Guidance on the Retention of Design Information for the Validation of Technical Change and Configuration Management

Transcription

1 Guidance on the Retention of Design Information for the Validation of Technical Change and Configuration Management Synopsis This document provides guidance to manufacturers, asset owners and operators on the concept of a design authority and the four underlying competencies fundamental to asset management. Signatures removed from electronic version Submitted by Vicki Austen Acting Standards Project Manager Authorised by Anne Blakeney Acting Department Head Railway Group Standards Management This document is the property of the Rail Safety and Standards Board Limited. It shall not be reproduced in whole or in part without the written permission of the Department Head of Railway Group Standards Management, Rail Safety and Standards Board. Published by: Rail Safety and Standards Board Evergreen House 160 Euston Road London NW1 2DX Copyright 2004 Rail Safety and Standards Board Limited

2 This page has been left blank intentionally

3 Page 1 of 12 Contents Section Description Page Part A A1 Issue record 2 A2 Implementation of this document 2 A3 Responsibilities 2 A4 Health and safety responsibilities 2 A5 Technical content 2 A6 Supply 3 Part B B1 Purpose 4 B2 Application of this document 4 B3 Definitions 4 B4 Introduction 4 B5 What needs to be done the four competencies 5 B6 Why it needs to be done 6 B7 How the competencies might be managed 6 B8 Management of shared systems 8 B9 Configuration management 10 B10 Interface specifications 10 References 12 RAIL SAFETY AND STANDARDS BOARD 1

4 Page 2 of 12 A1 Issue record A2 Implementation of this document Part A Issue Date Comments One June 2004 Original document The publication date of this document is 5 June This document does not supersede any other s. A3 Responsibilities s are non-mandatory documents providing helpful information relating to the control of hazards and often set out a suggested approach, which may be appropriate for Railway Group* members to follow. * The Railway Group comprises Network Rail Infrastructure Limited, Rail Safety and Standards Board Limited, and the train and station operators who hold Railway Safety Cases for operation on or related to infrastructure controlled by Network Rail Infrastructure Limited. Network Rail Infrastructure Limited is also known as Network Rail. Rail Safety and Standards Board Limited is also known as RSSB. A4 Health and safety responsibilities A5 Technical content Each Railway Group member is reminded of the need to consider its own responsibilities to ensure health and safety at work and its own duties under health and safety legislation. RSSB does not warrant that compliance with all or any documents published by RSSB is sufficient in itself to ensure safe systems of work or operation or to satisfy such responsibilities or duties. The technical content of this document has been produced and approved by a working group comprising representatives of the Rail Industry Association, the Association of Train Operating Companies, rolling stock companies, Network Rail and RSSB. The membership of the working group was as follows: Richard Gostling, Chair, Railway Industry Association Allan Sutton, Bombardier Jon Leigh, SAB WABCO Andrew Cheetham, Westinghouse Brakes (UK) Ltd Roger Kemp, Alstom Richard Lockett, ATOC David Edge, HSBC Tom Whitehead, HMRI Per Staehr, Bombardier Ian Fazakerley, Network Rail 2 RAIL SAFETY AND STANDARDS BOARD

5 Page 3 of 12 Keith Turner, RSSB Vicki Austen, RSSB David Curtis, Interfleet Technology Derek Hill, HMRI Keith Rose, Porterbrook David Clark, Bombardier Marie Marks, RSSB. Enquires to be directed to RSSB Tel: or enquiries@rssb.co.uk. A6 Supply Controlled and uncontrolled copies of this document may be obtained from the Corporate Communications Dept, Rail Safety and Standards Board, Evergreen House, 160 Euston Road, London NW1 2DX or enquiries@rssb.co.uk. Railway Group Standards can also be viewed at RAIL SAFETY AND STANDARDS BOARD 3

