COMMISSION REGULATION (EC) No 352/2009
of 24 April 2009
on the adoption of a common safety method on risk evaluation and assessment as referred to in Article 6(3)(a) of Directive 2004/49/EC of the European Parliament and of the Council
(Text with EEA relevance)
THE COMMISSION OF THE EUROPEAN COMMUNITIES,
Having regard to the Treaty establishing the European Community,
Having regard to Directive 2004/49/EC of the European Parliament and of the Council of 29 April 2004 on safety on the Community’s railways and amending Council Directive 95/18/EC on the licensing of railway undertakings and Directive 2001/14/EC on the allocation of railway infrastructure capacity and the levying of charges for the use of railway infrastructure and safety certification (Railway Safety Directive) (1), and in particular Article 6(1) thereof,
Whereas:
(1)
Pursuant to Article 6(1) of Directive 2004/49/EC, the Commission should adopt the first set of common safety methods (hereinafter CSMs) covering at least the risk evaluation and assessment methods mentioned in Article 6(3)(a) of that Directive, on the basis of a recommendation of the European Railway Agency.
(2)
The European Railway Agency made a recommendation on the first set of common safety methods (ERA-REC-02-2007-SAF) on 6 December 2007.
(3)
In accordance with Directive 2004/49/EC, CSMs should be gradually introduced to ensure that a high level of safety is maintained and, when and where necessary and reasonably practicable, improved.
(4)
Article 9(1) of Directive 2004/49/EC requires railway undertakings and infrastructure managers to establish their safety management systems in order to ensure that the railway system can achieve at least the common safety targets (CSTs). According to point (2)(d) of Annex III to Directive 2004/49/EC, the safety management system must include procedures and methods for carrying out risk evaluation and implementing risk control measures whenever a change of the operating conditions or new material imposes new risks on the infrastructure or on operations. That basic element of the safety management system is covered by this Regulation.
(5)
As a consequence of the application of Council Directive 91/440/EEC of 29 July 1991 on the development of the Community’s railways (2) and of Article 9(2) of Directive 2004/49/EC, particular attention should be paid to risk management at the interfaces between the actors which are involved in the application of this Regulation.
(6)
Article 15 of Directive 2008/57/EC of the European Parliament and of the Council of 17 June 2008 on the interoperability of the rail system within the Community (3) requires Member States to take all appropriate steps to ensure that the structural subsystems constituting the rail system may be placed in service only if they are designed, constructed and installed in such a way as to meet the essential requirements concerning them when integrated into the rail system. In particular, the Member States must check the technical compatibility of these subsystems with the railway system into which they are being integrated and the safe integration of these subsystems in accordance with this Regulation.
(7)
The absence of a common approach for specifying and demonstrating compliance with safety levels and requirements of the railway system proved to be one of the obstacles to liberalisation of the railway market. Therefore, in the past, the Member States performed their own assessments in order to accept a system, or parts of it, which had already been developed and proven safe in other Member States.
(8)
To facilitate mutual recognition between Member States, the methods used for identifying and managing risks should be harmonised among the actors involved in the development and operation of the railway system as well as the methods for demonstrating that the railway system in the territory of the Community conform to safety requirements. As a first step, it is necessary to harmonise the procedures and methods for carrying out risk evaluation and implementing control measures whenever a change of the operating conditions or new material imposes new risks on the infrastructure or on operations, as referred to in point (2)(d) of Annex III to Directive 2004/49/EC.
(9)
If there is no notified national rule for defining whether or not a change is significant in a Member State, the person in charge of implementing the change (hereinafter referred to as the proposer) should initially consider the potential impact of the change in question on the safety of the railway system. If the proposed change has an impact on safety, the proposer should assess, by expert judgement, the significance of the change based on a set of criteria that should be set out in this Regulation. This assessment should lead to one of three conclusions. In the first situation the change is not considered to be significant and the proposer should implement the change by applying its own safety method. In the second situation the change is considered to be significant and the proposer should implement the change by applying this Regulation, without the need for a specific intervention of the safety authority. In the third situation the change is considered to be significant but there are Community provisions which require a specific intervention of the relevant safety authority, such as a new authorisation for placing in service of a vehicle or a revision/update of the safety certificate of a railway undertaking or a revision/update of the safety authorisation of an infrastructure manager.
