Authorities Approval Process Plan Fjernbane Onboard SP-FB-FOB

Transcription

1 SP-FB-FOB

2 Revision: Ver. Date Author Review Approved Remarks XSICU XKAIT For Internal Review XAAV XDARA MFBK XDCN KRBU XCSLN JGHT XSICU XASK XDCN For review by Suppliers and RUs XSICU XASK Updated following comments DSB (PHH) Siemens (FJA) from suppliers and RUs Update consider NSA comments Alstom (AAH) on BL2 AAPP and BL2 EGO test Application S-ISA (ETCS) XSICU XASK XDCN Updated following stakeholder comments (SP-FB-FOB ). Updates following Onboard Generic Design Review XSICU XDCN PEMO Updated following new sw release approval strategy. Reviewed with PEMO XSICU XASK XDCN Review according to G-ISA comments SN486 and Executive Meeting SP NSA on XSICU XASK XDCN Review according to G-ISA XJOWI comments SN486 issue XSICU XASK XDCN Review according to G-ISA comments SN486 issue 03 Authorities Approval Process Plan SP-FB-FOB Banedanmark Signalprogrammet Amerika Plads København Ø Author: Simone Curletto Mail: Phone: Phone direct: 8234

3 Authorities Approval Process Plan Table of Contents Page 1 Introduction Reader s Guide Abbreviations References Known Open Points Scope Document Scope Safety Planning and documentation System Definition(s) Applicable TSI CCS TSI Loc & Pas TSI 14 3 Authority Approval Process Outline Legal Requirements Legislation Elements Stakeholders Detailed Process Approval process for Test and Transport Approval process for First of Class and series Approval process for changes Dependencies and Prerequisites 30 4 Approval Process flowchart for Test and Transport Approval Process flowchart for First of Class train... 33

4 1 Introduction The Project (FOB) is part of the Banedanmark Signalling Programme (BDK SP) and covers the complete replacement of the legacy Onboard ATC system with ERTMS Level 2 Baseline 3 Control-Command and Signalling Onboard Subsystem (CCS OB SS) on railway vehicles operating on the Fjernbane railway network. FOB is to support two early deployment programmes undertaken by the Fjernbane Infrastructure project, and the roll out will be completed by During these migration stages, trains will be also equipped with a Danish Specific Transmission Module (STM- DK), to allow trains to operate on tracks equipped with legacy trackside ATC. This Authority Approval Process Plan (AAPP) aims to plan and detail the approval process for achieving the APIS for the railway vehicles scope of the Onboard Project, in accordance with BEK 653 (ref. [R5]). 1.1 Reader s Guide This document addresses the following chapters: Chapter 1 Introduction: A brief description of the project that this AAPP addresses is given in this chapter along with a reader s guide, abbreviations and references. Chapter 2 Scope: The scope of this document covering the purpose and content is described in this chapter. Chapter 3 Authority Approval Process: This chapter describes the detailed process for obtaining the required authority approval(s)/authorisation(s). This includes the involved process elements and process stakeholders of the project s required approval(s)/authorisation(s) and the details of each approval/authorisation including internal dependencies and prerequisites. 1.2 Abbreviations AAPP ALS Alstom APIS Authorisation for Placing In Service (BEK 653) ATC Automatic Train Control BEK BDK BL CCS CSM-RA EDL EGO ERTMS Bekendtgørelse (NSA s Executive Order) Banedanmark Baseline Command-Control and Signalling Common Safety Method on Risk evaluation and Assessment Early Deployment Lines (Level 2 operation) Experience Gathering Operation European Rail Traffic Management System SP-FB-FOB

5 ETCS FOB FoC IC NA NSA NNTR OB PEMO RU SP SRAC STM-DK TE TSA TSI European Train Control System First of Class Interoperability Constituent Not Applicable National Safety Authority (Trafik og Bygge-styrelsen) Notified National Technical Rules Onboard Programme Engineering Management Office Railway Undertaking Signalling Programme Safety realted Application Conditions Specific Transmission Module Technical Expert ( sagkyndig in Danish) Technical System Authority Technical Specifications for Interoperability 1.3 References [R#] Referenced Documents Version Document Number [R1] Commission Implementing Regulation (EU) No N/A N/A 402/2013 of 30 April 2013 on the common safety method for risk evaluation and assessment and repealing Regulation (EC) No 352/2009, as amended by 2015/1136/EU [R2] Directive 2008/57/EC of the European Parliament N/A N/A and of the Council of 17. June 2008 on the interoperability of the rail system within the Community, as amended by 2009/131/EC, 2011/18/EU, 2013/9/EU, 2014/38/EU and 2014/106/EU [R3] Signalling Programme Safety Plan 3.0 SP-SA-P [R4] Signalling Programme Hazard Management Plan 3.0 SP-SA-P [R5] Bekendtgørelse om godkendelse af køretøjer på N/A N/A jernbaneområdet, BEK nr 653 af 08/05/2015, amended by BEK nr 859 af 7/7/2015 [R6] Alstom Interoperability Certification Plan (ref. T- B T-23 A A Release B) [R7] Commission Decision 2010/713/EU of 9 November N/A N/A 2010 on modules for the procedures for as- sessment of conformity, suitability for use and EC verification to be used in the technical specifications for interoperability adopted under Directive 2008/57/EC of the European Parliament and of the Council [R8] Bekendtgørelse om køretøjers tekniske kompatibilitet med jernbanenettet, BEK nr af 30/11/2012. N/A N/A SP-FB-FOB

