Engineering Safety Management Issue 3 Yellow Book 3 Volume 1 Fundamentals Disclaimer Railtrack has taken trouble to make sure that this document is accurate and useful, but it is only a guide. The company does not give any form of guarantee that following the recommendations in this document will be enough to ensure safety. Railtrack will not be liable to pay compensation to anyone who uses this guide. The Crystal Mark applies to volume 1 only. Published by Railtrack on behalf of the UK rail industry Published in January 2000 by: Railtrack PLC Railtrack House Euston Square London NW1 2EE. Phone: 020 7557 8000 www.railtrack.co.uk Distributed by: Praxis Critical Systems Limited 20 Manvers Street Bath BA1 1PX. Phone: 01225 466991 www.praxis-cs.co.uk Copyright © Railtrack PLC 2000 You can order further copies from the ESM administrator at Praxis Critical Systems. Foreword Railtrack published issue 1 of the Yellow Book in 1996 as a single volume. It contained certain group standards, line standards and departmental work instructions. Together these provided a basis for carrying out Engineering Safety Management and supported our customers and suppliers by giving details of some of our internal procedures for Engineering Safety Management. We published Issue 2 of the Yellow Book in 1997 in four volumes. This issue added more basic safety information, written specifically for those managing safety engineering. After publishing issue 2, we set up a steering group to direct further development of the Yellow Book. We also set up a user group, bringing together people with responsibility for safety from the railway and other industries, to support the steering group. We wrote issue 3 of the Yellow Book, under the direction of the steering group, with input from users, through the user group and other channels. We now publish material that is specific to Railtrack separately, and the Yellow Book has been aligned with relevant international standards. The guidance in the Yellow Book is no longer specific to Railtrack and may be useful in connection with other railways. We are continuing to try and improve the format and content of the Yellow Book. Please use the suggestion form at the end of this volume if you want to comment on this issue. Acknowledgements We have prepared this document with the guidance of the following steering group members. All of these people provided their time and expertise as professionals committed to improving railway safety. Their opinions do not necessarily reflect those of their employers. We gratefully acknowledge their contribution. Roger Aylward Brian Clementson Alan Cooksey John D Corrie Robert A Davis Andy Doherty Bruce Elliott Terry George Eddie Goddard Colin Hall Ali G Hessami Jim Irwin Roderick I Muttram Dee Razdan Chris Thompson The members were drawn from the following organisations: DaimlerChrysler Rail Systems (UK) Limited Her Majesty’s Railway Inspectorate HSBC Rail (UK) Limited London Underground Limited Mott MacDonald Limited Praxis Critical Systems Limited Railtrack PLC Virgin Trains Westinghouse Signals Limited WS Atkins Rail Limited We are also grateful to Plain English Campaign for their help in writing this document. Volume structure Volume 1 Engineering Safety Management Fundamentals 1 Introduction 2 Obligations and liabilities 3 Engineering safety management fundamentals 4 Putting the fundamentals into practice Volume 2 Engineering Safety Management Guidance Part 1: Introductory material 1 Introduction Part 2: Organisational fundamentals 2 Safety responsibilities 3 Safety culture 4 Competence and training 5 Working with suppliers 6 Communicating and co-ordinating Part 3: Change fundamentals 7 Defining changes 8 Identifying hazards and assessing and reducing risk 9 Safety requirements 10 Safety evidence and authorising change Part 4: Project fundamentals 11 ESM from start to finish 12 Safety planning and good practice 13 Configuration management, documentation and records 14 Independent professional review Appendices A Glossary B Document outlines C Checklists D Examples E Techniques F Referenced documents Volume 1 Engineering Safety Management Fundamentals Page 1 INTRODUCTION 1 1.1 Purpose 1 1.2 Definitions 1 1.3 The structure of the Yellow Book 2 2 OBLIGATIONS AND LIABILITIES 4 2.1 UK law 4 2.2 Railways (Safety Case) Regulations 5 2.3 ‘Reasonable practicability’ 5 2.4 Good practice 6 3 ENGINEERING SAFETY MANAGEMENT FUNDAMENTALS 8 3.1 Organisations 9 3.2 Changes 11 3.3 Projects 14 4 PUTTING THE FUNDAMENTALS INTO PRACTICE 16 5 OTHER REFERENCES 16 Introduction Section 1 Issue 3 Page 1 1 INTRODUCTION 1.1 Purpose Safety has always been the first concern for the railway. It is due to the professionalism and vigilance of its workers that railway transport is so safe, compared to other forms of transport. Railtrack has written Engineering Safety Management (or the Yellow Book as it is more commonly known) to help people who are involved in changes to the railway (such as new trains and signalling) make sure that these changes contribute to improved safety. Please do not be misled by the title. The Yellow Book is not just for engineers and you can use it