(10)
Whenever the railway system already in use is subject to a change, the significance of the change should also be assessed taking into account all safety-related changes affecting the same part of the system since the entry into force of this Regulation or since the last application of the risk management process described in this Regulation, whichever is the latest. The purpose is to assess whether or not the totality of such changes amounts to a significant change requiring the full application of the CSM on risk evaluation and assessment.
(11)
The risk acceptability of a significant change should be evaluated by using one or more of the following risk acceptance principles: the application of codes of practice, a comparison with similar parts of the railway system, an explicit risk estimation. All principles have been used successfully in a number of railway applications, as well as in other transport modes and other industries. The ‘explicit risk estimation’ principle is frequently used for complex or innovative changes. The proposer should be responsible for the choice of the principle to apply.
(12)
In accordance with the principle of proportionality as set out in Article 5 of the Treaty, this Regulation should not go beyond what is necessary to achieve its objective which is to establish a CSM on risk evaluation and assessment. When a widely recognised code of practice is applied, it should therefore be possible to reduce the impact of applying the CSM. In the same way, where there are Community provisions which require the specific intervention of the safety authority, the latter should be allowed to act as the independent assessment body in order to reduce double checking, undue costs to the industry and time to market.
(13)
Article 6(5) of Directive 2004/49/EC requires the Member States to make any necessary amendments to their national safety rules to comply with the CSMs.
(14)
In view of the different approaches currently in use for assessing safety, a transitional period is necessary, in order to give sufficient time to the actors concerned, where needed, to learn and apply the new common approach as well as to gain experience from it.
(15)
As a formalised risk-based approach is relatively new in some Member States, the CSM on risk evaluation and assessment should remain voluntary with respect to operational or organisational changes until 1 July 2012. This should allow the European Railway Agency to assist such applications, where possible, and to propose improvements, if appropriate, to that CSM before 1 July 2012.
(16)
The measures provided for in this Regulation are in accordance with the opinion of the Committee established in accordance with Article 27(1) of Directive 2004/49/EC,
HAS ADOPTED THIS REGULATION:
Article 1
Purpose
1. This Regulation establishes a common safety method on risk evaluation and assessment (CSM) as referred to in Article 6(3)(a) of Directive 2004/49/EC.
2. The purpose of the CSM on risk evaluation and assessment is to maintain or to improve the level of safety on the Community’s railways, when and where necessary and reasonably practicable. The CSM shall facilitate the access to the market for rail transport services through harmonisation of:
(a)
the risk management processes used to assess the safety levels and the compliance with safety requirements;
(b)
the exchange of safety-relevant information between different actors within the rail sector in order to manage safety across the different interfaces which may exist within this sector;
(c)
the evidence resulting from the application of a risk management process.
Article 2
Scope
1. The CSM on risk evaluation and assessment shall apply to any change of the railway system in a Member State, as referred to in point (2)(d) of Annex III to Directive 2004/49/EC, which is considered to be significant within the meaning of Article 4 of this Regulation. Those changes may be of a technical, operational or organisational nature. As regards organisational changes, only those changes which could impact the operating conditions shall be considered.
2. Where the significant changes concern structural subsystems to which Directive 2008/57/EC applies, the CSM on risk evaluation and assessment shall apply:
(a)
if a risk assessment is required by the relevant technical specification for interoperability (TSI). In this case the TSI shall, where appropriate, specify which parts of the CSM apply;
(b)
to ensure safe integration of the structural subsystems to which the TSIs apply into an existing system, by virtue of Article 15(1) of Directive 2008/57/EC.