6 [R#] Referenced Documents Version Document Number [R9] Verifikationsforskrift for DK-STM BL IN Q4236 [R10], Fjernbane Onboard Baseline 2 Project 5.0 SP-FB-FOB [R11] Alstom DK F-bane Onboard Project Safety Plan F T-23 A [R12] Rail Freight Corridor 1 NSA Working Group 1.0 N/A Guideline for CCS Authorisation on Rail Freight Corridor 1, version 1,0 dated 13/12/2013 [R13] Commission Recommendation 2014/897/EU on N/A N/A matters related to the placing in service of structural subsystems and vehicles under Directive 2008/57/EC and 2004/49/EC of the European Parliament and of the Council (also known as DV29 Bis) [R14] Commission Decision 2012/88/EU on the technical N/A N/A specification for interoperability relating to the control-command and signalling subsystems of the trans-european rail system. Amended by: Commission Decision 2012/696/EU [R15] COMMISSION DECISION (EU) 2015/14 N/A N/A amending Decision 2012/88/EU on the technical specification for interoperability relating to the control-command and signalling subsystems of the trans-european rail system [R16] DK F-Bane Onboard V&V And Master Test Plan D T-23 A from Alstom/SP-FB-FOB doc [R17] Approval Milestones Dependency Map 1.0 SP-SA-P SA-P pdf [R18] NSA Memorandum Who should be the Applicant for an APIS and what is the role? N/A TS [R19] Tender Document, Sub Appendix N/A SP-FB-FOB , The Onboard Customers list of Rolling Stock Generel, Management/SP-FB-FOB xlsx [R20] COMMISSION REGULATION (EU) No N/A N/A 1302/2014 concerning a technical specification for interoperability relating to the rolling stock locomotives and passenger rolling stock subsystem of the rail system in the European Union [R21] COMMISSION REGULATION (EU) No 1303/2014 concerning the technical specification for interoperability relating to safety in railway tunnels of the rail system of the European Union N/A N/A SP-FB-FOB

7 [R#] Referenced Documents Version Document Number [R22] EC Intermediate Statement of Verification by N/A Dated 02/10/2015 BDK for BL2 EGO test with DSB litra MR4031/ %20Interoperability/SP-FB-FOB pdf [R23] Ibrugtagningstilladelse for MR 4031/ NSA approval for BL2 EGO with DSB litra MR N/A TS , Dated 21/12/ %20Interoperability/SP-FB-FOB pdf [R24] NSA - Onboard Minutes of Meeting of 12 December 1.0 TS [R25] Onboard Test Readiness Review Checklist (Template) 3.0 SP-FB-FOB Integration/SP-FB-FOB docx [R26] Recommendation N. ERA-REC /REC N/A N/A of the European Railway Agency on amending and recasting Commission Decision 2012/88/EU on the Technical Specification for Interoperability relating to the Control-Command and Signalling Subsystems, dated 10/12/2015 [R27] Safety Target Determination and Apportionment, 1.0 SP Fjernbane [R28] DK F-BANE Onboard Generic System Definition. E T-23 A Baseline 3 [R29] Minutes of Meeting, BDK meeting with Fjernbane Onboard NoBo, Copenhagen, SP-FB-FOB [R30] Ny vejledning om godkendelse af softwarebaserede systemer 1 28/02/16 N/A SP-FB-FOB

8 1.4 Known Open Points 1 ID Point Issue Status 1. CCS TSI version after EDL Planning for upgrade after software release (certified against CCS TSI version corresponding to Subset 26 SRS 3.3.0, ref. [R14]) is not yet finalized: the target for signalling programme is the ETCS Baseline 3 Release 2, currently available as a draft (ref. [R26]). Banedanmark Signalling Programme is currently discussing with supplier the planning for further software releases including impacts of Release 2 on the project. Open 2. Section General, trains operating across Danish German border Onboard approval for ERTMS Level 2 operation is dependent on the Train Track System Validation activities, which are lead by SP EMO. These activities are identified in the Fjernbane Approval Milestones Dependency Map (ref. [R17]). This AAPP may be updated in the future once the list of TTSV is finalized. Some of the railway vehicles scope of Onboard Project are operating across the Danish - German border, currently located at Padborg station. Such trains are equipped with legacy German ATC (Indusi). Whether the legacy German ATC will be retained or it will be replaced by a German STM is a decision to be confirmed at Signalling Programme Level. Draft Open 1 With respect to version 2.0 of AAPP: Open point on SE-DK cross boarder train moved to section Open point operation L0 or ETCS switched off for white and yellow fleet without STM is now closed and explained in section 3.1. SP-FB-FOB

9 2 Scope This chapter defines the scope of this document (section 2.1) and the scope of the project applying for one or more approval(s) or Authorisation(s) for Placing in Service (APIS) at the National Safety Authority (NSA) (section 2.2). 2.1 Document Scope The scope of the FOB AAPP is to outline the activities and documentation necessary for applying and obtaining the Authorisation for Placing into Service (APIS) of the railway vehicles scope of the Signalling Programme Onboard Project. This document is used as a coordination tool between the Signalling Programme and the NSA on how to obtain the necessary approval(s)/authorisation(s). Because the project AAPP defines the overall split of responsibility of the independent assessment organisations, its content is agreed with the independent assessment organisations before the document is sent to the NSA for acceptance. The AAPP is prepared by Banedanmark as proposer of the APIS, and addresses the actors tasks and risk management activities as required by CSM-RA (ref.[r1]). Special arrangements that might occur for specific litras will be described in the specific system definition Safety Planning and documentation The present Authority Approval Process Plan covers the requirements for planning and description of the risk management process ad required by CSM-RA (ref.[r1], section 1.1.6) for which Banedanmark is acting as Proposer. Tabel 1: Mapping to CSM-RA requirements for safety documentation CSM-RA ref.[r1] 5.1. The risk management process used to assess the safety levels and compliance with safety requirements shall be documented by the proposer in such a way that all the necessary evidence showing the suitability of both the application of the risk management process and of its results are accessible to an assessment body The documentation produced by the proposer under point 5.1 shall at least include: Safety Documentation - Fjernbane Onboard (present document) - System Definition and Hazard Record (Generic and Specific) See below SP-FB-FOB

