unresolved hazard to a Risk Group will be determined and brought into relation with the CENELEC Standards Risk Matrix to further be used for safety measure definitions and safety requirements for hazard control elements. Deliverables D 2.1 First List of Hazards, Preliminary Hazard Analysis (PHA) (M 12) D 2.2 Consistency Analysis and Final Hazard Analysis (M 17) D 2.3 MODSafe Risk Analysis (M 29) MODSafe Annex I DoW Page 17 of 74

18 Work package number 3 Start date or starting event: M 15 Work package title Hazard Control and Safety Response Analysis Activity Type 10 RTD Participant id Acronym BTSERCS Alstom Thales Ansaldo Dimet. AREVA RATP UVHC TRIT LU Person-months per beneficiary: 8,5 5 4,5 4,5 4,5 2, ,5 1 Objectives The derived PHA from WP 2 will help to identify safety measures to be taken to mitigate the resulting consequences. These safety measures/functions will be in WP4 object to a Safety Requirement Allocation process and represent therefore one base of future cross acceptance schemes for generic architectures. Therefore the harmonized hazard analysis from WP 2 will be taken and all identified hazards will be covered by safety measures. These safety measures include safety functions, procedures and also system inherent safety. As it is expected to get a complete list of hazards where protection measures have to be taken as output from WP 2, also the derived safety measures should be complete. Nevertheless the list of safety measures will be checked against different realisations of urban transport systems currently on the market. Bombardier will lead the work package and other participants will contribute, verify and validate. Description of work Task 3.1: Preliminary Hazards Control and Safety Measures Analysis Following the rationale above, a first analysis task will consist in mapping existing generic Safety Architectures from previous EC projects (e.g. MODURBAN) and other generic architectures of the supply industry with the WP3 Hazards and Risk Analysis and the WP5 Functional Model. Output of this task will be a Hazard Log file that indicates which hazards are covered/protected by which safety function. Task 3.2: Final Hazards Control and Safety Measures Analysis In a second step, possible still unresolved hazards shall be covered by additional Safety Measures, matched with the Final Hazards and Risk Analysis. It may involve to some extent also non-technical issues like procedures or paper locks. Deliverables required from other MODSafe WPs as input D 2.1 First List of Hazards, Preliminary Hazard Analysis (PHA) (M 12) 10 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 18 of 74

19 Deliverables D 3.1 Preliminary Hazard Control and Safety Measures Analysis (M 39) D 3.2 Final Hazard Control and Safety Measures Analysis (M 48) MODSafe Annex I DoW Page 19 of 74

20 Work package number 4 Start date or starting event: M 6 Work package title Common Safety Requirements Activity Type 11 RTD Participant id Acronym UITP TelSys TMB RATP AREVA Ansaldo TRIT LU MMA Person-months per beneficiary: , ,5 1,5 2.5 Objectives This work package will focus on the definition of common safety requirements for hazard control and safety response measures (WP3). While the main input will be a consolidated list of generic hazard control and safety measures, the main objective of this work package is to provide a list of common safety requirements definitions. These common definitions will help each operator to define safety requirements for new parts/elements of his systems and thus limiting the efforts for an own safety analysis. UITP will lead the work package. Description of work Task 4.1: State of the Art and Review of Results from Previous Projects Since in particular the MODURBAN project, but also other projects like MODTRAIN had already applied various methods to a number of safety functions, task 4.1 will analyse the previously performed Safety Requirement Allocations (in these projects) and compare them with actual operator safety requirement assignment methods. Task 4.1 will compare the basic assumptions and algorithms of the underlying safety assignment methods, analyse common denominators investigate the various concepts comparable (repeatable) and recommend one particular concept to future operator risk and safety requirement analysis and assignment purposes. Task 4.2: Application of the Safety Requirement Allocation Process to MODSafe continuous Safety Measures and Functions It is anticipated that the various utilized Safety Requirement Assignment methods yield identical or at least very similar results for most regular operating continuous mode functions (normal safety functions like permanent over speed protection, traditional signalling functions or movement authority limit updates). Task 4.2 will therefore apply the recommended concept to all continuous mode safety functions and methods and analyse/define Safety Requirements to the MODSafe functions. As long as these functions and safety analyses do not or only weakly depend on the specific operational context, the safety requirements can be recommended as "general common principles" to European urban rail operators (guided transport operators) as potential standard safety requirement values. Task 4.3 Analysis of On Demand Functions and Systematic Failures The treatment of on demand functions and those safety conflicts that are subject to systematic failures is currently unresolved. Since On Demand functions and also systematic failures depend heavily on the operational context, standard values like a dedicated safety 11 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 20 of 74

