Professional Certificate in Advanced Railway RAMS and Safety Assurance Engineering

Topics covered

• • Representing service success and failure logic in an RBD rather than reproducing a physical architecture diagram.
• • Series, parallel, active and standby redundancy, k-out-of-n arrangements and the effect of switching or coverage assumptions.
• • Common-cause failures, shared services, dependencies, repair policies and the limits of independence assumptions.
• • MTBF, MTTR, steady-state availability and the distinction between equipment availability and service availability.
• • Identifying dominant contributors to unavailability and testing whether added redundancy produces a meaningful benefit.

Learning outcomes

• • Build and interpret RBDs for realistic railway architectures.
• • Calculate the availability of redundant configurations using explicit assumptions.
• • Identify the components and dependencies that dominate service unavailability.
• • Compare architecture alternatives against an availability target.

Topics covered

• • Purpose and limitations of qualitative and semi-quantitative risk matrices.
• • Defining severity and likelihood categories in relation to railway operations, exposure and available evidence.
• • Calibration, category boundaries, risk-ranking sensitivity and common matrix designs that can produce misleading conclusions.
• • Risk-acceptance principles, treatment of tolerable and unacceptable risk and documentation of residual risk.
• • Use of codes of practice, reference systems and explicit risk estimation within a structured railway risk-evaluation process.

Learning outcomes

• • Critically assess a risk matrix instead of applying it mechanically.
• • Calibrate severity and likelihood criteria for a defined operational context.
• • Explain why different matrices produce different risk decisions.
• • Record a clear and auditable risk-acceptance rationale.

Topics covered

• • Deriving quantitative safety requirements from hazards and system-level safety objectives.
• • Top-down and bottom-up allocation and the role of functional decomposition.
• • Distributing a risk budget across subsystems, functions and technical, human or operational controls.
• • Independence, shared functions, common causes, interfaces and the risk of double-counting risk reduction.
• • Maintaining traceability from hazard and operating scenario to allocated requirement and verification evidence.

Learning outcomes

• • Translate a system safety target into measurable subsystem and functional requirements.
• • Develop and explain a technically defensible allocation rationale.
• • Recognise invalid independence and interface assumptions.
• • Maintain hazard-to-requirement traceability through allocation decisions.

Topics covered

• • Relationship between hazard analysis, required risk reduction, safety integrity requirements and SIL.
• • Random hardware failures, systematic failures and why SIL is not a generic label for overall system criticality.
• • Quantitative targets where applicable, architectural implications, independence, segregation and common-cause control.
• • Software and hardware lifecycle implications and the associated verification, validation and independence needs.
• • Safety-case thinking and the evidence required to support a safety integrity claim.
• • Considering cybersecurity threats when they can invalidate functional-safety assumptions or affect safety evidence.

Learning outcomes

• • Connect a hazard and risk-reduction need to a safety integrity requirement.
• • Distinguish SIL from broad statements about safety or criticality.
• • Challenge unjustified or over-specified SIL requirements.
• • Identify the engineering, lifecycle and assurance implications of an allocated SIL.

Topics covered

• • Translating contractual and operational service requirements into measurable RAM targets.
• • Reliability, maintainability and availability relationships, including MTBF, MTTR and downtime budgets.
• • Equal, weighted and criticality-based allocation approaches and when each may or may not be suitable.
• • Service boundaries, failure classifications, exclusions, degraded operation and the risk of ambiguous availability definitions.
• • Interfaces with FMECA, FRACAS, logistics support, repair strategy, spares and operational feedback.
• • Sensitivity analysis, reliability growth and selecting improvements that address the actual bottleneck.

Learning outcomes

• • Convert an operational requirement into a structured RAM budget.
• • Perform subsystem availability allocation and test compliance.
• • Identify the failure and repair parameters that dominate performance.
• • Recommend balanced reliability, maintainability and architecture improvements.

Topics covered

• • System definition, operational context, assumptions, boundaries and interfaces for a brownfield change.
• • Integration of RAM targets, hazards, risk acceptance, safety allocation, SIL, availability and degraded operation.
• • Effects of migration, coexistence, configuration change and modification of an accepted system.
• • Review of supplier assumptions, completeness of evidence and alignment between hazard logs, requirements and calculations.
• • Safety argument structure and the evidence required before a design or readiness recommendation can be accepted.

Learning outcomes

• • Integrate RAMS and safety-assurance methods across one engineering decision.
• • Identify weaknesses and missing evidence in a supplier RAMS argument.
• • Explain the effect of interfaces, common causes and migration on the acceptance decision.
• • Communicate a concise engineering recommendation to project and safety stakeholders.