10 CSM-RA ref.[r1] (a) a description of the organisation and the experts appointed to carry out the risk assessment process; (b) results of the different phases of the risk assessment and a list of all the necessary safety requirements to be fulfilled in order to control the risk to an acceptable level; (c) evidence of compliance with all the necessary safety requirements; (d) all assumptions relevant for system integration, operation or maintenance, which were made during system definition, design and risk assessment. Safety Documentation - Fjernbane Onboard (description of organizations and roles) - Hazard Record Report (Generic and Specific, with reference to hazard workshops, showing competence of people involved in the specific risk assessment tasks) - System Definition (Generic and Specific, including list of safety requirements at the end of the iterative risk assessment process) - Hazard Record Report (Generic and Specific, showing the different phases of the risk assessment process: risk analysis including the hazard identification and risk evaluation ) - Hazard Record Report (Generic and Specific, including evidence of fulfillement of safety requirements on delta approach) - System Definition (Generic and Specific, providing Safety Requirements, reference to user and maintenance manuals, assumptions for limiting the risk assessment) - Hazard Record Report (Generic and Specific, including analysis of suppliers SRACs which became safety requirements for the system definition) Alstom s safety planning is detailed in their safety plan (ref. [R11]). In the cases where RUs (approved/authorised by the NSA) are acting as proposer (see section 3.3.1), the planning of safety activities is managed within each RU s Safety Management System and it is not covered by this AAPP. The Risk Assessment Process will be developed in compliance with CSM-RA (ref.[r1]). The risk analysis, including the hazard identification, and risk evaluation. The risk acceptance criterion for hazards evaluated by explicit risk estimation will be that "safety will be at least as good as today" as defined the Hazard Management Plan (ref. [R4]), or by applying the Design Target when applicable as defined by other CSM-RA (ref.[r1], amendment 2015/1136/EU). A quantitative safety target had been allocated by Signalling Programme during contractual stage (ref. [R27]) in terms of THR for Onboard ETCS equipment and interfaces, set at 2x10-9 hazards /h for each fitted train. This target is in line with the THR for Onboard ETCS defined in TSI (ref. [R14], Subset 91) and set at 0.67x10-9 dangerous failures/hour. The process for demonstration of this safety requirement is described in Alstom s Safety Plan (ref. [R11]) and results are presented in the Generic System Definition (ref. [R28]). Hazards associated with explicit risk evaluation, and which are not related to the Onboard Safety Target of the Signalling Programme [R27], or to the Design Targets as defined by CSM (ref. [R1]), a specific risk analysis will be undertaken in accordance with the Haz- SP-FB-FOB

11 ard Management Plan (ref. [R4], section 4.3.3) to determine the acceptability of each hazard. 2.2 System Definition(s) The Onboard Project covers the installation of the STM-DK/ETCS on board the existing railway vehicles. The main purpose of this equipment is to provide protection to the vehicles operated in level NTC, Level 0 and level 2, interfacing with the ETCS onboard subsystem. That allows the operation of the vehicle on the Danish ATC equipped lines. The vehicles scope of the Onboard Project are the existing railway vehicles operating on Fjernbane networks and private lines in Denmark. There are two main groups of railway vehicles scope of onboard project 2 : White Fleet Vehicles: locomotives, multiple units and driving trailer for the double-decker carriage used for operating passenger service Yellow Fleet Vehicles: Ballast regulators, tamping machines, track stabilizers, service vehicles etc., used for track works and maintenance It should be noted that the some trains (private line trains or yellow fleet) will not be fitted with STM-DK as they have no ATC today. Some other trains, operating in both Sweden and Denamark across the Øresund bridge, will be fitted with both STM-DK and STM-SE: the latter is part of a development process carried out by Trafikverket, the Swedish infrastructure manager (see section ). The principal configuration for the onboard ERTMS installation is shown in Figure 1 2 Tender Document, Sub Appendix 1, The Onboard Customers list of Rolling Stock Generel, SP-FB-FOB include the list of vehicles scope of onbaord project. Is updated regularly following contractual agreements with RUs. Currently, 35 FoC trains are offcially confirmed in the scope of teh Onboard Project. SP-FB-FOB

12 Driver Maintenance Crash Protected Memory DLS 6 Juridical ETCS Train Interface 1-3 CCS OB SS 4-3 ETCS DMIs 9 SSI switches ETCS Isolation Lamp 4-1 ETCS Isolation switch Ethernet Switch Ethernet Time Reference/ GPS COMET (serial) EVC Power Supply COMET (DMI and TRU Functions) EVC (ETCS + ATO) 5 COMET (RMR function) COMET (Buses) PB PB STM DK STM DK Isolation switch 4-2 Havarilog 7-1 Extra Speedometer STM DK Train Interface Radio Voice 12 CMD Power Supply Cold Movement Detector Odometry EURO- RADIO BIU TIU BTM K STM SE 11 STM SE Isolation switch Additional Lamps STM SE Train Interface Dead Man Train motion KMC Trackside EURORADIO Emergency Brake System Service Brake System 3-1 Level 2 Radio Communication 3-2 Traction System Trackside BALISE Existing Rolling Stock scope STM DK Supplier Scope STM SE Supplier Scope Infrastructure Scope Alstom Scope Options Figure 1: Principal configuration of the STM-DK/ETCS Installation In accordance with the CSM-RA for all changes to a railway there shall be a System Definition, defining precisely the change to the railway (the objective of the APIS). The figure below depicts the impacts of the implementation of the CCS OB SS on the structural and functional subsystems composing the Railway System, as defined by the Interoperability Directive (ref. [R2]). SP-FB-FOB