21 integrity level (SIL) residual rate can often not be applied. Examples for these functions/ safety measures are platform protection functions, safety inputs like train lengths or procedures for degraded (emergency) operations. It generally depends on the particular transport system how often a safety device is approached and then should reliably work. Therefore, risk analysis factors like Exposure or Cause Hazard Occurrence Rates become much more relevant. Since it may not be possible to induce and recommend Common Safety Requirements to operators for these types of functions, Task 4.3 will rather propose an adequate procedure how operators may deduce the safety requirements for these particular functions and systematic failures. Deliverables D 4.1 State of the Art Analysis and Compilation of Results from Previous Projects (M 14) D 4.2 Analysis of Common Safety Requirements Allocation for MODSafe continuous Safety Measures and Functions (M 24) D 4.3 Analysis of On Demand Functions and Systematic Failures (M 40) MODSafe Annex I DoW Page 21 of 74

22 Work package number 5 Start date or starting event: M 7 Work package title Functional and Object oriented Safety Model Activity Type 12 RTD Participant id Acronym TUD TelSys BME Ansaldo AREVA TRIT Person-months per beneficiary: 19 10,5 3 2,5 2 0,5 Objectives The main purpose of the Functional and Object Oriented Safety Model is to combine for the first time beyond state-of-the-art not only potential Hazards, Safety Requirements and functions but link these elements to a generic functional and object structure of a Guided Transport System. It will build on previous EU projects (MODURBAN, MODTRAIN) and develop in UML notation all generic Objects and Functions of a guided transport system including Civil Structures and other infrastructures, including tracks, stations etc. Rolling Stock Subsystems (Automatic) Train Controls Subsystems and Safety Systems SCADA and Telecommunications Energy and Propulsion Subsystems System Operating Procedures and Staff Tasks in Nominal and Degraded Operations (including evacuations etc.) TUD will lead the work package and other participants will contribute, verify and validate. Description of work Task 5.1: Safety Object Model First, a complete Object Model will be developed down to a generic level of detail just before realisation issues. Entries into the Object Models could be for example an Emergency Stop Handle in a Station, a carborne Safety Computer System, a wayside positioning balise or a Signal or a Work Procedure (e.g. for Evacuation). It will not include elements like a Movement Authority, a virtual block or moving block boundary or a speed value since these are rather parameters or functions than objects. The Objects will be ordered into UML class diagrams and various UML aggregations. Task 5.2: Safety Functional Model Secondly, a Functional UML Model will be generated, including all Subsystem Functions in a tree structured hierarchy model. These functions will be derived from projects like MODURBAN, UGTMS or MODTRAIN but also from other guided transport models like the AEIF Model. Function structure examples may be the generic ATC substructure into ATP, ATO and ATS, where in turn subfunction examples of the ATP may be Train Separation, Train Detection, Route Protection, Platform Protection etc., and at lowest level functions like e.g. Departure 12 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 22 of 74

23 Signal Issuance or Movement Authority Update Telegram exchange. A second part of the Functional Model development part will be the cross linking of the Functional and the Object Model. The Module will be extended to consider other subsystems and the system integration as fare as possible and applicable. Task 5.3: Safety Attributes Allocation Matrix Each pair of Object/Function will be cross referenced with the Hazards that it may be related to. From the functional Mini-Specification of each object, the concrete safety requirements for each Object/Function Pair may be derived in the model. As an example, a train separation scheme in a moving block system involves amongst others e.g. the positioning accuracy of a positioning balise. If the communicated position of a train over a balise is wrong for any reason, the train separation function may be compromised. On the other hand the functional model of the balise may include items like Mounting Position, Measurement Accuracy, Balise Position Detection for failed balise supervision. Since the Safety Requirement for the Train Separation Function in the Moving Block System will be SIL4, the subfunctions of the balise need also together produce a SIL4 result. From these considerations, the Safety Requirements of subfunctions like Mounting, or Measurement may be derived. It shall be noted that the failures related to the safety requirements may be Systematic (like mounting) or Statistical (like position measurement accuracy or balise failure). The completion of the Safety Attributes Allocation Matrix shall permit the completion and verification of the safety requirements, safety measures coverage, risk mitigation etc. Secondly, it shall be the base of a generic Safety Case Structure similar to the Technical Safety Report of the CENELEC Standards and structured into Generic Parts, Generic Application Parts and Specific Application Parts. Deliverables D 5.1 Urban Guided Transport Object Safety Model (M 16) D 5.2 Functional and Combined Object/Functional Guided Transport Model (M 22) D 5.3 Safety Attributes Allocation Matrix (M 28) MODSafe Annex I DoW Page 23 of 74

