CSM DT Level Crossing Example. 30 th November 2016 ERA CSM DT Workshop - Valenciennes Jens Braband - Siemens UNIFE

Transcription

1 CSM DT Level Crossing Example 30 th November 2016 ERA CSM DT Workshop - Valenciennes Jens Braband - Siemens UNIFE

2 Contents Background System definition Technical System functions Scope Hazard identification Application of CSM DT Validation Apportionment Conclusion 2

3 Level Crossing Fatalities are the third largest group of railway fatalities (after suicides and trespassers) Level Crossing accidents also contribute to railway delays One means to reduce fatalities and delays would be to introduce more automated Level Crossings However up to now harmonised safety requirements are missing CSM DT, if reasonably applied, could be a means to set such standardised requirements Background

4 The example has its origin in It was already part of the CENELEC WGA10 report, which was the predecessor of annex A of EN (re-issued as R ). All concepts of EN were validated on this example. It has been often discussed and has been published in several papers. It was re-used in the generic approach of the risk analysis of Deutsche Bahn AG. Background

5 System Definition Clearance gauge Road signal (04) Sighting point OFF Switch-off (02) Danger zone = length of LX + length of longest vehicle Road Braking distance Visible area Sighting point Distant signal (03) Braking distance Controller (07) Pow er sup ply (06) ON Strike-in distance Normalisation (05) Switch-on (01)

6 Technical System Functions No. Functional unit Remarks 01 LX switch-on Triggers activation of the LX when a train approaches (implemented by means of wheel detection equipment, e.g. an axle counter). 02 LX switch-off Triggers deactivation of the LX once a train has left the crossing (implemented by means of wheel detection equipment, e.g. an axle counter). 03 LX monitoring Displays the state of the LX to the train driver or interlocking (implemented e.g. by means of a distant signal) to allow monitoring of LX operation. 04 Road signalling Displays the state of the LX to road users 05 Normalisation Returns the LX to the normal position (no protection) if it is switched on and then not switched off within a certain time (due e.g. to a detector failure or the train stopping before the LX etc.). 06 Power supply Consists of the normal power supply system or, as a fall-back level, a battery capable of operating the LX for a limited period, e.g. 2 hours. The battery voltage is remotely controlled by the interlocking. 07 Controller Operates and controls the LX. A programmable electronic device which contains application software, site-specific data etc.

7 Scope Generic automated level crossing with traffic lights and monitoring: Status is signaled to train driver Line speed up to 160 km/h Roadtraffic regulations are in place Particular regulations may require additional protection e. g. barriers Extensive operational experience and accident data is available Similar to Swiss type MINI.

8 Methodological approach: Functional failure analysis (FFA) Historical event data (validation) Check if identified events are boundary hazards (w. r. t. system definition) and not causes of other hazards Focus in the example is on one hazard failure of LX to protect public from train Broadly acceptable risk not applicable Hazard Identification

9 Application of 2.5.5: Application of CSM DT The hazard is a result of a failure of a technical system If the LC protection fails there is only a slight chance that a road user or the train driver might prevent the accident. Both rely on the correct function -> credible direct accident Only a few people are typically affected (usually the car passengers and train driver, sometimes a small number of train passengers in the front car of the train) The potential for fatality clearly exists The most credible unsafe consequence is a critical accident as typically there is not more than one fatality (less than 99% of the significant accidents are serious). Thus choice of category (b) is justified (10-7 /h DT)

10 Validation Evaluation of Severity Statistics: EU statistics reported 282/300/373 fatalities and 287/296/336 serious injuries for 506/510/573 significant accidents in 2014/13/12 Less than 5% of the victims were train drivers or passengers In LC accidents (about 1%) were labeled potentially serious by ERA (without necessarily meeting the definition of a serious accident) DB statistics show similar results Note that accident severity is largely independent of the cause

11 Validation Some remarks on expert judgment: There are many scientific reviews e. g. Eliciting Expert Judgments: Literature Review, acera, 2006 There exists a lot popular literature, e. g. Kahnemann, Taleb, Surowiecki All sources agree that expert judgement without a proper methodological background leads to overly conservative results, mainly due to common psychological phenomena So, if reliable statistics exist, expert judgement is not the premiere choice

12 Validation Risk acceptance principles: Code of Practice: German standard DIN V covers explicitly LC and gives similar results Reference System/Explicit Risk Analysis: DB risk analysis (based on a particular risk matrix) leads to similar results Explicit Risk Analysis: Swiss LC example No SIL allocation at this level. Noting the uncertainties contained in risk analyses and slightly different assumptions the consistency of the results is satisfactory.

13 Standard EN approach Apportionment

14 Conclusion Meaningful application of CSM DT to LC is feasible if the regulation is applied as written (most credible unsafe consequence) reasonable severity estimates of the typical consequences are made Otherwise worst case estimates based on expert judgment will dominate introduction of more automated LC and progress of railway safety will be slowed down

15 Discussion and Questions Thank you for your attention!