for changes that involve more than just engineering. We considered other titles but felt that it was least confusing to keep the title people were familiar with. We originally published the Yellow Book for our own purposes. However, in our Network Management Statement and our Railway Safety Case, we have committed ourselves to taking a central role in Britain’s railways. We have therefore sponsored issue 3 on behalf of the whole industry, under the direction of a steering group with members from across the industry. We have improved the Yellow Book over time. This issue is in two volumes. This volume gives the basic legal background to Engineering Safety Management and the fundamentals of carrying it out. It is relevant to anyone working in the railway industry involved in, or accountable for, changing the railway. Volume 2 gives more specialised guidance as described on the next page. 1.2 Definitions In general we have written this volume in plain language but we use a few specialised terms. In this volume they have the following meanings. Hazard – any situation that could contribute to an accident. Hazards should be eliminated wherever ‘practicable’, but this is not always the case. Where a hazard cannot be completely eliminated then there will be some risk. Risk – the likelihood that an accident will happen and the harm that could arise. In many cases, risk cannot be eliminated entirely. We must accept this if we are to continually improve safety. We say that something is safe when the risk associated with it is reduced to an acceptable level. This level may reduce as technological advances make it possible to reduce risk even further. System – any collection of equipment, people and procedures which work together to achieve a common goal. We can treat any change to the railway as introducing a new system or changing an existing one. Engineering Safety Management (ESM) – managing the safety of changes which may affect railway safety. This involves considering the safety of the railway throughout the life of the change but is mostly done before the change is made. We cannot separate engineering from the other factors that affect safety, particularly human factors. ESM involves considering all relevant factors. Volume 1 Engineering Safety Management Fundamentals Page 2 Issue 3 Engineering safety case – this presents the justification for the safety of a change to the railway. (Like ESM, an engineering safety case covers more than just engineering.) This is different from a railway safety case which is a document that describes an organisation’s arrangements for safety management. Where we use safety case on its own, we mean an engineering safety case. 1.3 The structure of the Yellow Book Issue 3 of the Yellow Book is in two volumes: 1 Engineering Safety Management Fundamentals 2 Engineering Safety Management Guidance Volume 1 describes some of the safety obligations on people involved in changing the railway. It also describes the fundamentals of a systematic approach to meeting these obligations. There are many effective ways of putting these fundamentals into practice. Volume 2 gives advice on ways that have proved effective. Volume 2 is in three main parts, corresponding to the three groups of fundamentals we describe in this volume. We give guidance on each fundamental in a separate section. There is also a CD-ROM which provides information that supports volume 2. Volumes 1 and 2 are relevant to you if you are involved in railway ESM, whether or not you are looking to gain our safety acceptance. If you are looking to gain our safety acceptance, you should also read our industry guidance on our acceptance procedures. This describes how we grant safety acceptance and gives guidance on how to get it. Other organisations, such as Her Majesty’s Railway Inspectorate (HMRI) and London Underground Limited, also publish guidance on their safety acceptance procedures. However, these publications are not directly associated with the Yellow Book. Figure 1 shows the overall structure of this Yellow Book, and figure 2 gives a guide to the content and intended readers of each part. our CD-ROM ESM Tools and Information The Yellow Book Industry guidance on our acceptance procedures This is consistent with Volume 2 ESM Guidance Volume 1 ESM Fundamentals Figure 1 – Overall structure of the Yellow Book Introduction Section 1 Issue 3 Page 3 Part Content Intended readers Volume 1 – Engineering Safety Management Fundamentals • The essential features of an effective approach to ESM • Senior executives in the railway industry • Anyone whose work contributes to railway change Volume 2 – Engineering Safety Management Guidance • Guidance on one proven way of putting the fundamentals into practice • Anyone whose work contributes to railway change • Anyone assessing or auditing this kind of work CD ROM – Engineering Safety Management Tools and Information • Practical support to assess risk • Anyone carrying out a risk assessment Industry guidance on our acceptance procedures • Railtrack policy and guidance on gaining Railtrack safety acceptance • Anyone seeking our safety acceptance • Anyone assessing or auditing