Engineer Railway Vehicles common mistakes
Engineer Railway Vehicles · Understand the traps and how to avoid them.
Treating the EN 50126 lifecycle as a checklist of documents to submit, and answering that a hazard is 'closed' once a hazard log entry exists, rather than describing the hazard analysis, risk assessment, and the demonstration that residual risk is tolerable (ALARP principle) at each lifecycle phase.
Candidates memorise the phase names (concept, system definition, risk analysis, system requirements, etc.) but never internalise that the standard requires traceable evidence linking hazards to requirements to verification results; they confuse the artefact with the process.
What to do instead
For each lifecycle phase, practise stating the inputs, the analysis performed, the outputs, and the traceability to the next phase. When a question asks whether a hazard is resolved, answer in terms of risk reduction measures, residual risk evaluation against the tolerability criteria, and who accepted the risk.
Confusing SIL (Safety Integrity Level) with the required quantitative targets, e.g. claiming SIL 2 corresponds to a single fixed failure-rate number regardless of whether the function is high-demand or low-demand, or assigning SIL by counting hardware redundancy instead of deriving it from risk assessment.
SIL tables are memorised as a single column; candidates forget that low-demand mode uses PFD (probability of failure on demand) bands while high-demand/continuous mode uses PFH (probability of failure per hour) bands, and that SIL is allocated from the risk graph or risk matrix, not chosen by preference.
What to do instead
Learn both band tables separately and practise converting a scenario into demand mode first, then into the correct target band. Always state that SIL allocation follows from the risk assessment (e.g. risk graph parameters: severity, exposure, avoidability) and that redundancy is a design measure to achieve the target, not the source of the target.
Answering functional safety questions by citing only EN 5012x series and ignoring the supporting standards that examiners expect: EN 50128 for software, EN 50129 for safety-related electronic systems acceptance, and the role of the safety case and independent safety assessment.
Candidates study one standard in depth and treat the others as optional background, so they misattribute requirements (e.g. placing software architecture requirements in EN 50129) and lose marks on cross-referencing questions.
What to do instead
Build a one-page map: EN 50126 = lifecycle and RAMS; EN 50128 = software (with its own SIL-dependent techniques and measures tables); EN 50129 = safety case structure, evidence, and acceptance. For each question, identify which standard governs the activity before answering.
Describing type testing and homologation as a single act of 'getting a certificate', rather than distinguishing type examination/test (demonstrating conformity of a design to the applicable TSIs and national rules), the EC declaration of conformity/verification, and the authorisation for placing in service by the national safety authority.
The vocabulary of the EU railway framework (interoperability directives, TSIs, notified bodies, designation of conformity assessment bodies, national rules) is dense and candidates blur the roles, so they attribute authorisation to the wrong actor.
What to do instead
Draw the chain explicitly: applicant → conformity assessment (NoBo/DeBo as applicable) → EC verification and declaration → national safety authority authorisation for placing in service, with national rules applying where TSIs leave open points. Answer role questions by naming which body does which step and what evidence it produces.
Assuming a vehicle that holds a valid EC type/examination certificate can be operated anywhere without further assessment, and ignoring the need to check compatibility with the specific infrastructure (gauging, axle load, train detection, power supply, EMC, pantograph geometry) and route acceptance.
Candidates conflate design conformity with operational compatibility; the interoperability framework separates them, and route-specific acceptance is a recurring exam theme.
What to do instead
For any 'can this vehicle run on network X' question, list the compatibility parameters to be checked (loading gauge, axle load and wheel-rail forces, train detection/electrical interference, traction current system, signalling and train protection fitment, braking performance) and state that route acceptance and infrastructure compatibility assessment are required separately from type conformity.
Treating the ISO/TS 22163 (IRIS) certification scheme as a generic ISO 9001 audit and answering that the audit covers only documented procedures, missing the mandatory performance indicators, the specific rail requirements (e.g. project management, RAMS/LCC, obsolescence management, special processes, supplier management) and the maturity assessment concept.
Candidates carry over ISO 9001 habits and do not study the rail-specific 'iron' requirements and the scoring/maturity model, so they miss questions about what distinguishes IRIS from ISO 9001.
What to do instead
Learn the structure of ISO/TS 22163: it builds on ISO 9001 and adds rail-specific requirements plus mandatory key performance indicators and a maturity level assessment. Practise answering by naming the specific rail requirements (RAMS/LCC, obsolescence, configuration management, special processes, counterfeit parts) and how audit evidence would be sampled.
In quality management questions, describing corrective action as 'fix the defect and update the procedure', omitting root cause analysis, containment, effectiveness review, and the distinction between correction, corrective action, and preventive action.
Everyday language uses 'corrective action' loosely; candidates answer with the intuitive meaning rather than the ISO 9001/ISO/TS 22163 definitions, and lose marks on the process steps and records.
What to do instead
Memorise the definitions: correction removes the nonconformity, corrective action eliminates the cause, preventive action addresses potential causes. Structure answers as containment → root cause analysis (e.g. 5-why, Ishikawa) → action → verification of effectiveness → update of risk and lessons learned. Mention records as objective evidence.
In build supervision and inspection answers, jumping straight to final acceptance testing and skipping hold points, witness points, inspection and test plans (ITPs), and the surveillance of special processes (welding, NDT, painting, heat treatment) that cannot be verified after the fact.
Candidates associate inspection with end-of-line testing; they do not appreciate that special processes require qualification of personnel and procedures and continuous surveillance, and that hold points require formal release before work proceeds.
What to do instead
Answer build-supervision questions with the control chain: approved drawings and specifications → ITP with hold/witness/review points → qualification of special processes and personnel → in-process records → nonconformity handling → final inspection and release. Emphasise that special processes are verified by procedure and personnel qualification plus in-process records, not by final inspection.
Valuing rail assets by simple depreciated cost without considering condition, remaining useful life, overhaul cycles, obsolescence, and market or functional utility, and failing to distinguish replacement cost, market value, and value in use.
Candidates default to accounting depreciation because it is familiar, but asset valuation for rolling stock requires engineering assessment; examiners test whether the candidate can justify a value basis and reconcile it with technical condition.
What to do instead
For valuation questions, state the value basis first (market value, replacement cost new less depreciation, or value in use), then the evidence: condition assessment, maintenance and overhaul history, remaining life of major components, obsolescence of spares and systems, and comparable transactions. Show how physical, functional, and economic obsolescence are each quantified.
Answering security questions with safety logic, e.g. treating trespass and vandalism as purely a safety risk, and omitting the security risk assessment, the security management system, zone/access control, and the interface between safety and security (cyber security of signalling and rolling stock systems).
Safety and security are taught together and candidates blur them; also security is often studied only as a list of measures rather than as a risk-based management process with its own assessment and governance.
What to do instead
Separate the two: safety addresses accidental harm, security addresses deliberate acts. For security questions, structure answers as threat identification → vulnerability and consequence assessment → risk treatment (deter, detect, delay, respond, recover) → security management system and roles → interface with safety (e.g. cyber security requirements for signalling and onboard systems, EN 50701-type considerations). Always state who owns the risk.