IFB No.: HSR25-12 Fresno Station Early Works

C.11 Program Safety, Security, and RAM Requirements

Rev. 1.0

Revision(s) Date Description 0 12/10/2025 Initial Release

IF

B

N o.

: H S

R

-1

IN

IT

IA

L

R E

LE

A

S E

2/

/2

California High-Speed Rail Authority

Standard Specifications REQS-0016 – Program Safety, Security, and RAM Requirements

Rev. 1.0

Authored: December 9, 2025

Stefan Oberthuer, RAM Lead Date

Checked: December 9, 2025

Rik Lor, Certification and System Safety Lead Date

Checked:

R Greenwood

December 9, 2025

Rubina Greenwood, Deputy Director of Network Integration Date

Approved: December 9, 2025

Ryan Scott, Director of Rail Engineering Date

Released by: December 9, 2025

Amit Joshi, Configuration Manager Date

CALIFORNIA HIGH-SPEED RAIL AUTHORITY

REQS-0015 – Program Safety, Security, and RAM Requirements 2 of 24

Document Revision History – Program Safety, Security, and RAM Requirements

Second Edition

December 2025

Revision Date Revision Description

0.0 October 2025 First edition

1.0 December 2025 Review and updated for clarity

REQS-0015 – Program Safety, Security, and RAM Requirements 3 of 24

TABLE OF CONTENTS

1 SCOPE OF THE DOCUMENT

1.1 SCOPE DESCRIPTION

2 REFERENCE STANDARDS AND DOCUMENTS

2.1 GENERAL

2.2 DESIGN GUIDELINES

2.3 TSI

2.4 STANDARDS AND REGULATIONS

2.5 OTHER DOCUMENTS

3 TERMS, DEFINITIONS, AND ABBREVIATIONS

4 RAM MANAGEMENT PROCESS

4.1 RAM PERFORMANCE REQUIREMENTS

4.2 RAM QUANTITATIVE TARGETS

4.3 CONTRACTOR RAM PLANNING AND ORGANIZATION

4.4 HSR SYSTEM LIFE-CYCLE STAGES AND ASSOCIATED CONTRACTOR TASKS – PHASES 1 – 5 OF EN50126- 1:2017

4.5 HSR SYSTEM LIFE-CYCLE STAGES AND ASSOCIATED CONTRACTOR TASKS – PHASES 6 AND 7 OF

EN50126-1:2017

4.6 HSR SYSTEM LIFE-CYCLE STAGES AND ASSOCIATED CONTRACTOR TASKS – PHASES 8 TO 10 OF

EN50126-1:2017

4.7 HSR SYSTEM LIFE-CYCLE STAGES AND ASSOCIATED CONTRACTOR TASKS – PHASES 11 AND 12 OF

EN50126-1:2017

4.8 CHANGE MANAGEMENT PROCEDURE FOR RAM SUBMITTALS

4.9 EPIDEMIC FAILURE MANAGEMENT PROCEDURE

4.10 RAM PERFORMANCE CORRECTION PROCEDURE

5 SAFETY MANAGEMENT PROCESS

5.1 CONTRACTOR’S SAFETY PLANNING AND ORGANIZATION

5.2 SYSTEM INTEGRATION REQUIREMENTS

5.3 SAFETY ANALYSES

5.4 RISK EVALUATION, CLASSIFICATION, AND ACCEPTANCE

5.5 SAFETY REQUIREMENTS TRACKING

5.6 SAFETY CERTIFICATION

5.7 SAFETY COMMITTEES

6 SECURITY MANAGEMENT PROCESS

6.1 CONTRACTOR SECURITY PLANNING AND ORGANIZATION

6.2 SECURITY ANALYSES

6.3 SECURITY RISK ASSESSMENT

6.4 SECURITY COMMITTEES

7 CONSTRUCTION SAFETY AND SECURITY

7.1 CONSTRUCTION SAFETY AND SECURITY PROGRAM

7.2 PROGRAM ELEMENTS

7.3 CONSTRUCTION RISK MANAGEMENT

8 COORDINATION WITH FEDERAL AGENCIES

8.1 FEDERAL RAILROAD ADMINISTRATION COORDINATION

8.2 DEPARTMENT OF HOMELAND SECURITY COORDINATION

REQS-0015 – Program Safety, Security, and RAM Requirements 4 of 24

1 SCOPE OF THE DOCUMENT

1.1 Scope Description

1.1.1 The scope of this Technical Specification is to define the California High-Speed Rail Authority’s (Authority) requirements for the management of Reliability, Availability, Maintainability, and Safety (RAMS), and Security processes.

1.1.2 This Technical Specification is based on the following reference documents:

• PLAN-1004 – Safety and Security Management Plan (SSMP)

• PLAN-1032 – Rail System Safety Plan

• PLAN-1033 – RAM Management Plan

• REQS-0003 – Systems Development Life Cycle Requirements (SDLC)

1.1.3 This Technical Specification provides non-functional (or process) requirements applicable to the Contractor for RAM, Safety, and Security. The Contractor should also refer to the Plans referred in Clause 1.1.2 for additional details on how the Authority expects the related tasks to be performed.

1.1.4 Note that additionally to this specification, Technical Contract Requirements for RAM, Safety and Security are included in the Design Criteria Manual (DCM).

1.1.5 Cybersecurity management process is addressed separately in the Cybersecurity specification SPEC- 0005.

1.1.6 The requirements are formulated using the following words and their meanings:

• “Shall”: Indicates mandatory requirement that must be strictly implemented. Any impossibility to fulfil this requirement must be agreed through a derogation case (see change management procedure).

• “Must”: Indicates an obligation or a mandatory requirement.

• “Should”: Indicates preferred course of action, recommendations. No agreement of derogation is necessary, there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course - for example the same goal is reached by other solutions, which are permissible within the binding standards or documents.

• “May”: Indicates a permissible course of action within the limits of the standards, but which is not mandatory to be fulfilled.