13 Impact of the CCS OB SS Vehicle RST SS INF SS CCS OB SS OPE SS MAI SS CCS TS SS Structural SS Functional SS ENE = Energy, INF = Infrastructure, RST = Rolling Stock CCS = Control, Commanda and Signalling, OPE = Operation and Traffic management, MAI = Maintenance, TAP = Telematic Applications for Passenger Service, TAF = Telematic Application for Fraight Service, OB = Onboard, TS = Trackside, SS = Subsystem Figure 2: Impact of the STM-DK/ETCS A System Definition for each train type will be issued addressing the interfaces with the railway vehicles, with the purpose to carry out the risk assessment (see section ) 2.3 Applicable TSI CCS TSI Onboard is candidate version for starting train fitment and STM commercial operation with CCS TSI version corresponding to Subset 26 SRS (ref. [R14]) including some Change Request related to Subset 26 SRS (ref. [R15]) and specific Danish functionalities. Strategy decided by Signalling Programme is to have an upgraded version for starting EDL commercial operations in ETCS L2, onboard software release 6.4.0, which includes on top of the previous releases, the following changes: Level Crossing activation: change requested by SP PEMO for integration with current implementation by infrastructure project SP-FB-FOB

14 Customized DMI for STM: changes requested by BDK TSA and driver instructors to improve visualization function of STM The software release is based on CCS TSI version corresponding to Subset 26 SRS (ref. [R14]), and considering some but not all the Change Requests (CRs) related to Subset 26 SRS (ref. [R15], so called Maintenance Release 1),which is the current legal basis. The analysis of CRs beyond the scope of version, i.e. CRs applicable to version, is performed by Alstom at ETCS product level (i.e. product level, ref. [R29]). It should be noted that formally, for the software release 6.4.0, the NoBo certification does not address the CRs beyond 3.3.0, although these are considered by Alstom s safety process and ISA at Interoperability Constituent level and eventually exported at Subsystem level, when applicable, as SRACs. Furthermore, the updated draft version of the CCS TSI has been made available by ERA (ref [R26], so called Release 2): this version is identified by PEMO as the target for the Signalling Programme, Planning for upgrade after software release is not yet finalized. This is currently an open point Loc & Pas TSI NSA Decision regarding the Baseline 2 project (see ref. [R10]) requires the involvement of a NoBo to verify changes to the Rolling stock sub-system with regards to TSI LOC&PAS (ref. [R20]) and SRT (ref. [R21]). Onboard Project considers that there is a renewal of the Rolling Stock Subsystem: the major change is the upgrade of the CCS Subsystem, which is not part of the Rolling Stock subsystem. As a consequence, there are some changes in the Rolling Stock (mainly the desk configuration and DMI). Therefore, regarding the Rolling Stock Subsystem a renewal (as defined by Interoperability Directive (ref. [R2]) any major substitution work on a subsystem or part subsystem which does not change the overall performance of the subsystem ) is considered. In order to comply with NSA Decision, during the development of BL2 project BDK SP FOB has performed a review of the above requirements to identify the parameters affected by the installation of STM-DK/ETCS as follows: A first analysis has been made by BDK SP examining the TSI LOC&PAS clause by clause. G-NoBo has been consulted by BDK SP during the analysis; Alstom has reviewed this analysis based on previous projects experience; A document has been issued by Alstom to formalize this analysis; BDK SP has requested G-NoBo to endorse the result of the analysis; G-NoBo has assessed the list as complete few remarks accepted by BDK SP and Alstom. The following Table 1 presents the result of the above analysis. SP-FB-FOB

15 Clause Title Standard/Rule Comment Fixing of devices to car body structure Load conditions and weighted mass EN :2010 EN 15663:2009 Included as design requirement in Alstom s delivery. It refers to testing in accordance with EN Alstom s Environmental Test Plan (T-23 A425698) covers also EN 61373:2010 for testing of equipment used for Onboard Project. Assessed by S-ISA. Covered by BEK 1127 / overenstemmelseserklaring, including running dynamic behaviour for each FoC. EN provides definition for vehicle mass calculation. EN allows up to 10 % change in the mass without having any further investigations for vehicles with with primary and secondary suspension. This is the case for TSI CCS installation Assessed by DeBo Gauging TSI INF Covered by BEK 1127 / overenstemmelseserklaring for Environmental conditions Protection against electrical hazards Driver s desk Ergonomics EN :2014 EN 50153:2002 each FoC. Alstom s design aims to install equipment within the referential train (original envelop), so existing gauge is not affected. Assessed by DeBo. EN :1999 is included as design requirement in Alstom s delivery, as well as EN :2006 for EMC. These standards are addressed in Alstom s Safety Case (GASC and SASC). Assessed by S-ISA. Included as design requirement in Alstom s delivery: It is a requirement for the products and for their installation in the vehicle.etcs equipment is not accessible to passengers. Installation constrains are checked by NoBo during installation audits. Installation quality is assessed by NoBo. - Design based on Alstom s experience in order not to disturb the normal operation of the vehicle. It is covered by driver s acceptance. Addressed by Signalling Programme Human Factor team in coordination with supplier and driver union. Relevant safety aspects are included in the CSM Process a Project Level Assessed by G-ISA when applicable Speed indication TSI CCS Covered by TSI CCS Assessed by NoBo for CCS Driver display unit and screens TSI CCS Covered by TSI CCS Assessed by NoBo for CCS SP-FB-FOB

