IEC TR 62267-2: Hazard Analysis for Automated Urban Guided Transport (AUGT) Systems

Introduction to AUGT Safety and IEC 62267

IEC TR 62267-2:2011 presents a comprehensive top-level hazard analysis for Automated Urban Guided Transport (AUGT) systems — the technology behind driverless metros and automated people movers in cities worldwide. Part 2 of the IEC 62267 series provides the methodological framework and results of a generic hazard analysis conducted to compensate for the absence of a driver or attendant staff from the train. This technical report is an essential reference for transport authorities, safety engineers, and system integrators developing or deploying automated urban rail systems.

Methodology: From Hazard Identification to Safeguard Allocation

The hazard analysis methodology defined in TR 62267-2 follows a systematic five-step process. First, hazard identification catalogs top-level hazards present as a consequence of train operations (e.g., closing and opening of train doors, obstacles in the guideway). Second, cause identification analyzes why each hazard may lead to an accident. Third, trigger identification determines the events or conditions that transition a hazardous situation into an actual accident. The combination of hazard, cause, and trigger forms a hazardous situation — the fundamental unit of analysis. Finally, possible safeguards are listed: design measures that can compensate for the absence of operational staff.

Key Hazard Categories and Their Associated Safeguards

The hazard analysis covers five functional domains: safe movement of trains (collision avoidance, overspeed protection), driving operations (traction control, braking), guideway supervision (obstacle detection, track integrity), passenger transfer supervision (door safety, platform edge protection), and train operation (fire detection, emergency communication). For each domain, the report tabulates specific hazardous situations and cross-references them with possible safeguards drawn from existing AUGT systems in North America, Europe, and Asia.

Notable safeguard categories include train-borne detection systems (obstacle detectors, door obstruction sensors), wayside protection systems (platform screen doors, track vacancy detection), operational procedures (manual intervention by remote operators, emergency evacuation protocols), and communication-based train control (CBTC) architectures that ensure fail-safe train separation even in driverless operation.

Relationship to the Safety Lifecycle (IEC 62278 / EN 50126)

IEC TR 62267-2 is designed to integrate with the railway RAMS (Reliability, Availability, Maintainability, and Safety) lifecycle defined in IEC 62278 (EN 50126). The generic hazard analysis corresponds to lifecycle phases 3 (risk analysis) and 4 (safety requirements specification). By starting from this pre-existing generic analysis, AUGT projects can significantly reduce the effort required for hazard identification while ensuring comprehensive coverage. However, the report stresses that the generic analysis must be complemented by project-specific analysis addressing local conditions, existing infrastructure interfaces, and the prevailing safety culture.

Practical Implications for System Design

For engineers designing AUGT systems, TR 62267-2 provides a structured basis for safety requirements allocation. Each identified safeguard in the hazard analysis can be allocated to a specific subsystem (rolling stock, signaling, platform edge doors, communications) with defined safety integrity levels (SIL). The report emphasizes that safeguards should be diverse and independent to avoid common-cause failures — a principle that drives architectural decisions such as separating train-borne obstacle detection from wayside track vacancy detection.

Commissioning and validation considerations are equally important for AUGT system deployment. The generic hazard analysis provides the baseline, but each specific installation must undergo rigorous testing that validates all safeguard mechanisms under realistic operating conditions. This includes normal service scenarios, degraded modes (such as communication interruptions or sensor failures), and emergency situations (fire, evacuation, medical emergencies on board). The testing philosophy should follow the verification and validation lifecycle defined in IEC 62278, with progressive integration from component testing through subsystem testing to full system acceptance. International experience from systems in cities such as Dubai, Paris, Singapore, and Copenhagen demonstrates that commissioning a new AUGT system typically takes 12 to 24 months of intensive testing before revenue service begins.