However, application of the CSM in the case referred to in point (b) of the first subparagraph must not lead to requirements contradictory to those laid down in the relevant TSIs which are mandatory.
Nevertheless if the application of the CSM leads to a requirement that is contradictory to that laid down in the relevant TSI, the proposer shall inform the Member State concerned which may decide to ask for a revision of the TSI in accordance with Article 6(2) or Article 7 of Directive 2008/57/EC or a derogation in accordance with Article 9 of that Directive.
3. This Regulation shall not apply to:
(a)
metros, trams and other light rail systems;
(b)
networks that are functionally separate from the rest of the railway system and intended only for the operation of local, urban or suburban passenger services, as well as railway undertakings operating solely on these networks;
(c)
privately owned railway infrastructure that exists solely for use by the infrastructure owner for its own freight operations;
(d)
heritage vehicles that run on national networks providing that they comply with national safety rules and regulations with a view to ensuring safe circulation of such vehicles;
(e)
heritage, museum and tourist railways that operate on their own network, including workshops, vehicles and staff.
4. This Regulation shall not apply to systems and changes, which, on the date of entry into force of this Regulation, are projects at an advanced stage of development within the meaning of Article 2(t) of Directive 2008/57/EC.
Article 3
Definitions
For the purpose of this Regulation the definitions in Article 3 of Directive 2004/49/EC shall apply.
The following definitions shall also apply:
1.
‘risk’ means the rate of occurrence of accidents and incidents resulting in harm (caused by a hazard) and the degree of severity of that harm;
2.
‘risk analysis’ means systematic use of all available information to identify hazards and to estimate the risk;
3.
‘risk evaluation’ means a procedure based on the risk analysis to determine whether the acceptable risk has been achieved;
4.
‘risk assessment’ means the overall process comprising a risk analysis and a risk evaluation;
5.
‘safety’ means freedom from unacceptable risk of harm;
6.
‘risk management’ means the systematic application of management policies, procedures and practices to the tasks of analysing, evaluating and controlling risks;
7.
‘interfaces’ means all points of interaction during a system or subsystem life-cycle, including operation and maintenance where different actors of the rail sector will work together in order to manage the risks;
8.
‘actors’ means all parties which are, directly or through contractual arrangements, involved in the application of this Regulation pursuant to Article 5(2);
9.
‘safety requirements’ means the safety characteristics (qualitative or quantitative) of a system and its operation (including operational rules) necessary in order to meet legal or company safety targets;
10.
‘safety measures’ means a set of actions either reducing the rate of occurrence of a hazard or mitigating its consequences in order to achieve and/or maintain an acceptable level of risk;
11.
‘proposer’ means the railway undertakings or the infrastructure managers in the framework of the risk control measures they have to implement in accordance with Article 4 of Directive 2004/49/EC, the contracting entities or the manufacturers when they invite a notified body to apply the ‘EC’ verification procedure in accordance with Article 18(1) of Directive 2008/57/EC or the applicant of an authorisation for placing in service of vehicles;
12.
‘safety assessment report’ means the document containing the conclusions of the assessment performed by an assessment body on the system under assessment;
13.
‘hazard’ means a condition that could lead to an accident;
14.
‘assessment body’ means the independent and competent person, organisation or entity which undertakes investigation to arrive at a judgement, based on evidence, of the suitability of a system to fulfil its safety requirements;
15.
‘risk acceptance criteria’ means the terms of reference by which the acceptability of a specific risk is assessed; these criteria are used to determine that the level of a risk is sufficiently low that it is not necessary to take any immediate action to reduce it further;
16.
‘hazard record’ means the document in which identified hazards, their related measures, their origin and the reference to the organisation which has to manage them are recorded and referenced;
17.
‘hazard identification’ means the process of finding, listing and characterising hazards;
18.
‘risk acceptance principle’ means the rules used in order to arrive at the conclusion whether or not the risk related to one or more specific hazards is acceptable;
19.