24 Work package number 6 Start date or starting event: M 7 Work package title Safety Life Cycle Responsibilities Activity Type 13 RTD Participant id Acronym TRIT BME R&B RATP INRETS UTC UITP Person-months per beneficiary: 5, ,5 Objectives The objective of WP 6 is to identify common practices and/or similarities for the safety approval of guided urban transport systems, In particular ATC-Systems by safety authorities and other involved parties, throughout the different countries of European Union. On this basis a potential common procedure for building, assessing and approving the different safety files will be developed and proposed bearing in mind the different responsibilities along the safety life cycle and the roles and authorizations of the different actors. TRIT will lead the work package. Description of work It is planned to develop and propose a standard approach or a safety life cycle for the approval and certification of guided urban transport systems (in particular ATC-Systems). This standard safety life cycle will be defined in a way which ensures applicability all over Europe. As a basis for the development of this safety life cycle a survey of the currently used safety life cycle approaches in some different European member countries (to be selected as a representative sub-set of the 27 member states) is needed. This survey will be based on the knowledge and experience of the involved partners and in addition by qualitative interview in selected countries. In order to facilitate the transition between WP1 and WP6, joint WP meeting(s) will be organized during the overlapping period. Coordination is also needed between WP6 and WP7. Task 6.1: Survey of current safety life cycle approaches The survey will particularly be focused on identifying for the different countries: The regulatory authorities responsible and competent (national ministries, agencies, prefect, public transport authority ) for delivering the authorizations regarding safety regulations to put guided urban transport systems into service. Legal status of these authorizations (regulations at the ministerial, prefectural, regional level), and validity of duration of this authorisation. Regulation, if any (decrees, ministerial orders), governing the process necessary to obtain these authorizations, and the different safety files that must be provided to the authorities: e.g. in France "decree regarding the safety of public guided transit", which requires the supply of three safety files. Regulation governing the assessment process of safety files by notified independent bodies, organizing the competence sectors (rolling stock; signalisation, track ) and 13 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 24 of 74

25 the different safety assessment levels (e.g. global system including infrastructures / transit system / subsystems), and defining the content of the safety assessment reports, Regulation governing the process for managing possible modifications concerning urban guided transport systems already in operation and the evidence and documentation that must be provided to justify that the modification will not weaken the system safety level. Regulation governing the periodic re-evaluation of the system safety, and in that case, periodicity to be taken into account. Juridical responsibilities following the legislation and regulations in force in the different countries, of the different participants (industrials, project managers, contracting and organizing authorities, owning and operating entities, independent safety assessors and notified bodies, technical departments of ministry etc) Task 6.2: Identification of similarities within current safety life cycle approaches Following the survey of current safety life cycle approaches the next phase of WP 6 will identify common practices and/or similarities and contradictions and assess the regulation background. The main phases of the safety life cycles in different European countries will be analysed regarding similarities and regarding contradictions and basic differences. The result of this task will be starting point for the development of a proposal for a unitary generic safety life cycle for guided urban transport systems. Task 6.3: Development of a common safety life cycle Based on the results of the previous analysis a common safety life cycle will be defined and proposed. The respective descriptions will especially consider the interfaces between the different life cycle phases and responsibilities. Deliverables required from other MODSafe WPs as input D1.1 First draft- State of the art on safety responsibilities and certification Deliverables D 6.1 Survey of current safety life cycle approaches (M 16) D 6.2 Comparison of current safety life cycle approaches (M 20) D 6.3 Proposal of a common safety life cycle approach (M 28) MODSafe Annex I DoW Page 25 of 74