The Schedules define the technical scope of the Work for the Project. The requirements set out in these Schedules are mandatory. The Contractor is obliged to comply with these requirements, subject to any waivers and variations from specific requirements that the Authority may grant in its sole discretion, or for which the Contractor may apply through the Design Variation Request (DVR) process.

REQS-0015 – Program Safety, Security, and RAM Requirements 5 of 24

2 REFERENCE STANDARDS AND DOCUMENTS

2.1 General

2.1.1 The Contractor shall apply the in-force standards, guidelines, and specifications provided in this chapter for all project stages of the design, test, manufacture, supply, delivery, assembly, installation, testing, commissioning, and training.

2.2 Design Guidelines

2.2.1 The latest version of the following Design Guidelines shall be applied:

TABLE 1 DESIGN GUIDELINES

Code Title

DCM Rev 7.0 Design Criteria Manual, Rev 7.0

2.3 TSI

Not applicable.

2.4 Standards and regulations

2.4.1 The Contractor shall apply the following standards and regulations, the in-force versions shall be applied.

TABLE 2 – LIST OF APPLICABLE STANDARDS AND REGULATIONS

# Code Title

1 EN 50126-1 Railway applications - The Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) - Part 1: Generic RAMS Process

2 EN 50126-2

Railway applications - The Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) - Part 2: Systems Approach to Safety

3 EN 50126-3

Railway applications – The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) – Part 3: Guide to the application of EN 50126-1 for rolling stock RAM

4 EN 50128 Railway applications - Communication, signaling and processing systems - Software for railway control and protection systems

5 EN 50129 Railway applications – Communication, signaling and processing systems — Safety-related electronic systems for signaling.

6 EN 50716 Railway Applications – Requirements for Software Development

7 EN 50159 Railway applications - Communication, signaling and processing systems - Safety-related communication in transmission systems

8 EN 61124 Reliability testing – Compliance tests for constant failure rate and constant failure intensity

9 IEC 60300-3-11 Dependability management - Part 3-11: Application guide - Reliability centered maintenance

10 IEC 62380 Reliability data handbook - Universal model for reliability prediction of electronics components, Printed Circuit Boards (PCB) and equipment

11 IEC 60605-4

Equipment reliability testing - Part 4: Statistical procedures for exponential distribution - Point estimates, confidence intervals, prediction intervals and tolerance intervals

12 IEC 60812 Analysis techniques for system reliability – Procedures for failure mode and effects analysis

13 IEC 60863 Presentation of reliability, maintainability, and availability predictions

REQS-0015 – Program Safety, Security, and RAM Requirements 6 of 24

# Code Title

14 IEC 61025 Fault Tree Analysis

15 IEC 61078 Analysis techniques for dependability – Reliability block diagram method

16 IEC 61165 Application of Markov Techniques

17 IEC 61160 Design Review

18 IEC 60706-2 Maintainability of equipment - Part 2: Maintainability requirements and studies during the design and development phase

19 MIL-STD-785B Reliability Program for Systems and Equipment, Development and Production

20 MIL-STD-471A Maintainability Verification / Demonstration / Evaluation

21 MIL-HDBK-781A Reliability Test Methods, Plans, and Environments for Engineering Development, Qualification, and Production

22 MIL HDBK 344A Environmental Stress Screening (ESS) of electronic equipment

23 CPUC General Orders California Public Utilities Commission (CPUC) General Orders

24 FRA CFR title 49, Parts 200-299

U.S. Department of Transportation, Title 49 Code of Federal Regulations, Parts 200 to 299

25 MIL-STD-882E U.S. Department of Defense, MIL-STD-882E, Standard Practice, System Safety

26 DOT-FTA-MA-26-5019-

03-01

U.S. Department of Transportation, Federal Transit Administration, The Public Transportation System Security and Emergency Preparedness Planning Guide

27 FTA C 5800.1 U.S. Department of Transportation, Federal Transit Administration, Circular 5800.1

– Safety and Security Management Guidance for Major Capital Projects

28 FTA-MA-90-5006-02-01 U.S. Department of Transportation, Federal Transit Administration, Handbook for Transit Safety and Security Certification

29\ CSM-RA Office Journal of the European Union, Commission Regulation (EC) 402/2013, Common Safety Method for Risk Assessment

30 CFR Title 29, Part 1910 Occupational Safety and Health Standards

2.5 Other Documents

2.5.1 The following other documents shall be referred:

TABLE 3 – OTHER DOCUMENTS

# Authority Document # Title

1 PLAN-1033 RAM Management Plan, Revision 5

2 PLAN-1004 Safety and Security Management Plan (SSMP), Revision 9

3 PLAN-1032 Rail System Safety Plan

4 REQS-0003 Systems Development Life Cycle Requirements (SDLC), Application to Track and Systems Procurements

5 SPEC-0005 STS Cybersecurity, TSCC Specifications

6 GUIDE-0005 Testing and Commissioning Strategy

7 RPRT-0003 Preliminary Hazard Analysis (PHA)

REQS-0015 – Program Safety, Security, and RAM Requirements 7 of 24

3 TERMS, DEFINITIONS, AND ABBREVIATIONS

3.1.1 All the terms, definitions, and abbreviations are provided in: Glossary of Terms, Abbreviations, and

Definitions, in addition to the below:

