1、PUBLISHED DOCUMENT PD CLC/TR 50506-1:2007 Railway applications Communication, signalling and processing systems Application Guide for EN 50129 Part 1: Cross-acceptance ICS 93.100 PD CLC/TR 50506-1:2007 This Published Document was published under the authority of the Standards Policy and Strategy Com
2、mittee on 31 May 2007 BSI 2007 ISBN 978 0 580 50824 0 National foreword This Published Document was published by BSI. It is the UK implementation of CLC/TR 50506-1:2007. The UK participation in its preparation was entrusted by Technical Committee GEL/9, Railway electrotechnical applications, to Subc
3、ommittee GEL/9/1, Signalling and communications. A list of organizations represented on this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Amendments i
4、ssued since publication Amd. No. Date Comments TECHNICAL REPORT CLC/TR 50506-1 RAPPORT TECHNIQUE TECHNISCHER BERICHT May 2007 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secre
5、tariat: rue de Stassart 35, B - 1050 Brussels 2007 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members. Ref. No. CLC/TR 50506-1:2007 E ICS 93.100 English version Railway applications - Communication, signalling and processing systems - Application
6、 Guide for EN 50129 - Part 1: Cross-acceptance This Technical Report was approved by CENELEC on 2007-01-16. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ir
7、eland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. Foreword This Technical Report was prepared by SC 9XA, Communication, signalling and processing systems, of Technical Committ
8、ee CENELEC TC 9X, Electrical and electronic applications for railways. The text of the draft was submitted to vote and was approved by CENELEC as CLC/TR 50506-1 on 2007-01-16. CLC/TR 50506-1:2007 2 Contents Introduction . 4 1 Scope. 4 2 Normative references . 4 3 Terms, definitions and abbreviated t
9、erms 5 3.1 Terms and definitions . 5 3.2 Abbreviated terms 5 4 Cross-acceptance. 7 4.1 General 7 4.2 Definition and importance of cross-acceptance 7 4.3 Lifecycle for cross-acceptance . 7 4.3.1 General 7 4.3.2 Specification 9 4.4 Cross-acceptance process . 9 4.4.1 The basic premise 9 4.4.2 Principle
10、s of cross-acceptance. 10 4.4.3 Safety cases for cross-acceptance. 14 4.4.4 Generic product / application safety case for cross-acceptance . 14 4.4.5 Field testing . 15 4.4.6 Compliance report 15 Bibliography 16 Figures Figure 1 The role of assessor and developer in maintaining system requirements .
11、 12 Figure 2 The three types of safety case involved in cross-acceptance process 14 Table Table 1 Lifecycle for cross-acceptance of safety related/safety critical systems/products/equipment . 8 CLC/TR 50506-1:2007 3 Introduction EN 50129 was developed in CENELEC and is now regularly called up in spe
12、cifications. In essence, it lists factors that influence RAMS (see EN 50126) and adopts a broad risk-management approach to safety. EN 50129 is the basic standard for safety related electronic systems for signalling. Use of EN 50129 has enhanced the general understanding of the issues, but has also
13、shown that items like cross-acceptance need further explanation and clarification. Therefore CENELEC decided to address those items in this application guide for cross-acceptance. 1 Scope This application guide for cross-acceptance is a Technical Report about the basic standard. It is applicable to
14、the same systems and addresses the same audience as the standard itself. It provides additional information on the application of EN 50129 to cross-acceptance. Therefore it deals with the acceptance by a safety authority of a previously accepted system or product in a different environment and/or co
15、ntext, often referred to as cross-acceptance. It is mainly dedicated to safety assessors, safety authorities, validators, and safety managers. In drafting this guide, it is assumed that the reader is familiar with the basic structure of the standard. 2 Normative references The following referenced d
16、ocuments are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. NOTE Additional informative references are included in the bibliography. EN
17、 50124-1, Railway applications - Insulation coordination - Part 1: Basic requirements - Clearances and creepage distances for all electrical and electronic equipment EN 50126, Railway applications - The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) E
18、N 50128, Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems EN 50129, Railway applications - Communication, signalling and processing systems - Safety related electronic systems for signalling EN 61508 series, Functional safe
19、ty of electrical/electronic/programmable electronic safety-related systems (IEC 61508 series) EN/ISO 9001:2000, Quality management systems Requirements (ISO 9001:2000) EN/ISO/IEC 17020, General criteria for the operation of various types of bodies performing inspection (ISO/IEC 17020) CLC/TR 50506-1
20、:2007 4 3 Terms, definitions and abbreviated terms 3.1 Terms and definitions For the purposes of this document, the terms and definitions given in EN 50126, EN 50128, EN 50129 and the following apply. Other definitions not included in these documents have been added to eliminate any doubts regarding
21、 their interpretation. 3.1.1 generic application system with specific functions that are related to “a category of applications” associated with a general environmental and operational context, which is developed on the basis of criteria of standardization and parameterization of its elements, so as
22、 to render it serviceable for various tangible applications. By combining generic products or combining these with other generic applications, it is possible to obtain a new generic application 3.1.2 generic product component/product capable of performing certain functions, with a specific performan
23、ce level, in the environmental and operational conditions stated in the reference specifications. It can be combined with other products and generic applications to form other generic applications 3.1.3 specific application a specific application is used for only one particular installation 3.1.4 ri
