- 7 - TR 62267-2 @IEC:2011(E) 5 Methodologyofthepresenthazardanalysis 5.1 General It is the purpose of the hazard analysis to demonstrate that the AUGT application is as safe as applications with drivers. This is the reason that it has been structured following the basic functions of AUGTsystems as identified in Table 1of IEC 62267:2009. 5.2 Hazard identification Reuters The column"Hazard” shows the top-level hazards identified. A hazard is considered as a train doors)or possible influences to these operations (e.g.obstacle in the guideway) 5.3 Cause identification The column "Cause" contains the reason or description why the hazard may lead to an accident. 5.4 Trigger identification The column "Trigger" contains the possible event(s) or condition(s) which leads from the identified hazard to an accident. 5.5 Hazardous situation com The combination of hazard, cause and trigger are mentioned and tabulated in Clause 7 of dow IEC 62267:2009 as"hazardous situation". It shall be noted that a hazardous situation can be mitigated usually only by avoiding or mitigating causes and/or triggers. Table 1 gives a unique numberforeach hazardous situation. 5.6 Accident The column"Accident (Effect)"in Table 1 contains the assumed harmful consequence for each identified hazard, cause and trigger. 5.7 Result of the hazard analysis The column“Safeguard”in Table 1 lists possible measures (barriers)which are able to compensate the absence of a train driver from the front cabin of the train (Driverless Train Operation -DTO), or No further I any attendant staff on board train (Unattended Train Operation -UTO) in order to mitigate the hazardous situations to a sufficient level.The possible safeguards are gained from the experience of AUGT systems operated in the world and defined in a way that ction consequence. or distribut During the development of the hazard analysis for each mitigation and thereby each safeguard of the identified hazards, the question of whether the safeguard compensates for the absence of driver (DTO) or staff (UTO) was addressed by the group. The resulting hazard tion analysis table (Table 1) shows the safeguards that were found to be able to either mitigate or compensate the identified hazards, taking into account the local safety culture. When the safeguard on its own compensates the absence of driver or staff for the identified hazard, the Uncontrolledwhen prin - 8 - TR 62267-2 @IEC:2011(E) 5.8 ReferencetoIEC62267 The column“IEC 62267:200g"provides the references to the safety requirements described in Clause8 of IEC62267:2009 which might beconsidered for choosing safeguards or appropriate combinations of safeguards and to establish their system requirements as mo The entry"Out of scope" is provided if a hazardous situation and the assigned safeguard are not specific to AUGT systems because in conventional operations operational staff on board trains is not involved in hazard mitigation. Thus,"Out of scope" is entered in the column when no reference to a safeguard is provided in IEC 62267. 6 Structure of hazard analysis table So 6.1 General nc. The present hazard analysis table (Table 1) is structured according to the basic functions of train operations for which a driver from the front cabin or attendant staff on board the train has a responsibility for ensuring safe operation depending on the grade of sutomation. Each basic function is intended to cover their associated top-level hazards as described below. 6.2 Hazards associated with"ensuring safe movement of trains” Ensuring safe movement of trains and its associated basic functions "ensure safe route", “"ensure safe separation of trains” and"ensure safe speed" is intended to cover all hazards leading to derailment or collision of trains with other trains or infrastructure caused by unsafe routes and route elements (e.g. moving points, flank movements or oncoming train movements), insufficient spacing between trains and between train and infrastructure (e.g. line end) ex