6 Page 4 of 12 B1 Purpose Part B This document provides guidance on the retention of design information for the validation of technical change and configuration management relating to the design or use of a railway asset. This document does not cover the mandatory safety approval or acceptance procedures which may apply to an asset, but is intended to advise those responsible upon how the risks associated with changes of design or use may be minimised by the retention and subsequent use of design information. B2 Application of this Document B2.1 To whom the guidance applies This document contains guidance that is applicable to all parties in the railway industry who are involved in the design, development, modification, maintenance and operation of railway vehicles and infrastructure. B2.2 Documents supported by this Guidance Note There are no documents supported by this Guidance Note. B3 Definitions Original Equipment Manufacturer Original Equipment Manufacturer (OEM) is a company (including, but not limited to, train manufacturers and component suppliers) responsible for the original construction of an asset or system, which is unique and is reliant on the configuration of more than one standard component. The four competencies The four competencies described in section B5. Vehicles For the purpose of this document all references to vehicles mean trains and rolling stock only. B4 Introduction Whilst the various parties that constitute the railway industry each have specific safety responsibilities within the scope of their particular undertaking, many of the activities carried out by members of the generic groups of undertaking (manufacturer, leasing company, train operator etc) are similar. This document describes the elements for the control of design information that are common to the various parties. In particular: a) what needs to be done to ensure that: i) design information is retained ii) iii) changes can be validated records are kept of changes made b) why this needs to be done c) how it might be done. 4 RAIL SAFETY AND STANDARDS BOARD

7 Page 5 of 12 B5 What needs to be done the four competencies B5.1 General In order to achieve the purpose set out in this Guidance Note, four competencies have been identified. Adoption of these competencies should assist industry parties in meeting their legal duties. The four competencies relating to design information should be in place for each and every asset. For practical purposes, records may be collated into generic groupings (for example, vehicle classes). However, because there is in the rail industry no single individual legal entity with the obligation to control the design integrity of groups or classes of assets owned and operated by several parties (and no intention to create such a legal entity), legal responsibility for the integrity of an individual asset rests with the party(ies) in control of the operation of the individual asset on the railway. This means that any co-ordination and collation of information should be bottom up under the control of those who control the assets. In respect of any asset, each of the competencies may be managed by a different party according to the particular circumstances. Competence 1 The know why of a system For any system (including infrastructure) or equipment, there is a need for a body that understands the technical and operational requirements and who retains records indicating how these influenced the design of the system. It is not simply a question of knowing how to manufacture or maintain equipment, someone has to know why it is how it is. Whereas other bodies, such as licensees, maintenance organisations, or users may have the know how to build or maintain a component or system, they are unlikely to have the know why of the design. The individual or organisation with the know why may be different for different sub-systems within a system (for example, a diesel engine within a vehicle). Competence 2 Retention of information There is a need for a body to retain design information so that if, years after a system or asset such as a vehicle has entered service, there is a desire to substantially modify it, change its use or understand its behaviour (for example, following an accident), the original design information can be recalled. Competence 3 Ability to make an informed judgement on the validation of technical change In an evolving railway there is a need for a body capable of making an informed judgement on the suitability of an asset (such as a vehicle or its systems) for a particular proposed route or application and for assessing the technical, operational and safety implications of any proposed modifications to an existing asset or its use. Competence 4 Management of configuration levels There is a need to ensure that records are kept of different configuration levels of any particular design as it evolves throughout its life. This is in order that when technical change is validated, the body carrying out the change is able to certify that any particular modification is compatible not only with the original design, but also with any subsequent modifications. B5.2 Managing the four competencies Where, for legal or commercial reasons, all four of the competencies rest with a single party, such as is the case within the aviation industry, the term Design Authority is often used to describe this single party. Whilst this option has been considered by the rail industry, the creation of a legal entity responsible for authorising design changes to a type of rail vehicle would require both a transfer of safety responsibilities from Railway Safety Case duty holders and some form of regulation to address the issue of the monopoly status of any such Design RAIL SAFETY AND STANDARDS BOARD 5