26 Work package number 7 Start date or starting event: M 7 Work package title Acceptance, Approval, Certification Activity Type 14 RTD Participant id 4 1 6/ Acronym BME TRIT INRETS/ IFSTTAR RATP UITP UTC LU R&B Person-months per beneficiary: 9 5,5 4,7 4 1,5 1,5 0,5 2 Objectives The Acceptance, Approval and Certification (AAC-) procedures are characterized by high diversity in different European countries. Diverse actors are involved and different procedures and different roles are applied along the AAC-course in the field of urban systems, which are non-interoperable with other rail systems and very scarcely need for interconnectivity with another rail system (e.g. tram-train). The main objective of this work package is to develop a typical optimized frame for the AAC procedure based on elementary activity modules and on an analysis of current AAC procedures over Europe. Such typical optimized frame would offer relevant authorities a common reference over Europe and therefore facilitate the creation of new urban rail systems. In the following the main milestones are described in order to achieve this goal. BME will lead the work package; other participants will contribute. Description of work A typical optimized frame AAC-procedure can only be proposed based on an adequate analysis and synthesis process. The analysis phase of the WP consists of two steps: first the current AAC-procedures in different countries and cities of Europe will be reviewed. Secondly, in this survey the elementary activity steps will be identified. As a result a list of elementary activity modules will be provided. In the synthesis phase first a generic model of an AAC-procedure will be drafted based on the elementary activity modules. In a second step, based on the generic model, an optimized frame AAC-procedure will be proposed. Task 7.1: Survey of current AAC-procedures Any future proposal can reach its aim only if the current situation is clear, functions and motivations in the current processes are understood. To achieve this, a survey of current AAC-procedures in different European countries will be carried out concentrating on certification and approval issues in addition to WP1. Roles and functions will be described and activity steps of the involved bodies specified. Task 7.2: Identifying elementary activity modules A convergence of the different national and regional frame AAC-procedures may only be successful, if a generic AAC-model consists of elementary activity modules. Though carried out by different authorized bodies or at different phases of the safety life cycle the formal activities carried out in the different AAC-procedures are to a wide extent similar. A main task is to identify the major activity modules on which the AAC-processes are in principle based.. 14 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 26 of 74

27 Task 7.3: Generic model for an AAC-procedure Under this task a generic model AAC-procedure based on the elementary activity modules is modelled and proposed. Task 7.4: Proposal for a typical optimized AAC process Based on the survey and based on the generic description of an AAC-process a typical (i.e. clear, logical, complete and both in time and cost minimal resources) frame will be developed and proposed. Deliverables D 7.1 Review of current AAC procedures (M 12) D 7.2 List of elementary activity modules (M 18) D 7.3 Generic model of AAC processes (M 30) D 7.4 Proposal of a typical optimized AAC process (M 42) MODSafe Annex I DoW Page 27 of 74

28 Work package number 8 Start date or starting event: M 9 Work package title Level of sophistication and relevant technology of security surveillance systems Activity Type 15 RTD Participant id 10 14/ Acronym UITP KITE RATP LU R&B MMA Person-months per beneficiary: 4 11,6 6 0,75 2,5 4,5 Objectives Identification, categorization and assessment of relevant technologies for security surveillance and prevention and for integration into an overall safety/security model. UITP will lead the work package. Description of work Task 8.1: State of the art (also other fields of transport) The task shall use as part of inputs the State-of-the-Art outcomes of the European Project COUNTERACT and some other projects in which operators have had an important role (e.g. Prismatica FP5). Different types of existing means and measures for security enhancement will be analysed that can be useful in the domain of urban guided transport systems. In particular, the two main lines of assessment, preventive and reactive means and measures, will be considered, in association to the current activities in other domains, such as aviation and rail operations: - Preventive measures to anticipate malicious activities in other domains linked to persons integrity (passengers, staff and infrastructures); - Reactive measures against malicious activities in other domains linked to persons integrity (passengers, staff and infrastructures); - Harmonised approaches for ensuring security enhancement and protection. Task 8.2: Regulation in force and technology needed in regard to the level of sophistication This task will focus first on the assessment of the relevant regulations and norms in force at the EU level and within EU Countries at the National level. Then the existing technology for preventive protection measures and means will be evaluated. In particular, To deal with all type of laws and legal requirements, it is imperative to define the scale of laws, and the hierarchy of legal references. According to this principle, norms established by lower ranking sources are invalidated if in contrast with those coming from higher ranking. Starting from the top, a hierarchy of legal references will be developed. Techniques, methods and tools used by the operators and manufacturers (indirectly) to satisfy legal requirements in area of design, training and accident investigation will be revised. Analysis of barriers: adequacy and eventual contradiction with safety principles and procedures or environment, e.g. access control on fire doors. 15 Please indicate one activity per work package: RTD = Research and technological development (including any activities to prepare for the dissemination and/or exploitation of project results, and coordination activities); DEM = Demonstration; MGT = Management of the consortium; OTHER = Other specific activities, if applicable. MODSafe Annex I DoW Page 28 of 74