24、sk analysis identification of hazards associated with a product, process or system, scrutiny of their causes and systematic determination of their consequences in an operational context. Risk analysis results in the identification of the nature of likely sources of harm arising from a product, proce
25、ss or system and their impact in terms of nature of likely accidents and the severity of harm caused 3.1.5 safety analysis subset of risk analysis solely focused on hazards which have a potential for causing accidents which may cause harm to people 3.2 Abbreviated terms For the purposes of this docu
26、ment, the abbreviated terms used in EN 50126, EN 50128 and EN 50129 and the following apply. Other abbreviations not included in these standards have been added to eliminate any doubts regarding their interpretation. CMP configuration management plan COTS commercial-off-the-shelf CRS customer requir
27、ements specification CTC centralised traffic control DRACAS data reporting and corrective action system FMECA failure mode effects and criticality analysis FRACAS failure reporting and corrective actions system FTI formal technical inspection FTP field trial plan CLC/TR 50506-1:2007 5 FTR field tria
28、l report FPGA field programmable gate array HAZAN hazard analysis HAZOP hazard and operability study I/O input / output IHA interface hazard analysis ISA independent safety assessor LRU line replaceable unit OSHA operation and system hazard analysis PCB printed circuit board PHA preliminary hazard a
29、nalysis PLC programmable logic controller QAP quality assurance plan QMS quality management system RAM-P RAM-plan SC safety case SAD system architecture description SADT structured analysis and design techniques SAP safety plan SEEA SW error effects analysis SHA system hazard analysis SRS system req
30、uirements specification SSHA subsystem hazard analysis SSRS subsystem requirements specification VAP validation plan VHDL VHSIC hardware description language VHSIC very high speed integrated circuit VLSI very large scale integration VTR validation test report V create preliminary hazard analysis (PH
31、A) and hazard analysis (HAZ- AN) on the base of CRS and risk analysis. SRS, preliminary hazard analysis, hazard analysis. Evaluation of differences Evaluation of differences between originally approved application and new customer application. Evaluation of differences between originally approved ap
32、plication and new customer application. Verification report of specification, updated hazard-log (if identified). Validation Assessor: assess validation plan. Start system validation of system requirement specification against customer requirement specification. Life cycle; validation test report, f
33、ield trial report (post pilot). Assessment Assessor: create assessment report; safety case will be examined by an assessor. The result of his work will be presented in an assessment report, forming the background for the decision taken by the railway authority. Assessment of the differences, the ass
34、essor must be familiar with the operating conditions. Assessment report. System acceptance System acceptance; validation of the system following findings in risk analysis; prepare test report or/and application safety case, start pre-pilot phase. Application safety case, compliance report, system ac
35、ceptance by customer and railway authority. Operation and maintenance Operate and maintain the system; introduce a DRACAS system. RAMS- demonstration Update field trial report. Field trial report (pre-pilot). CLC/TR 50506-1:2007 8 4.3.2 Specification As with the original approval, a cross-acceptance
36、 approval is based on a specification prepared by the infrastructure owner or railway undertaking. This specification should normally contain details on the following key points: environmental conditions (climatic, mechanical, EMI, EMC, etc.), reliability and availability, safety target (THR), inter
37、faces, functional requirements based on operational rules, operational limits and dimensions, non functional requirements (necessary documents, size, weight, etc.). In addition, all functional and safety requirements should be defined. The quoted safety target (THR = Tolerable Hazard Rates) should b
38、e calculated based on a risk analysis. The specification prepared by the infrastructure owner or railway undertaking will then form the basis for examining the differences between the originally approved system and the cross-acceptance system. 4.4 Cross-acceptance process A structured and risk based
39、 framework for cross-acceptance of product, system or process is developed in this guidance comprising seven core principles. The principles are universal and are particularly pertinent to safety critical systems where no systematic and efficient framework for their adoption and application in new a
40、pplications or environments exists. 4.4.1 The basic premise The cross-acceptance of a product, system or process is implicitly founded on a number of key assumptions and conditions namely a) the product, system or process has been specified, designed and developed by a competent, capable and reputab
41、le organisation, b) the product, system or process has been scrutinised, analysed and assessed through a rigorous process to assure its relevant safety, environmental and technical performance and this process has been documented at an appropriate level of detail, c) the product, system or process h
42、as been evaluated for its compliance with regulatory requirements and best practice standards and codes of practice, d) the assessment has been peer reviewed and the product, system or process approved or certified by a relevant competent body or authority in its native environment implying tolerabi
43、lity of its risks subject to specified constraints and controls, e) the product, system or process has preferably got a demonstrable record of adequate verification, validation and testing or trouble free operation in its native environment, f) the product, system or process has potential for a wide
44、r scope of application beyond its initial native environment either in its original state, or through small-scale redesign and adaptation, g) there is a perceived or real safety or environmental benefit or need in adapting the product, system or process for use in new (target) environments, CLC/TR 50506-1:2007 9