‘code of practice’ means a written set of rules that, when correctly applied, can be used to control one or more specific hazards;
20.
‘reference system’ means a system proven in use to have an acceptable safety level and against which the acceptability of the risks from a system under assessment can be evaluated by comparison;
21.
‘risk estimation’ means the process used to produce a measure of the level of risks being analysed, consisting of the following steps: estimation of frequency, consequence analysis and their integration;
22.
‘technical system’ means a product or an assembly of products including the design, implementation and support documentation; the development of a technical system starts with its requirements specification and ends with its acceptance; although the design of relevant interfaces with human behaviour is considered, human operators and their actions are not included in a technical system; the maintenance process is described in the maintenance manuals but is not itself part of the technical system;
23.
‘catastrophic consequence’ means fatalities and/or multiple severe injuries and/or major damages to the environment resulting from an accident;
24.
‘safety acceptance’ means status given to the change by the proposer based on the safety assessment report provided by the assessment body;
25.
‘system’ means any part of the railway system which is subject to a change;
26.
‘notified national rule’ means any national rule notified by Member States under Council Directive 96/48/EC (4), Directive 2001/16/EC of the European Parliament and the Council (5) and Directives 2004/49/EC and 2008/57/EC.
Article 4
Significant changes
1. If there is no notified national rule for defining whether a change is significant or not in a Member State, the proposer shall consider the potential impact of the change in question on the safety of the railway system.
When the proposed change has no impact on safety, the risk management process described in Article 5 does not need to be applied.
2. When the proposed change has an impact on safety, the proposer shall decide, by expert judgement, the significance of the change based on the following criteria:
(a)
failure consequence: credible worst-case scenario in the event of failure of the system under assessment, taking into account the existence of safety barriers outside the system;
(b)
novelty used in implementing the change: this concerns both what is innovative in the railway sector, and what is new just for the organisation implementing the change;
(c)
complexity of the change;
(d)
monitoring: the inability to monitor the implemented change throughout the system life-cycle and take appropriate interventions;
(e)
reversibility: the inability to revert to the system before the change;
(f)
additionality: assessment of the significance of the change taking into account all recent safety-related modifications to the system under assessment and which were not judged as significant.
The proposer shall keep adequate documentation to justify his decision.
Article 5
Risk management process
1. The risk management process described in Annex I shall apply:
(a)
for a significant change as specified in Article 4, including the placing in service of structural subsystems as referred to in Article 2(2)(b);
(b)
where a TSI as referred to in Article 2(2)(a) refers to this Regulation in order to prescribe the risk management process described in Annex I.
2. The risk management process described in Annex I shall be applied by the proposer.
3. The proposer shall ensure that risks introduced by suppliers and service providers, including their subcontractors, are managed. To this end, the proposer may request that suppliers and service providers, including their subcontractors, participate in the risk management process described in Annex I.
Article 6
Independent assessment
1. An independent assessment of the correct application of the risk management process described in Annex I and of the results of this application shall be carried out by a body which shall meet the criteria listed in Annex II. Where the assessment body is not already identified by Community or national legislation, the proposer shall appoint its own assessment body which may be another organisation or an internal department.
2. Duplication of work between the conformity assessment of the safety management system as required by Directive 2004/49/EC, the conformity assessment carried out by a notified body or a national body as required by Directive 2008/57/EC and any independent safety assessment carried out by the assessment body in accordance with this Regulation, shall be avoided.
3. The safety authority may act as the assessment body where the significant changes concern the following cases:
(a)
where a vehicle needs an authorisation for placing in service, as referred to in Articles 22(2) and 24(2) of Directive 2008/57/EC;
(b)
where a vehicle needs an additional authorisation for placing in service, as referred to in Articles 23(5) and 25(4) of Directive 2008/57/EC;
(c)
where the safety certificate has to be updated due to an alteration of the type or extent of the operation, as referred to in Article 10(5) of Directive 2004/49/EC;
(d)
where the safety certificate has to be revised due to substantial changes to the safety regulatory framework, as referred to in Article 10(5) of Directive 2004/49/EC;
(e)
where the safety authorisation has to be updated due to substantial changes to the infrastructure, signalling or energy supply, or to the principles of its operation and maintenance, as referred to in Article 11(2) of Directive 2004/49/EC;
(f)
where the safety authorisation has to be revised due to substantial changes to the safety regulatory framework, as referred to in Article 11(2) of Directive 2004/49/EC.