16 Clause Title Standard/Rule Comment Recording device TSI OPE JRU is the recording device for signaling system. Havarilog Emergency lighting EN 13272:2012 is the recording the device for rolling stock, and it is fitted only on trains equipped with legacy ATC. This has been discussed and agreed with TBST. No further assessment. The capacity of the train battery will be discuss with the RU and checked for each train, according to Alstom s document Installation Impact Analysis for each FoC. Assessed by S-ISA for CCS Material requirements Documentation related to maintenance Interface with the control, command and signalling subsystem EN : Running Capability EN 50553:2012 CCS equipment (both ETCS and STM-DK) is in accordance with EN Both systems can be isolated (EB bypassed) to allow train to move in case of failure or fires affecting the CCS system functioning. Cabling path involving isolation is following current path of ATC cables. Assessed by G-ISA. Included as design requirement in Alstom s delivery, Fire ad smoke report (T-23 E144096). It applies also to STM- DK and STM-SE. Assessed by S-ISA for CCS TSI CCS - Technical file for by CCS address maintenance documentation. Assessed by NoBo for CCS Covered by TSI CCS Assessed by NoBo for CCS Table 1: TSI LOC&PAS affected by the installation of a STM-DK/ETCS Compliance with the above clauses is applied on voluntary basis, as rolling stock subsystem is subject to renewal. Compliance with TSI Loc & Pas only applies to installation norms applicable to the changes resulting from installing Onboard CCS, no Notified Body for Loc & Pas TSI is involved. This approach was part of BDK application for BL2, as stated in the Declaration of Verification (ref. [R22]). This approach has been accepted and approval granted (ref. [R23]). Details on how each point is implemented in the onboard design will be provided to NSA as separate document or presentation. SP-FB-FOB

17 3 Authority Approval Process This chapter describes the process agreed in the project for obtaining the required approvals/apis. Section 3.1 outlines the process in overall terms, section 3.2 the legal requirements including legislation, process elements and stakeholders and section 3.3 the approval process described in detail for each system that requires approval in the project. 3.1 Outline The strategy for onboard approval depends on the roadmap for onboard software releases up to the final target of TSI CCS R2 (see section 2.3.1); whether the trains fitted before early deployment will be equipped or not with STM-DK (see section ). The onboard approval migration Steps vs. Onboard software release plan (see section 2.3.1) are depicted in Figure 3. Onboard APIS migration Plan 6.y.y 6.x.x SRS (R2) Onboard Software release SRS (MR1) APIS LNTC/L0/L2 (change) CCS TSI version SRS APIS LNTC/L0/L2 EGO LNTC/L0/L2 Software Update & TTSV Approvals for commercial operation of FoC & series (BEK 653) EGO LNTC/L0 Software Update & TTSV Legacy Infrastructure Early Deployment Infrastructure Roll Out Figure 3: Onboard Approval Migrationstrategy vs. Onboard software relase plan With reference to the applicable version of the CCS TSI (see section 2.3.1) the Onboard Signalling programme intends to apply for the following approvals: Experience Gathering Operation (EGO) application for commercial operation with passenger in Level NTC (when available) and Level 0, on existing lines (ATC, ATP and unfitted lines). SP-FB-FOB

18 Experience Gathering Operation (EGO) application for commercial operation with passenger in Level NTC (when available), Level 0 and Level 2, limited to operation on Early Deployment Lines. APIS application for commercial operation in Level NTC (when available), Level 0 and Level 2, for infrastructure roll out. It should be noted that the onboard project will apply for EGO until a certification of the onboard against a valid legal basis is available (See section 2.3.1). APIS application will be submitted to NSA when covered by a valid legal basis. the onboard approval migration steps related for each FoC and series is presented in Figure 4 below, including some activities that will be carried out for the Test Train, i.e. the first train fitted with Baseline 3 STM-DK/ETCS 3. Approval Level 0 and Level NTC Test Train (Litra MR/MRD) Handover From RU Fitment and Commissioning Test & Transport STM and ETCS Dynamic Tests on closed track L0/LNTC Handback to RU FoC (Litra xx) Handover From RU Fitment and Commissioning Test & Transport STM and ETCS Dynamic Tests on closed track L0/LNTC Handback to RU Series N.1 (Litra xx) Handover From RU Fitment and Commissioning Covering the whole train series Handback to RU Approval Level 2 (additional to Level 0 and Level NTC) Test Train (Litra MR/MRD) Handover From RU Software Upgrade and Commissioning Test & Transport Train Track Validation Tests (On specific TS CCS) on closed tracks L2 Handback to RU Possible site tests based on delta approach depending on FoC FoC (Litra xx) Handover From RU Software Upgrade and Commissioning L2 Handback to RU Series N.1 (Litra xx) Handover From RU Software Upgrade and Commissioning Covering the whole train series Handback to RU First Handover / Handback Figure 4: Onboard approvals migration steps for FoC Approval for Test and Transport: upon completion of installation and commissioning tests in the workshop, the First of Class train undergo low speed and high speed dynamic testing on specific tracks closed to traffic (see section for details). 3 The Onboard Project will fit 4DSB s Litra MR trains with STM-DK/ETCS equipment: these trains will not be used by DSB for commercial service and will be used to support the train track integration activities carried out at Signalling programme level. SP-FB-FOB