8 Page 6 of 12 Authority. It is considered the need for this level of legal change is not necessary at this time and that the four competencies are best managed by arrangements agreed between the respective parties. It is assumed, however, that, for vehicles, the vehicle integrator (the original manufacturer) manages all four competencies up until the point of new vehicle delivery; thereafter, the parties may choose to make different arrangements according to circumstance. However, if a change is made, the owner and/or duty holder have a responsibility to ensure continuity of information and competence. B6 Why it needs to be done B6.1 The Health and Safety at Work etc Act 1974 The Health and Safety at Work Act and its dependent regulations place obligations on manufacturers, owners and users of railway infrastructure and vehicles to ensure adequate records are kept of their design, manufacture and testing. B6.2 Interoperability regulations The interoperability regulations require the retention and updating of a technical file. For railway infrastructure, Railway Group Standards such as GI/RT7001 also mandate such requirements. B6.3 Railway Safety Case regulations The Railway Safety Case (RSC) regulations require infrastructure controllers and train operators (the RSC duty holders) to have in place processes to ensure the safety integrity of any infrastructure or vehicle they operate. To comply with this requirement, RSC duty holders are expected to ensure that records are maintained of infrastructure and vehicle configuration, including compatibility with different infrastructure and other vehicles. B6.4 The four competencies There is a primary legal safety obligation, which rests with the RSC duty holder, to ensure that the four competencies are managed to the extent necessary to ensure that safety risk is minimised to a level as low as reasonably practicable. There may, however, be a commercial incentive for a more restrictive level of control than required by the safety regime alone. For example, with a vehicle, a leasing company may wish to maintain more than the minimum to preserve the residual value of its assets. This will not only be affected by the safety-related aspects of the ability to modify a vehicle, but also the commercial opportunities arising from the ability to modify a vehicle. B7 How the competencies might be managed B7.1 Vehicles Prior to the privatisation of the railway industry in Great Britain, British Rail was the owner and operator of almost all vehicles, and designed (or approved the design of) these vehicles. It therefore managed all the four competencies itself. By contrast, in the civil aircraft industry, Rolls Royce is the Design Authority for the RB211 engine, and Airbus is the Design Authority for the A320 aircraft. There is no universally right way of working within the current railway industry structure, but the following may be treated as good practice. B7.1.1 Contracts for new vehicles When placing orders for new vehicles the purchaser should consider how the four competencies will be managed. It is almost inevitable that, when the vehicles are commissioned, the train manufacturer is the only body with access (directly or indirectly) to the know how and the know why of the design and is therefore the obvious body to take many of these responsibilities, at the very least up to the point of entry into service. 6 RAIL SAFETY AND STANDARDS BOARD