4. Where the significant changes concern a structural subsystem that needs an authorisation for placing in service as referred to in Article 15(1) or Article 20 of Directive 2008/57/EC, the safety authority may act as the assessment body unless the proposer already gave that task to a notified body in accordance with Article 18(2) of that Directive.
Article 7
Safety assessment reports
1. The assessment body shall provide the proposer with a safety assessment report.
2. In the case referred to in point (a) of Article 5(1), the safety assessment report shall be taken into account by the national safety authority in its decision to authorise the placing in service of subsystems and vehicles.
3. In the case referred to in point (b) of Article 5(1), the independent assessment shall be part of the task of the notified body, unless otherwise prescribed by the TSI.
If the independent assessment is not part of the task of the notified body, the safety assessment report shall be taken into account by the notified body in charge of delivering the conformity certificate or by the contracting entity in charge of drawing up the EC declaration of verification.
4. When a system or part of a system has already been accepted following the risk management process specified in this Regulation, the resulting safety assessment report shall not be called into question by any other assessment body in charge of performing a new assessment for the same system. The recognition shall be conditional on demonstration that the system will be used under the same functional, operational and environmental conditions as the already accepted system, and that equivalent risk acceptance criteria have been applied.
Article 8
Risk control management/internal and external audits
1. The railway undertakings and infrastructure managers shall include audits of application of the CSM on risk evaluation and assessment in their recurrent auditing scheme of the safety management system as referred to in Article 9 of Directive 2004/49/EC.
2. Within the framework of the tasks defined in Article 16(2)(e) of Directive 2004/49/EC, the national safety authority shall monitor the application of the CSM on risk evaluation and assessment.
Article 9
Feedback and technical progress
1. Each infrastructure manager and each railway undertaking shall, in its annual safety report referred to in Article 9(4) of Directive 2004/49/EC, report briefly on its experience with the application of the CSM on risk evaluation and assessment. The report shall also include a synthesis of the decisions related to the level of significance of the changes.
2. Each national safety authority shall, in its annual safety report referred to in Article 18 of Directive 2004/49/EC, report on the experience of the proposers with the application of the CSM on risk evaluation and assessment, and, where appropriate, its own experience.
3. The European Railway Agency shall monitor and collect feedback on the application of the CSM on risk evaluation and assessment and, where applicable, shall make recommendations to the Commission with a view to improving it.
4. The European Railway Agency shall submit to the Commission by 31 December 2011 at the latest, a report which shall include:
(a)
an analysis of the experience with the application of the CSM on risk evaluation and assessment, including cases where the CSM has been applied by proposers on a voluntary basis before the relevant date of application provided for in Article 10;
(b)
an analysis of the experience of the proposers concerning the decisions related to the level of significance of the changes;
(c)
an analysis of the cases where codes of practice have been used as described in section 2.3.8 of Annex I;
(d)
an analysis of overall effectiveness of the CSM on risk evaluation and assessment.
The safety authorities shall assist the Agency by identifying cases of application of the CSM on risk evaluation and assessment.
Article 10
Entry into force
1. This Regulation shall enter into force on the 20th day following its publication in the Official Journal of the European Union.
2. This Regulation shall apply from 1 July 2012.
However, it shall apply from 19 July 2010:
(a)
to all significant technical changes affecting vehicles as defined in Article 2(c) of Directive 2008/57/EC;
(b)
to all significant changes concerning structural subsystems, where required by Article 15(1) of Directive 2008/57/EC or by a TSI.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels, 24 April 2009.