19 Approval for ERTMS Level 0 and/or Level NTC: upon completion of installation, commissioning and dynamic testing, application for approval in Level NTC and/or Level NTC (Danish STM) will be sought for each FoC. Trains not fitted with STM-DK (i.e. without ATC today) will operate in Level 0 before Early Deployment Lines (see section for details). Second Handover / Handback Approval for ERTMS Level 2 4 on a specific network: this activity consists in the Track Train System Validation defined by Fjernbane Approval Milestones Dependency Map (ref. [R17]) between the Onboard CCS with a specific Trackside CCS. This is a programme level activity, see section for details. Approval for Test and Transport it is also expected for Track Train System Validation: this is also a programme level activity, see section for details; It should be noted that for yellow fleet owned by BDK, it is under investigation the possibility to operate the vehicles with ETCS isolated with a sealed switch as soon as the installation is completed and before Early Deployment Lines. This approval will be approached as Significant Change in accordance with BDK Trace process for obtaining BDK K&S approval. 3.2 Legal Requirements This section describes the legal requirements for obtaining the project approval(s)/authorisation(s). The section is divided into three subsections addressing the specific legislation that the project must comply with (section 3.2.1), the elements of the legislation that must be in place (section 3.2.2) and the involved stakeholders (section 3.2.3) Legislation The main legislations that this project must comply with are the following: [R5] [R8] [R1] Bekendtgørelse om godkendelse af køretøjer på jernbaneområdet, BEK nr 653 af 08/05/2015 Executive Order on the Approval of Railway Vehicles Bekendtgørelse om køretøjers tekniske kompatibilitet med jernbanenettet, BEK nr af 30/11/2012. Executive order on vehicle technical compatibility with the rail network Commission Implementing Regulation (EU) No 402/2013 of 30 April 2013 on the common safety method for risk evaluation and assessment and repealing Regulation (EC) No 352/ It is noted that Level 1 is also supported by Alstom generic ETCS product (ref. [R11]). Howevere there is Level 1 infrastructure currently foreseen in the Signalling Programme scope, therefore Level 1 will be not be scope of the APIS application. SP-FB-FOB

20 [R2] Directive 2008/57/EC of the European Parliament and of the Council of 17. June 2008 on the interoperability of the rail system within the Community, and amendments Elements The elements that form the basis for application for approval to the NSA for the different migration steps outlined in section 3.1, are defined and described in the following sections. The elements included in each application package are presented in detail in section System Definition The System Definition shall be developed in accordance with CSM-RA (ref. [R1]) for changes introduced to the railway system. The System Definition will be prepared following the guidelines from SP Safety Management and NSA (ref. [R3]). The System definition shall form the basis for the development of the risk management process as defined in CSM-RA (ref. [R1]) Hazard Record Hazard Records will be produced in accordance with the Hazard Management process as defined in CSM-RA (ref. [R1]) for changes introduced to the railway system on the basis of the System Definition (section ). The Hazard Records will be established through hazard identification workshop sessions and updated and maintained by means of regular safety working group meetings. The Hazard Management process will be developed in accordance with the process described in the Hazard Management Plan (ref. [R4]).. The hazard record, which uses the hazard record template from the Hazard Management plan, lists in the detail each step as required by Hazard Management Plan and CSM-RA. The Hazard Record document will be prepared to present the results of the analysis carried out at each step, organization involved and eventually with the list of the safety requirements, in accordance with CSM-RA (ref. [R1]) Significant Change Assessment In accordance with the CSM-RA (ref. [R1]) and BEK 653 ref. ([R5]) a Significant Change Assessment shall be provided with the scope to assess whether or not a change to the railway system requires the full application of the CSM-RA process and whether or not it is significant Safety Assessment Report The Safety Assessment Report shall be provided by G-ISA for the Onboard Project for Fjernbane, in accordance with CSM-RA (ref. [R1]), Article 7. The main inputs to the G- ISA Safety Assessment Report are the System Definition and the Hazard Record (ref and ). In addition, as required by CCS TSI, Safety Assessment Reports in accordance with CSM-RA (ref. [R1]) issued at supplier level by the respective S-ISAs are of relevance for the process, as described in the SP Safety Plan (ref. [R3]). NoBo reports (ref ) will be inputs to G-ISA as well. SP-FB-FOB

21 Certificates of Conformity / Verification In accordance with the Interoperability Directive (ref. [R2]), interoperability constituents and subsystems shall be verified and accompanied by EC verification certificates, issued in compliance with the modules defined by the Commission Decision 2010/713/EU (ref. [R7]). The following modules are applied to the different subsystems: Module CH1 for STM-DK: an EC Certificate of Conformity will be issued addressing the CCS TSI requirements related to STM-DK. Module SH1 for STM-DK/ECTS subsystem: an EC Certificate of Verification will be issued addressing the CCS TSI requirements related to Onboard ETCS and the interfaces with STM-DK and the Rolling Stock defined in CCS TSI. Combination of Module SB and Module SD, for STM-DK national requirements: Verification Certificates will cover the national requirements for STM-DK. It should be noted that for EGO approvals (see section 3.1), the certificate for STM- DK/ECTS subsystem will be an Intermediate Statement of Verification (ISV), as required by BEK 653 (ref. [R5]) Manuals Both operation and maintenance manuals provided by the suppliers are supporting elements to the technical files of the subsystems which are part of APIS application Compatibility certificate This certificate documents the technical compatibility between vehicle and rail network in accordance with BEK 1127 (ref. [R8]). Since the railway vehicles scope of the Onboard Project are existing railway vehicle, an assessment of the change will need to be carried out by the RU with the support of BDK SP and, for the parameters affected by the change, a new limited Compatibility Certificate, listing the parameters concerned shall be drawn up in accordance with Appendix 1, Column 4 of BEK 1127 and issued by a DeBo 5 with a Module SB Technical File The technical file is the record of information related to the subsystem in question and the verification activities undertaken (refer to sections from to ). The Technical File shall be prepared in accordance with the Directive 2008/57/EC (ref. [R2]) Annex VI. Technical Files accompany the NoBo and DeBo certificates for each constituent/subsystem. A Technical File accompanying the Applicant s Declaration of Verification for the APIS will be also assembled and kept by Banedanmark. 5 It should be noted that the current BEK 1127 is based on the List of Parameter from Commission Decision 2009/965/EC, which is undergoing a general revision: a new revision of BEK 1127 is also expected. SP-FB-FOB