TABLE 4 – ABBREVIATIONS / ACRONYMS

Abbreviation / Acronym Term

Authority California High-Speed Rail Authority

ALARP As Low As Reasonably Practicable

CAR Corrective Action Report

CCB Change Control Board

CCF Common Cause Failure

CMA Corrective Maintenance Analysis

DCM Design Criteria Manual

EN Euro Norm

ESS Environmental Stress Screening

FLSSC Fire and Life Safety and Security Committee

FMECA Failure Modes and Effects Criticality Analysis

FRACAS Failure Reporting and Corrective Action System

FTA Federal Transit Administration

HPMR Historical Product Maintainability Report

HSR System California High-Speed Rail System

IEC International Electrotechnical Commission

MIL-STD United States Military Standard

MTBSF Mean Time Between Service Failures

MTTRS Mean Time to Restore Service

O&M Operations and Maintenance

OTA On-Time Arrival

PCB Printed Circuit Board

PMA Preventive Maintenance Analysis

PRR Preliminary RAM Report

RA RAM Analysis

RAM Reliability, Availability, and Maintainability

RAMP Reliability, Availability, and Maintainability Management Plan

RAMS Reliability, Availability, Maintainability, and Safety

RAR RAM Allocation Report

RCM Reliability Centered Maintenance

RCMR Reliability Centered Maintenance Report

RM Requirements Management

SCADA Supervisory Control and Data Acquisition

SDLC System Development Lifecycle

SiSTVA Site-Specific Threat and Vulnerability Analysis

SITC System Integration Testing Committee

REQS-0015 – Program Safety, Security, and RAM Requirements 8 of 24

Abbreviation / Acronym Term

SONO Statement of No Objection

SPOF Single Point of Failure

SSCR Safety and Security Certification Reports

SSHASP Site-Specific Health and Safety Plans

SSI Sensitive Security Information

SSMP Safety and Security Management Plan

SSOC Safety and Security Oversight Committee

SSSP Site-Specific Security Plans

TVA Threat and Vulnerability Analysis

V&V Verification and Validation

REQS-0015 – Program Safety, Security, and RAM Requirements 9 of 24

4 RAM MANAGEMENT PROCESS

4.1 RAM Performance Requirements

4.1.1 The Contractor (“Contractor”) shall demonstrate that the Work is compliant with RAM requirements including but not limited to On-Time Arrival (OTA), Mean Time Between Service Failure (MTBSF), Mean Time to Restore Service (MTTRS), percentage of late stops and percentage of missed stops.

4.1.2 The Contractor shall incorporate a Spare Part Analysis in the RAM submittal Corrective Maintenance Analysis.

4.1.3 The Spare Part Analysis shall demonstrate the impact of component failure and the criticality on system functionality.

4.1.4 The Spare Part Analysis shall refer to random failures and corrective maintenance activities.

4.1.5 The Spare Part Analysis shall use a mathematical approach including the component failure rate (constant).

• Assume that failed items cannot be repaired.

• The calculations for one year is set to 8760 hours. One day is counted as 24 hours and one year is counted as 365 days. This time assumes random failures that can also happen in non-service times.

4.1.6 The Spare Part Analysis shall use a justified lead time.

4.1.7 The Contractor’s designs shall include maintenance diagnostic function to provide health status and diagnostic information to the maintenance system.

4.2 RAM Quantitative Targets

4.2.1 The Contractor shall perform and deliver a Common Cause Failure (CCF) analysis for all redundant systems.

4.2.2 The Contractor shall use the Beta-Factor (β) to model and account for CCF in redundant configurations.

4.2.3 The CCF analysis shall include dependencies such as design, manufacturing, environment, maintenance, and operations.

4.2.4 The Contractor shall use the following table for beta-factors:

System Architecture & Mitigation Measures Typical β-Factor

Highly diverse systems (e.g., different hardware/software, strong isolation, different suppliers) 0.01 – 0.02

Moderately diverse systems (same hardware platform, some separation and diversity in software) 0.03 – 0.05

Low-diversity redundant systems (same hardware/software, limited separation) 0.05 – 0.1

4.2.5 RAM targets shall be developed based on the following service interruption and service failures:

• Train arrives more than two minutes late at a station (late stops).

• Train does not arrive at a station (missed stops).

• Train arrives at a station in a condition not suitable for service.

4.2.6 The Contractor shall meet the following Train Control system targets:

• System MTBSF: 1369 hours

• System MTTRS: 4.15 hours

REQS-0015 – Program Safety, Security, and RAM Requirements 10 of 24

• System Availability: 99.94%

4.2.7 The Contractor shall meet the following Telecommunication system targets:

• System MTBSF: 7649 hours

• System MTTRS: 4.24 hours

• System Availability: 99.94%

4.2.8 The Contractor shall meet the following SCADA system targets:

• System MTBSF: 3258 hours

• System MTTRS: 0.97 hours

• System Availability: 99.97%

4.2.9 The Contractor shall meet the following Traction Power system targets:

• System MTBSF: 4855 hours

• System MTTRS: 2.22 hours

• System Availability: 99.95%

4.2.10 The Contractor shall refer to the technical specifications for specific system and subsystem RAM targets.

4.2.11 The Contractor shall achieve an OTA of 98.8% during pre-revenue testing.

4.3 Contractor RAM Planning and Organization

4.3.1 The Contractor shall develop and submit a Contractor RAM Management Plan.

4.3.2 The Contractors RAM Management Plan shall describe the RAM Management Program for the whole scope of the Project.

4.3.3 The Contractor RAM Management Plan shall:

• Be compliant with all applicable legislation and regulation;

• Be consistent with the Project lifecycle phases of EN 50126-1:2017, REQS-0003, and PLAN-1033;

and

• Be updated as specified in EN 50126-1:2017 and in PLAN-1033.

4.3.4 The Contractor shall provide a Project RAM schedule, which identifies specific tasks, with start and completion dates, milestones, and explains how these tasks are coordinated and integrated with the project schedule.

4.3.5 The Contractor shall ensure the coordination between the Project Schedule and the RAM schedule.

4.3.6 The Contractor shall state methodology of the tasks to comply with the RAM requirements and describe the process of certification of the RAM compliance.

4.3.7 The Contractor shall provide the organization of personnel responsible for performing the Contractor’s RAM Management Program (including resumes demonstrating the qualification and experience of the RAM Team).

4.3.8 The Contractor shall coordinate RAM activities with System Safety, Quality, O&M, V&V, and others.

4.3.9 The Contractor’s RAM Management Plan shall specify contractual RAM targets.

4.3.10 The Contractor shall plan for RAM analyses in each engineering phase and provision of RAM submittals.

4.3.11 The Contractor shall describe demonstration testing plans for validation of compliance with RAM requirements.

REQS-0015 – Program Safety, Security, and RAM Requirements 11 of 24

4.3.12 The Contractor shall respond to the Authority’s comments and update RAM submittals accordingly.

4.3.13 The Contractor shall update and submit RAM deliverables, reflecting any changes that impact RAM performance.

4.3.14 The Contractor shall monitor progress and report status on the RAM activities to the Authority, including planning for bi-weekly RAM meetings with the Authority.