9 Page 7 of 12 B7.1.2 Retention of design information Under normal circumstances the train manufacturer would be the natural party to carry the ongoing responsibility for the retention of design information and thus to validate technical change or to provide the underlying technical data to allow the validation to be undertaken by others. The level of information necessary to satisfy a supplier s legal obligations, and the manner in which it is stored, may not be sufficient to manage the four competencies in the long-term. For example, the train manufacturer could satisfy its legal requirements by storing all design information as microfiche images or PDF files, thus getting round long-term problems of incompatible data formats in word processor or CAD systems. However, such images could not be modified as a result of design change without extensive re-creation of live drawings. The purchaser should agree with the supplier what additional retention is necessary to allow proper management of technical change throughout the life of the vehicle. (It should be recognised that long-term retention of live documents has a cost involved which would be reflected in the supply contract.) In addition, purchasers of trains or train components should make suitable arrangements to ensure continued access to such information in the event that the train manufacturer becomes unable or unwilling to continue in the role. If the OEM is unwilling to accept the responsibility of managing the four competencies, the operator or lessor should make alternative arrangements, such as appointing a body that is prepared to provide this support. An operator of new vehicles could discharge its obligations to ensure all four competencies are sufficiently managed, by entering into an agreement with the lessor who would make the appropriate arrangements with the manufacturer. B7.1.3 Existing vehicles where design and configuration information has been lost For orphan vehicles, that is, those without an obvious OEM, the owner (normally the rolling stock company (ROSCO)) will normally wish to take responsibility for ensuring that the four competencies are managed appropriately. This may be by contracting them out to a body with appropriate competence, such as a technical consultancy. A lessee should ensure that this is properly addressed when taking a vehicle on lease or renewing an existing lease. The level of design competence necessary, clearly depends on the probable future of a vehicle. A vehicle that will be scrapped in five years is in a different category to one that is approaching its mid-life overhaul and which may have 15 years of useful service ahead. When safety-critical systems for orphan vehicles are upgraded at renovation, reverse engineering may be necessary to establish a specification and design. The organisation doing the reverse engineering should generally be contracted to manage the four competencies in relation to the project. B7.2 New projects through renovation On other projects, the renovation organisation may redesign all or part of a project (such as replacement of camshaft control by an electronic chopper control type or replacement of a traction motor). This is in effect a new project in which the renovation organisation takes on the four competencies, at least to the point of entry into service, and the controls that would apply to new build in relation to configuration management, hazard logs and design reviews should also apply. Vehicles subject to major re-engineering of this sort should be managed as though they are a new project that happens to use some secondhand systems. Consideration should be given as to whether this justifies the allocation of a new class number. RAIL SAFETY AND STANDARDS BOARD 7

10 Page 8 of 12 The interoperability regulations require that vehicles which are subject to a performance upgrade be approved under the new regulations, which would be compatible with this approach. B7.3 Agreement of who manages competencies In all situations, the operator and lessor of the vehicles should ensure that they have agreed how the four competencies are to be managed, and by whom, to assure themselves that there are robust processes in place for controlling design changes and configuration. B7.4 Infrastructure For infrastructure and infrastructure systems, the four competencies are generally under the direct control of one organisation, that is, the infrastructure controller. There are cases, however, where additional careful consideration should be given to the allocation of responsibilities, as described below: a) Where contractors are employed to design, construct, modify, maintain or decommission assets, contractual arrangements should include the preparation and maintenance of adequate information to manage the four competencies. Arrangements should include provision to recover the information if the contractor becomes unwilling or unable to provide it. As built records should always be preserved. b) Where components of the infrastructure or infrastructure system are provided by a supplier, arrangements should be in place to ensure that these components and replacements are (and remain) compatible with the system into which they are integrated. In some circumstances, there may be several suppliers with the know how and records of different components and others responsible for the linking of these components into a functional system. c) Infrastructure systems are frequently adapted to suit specific circumstances and specific geographic locations. In these cases, care should be taken to ensure that these adaptations are recorded in sufficient detail that erroneous assumptions about the system cannot lead to an unsafe situation. For example, where original design philosophy records may be held centrally, minor or local maintenance modifications may be recorded in on-site records. d) Where modifications are to be carried out on infrastructure or infrastructure systems where the original information is not available, the infrastructure controller should either: i) replace the whole asset ii) iii) ensure that the modification is independent of the existing asset carry out sufficient site investigation and testing to determine the know why of the design of the existing assets. B8 Management of shared systems B8.1 General There are many examples in both the railway and other industries of systems that are operated by several independent parties. Because the parties are autonomous entities, a hierarchical command and control structure cannot be applied to ensure system integration. Instead, where there is an organisational/contractual boundary, prescriptive standards are used to define the interfaces, such that any sub-system complying with these standards can be assumed to be compatible. To take a non-railway example, a mobile phone manufactured by an independent manufacturer in Finland and certified compliant in the EU is compatible (and accepted as such without any local approval process) with Australian infrastructure. 8 RAIL SAFETY AND STANDARDS BOARD