22 Declaration of verification The EC Declarations of Verification issued at supplier level, based on the NoBo certificates and technical files of the delivery. The EC DoV for CCS subsystem will be issued by Alstom, refer to section A Declaration of Verification will be issued by Banedanmark as applicat for the APIS, to comply with requirements of interoperability directive Annex V (ref. [R2]) Declaration on Safety Declaration on Safety according to CSM (ref. [R1]) will be issued by the proposer in the meaning of CSM RA (ref. [R1]) article 3(11d). For test and transport permission the Declaration on Safety will be issued by the RU. For the APIS the Declaration on Safety will be issued by Banedanmark Application form The Application form will be prepared in accordance with Trafik og Bygge-styrelsen template for each different authorisations. Details are presented in section Stakeholders The stakeholders involved in the authority approval process and their responsibilities within each of the listed approval elements of the previous section are defined and described in the following. The overall responsibilities and definition of roles of the stakeholders involved in the Signalling Programme are presented in the SP Safety plan (ref. [R3]). Status meeting between NSA, Project and relevant stakeholders (G- ISA, Alstom and DSB are regular participants) takes place on monthly basis to discuss planning, progress and issues of the project National Safety Authority (NSA) The NSA provides: - Permission for Test and Transport - Authorisation to Place Into Service (APIS) or Authorization for Expereince Gathering Operation (EGO) for trains to be equipped with the Onboard CCS - Approval of the Sagkyndig Project Project is the part of Banedanmark Signalling Programme appointed to control the compliance of Onboard CCS delivery against contractual and legal requirement. Legally, the responsibility of Signalling Programme Onboard Project lies on Banedanmark. Depending on the authorisation, the Onboard Project covers different role. - Actor responsible for developing the CSM-RA process required for test and Transport permission (RU is the propose and applicant towards NSA) SP-FB-FOB

23 - Proposer and Applicant for APIS (proposer in the meaning of CSM RA (ref. [R1]) article 3(11d)) Depending on the authorisation, the Onboard Project may provide: - Application to APIS - System Definition - Significant Change Assessment - Project level Hazard Record, to G-ISA - Application to DeBo for Verification Certificates for STM-DK (refer to section ) - Application to DeBo for the Compatibility Certificate of Rolling Stock according to BEK 1127 (ref. [R8]) - Declaration on Safety as Proposer, in the meaning of CSM RA (ref. [R1]) article 3(11d) for APIS of Railway Vehicles - Declaration of Verification as Applicant to APIS, and Technical file accompanying the DoV in accordance with Interoperability Directive annex V and VI (ref. [R2]) 6 It should be noted that the declarations by Proposer and Applicant are formally issued by Banedanmark, and will be signed by the third party coordinator of the signalling programme Suppliers Within the onboard project, two suppliers are involved. Siemens is responsible for the design, manufacturing and delivery of the STM-DK as interoperability constituent suitable for installation and integration with the OB CCS and Rolling Stock Subsystems. The installation if the STM-DK on board the trains is scope of Alstom 7. For supporting the integration, Siemens provides: - User manual and maintenance manual of the STM-DK - Generic Application Safety Case of the delivery, applicable any train type, to STM-DK S-ISA - Declaration of Conformity, based on S-NoBo certificate (ref. section ) Alstom is the supplier of the ETCS OB CCS Subsystem. Alstom is responsible for design manufacture, installation and testing of the integrated STM /ETCS subsystem including the interfaces with the Rolling Stock Subsystem as defined in the TSI CCS (ref. [R14]). Alstom provides: User manual and maintenance manual of the Onboard ETCS Generic Application Safety Case, applicable to train type, to ETCS S-ISA 6 The Declaration as applicant to APIS will also cover the verification of national requirement for national requirements of STM-DK and compatibility certificate, no separate declarations will be provided. 7 with the exception of the IC3 trains where Siemens will be responsible for the installation of the STM-DK. In this case SINTEF will act as ISA and Ricardo (as Sagkyndig) will cover the verification of Siemens activities with module SB and SD. SP-FB-FOB