4.3.15 The Contractor shall attend and address audits performed by the Authority on Contractor RAM processes.

4.4 HSR System Life-Cycle Stages and Associated Contractor Tasks – Phases 1 – 5 of EN50126-1:2017

4.4.1 The Contractor shall provide the required deliverables listed in this Section 4.4, as per the schedule provided in Appendix A – Section 7.2 of PLAN-1033.

4.4.2 The Contractor shall submit the Contractor RAM Management Plan in Phase 1, consistent with the

REQS-0003.

4.4.3 The Contractor shall develop and submit a Historical Product Maintainability Report (HPMR) that provides RAM data on previous applications on Scope of Work items (refer to Section 6.6 of PLAN- 1033 for additional details).

4.4.4 The Contractor’s HPMR shall evaluate past experience data including, but not limited to:

• Recurrent and critical failure modes on systems;

• Design provisions recommended through RAM analyses performed on systems; and

• Good practices and lessons learned on RAM Management from other Projects.

4.4.5 The Contractor shall develop and submit a RAM related risk analysis (refer to Section 6.6 of PLAN- 1033 for additional details on risk analysis techniques), including:

• Identification of the undesired events that could lead to service interruptions;

• Identification of the causes of the undesired events;

• Identification of the mitigation measures in place to control or limit the occurrence of undesired events;

• Estimation of the frequencies of the undesired events;

• Identification of additional mitigation measure necessary to ensure that the risks are mitigated to an acceptable level; and

• Methodology, assumption, and data used to perform risk analysis.

4.4.6 The Contractor shall develop and submit a Preliminary RAM Report (PRR) that demonstrates Preliminary Design is compliant with the RAM requirements.

4.4.7 The Contractor’s PRR shall address the impacts of:

• Applicable legislation and regulations impacting RAM performances; and

• The RAM activities on the Project schedule and design.

4.4.8 The Contractor shall perform the PRR (refer to Section 6.7 of PLAN-1033 for additional details) based on the Preliminary Design including an estimation of System Availability, MTBSF, MTTRS:

4.4.9 The Contractor shall develop and submit a RAM Allocation Report (RAR) using an initial understanding of the design.

4.4.10 The Contractor’s RAR shall be a preliminary analysis that guides the design to be compliant with the Contract RAM requirements.

REQS-0015 – Program Safety, Security, and RAM Requirements 12 of 24

4.4.11 The Contractor’s RAR shall identify design flaws that would prevent the achievement of the RAM requirements and enable early action to correct any such flaws (refer to Section 6.5 of PLAN-1033 for additional details).

4.4.12 The Contractor’s RAR shall apportion RAM Targets and requirements to the sub-systems and components of the Project, using the System Breakdown Structure (refer to Section 6.4 of PLAN-1033 for additional details).

4.4.13 The Contractor’s RAR shall specify RAM Targets and requirements to the sub-contractors and suppliers of the Project.

4.4.14 The Contractor shall capture, derive, and allocate all the contractual RAM requirements in the Project Requirements Management (RM) Tool, as described in REQS-0003 requirements.

4.5 HSR System Life-Cycle Stages and Associated Contractor Tasks – Phases 6 and 7 of EN50126-1:2017

4.5.1 The Contractor shall develop and submit the required deliverables listed in this Section 4.5, as per the schedule provided in Appendix A – Section 7.2 of PLAN-1033.

4.5.2 The Contractor shall develop a manufacturing process in Phase 6 capable of producing RAM validated sub-systems and components, that use:

• Environmental stress screening to remove latent defects from product prior to field delivery by exposing the product to stresses such as extreme thermal conditions or vibration (refer to Section

6.21 of PLAN-1033 for additional details); and

• RAM improvement testing to enhance the product reliability through the identification, analysis and correction of failures and the verification of the corrective action effectiveness (refer to Section

6.22 of PLAN-1033 for additional details).

4.5.3 The Contractor shall develop and submit a Maintainability Demonstration Test Plan in Phase 6.

4.5.4 The Contractor’s Maintainability Demonstration Test Plan shall include test methods and procedures to demonstrate the accuracy of task time estimates for maintenance tasks described in the Preventive Maintenance Analysis (PMA) and the Corrective Maintenance Analysis (CMA) (refer to Section 6.24 of PLAN-1033 for additional details).

4.5.5 The Contractor, in Phase 6, shall develop and submit a Failure Reporting and Corrective Action System (FRACAS) Implementation Plan (refer to Section 6.23 of PLAN-1033 for additional details), use a FRACAS to track and report on failures, and to direct corrective action.

4.5.6 The Contractor, in Phase 6, shall develop and submit a RAM Performance Demonstration Plan.

4.5.7 The Contractor’s RAM Performance Demonstration Plan shall include test methods and procedures using FRACAS data to demonstrate that the RAM performance is compliant with the requirements (refer to Section 6.25 of PLAN-1033 for additional details).

4.5.8 The Contractor shall implement all RAM activities described in the Contractor RAM Management Plan through design, construction, and testing.

4.5.9 The Contractor shall update the Contractor RAM Management Plan in phase 6.

4.5.10 The Contractor shall develop and submit a Reliability Centered Maintenance Report (RCMR) (refer to Section 6.9 of PLAN-1033 for additional details).

4.5.11 The Contractor shall utilize a Reliability Centered Maintenance (RCM) approach to determine Preventive Maintenance intervals and activities.

4.5.12 The Contractor shall develop and submit a PMA (refer to Section 6.10 of PLAN-1033 for additional details).

REQS-0015 – Program Safety, Security, and RAM Requirements 13 of 24

4.5.13 The Contractor shall develop and submit a CMA (refer to Section 6.11 of PLAN-1033 for additional details).

4.5.14 The Contractor shall submit evidence that RAM predictions for the Final Design are compliant with the requirements in a RAM Prediction Report (RPR) (refer to Section 6.12 of PLAN-1033 for additional details).