11 Page 9 of 12 B8.2 System Authorities For this shared system approach, a jointly managed body is required to specify the system architecture at the organisational interfaces by means of detailed and prescriptive standards. Such bodies may be referred to as a System Authority, an Interface Committee, or even a Stakeholder Board. Such a body may even be an organisation like the International Telecommunications Union, which is an international organisation within the United Nations where governments and the private sector co-ordinate global telecom networks and services. Within the European rail industry, prescriptive standards at the vehicle-infrastructure interface, are now required by the interoperability directive. These are currently being produced by AEIF (the Association Européenne pour l Intéroperabilité Ferroviaire); this is to be continued by its successor body the European Rail Agency. B8.3 The key feature of a System Authority A System Authority exists as a means of jointly managing a shared system. To do this it apportions responsibilities and defines interface parameters with which those sharing the system would comply as a condition of entry to the system. A System Authority exerts top down control upon all parties, whereas the four competencies outlined in this document can only be managed bottom up by the parties managing each and every asset. B8.4 Assurance of the internal integrity of a sub-system Whether or not an engineered product is a sub-system of a shared system (such as an on-vehicle TPWS receiver) or a system standing alone in its own right, its own internal integrity needs to be assured. This is first an activity carried out by the manufacturer at the design stage, but thereafter the sub-system s integrity is dependent upon the user using it for its intended purpose, maintaining it properly and not modifying the design without taking due account of all relevant factors. B8.5 Managing the four competencies To assure integrity, it is often considered desirable that a single organisation is identified to manage the four competencies in respect of a particular design of engineering component or sub-system that may be fitted to a number of different assets. This body holds all the design data and is constituted by its members such that any changes of intended use from that assumed at original design, or modifications to it, have to be validated and approved by it. Where the component is part of a larger system or asset, the party controlling the asset should ensure that the interface between the system and sub-system is properly controlled, in order that design changes each side of the interface are compatible and the records describing the main system or asset reflect updates to the sub-system and vice versa. B8.6 Design change covering both vehicles and infrastructure For a shared system such as TPWS/AWS, the System Authority would be responsible for defining the functional requirements of the system and the functionality of the vehicle (and track) sub-system equipment with the message configuration, signal strength and receptivity required either side of the trackvehicle interface. The party managing the vehicle would make use of the arrangements it has put in place to deliver the four competencies to assure itself both that the on-vehicle TPWS equipment was capable of withstanding the vibration and power supply fluctuations of its on-vehicle environment (that is, that it was compatible with the system the vehicle into which it is to be integrated) and that it met the interface specifications and functional requirements of the System Authority, in this particular use, on this particular vehicle. The notified body, or vehicle acceptance body, contracted to certify that the vehicle can be placed into service will have responsibility for confirming that both requirements have been satisfactorily managed. B8.7 Design change for sub-systems A system, such as TPWS/AWS, consists of a number of sub-systems or black boxes, some on the vehicles, and others on the trackside. Each of these requires the four competencies to be managed; this would normally be by the RAIL SAFETY AND STANDARDS BOARD 9