24 Specific Application Safety Case, applicable to the specific train type, to ETCS S-ISA Declaration of Verification, based on S-NoBo certificates (ref. section ) Railway undertakings The RUs are the owners and / or operators of the railway vehicles. Depending on the authorisation, the Railway Undertaking covers different roles: Proposer and Applicant for Test and Transport permission according to BEK 653 (see section for details). Regarding APIS; the RU is an actor supporting for developing the CSM-RA Process by BDK Onboard Project. Depending on the authorisation, the Railway Undertaking provides: Application Quality Check, on the application prepared by BDK for Test and Transport Approval Declaration on Safety, in accordance with CSM-RA (ref. [R1]) for Test and Transport permission Supporting evidence for the Compatibility Certificate of Rolling Stock according to BEK 1127 (ref. [R8]), in particular for the changes in Rolling Stock parameters. Internal approval for operation (Driftstilladelse), upon APIS by NSA, for placing into service the vehicle in accordance with the procedures of the RU safety certificate Independent Safety Assessor (ISA) Signalling Programme distinguishes two types of assessment bodies for the verification of the safety management processes: General ISA related to the Signalling programme level, including the Onboard project, and Supplier ISA relating to the work undertaken by the suppliers. Within the Onboard Project, the following assessors have been nominated: Ricardo Rail (formerly Lloyd s Register Rail) as G-ISA TÜV Rheinland / Luxcontrol Nederland B.V. as S-ISA for Onboard ETCS SINTEF as S-ISA for STM-DK G-ISA provides: - Safety Assessment Report according to the BEK 653 (ref. [R5]) and CSM-RA - Validation of S-ISA s scope of work S-ISAs provide: - The S-ISA Safety Assessment Reports based on CSM-RA and suppliers safety processes. SP-FB-FOB

25 Notified Body (NoBo) Signalling Programme distinguishes two types of notified bodies for the verification of compliance with Interoperability Directive requirements: General NoBo related to the Signalling programme level, including the Onboard project, and Supplier NoBo related to the work of the suppliers. Within the Onboard Project, the following notified bodies have been nominated: Ricardo Rail (formerly Lloyd s Register Rail) as G-NoBo TÜV Rheinland / Luxcontrol Nederland B.V. as S-NoBo for Onboard ETCS SINTEF as S-NoBo for STM-DK S-NoBo for STM-DK provides: Technical File for STM-DK EC Certificate of Conformity for STM-DK (for CCS TSI related requirements) S-NoBo for Onboard ERTMS provides: Technical File for Onboard ETCS EC Certificate of Verification for Onboard ERTMS (module SH1) ERTMS S-NoBo will take as inputs the certificates of conformity for onboard for ERTMS interoperability constituents, issued by the IC-NoBo for the generic application, STM-DK NoBo certificates and GSM-R NoBo certificate. The ETCS IC certification will be managed at Supplier levels (ref. [R6]) Designated Body (DeBo) Two Designated Bodies are involved in the Onboard Project: Certificate of Conformity for STM-DK versus national requirements verification (ref. STM-DK Verifikationsforskrift 8 ) Compatibility Certificate according to BEK 1127 (ref. [R8]). DeBo for national requirements of STM-DK provides: SB Type examination certificate, for STM-DK SD Verification Certificate, for STM-DK Technical File, for STM-DK As the scope of verification activities of the installation by NoBo for STM-DK/ECTS and DeBo for STM-DK may overlap, cross acceptance of NoBo reports by DeBo is expected, in particular for module SD. DeBo for Compatibility Certificate will use module SB as required by BEK 1127 (ref. [R8]). 8 At the date of submission of this AAPP, the STM-DK Verifikationsforskrift is not yet notified as national rule, the DeBo role is formally taken over by a Sagkyndig (Technical Expert). SP-FB-FOB

26 3.3 Detailed Process This section provides the detailed information on each required approval/apis that the project must apply for. It furthermore addresses the dependencies, if any, prerequisites and interactions that are identified between the approvals/apis and towards other projects/stakeholders and defined in the system definitions (see section 2.2). The detail activity schedule is provided as a separate document Approval process for Test and Transport This section summarizes the deliverables forming part of the application to approval for Test and Transport, along with the inputs to the G-ISA / G-NoBo / DeBo as relevant. As part of Banedanmark Signalling Programme the Test and Transport approval is applicable to the dynamic test needed for the first train of a type (i.e. FoC Train). For Dynamic Test are intended all STM-DK and ETCS tests that requires to run the train at the maximum train speed of the train on a track reserved for the testing, i.e. by closing the track to commercial traffic thus prohibiting other trains to enter the test track. A Test and Transport System Definition (including Significant Change Assessment) will be issued for each RU and will be applicable for all FoC operated by the RU. This approach is based on the experience with Test and Transport approval from Baseline 2 Project and takes into account the following considerations: The STM-DK and ETCS dynamic test type and strategy is the same for each FoC, as presented in Alstom s Master Test Plan (ref. [R16]). The STM-DK and ETCS dynamic test will take place in specific location on Banedanmark network: BDK TSA has identified the list possible locations for STM high speed test. The same locations can be used for ETCS high speed test. Since the test procedures will be the same for each FoC, the rules to be followed by RU for executing the test runs are expected to be applicable to each FoC test. Generally, the existing rules in RU s SMS can be adopted for the test runs: the ETCS odometry test is the only relatively new test, because it involves soap for testing worst case wheel/rail adhesion. Location of tests will be decided with BDK basis organisation (BDK Teknisk Drift, Kvalitet and Sikkerhed or Signalkommission as applicable). The verification that installation and commissioning test of each FoC has been performed correctly, will be carried out as part of a Test Readiness Review (TRR, ref. [R25]) which is a process already in place and agreed by Alstom, BDK and RU (DSB). A check by involved assessors (G-ISA; NoBo and DeBo/Sagkyndig as applicable) will be added. As allowed with BEK 653, clause 14, part 6, a new Compatibility Certificate will not be provided as part of the application for test and transport: the changes and validity of the existing Compatibility Certificate will be addressed as part of the System Definition. The following table summarizes the legal requirements, roles and deliverables for approval process for Test and Transport permission. SP-FB-FOB