4.5.15 The Contractor’s manufacturing process prepared in life cycle Phase 6 shall be implemented and operated in Phase 7.

4.5.16 The Contractor shall establish RAM assurance arrangements, including:

• Quality assurance measures suitable to meet RAM requirements;

• Manufacturing process improvement and assurance measures, as applicable;

• Environmental stress screening, as applicable; and

• Inspection and testing for RAM related failure modes.

4.6 HSR System Life-Cycle Stages and Associated Contractor Tasks – Phases 8 to 10 of EN50126-1:2017

4.6.1 The Contractor shall develop and submit the required deliverables listed in this Section4.6, as per the schedule provided in Appendix A – Section 7.2 of PLAN-1033 and as per their respective Project Contractual Requirements.

4.6.2 During Integration and System Validation Phases, the Contractor shall develop and submit the Maintainability Demonstration Tests as described in the Maintainability Demonstration Test Plan and provide the Maintainability Demonstration Tests Reports (refer to Section 6.24 of PLAN-1033 for additional details).

4.6.3 During all Testing phases, the Contractor shall identify and correct any epidemic failure as per the epidemic failure clause (refer to Section 4.9).

4.6.4 During the Dynamic and Trail Running Testing phase, the Contractor shall:

• Track and report RAM performance of the Contractor scope during the Dynamic and Trail Running Testing;

• Provide a monthly RAM Performance Demonstration Report for Authority Approval (refer to Section 6.25 of PLAN-1033 for additional details); and

• Implement the corrective actions identified in the RAM Performance Demonstration Reports (refer to Section 4.10 for detailed RAM performance correction procedure requirements).

4.6.5 The Contractor’s RAM Performance Demonstration Report shall cover the OTA, epidemic failures, MTBSF, MTTRS, percentage of late stops and percentage of missed stops.

4.6.6 The Contractor’s RAM Performance Demonstration Reports shall include:

• Reporting each service interruption, and its cause;

• Explanation of any service interruptions that are not countable against the Contractor scope;

• Service interruptions for the current month and five previous months, 10-day, 30-day, 90-day, and

180-day running measurement of the service interruptions;

• OTA calculation based on the service interruptions recorded on a 3-month running period and comparison of the result with the OTA Target;

• MTBSF calculation based on the service failures recorded on a 3-month running period and comparison of the result with the system MTBSF Targets; and,

• MTTRS calculation based on the time to restore service recorded on a 3-month running period and comparison of the result with the system MTTRS Target.

4.6.7 In respect to epidemic failures, if the cumulative chargeable failures of any lowest replaceable unit (LRU) exceeds ten percent of the total LRU population during the Dynamic and Trial Running Testing, REQS-0015 – Program Safety, Security, and RAM Requirements 14 of 24 the Contractor shall redesign and replace or modify the entire population of the defective LRU in accordance with the revised design.

• Chargeable failure is:

• Any independent failure which requires repair or replacement of a component or part that was designed, installed, or constructed by the Contractor unless specified otherwise herein, or unless determined by the Authority to be caused by a condition external to the equipment under test. (Added note: A fault in the item while operating within its design and environmental specification limits.)

• Failure due to Workmanship deficiencies must be counted as chargeable. (Added note:

Improper operation, maintenance, or testing of the item because of contractor supplied documentation.)

• Transient conditions which temporarily prevent a function from being successfully performed must be counted as chargeable failures unless it is shown that they are the result of external influences beyond the requirements of this Contract.

4.6.8 The Contractor shall maintain the FRACAS throughout the RAM demonstration period.

4.7 HSR System Life-Cycle Stages and Associated Contractor Tasks – Phases 11 and 12 of EN50126-1:2017

4.7.1 The Contractor shall develop and submit the required deliverables listed in this Section4.7, as per the schedule provided in Appendix A – Section 7.2 of PLAN-1033.

4.7.2 The Contractor shall plan for a RAM demonstration period of at least 12 months. To end the RAM Demonstration Period after 12 months, all RAM and Performance targets shall be demonstrated.

4.7.3 The Contractor shall track and report actual RAM performance of the Contractor Scope Items during the RAM demonstration period.

4.7.4 The Contractor shall develop, maintain, and submit a monthly RAM Performance Demonstration Report for Authority Approval (refer to Section 6.25 of PLAN-1033 for additional details) during the RAM demonstration period.

4.7.5 The Contractor shall develop and implement the corrective actions identified in the RAM Performance Demonstration Reports (refer to Section 4.10 for detailed RAM performance correction procedure requirements) during the RAM demonstration period.

4.7.6 The Contractor’s RAM Performance Demonstration Report shall cover the OTA, epidemic failures, Mean Time Between Service Failure (MTBSF), Mean Time To Restore Service (MTTRS), percentage of late stops, and percentage of missed stops.

4.7.7 The Contractor’s RAM Performance Demonstration Reports shall include:

• Reporting each service interruption, and its cause;

• Explanation of any service interruptions that are not countable against the Contractor scope;

• Service interruptions for the current month and five previous months, 10-day, 30-day, 90-day, and

180-day running measurement of the service interruptions;

• OTA calculation based on the service interruptions recorded on a 3-month running period and comparison of the result with the OTA Target;

• MTBSF calculation based on the service failures recorded on a 3-month running period and comparison of the result with the system MTBSF Target; and

• MTTRS calculation based on the time to restore service recorded on a 3-month running period and comparison of the result with the system MTTRS Target.

4.7.8 In respect to epidemic failures, if the cumulative chargeable failures of any lowest replaceable unit (LRU) exceeds ten percent of the total LRU population during the RAM demonstration period, the Contractor shall redesign and replace or modify the entire population of the defective LRU in accordance with the revised design.