projects for which Railtrack safety acceptance is requested Figure 2 – Content and intended readers of the Yellow Book, and associated publications Volume 1 Engineering Safety Management Fundamentals Page 4 Issue 3 2 OBLIGATIONS AND LIABILITIES The main purpose of the Yellow Book is to help you set up a process that protects you and others from mistakes and gives documented evidence (the engineering safety case) that risk is at an acceptable level. The Yellow Book also helps you to keep within the law and relevant standards. This section describes some of the obligations that the Yellow Book helps you to carry out. It also describes some of the legal liabilities that you face and some ways of reducing them. We discuss UK law, but the discussion is no substitute for detailed legal advice. 2.1 UK law The Government reviewed the arrangements for regulating railway safety before privatising the British main line railway. It followed recommendations in the report ‘Ensuring Safety on Britain’s Railways’ and confirmed that the Health and Safety Executive (HSE) would be the safety regulator for the whole railway network. In fact HMRI, which is part of HSE, does the regulating. More generally, the ‘Health and Safety at Work etc Act 1974’ places duties on employers and employees. Employers must ensure, ‘so far as is reasonably practicable’, the health, safety and welfare of their employees and of other people they affect. In the case of railways, this includes passengers and other members of the public. Section 2.3 discusses the phrase, ‘so far as is reasonably practicable’. The act applies to those who supply products, such as trains and signalling systems, as well as those who run and maintain the railways. These responsibilities can be shared under a contract but cannot be completely transferred. The act contains powers to make regulations. Regulations made under the act have the force of law. HSE publishes guidance notes on regulations, which you should read if they are relevant to you. The ‘Management of Health and Safety at Work Regulations 1992’ says employers must assess the risk to employees and others affected by their work. Employers who share a workplace must also co-operate to achieve safety and share safety information. The ‘Construction (Design and Management) Regulations 1994’ place duties on those involved in some construction projects. They must plan, co-operate, share information and keep certain records. This will control the risk to the health and safety of people affected by the project. The people involved must be able to show HSE that they have done this. The ‘Railways (Safety Critical Work) Regulations 1994’ place a duty on those who employ people doing defined ‘safety-critical’ work on the railway to assess that they are competent and fit to do the work. The assessment must be recorded. The ‘Railways (Safety Case) Regulations 1994’ say that train and station operators and railway infrastructure controllers must prepare a railway safety case. The railway safety case must be accepted before they start operations and they must follow it. We discuss railway safety cases in the next section. As well as the railway’s own acceptance processes, statutory approval is needed for new and changed railways. The ‘Railways and Other Transport Systems (Approval of Works, Plant and Equipment) Regulations 1994’, made under the ‘Transport and Works Work Act 1992’, confirm the powers given to HMRI by earlier laws. They also extend them, in particular, to include the general power to approve trains. Obligations and Liabilities Section 2 Issue 3 Page 5 HMRI publishes guidance on how the regulations apply and how to get approval. The approval process is similar to the railway’s own acceptance process. In many cases, the work done to get railway acceptance will help to get HMRI approval as well. There are other relevant acts and regulations, which we do not discuss. 2.2 Railways (Safety Case) Regulations Any train or station operator must write a railway safety case and have it accepted before starting operations. The operator must then follow their safety case. HSE accepts railway safety cases from the infrastructure controller, who owns and runs the infrastructure. The infrastructure controller may accept railway safety cases from train and station operators. The Railway Group is made up of us and those organisations whose railway safety cases we accept. Among other things, the railway safety case must describe: • the operator’s safety policy and arrangements for safety management; • the operator’s assessment of the risk; • how it will monitor safety; • how it organises itself to carry out its safety policy; and • how it makes sure that its staff are competent to do safety-related work. A railway safety case must also show a systematic approach to managing technical change in general. An engineering safety case shows a systematic approach to managing the safety of one change to the railway. The two are different but related and an engineering safety case can support a railway safety case. 2.3 ‘Reasonable practicability’ We have seen that the ‘Health and Safety at Work etc Act 1974’ places