12 Page 10 of 12 original designer, although the party controlling the asset may need to establish appropriate competence for historic systems, such as AWS components. A notified body is involved if the vehicle or track falls within the scope of the interoperability regulations. In this instance they should have provided for the manufacturer, at manufacture, a certificate of conformity for each black box and/or the collection of black boxes that confirms their compliance with the System Authority s interface specifications. This proves compatibility with the shared TPWS system (but not with vehicles into which they are to be integrated). B8.8 Pooled components If a number of parties have the same design of sub-system components fitted to their assets (for example, AWS receivers) and the original supplier does not manage the four competencies in respect of the component, it may be commercially advantageous to set up a collective pooling arrangement to do so. This not only brings about economies of scale but simplifies the interface managed by the System Authority from a many-to-one interface to a one-to-one interface. B9 Configuration management B9.1 General It is important to understand the need for configuration management. An asset, be it infrastructure or a vehicle, can be in one of several configuration levels and can be updated from one to another. B9.1.1 It is essential that it is confirmed that an asset at a particular configuration level is compatible with other adjacent infrastructure, or classes of vehicle on which it is to be used. The changes should be validated using the standard processes for engineering change. B9.1.2 For vehicles, the rolling stock company (as the vehicle owner) is normally best placed to be responsible for ensuring records of the configuration of each vehicle are maintained, and in conjunction with the operator, authorising any change in configuration level. This should not necessarily require notified body approval but may require updating any central database of vehicle configuration. B9.1.3 The operator and the owner should agree how changes to configuration levels are to be managed. These arrangements should ensure that changes are not made without taking account of the need for the know why competency to be brought to bear. B9.2 Levels of effect of change It is necessary to be clear as to what type of change requires reference to underpinning design logic. Cosmetic changes, such as changing the colour of the carpet or the colour of the material used for seat coverings in a vehicle, should not generally require reference. However, changes that have significant safety or performance implications that may mean revisiting the original design calculations (such as modifying the fire load or the ability of a vehicle to meet particular fire standards) would require reference. B10 Interface specifications B10.1 Technical Specifications for Interoperability (TSIs) and Railway Group Standards As has been mentioned earlier, for a shared system (that is, the European railway) to work effectively, mandatory prescriptive interface specifications are required. At the macro level these will be produced by TSI drafting committees. At the moment, TSIs relate only to interfaces between major components (vehicles, the track etc) but there is a requirement for them to standardise all 10 RAIL SAFETY AND STANDARDS BOARD

13 Page 11 of 12 interfaces where there is a positive economic benefit, whilst at the same time assuring safety. Railway Group Standards provide prescriptive specification only where specifically necessary to ensure system safety and safe interworking. They are not primarily intended to provide the most economic or efficient interface specification. B10.2 Detailed interface specifications If technical compatibility is required at a lower level or between only one or two of the elements (for example, operational interconnectivity between Class 158 and Class 170 diesel multiple units) the interface specification has to be clearly and prescriptively defined. In this case a specification called, for example, UK DMU Type A2 coupling interface specification is needed. This would specify the following: a) the physical interface of the coupler b) the maximum movements and tolerances c) the pin configuration on the auto coupler d) the signal on each pin e) the meaning of each under different operational conditions f) the maximum source impedance and minimum sink impedance allowable. An arrangement to devise and work to such a specification is entirely a matter for voluntary commercial agreement between the parties. B Because the primary safety responsibility rests with the Railway Safety Case duty holder, provided it does not conflict with a TSI, or in its absence a Railway Group Standard, there is nothing to prevent individual entities developing bilateral or multilateral specifications such as the UK type A2 coupling. However, they should: a) take account of whether or not it is envisaged that in future there is to be a TSI or RGS b) refer back to the manager(s) of the four competencies to assess the change. The component or system may be considered an interoperability constituent. Even though there may be at the time no relevant parameters within the TSI, or it may be inappropriate or uneconomic to apply the TSI, it will still be necessary to use a NoBo to validate the specification against the essential requirements of interoperability and to obtain NoBo certification for the component s satisfactory integration into the systems into which it is being integrated, prior to approval by the Supervisory Authority (HMRI) for its placing into service. RAIL SAFETY AND STANDARDS BOARD 11

14 Page 12 of 12 References Railway Group Standards and other Railway Group Documents The Railway Group Standards Code GI/RT7001 Management of Safety Related Records of Elements of the Infrastructure The Catalogue of Railway Group Standards and the Railway Group Standards CD-ROM give the current issue number and status of documents published by RSSB. This information is also available from 12 RAIL SAFETY AND STANDARDS BOARD