REQS-0015 – Program Safety, Security, and RAM Requirements 15 of 24

4.7.9 The Contractor shall maintain the FRACAS throughout the RAM demonstration period.

4.8 Change Management Procedure for RAM Submittals

4.8.1 After a RAM submittal has received an approval disposition, a change might occur that impact the accuracy of this RAM submittal. Such a change can be triggered for example by a Change during Design, or a Change during Construction, or a comment on another submittal that could lead to inconsistencies in RAM submittals that already have received an approval disposition. In that situation, the Contractor shall submit for Authority review an amendment of the RAM submittals impacted as soon as the Change is confirmed. The amendment may include only the Sections or Appendices of the RAM submittals impacted by the Change.

4.8.2 The Contractor shall submit consolidated, updated, and consistent RAM submittals including all the Changes before Final Acceptance of the Work.

4.9 Epidemic Failure Management Procedure

4.9.1 An epidemic failure shall be deemed to have occurred if the epidemic failure rate of a component or a sub-system exceeds a limit agreed with the Authority. Refer to Section 6.29 of PLAN-1033 for the definition of an epidemic failure.

4.9.2 The Contractor shall first submit a value for the epidemic failure limit to the Authority for approval.

4.9.3 The Contractor may propose different epidemic failure limits for different components or sub-systems, with the agreement of the Authority.

4.9.4 The Contractor shall record and analyze the failures and defects detected during Testing and Pre-revenue Service.

4.9.5 If failures or defects have been recorded on multiple substantially identical components or sub-system, the Contractor shall calculate the epidemic failure rate for this type of component or sub-system and compare it to the limit agreed with the Authority.

4.9.6 If the epidemic failure rate for a component or a sub-system exceeds the limit agreed with the Authority, the Contractor shall perform a root cause analysis to confirm the epidemic failure.

4.9.7 The Contractor shall develop and submit an epidemic failure analysis report with epidemic failure rate, root cause analysis, and conclusions to the Authority within 30 days from the date the Contractor confirms the occurrence of an epidemic failure.

4.9.8 The Contractor’s epidemic failure analysis shall include the type, process, and conclusions of the epidemic failure.

4.9.9 The Contractor’s epidemic failure analysis shall be approved by Authority prior to determining suitable corrective action.

4.9.10 Once the Contractor has received written approval of the epidemic failure analysis report from Authority, the Contractor shall, within 21 days, develop and submit a Modification Program to the Authority for approval, with respect to all affected components or Systems in all Project Assets.

4.9.11 The Contractor’s Modification Program shall reflect the results of the approved epidemic failure analysis and include an action plan to ensure that the causes of the epidemic failure are addressed and that all applicable components or sub-systems are no longer defective or at risk of defect or failure.

4.9.12 The Contractor’s Modification Program shall include a schedule for curing the applicable defects or failures.

4.9.13 Once approved by the Authority, the Contractor shall implement the Modification Program.

REQS-0015 – Program Safety, Security, and RAM Requirements 16 of 24

4.10 RAM Performance Correction Procedure

4.10.1 If in a monthly RAM Performance Demonstration Report, the OTA, MTBSF, MTTRS, percentage of late stops, or percentage of missed stops don’t achieve the RAM requirements, the Contractor shall develop and submit a Corrective Action Report (CAR) with the RAM Performance Demonstration Report.

4.10.2 The CAR shall identify the Scope Item(s) responsible, the corrective actions the Contractor will take, and the schedule for corrective actions.

4.10.3 The Contractor shall include the CAR with the next RAM Performance Demonstration Report after failing to achieve the RAM requirements.

4.10.4 The Contractor shall follow up the status of these actions and report the status in the monthly RAM Performance Demonstration Reports until resolution.

4.10.5 If a Project Asset does not meet the RAM commitment over 30 consecutive days of operations or 100 cumulative days of operations, the Contractor shall develop and submit a new Project Asset to replace the element that could not meet the RAM commitment.

REQS-0015 – Program Safety, Security, and RAM Requirements 17 of 24

5 SAFETY MANAGEMENT PROCESS

5.1 Contractor’s Safety Planning and Organization

5.1.1 The Contractor shall develop and submit a Safety and Security Management Plan (SSMP) specific to its Work and consistent with the requirements in Section 8.2.1 of the Authority’s SSMP (PLAN-1004).

5.1.2 The Contractor’s SSMP shall detail the Contractor’s approach to safety hazard analysis, safety assurance, and compliance within its system boundaries.

5.1.3 The Contractor’s safety management process shall be compliant with CENELEC standards (EN 50126-1/2/3, EN 50716 and EN 50129), the Common Safety Method for Risk Assessment (CSM-RA), FRA regulations (49 CFR 236, 238, 239, 270), FTA Circular 5800.1, FTA Handbook for Transit Safety and Security Certification (EN 61124), and CPUC GO 164-E.

5.1.4 The Contractor shall develop and submit a System Safety Organization, including, but not limited to a Safety Manager, safety engineers, RAMS analysts, and compliance specialists.

5.1.5 The Contractor shall maintain current records of staff skills and qualifications of its System Safety Organization, designate deputies for critical positions, and ensure the ongoing effectiveness of safety management in the event of any personnel changes.

5.1.6 The Contractor’s safety assurance process for all CORE SYSTEMS (refer to Section 2.1. of PLAN- 1032 for CORE SYSTEMS definitions), pertaining to its Work, shall comply with their respective regulatory and standards framework.

5.1.7 The Contractor shall develop and submit, to the Authority for approval, a mapping, as per Table 2-1 of PLAN-1032 for CORE SYSTEMS and deliverables in the Work.

5.1.8 The Contractor shall monitor progress and report status on the Safety activities to the Authority, including planning for monthly Safety meetings with the Authority.

5.2 System Integration Requirements

5.2.1 The Contractor shall formally identify, analyze, and control all physical, functional, and operational interfaces between CORE SYSTEMS under the Work.

5.2.2 The Contractor shall develop and submit an Interface Hazard Analyses (IHAs) between CORE SYSTEMS and subsystems under the Work.

5.2.3 The Contractor shall contribute to IHAs performed by the CORE SYSTEMS Integration Safety Team, between CORE SYSTEMS under the responsibility of the Contractor and external CORE SYSTEMS.