duties on employers to ensure health, safety and welfare ‘so far as is reasonably practicable’. This section gives more guidance on this test. We have taken account of the HSE discussion document, ‘Reducing Risks, Protecting People’. If you are working on a change to the railway, you should first identify the hazards associated with the change. You should make sure that you have precautions in place against each hazard within your control (unless you can show that the risk arising from the hazard is so small that it is not worth considering). You should make sure that your precautions reflect good practice, as set out in the law, government guidance and standards. If the risk is low and completely covered by good practice, published by a recognised authority, showing that you have followed this good practice may be enough to show that the risk is acceptable. For instance the electrical safety of ordinary office equipment is normally shown by certifying it against electrical standards. However, before you decide that just referring to standards is enough, make sure that: • the equipment is being used as intended; • all of the risk is covered by the standards; and • the standards cover your situation. We discuss good practice further in the next section. Volume 1 Engineering Safety Management Fundamentals Page 6 Issue 3 If following good practice is not enough to show that the risk is acceptable, you should also assess the total risk that will be produced by the part of the railway being changed. You then need to compare it with two extreme regions. • An intolerable region where risk can never be accepted. • A broadly acceptable region where risk can always be accepted. To decide whether or not to accept a risk: 1 check if the risk is in the intolerable region – if it is, do not accept it; 2 check if the risk is in the broadly acceptable region – if it is, you will not need to reduce it further, unless you can do so at reasonable cost, but you must monitor it to make sure that it stays in that region; and 3 if the risk lies between these two regions, accept it only after you have taken all ‘reasonably practicable’ steps to reduce the risk. You should consider ways of making the change less likely to contribute to an accident. You should also consider ways of making the change more likely to prevent an accident. You do not have to consider steps that are outside your control. You will generally expect the risk to be lower after the change than it was beforehand. If it is higher, it is unlikely that you have reduced the risk as low as reasonably practicable. If you are not certain about the risk, you should choose to be cautious – uncertainty does not justify not taking action. To decide whether a step that would reduce risk is reasonably practicable, you must balance the reduction in risk against other factors. These include cost and any increase in complexity. In ‘Reducing Risks, Protecting People’, HSE suggest that you can use a figure of slightly under £1 million (at 1998 prices) as a ‘benchmark’ – an indication of what it is reasonably practicable to spend to reduce risk by one fatality. However, you should use a higher figure for risks for which there is high public concern. As risks of major railway accidents fall into this category, the benchmarks used in railway decision making are often higher. All benchmarks are only rough reflections of the values held by society. If there is significant public concern about a hazard, you should take this into account in your decision making and it may justify precautions that would not be justified otherwise. Following this guidance will help you make objective decisions and show how you reach those decisions. It also helps you make sure that you are using limited resources in the best way. 2.4 Good practice The main reason for using good practice is to reduce risk. However, if you face a civil action for damages after an accident, you may want to show that you used good practice and met relevant standards. This could help your defence against a charge of negligence and reduce other legal liabilities. The standards that are relevant to you will depend upon what you are doing but the following generally apply. Our Safety and Standards Directorate maintains a series of ‘Railway Group Standards’, which cover aspects of the UK main line railway and members of the Railway Group must meet these. Obligations and Liabilities Section 2 Issue 3 Page 7 HMRI’s ‘Railway Safety Principles and Guidance’ (the ‘Blue Book’) gives advice on designing, constructing and altering works, plant and equipment, while maintaining railway safety. It sets out safety principles and the factors affecting how to put them into practice. It also gives advice on detailed aspects of railway construction. It deals with the end result of design and construction rather then the processes themselves. The Engineering Council’s ‘Guidelines on Risk Issues’ give practical and ethical guidance to engineers and managers on how to meet their social responsibilities by controlling risk. They discuss: • the legal and professional restrictions on the engineer; • the concepts behind managing