5.2.4 The Contractor shall implement Safety Related Application Conditions (SRAC) coming from other Project stakeholders and manage them through its Contractor Safety Management Process.

5.3 Safety Analyses

5.3.1 As part of the safety assurance process, the Contractor shall provide all the analyses listed in this Section and ensure their consistency with Program-level and Integration-level safety analyses.

5.3.2 Prior to beginning any safety analysis, the Contractor shall review and base all Contractor safety analysis on the Authority PHA report, noted in RPRT-0003.

5.3.3 The Contractor shall use guidance, provided in Section 4.2.7 of PLAN-1004, to perform the safety analyses.

5.3.4 The Contractor shall develop and submit a Preliminary Hazard Analysis (PHA).

5.3.5 The Contractor shall develop and submit a System Hazard Analysis (SHA).

REQS-0015 – Program Safety, Security, and RAM Requirements 18 of 24

5.3.6 The Contractor shall develop and submit a Subsystem Hazard Analysis (SSHA) for all identified subsystems under the Work.

5.3.7 The Contractor shall develop and submit Failure Modes, Effects and Criticality Analyses (FMECA) for the systems and subsystems in its Work.

5.3.8 The Contractor shall develop and submit Fault Tree Analyses and Common Cause / Dependent Failure analyses for the systems and subsystems in its Work.

5.3.9 The Contractor shall develop and submit a Human Factors Analysis related to design tasks, workload, procedures, and training.

5.3.10 The Contractor shall develop and submit an Operational & Support Hazard Analysis (OSHA) for maintenance, operation, and logistics tasks.

5.3.11 The Contractor shall develop and submit IHA for interfaces between CORE SYSTEMS and between subsystems within the Work.

5.3.12 The Contractor shall develop and submit safety analyses related to software and hardware elements per EN 50716 and EN 50129 standards (e.g., Timing Analysis, THR/MTBHE calculations, where applicable).

5.3.13 The Contractor shall perform and document hazard reviews of FAT/SAT/field and Pre-Revenue tests.

5.3.14 The Contractor shall perform Hazard Identification (HAZID) interdisciplinary workshops during design, integration & validation and startup phases, and provide Hazard Identification Reports.

5.3.15 The Contractor shall invite the Authority to all HAZID workshops.

5.3.16 The Contractor’s HAZID workshops shall provide a cross-check and permit update of the hazard analyses.

5.3.17 The Contractor shall record hazards identified in HAZID workshops in the Hazard Record, linked to applicable formal analyses, and traced to mitigations and safety requirements.

5.4 Risk Evaluation, Classification, and Acceptance

5.4.1 The Contractor shall identify and analyze safety hazards across all relevant operating modes, consistent with EN 50126, CSM-RA, FRA Parts 236/238/239/270, EN 61124, and PLAN-1004 requirements.

5.4.2 The Contractor’s safety analyses shall address, at a minimum, the following operating modes for Revenue and Non-Revenue Service: Normal, Degraded, Emergency, Abnormal, Maintenance, Startup/Shutdown, and Testing/Commissioning.

5.4.3 The Contractor shall follow the risk evaluation and acceptance process outlined in Section 4.2.5 of the

PLAN-1004:

• Safety hazards shall be assessed using the severity and frequency ratings of the PLAN-1004

Tables 4-1 and 4-2 (including qualitative and MTTHE guidance);

• The residual risk shall be assessed using the Risk Assessment Matrix (Table 4-3) and actions shall be followed as directed in the Risk Acceptance Matrix (Table 4-4).

5.4.4 The Contractor shall justify that all safety hazards and mitigations identified in Program-level and Integration-level safety analyses (e.g. Program PHA) that apply to CORE SYSTEMS in its Work are addressed and provide traceability with its own safety analyses.

5.4.5 The Contractor shall also apply the methods for risk evaluation, classification, acceptance and mitigation provided under the standards framework (refer to Clause 5.1.6), e.g. CENELEC THR/SIL or MTBHE, for the CORE SYSTEMS.

REQS-0015 – Program Safety, Security, and RAM Requirements 19 of 24

5.4.6 The Contractor shall map the results of the standards framework assessment to the PLAN-1004 severity/frequency categories for Authority decision-making.

5.4.7 The Contractor shall apply the step-by-step process, provided in Section 4.1.7 of PLAN-1032, when CENELEC standards are identified as the standards framework, for safety-related functions.

5.4.8 The Contractor shall apply the more conservative result where differences occur between the PLAN- 1004 and other methods under the standards framework.

5.4.9 The Contractor shall define, for each CORE SYSTEM under the Work, the baseline exposure (hours, km, cycles, demands, missions) and submit it to the Authority for acceptance.

5.4.10 The Contractor shall express the safety hazards at fleet / overall rail system level.

5.4.11 The Contractor shall justify that mitigations required for risk control follow one of the three CSM-RA principles:

• Codes of Practice (CoP): compliance with standards (CENELEC, Authority Technical Memos, FRA, and other regulations);

• Similar Reference System (SRS): evidence that hazard is acceptably managed in a comparable, proven HSR/rail system;

• Explicit Risk Estimation (ERE): quantitative demonstration (e.g., SIL allocation, MTBHE calculation, THR) when CoP or SRS do not apply.

5.4.12 The Contractor shall implement technical risk mitigations mandated by regulation that apply to its Work.

5.4.13 The Contractor shall justify that residual risks (resulting risks after mitigations have been applied) are As Low As Reasonably Practicable (ALARP). Guidance on ALARP is provided in Section 4.1.9 of PLAN-1032 and in Section 4.1.6 of the PLAN-1004.

5.4.14 The Contractor’s ALARP assessment shall be documented in the Hazard Record.

5.5 Safety Requirements Tracking

5.5.1 The Contractor shall refer to () for safety requirements tracking.

5.6 Safety Certification

5.6.1 The Contractor shall develop and submit Safety Cases, with structure and content as per EN 50126- 1, EN 50126-2 for all CORE SYSTEMS under his Scope of Work.

5.6.2 The Contractor shall develop and submit a Safety Case with structure and content as per EN 50129, for Train Control and Communications Systems.

5.6.3 Safety Cases shall be provided by the Contractor for the following Project lifecycle milestones:

• Design Certification – Safety requirements embedded in system design;

• Manufacturing/Construction Certification – System built per approved designs;

• Testing & Integration Certification – System verified via lab, field, and system-level testing; and

• Operational Readiness Certification – System safe for revenue service.

5.6.4 For each Certifiable Element and for each Project lifecycle milestone identified in Clause 5.6.3, the Contractor shall provide Certificate of Conformance packages.

5.6.5 The Contractor’s Certificate of Conformance packages shall consist of a Certificate of Conformance specific to each element, all completed Safety and Security Certification Reports (SSCR), and all objective evidence / supporting documentation such as design element descriptions (executive summary), hazard analysis, drawings, specifications, design variances, field reports, and photographs.

REQS-0015 – Program Safety, Security, and RAM Requirements 20 of 24

5.6.6 At each Project lifecycle milestone identified in Clause 5.6.3, the Contractor shall identify safety critical items (i.e. mitigations) that cannot be closed prior to the start of the next Project phase and place them on an Open Items List, using the RM tool.

5.6.7 The Contractor shall provide justification as to why the item(s) of the Open Items List cannot be closed, and the list shall be submitted for review to the appropriate Safety Committees.

5.6.8 The Contractor’s Safety Certification shall be consistent with the FTA Handbook for Transit Safety and Security Certification (EN 61124).

5.7 Safety Committees

5.7.1 The Contractor’s SSMP shall establish the following Project-specific committees, to which the Authority and any other stakeholder or third-party, appointed by the Authority, will participate:

• Safety and Security Oversight Committee (SSOC).

• Fire and Life Safety and Security Committees (FLSSC).

• Change Control Board (CCB) to review and approve or defer safety-relevant design and process changes.

• An Interface Control Board (ICB) to manage technical and operational interfaces and oversee interface hazard resolution.

• A System Integration Testing Committee (SITC).

• The Contractor’s Safety Manager shall participate as member of the Program-level SSOC, as directed by the Authority.

5.7.2 The Contractor shall chair the Project-specific committees that the Contractor has established.

5.7.3 The Contractor shall submit to the Program-level SSOC, at least quarterly, updates on the general status of its safety activities, safety issues that require resolution at SSOC level, and present conclusions and any open items of its Safety Certification activities.

5.7.4 The Contractor’s Safety Manager shall participate as a member of the Program-level FLSSC.

5.7.5 The Contractor shall submit to the FLSSC any issues related to fire and life safety related to its Work.

5.7.6 The Contractor’s Safety Manager shall participate as a member of the Program-level CCB as directed by the Authority.

5.7.7 The Contractor shall submit to the CCB for review safety-relevant design and process changes pertaining to its Work.

5.7.8 The Contractor’s Safety Manager shall participate as a member of the Program-level Integration Delivery Group (PIDG) as directed by the Authority.

5.7.9 The Contractor shall submit to the PIDG for review the integration baseline and any changes to the integration baseline, pertaining to its Work.

5.7.10 The Contractor’s Safety Manager shall participate as a member of the System Integration Testing Committee as directed by the Authority.

5.7.11 The Contractor shall participate in any other Program-level Committee, as directed by the Authority.

REQS-0015 – Program Safety, Security, and RAM Requirements 21 of 24

6 SECURITY MANAGEMENT PROCESS

6.1 Contractor Security Planning and Organization

6.1.1 The Contractor shall develop and submit a Safety and Security Management Plan (SSMP) specific to its Work per PLAN-1004 and EN 61124.

6.1.2 The SSMP shall detail the Contractor’s approach to security hazards and vulnerability analysis, security assurance, and compliance within its system boundaries.

6.1.3 The Contractor’s security management process shall be compliant with FRA regulations (49 CFR 236, 238, 239, 270), FTA Circular 5800.1, EN 61124, and CPUC GO 164-E.

6.1.4 The Contractor shall set up a Security Organization (Security Manager, security engineers, analysts, compliance specialists). The contractor may set up a single organization managing both Safety and Security activities, and personnel roles may be shared between Safety and Security.

6.1.5 The Contractor shall maintain current records of staff skills and qualifications of its Security Safety Organization, designate deputies for critical positions, and ensure the ongoing effectiveness of security management in the event of any personnel changes.

6.1.6 The Contractor shall plan to monitor progress and report status on the Security activities to the Authority, including planning for monthly Security meetings with the Authority.

6.1.7 The Contractor shall monitor progress, report status, and organize monthly meetings for Security and Safety jointly.

6.1.8 The management of cybersecurity is not included in this Section 6. The Contractor shall refer to SPEC- 0005, Cybersecurity Specifications.

6.1.9 The Contractor shall manage threat and vulnerability information and assessments as Sensitive Security Information (SSI) and follow the SSI Best Practices Guide for Non-DHS Employees and Contractors.

6.2 Security Analyses

6.2.1 The Contractor shall provide the analyses listed in this Section and ensure their consistency with Program-level and Integration-level security analyses, as part of the security assurance process,

6.2.2 The Contractor shall develop and submit a Threat and Vulnerability Analysis (TVA).

6.2.3 The Contractor shall develop and submit Site-Specific Threat and Vulnerability Assessments (SiSTVA), as necessary or as directed by the Authority.

6.2.4 The assessment shall identify and analyze threats and vulnerabilities and then determine how to mitigate the risks.

6.3 Security Risk Assessment

6.3.1 The Contractor shall apply the security risk assessment process outlined in Section 4.3 of the PLAN- 1004 to its Work.

6.3.2 The Contractor shall justify that security hazards and mitigations identified in Program-level and Integration-level safety analyses (e.g. Program TVA) that apply to its Work are addressed and provide traceability with its own security analyses.

6.3.3 The Contractor shall develop countermeasures to mitigate or eliminate unacceptable security risk. If the residual risk (i.e.