risk; and • implications for education and public awareness. The Hazard Forum’s document ‘Safety-related Systems – Guidance for Engineers’ gives professional engineers an overview of the professional, practical and legal aspects of working on safety-related systems. It applies particularly to computer- based systems. Also, if your work involves electronic systems then the following will generally apply: • IEC Standard 61508, ‘Functional safety of electrical/electronic/programmable electronic safety-related systems’. This is an international standard that applies to all sectors of industry. It describes a general safety lifecycle, which includes analysing hazards and risks, and setting safety requirements. • CENELEC have published European standards for railway applications and are working on others. The Yellow Book is generally in line with these standards and following the Yellow Book guidance will help you meet these other standards. However the Yellow Book takes a wide view of good practice and does not say that you have to follow any one standard. Volume 1 Engineering Safety Management Fundamentals Page 8 Issue 3 3 ENGINEERING SAFETY MANAGEMENT FUNDAMENTALS To make sure that a change to the railway is safe and to show this, you must follow a systematic approach to Engineering Safety Management. You do not need to carry out a full programme of ESM activities if you can show that the change involves only a ‘broadly acceptable’ level of risk, or no risk. However, you must monitor the risk to check that it stays low. If the risk comes completely within accepted standards that define agreed ways of controlling it, showing that you have met these standards may be enough to show that the risk is acceptable. For instance the electrical safety of ordinary office equipment is normally shown by certifying it against electrical standards. However, before you decide that just referring to standards is enough, make sure that: • the equipment is being used as intended; • all of the risk is covered by the standards; and • the standards cover your situation. If you need to carry out an ESM programme, it must have some fundamental features. We can look at these under three headings. These are: • the organisation, including the people who work within it, that will carry out the work; • the proposed change to the railway; and • the project, in other words the collection of activities which will make the change happen. We use ‘organisation’ to mean a company, government agency or other corporate group. Any change to the railway should be managed as a project. The fundamentals do not just apply to the railway. When we refer to a ‘change’, this could be a change to any complicated system. In our case, this system will always be the railway, including not just physical parts like the track and trains, but people and procedures as well. Each fundamental is shown in a box, followed by an explanation and justification. ESM Fundamentals Section 3 Issue 3 Page 9 3.1 Organisations 3.1.1 Safety responsibility Your organisation must identify safety responsibilities and put them in writing. It must keep records of the transfer of safety responsibilities and must make sure that anyone taking on safety responsibilities understands and accepts these responsibilities. It must make sure that anyone who is transferring responsibility for safety passes on any known assumptions and conditions that safety depends on. You need a structured organisation with good communications to carry out successful ESM. Everyone should have clear responsibilities and understand them. In particular, anyone whose work creates a risk should be responsible for managing it. They should have the knowledge they need to understand the implications of that risk and to put controls in place. Your organisation should identify who is accountable for the safety of work. They will stay accountable even if they pass on responsibility, for parts of the work, to others. The organisation that takes the lead in introducing a change should make sure that the other organisations are clear on their safety responsibilities. If you hand over infrastructure changes to an infrastructure controller or hand over rolling stock to a train operator, you may also transfer some safety responsibility. 3.1.2 Safety culture Your organisation must have safety as a primary goal. The most important factor in achieving safety is creating a safety culture. This means running an organisation so that safety is seen as a primary goal and considered appropriately in every activity. Everyone should understand that achieving safety will help to meet business goals. Setting up safety procedures is not enough. All staff should understand why these procedures are necessary and use them. 3.1.3 Competence and training Your organisation must make sure that all staff who are responsible for ESM activities are competent to carry them out. Your organisation must give them enough resources and authority to carry out their responsibilities. Your organisation must monitor their performance. Staff should have the proper training, technical knowledge, skills, experience and qualifications for their job.