1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI British StandardsWB9423_BSI_StandardColCov_noK_AW:BSI FRONT COVERS 5/9/08 12:55 Page 1Railway applications Communication, signalling andprocessing systems Applicationguide for EN 50129Part 2: Safety
2、assurancePD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSINational forewordThis Published Document is the UK implementation of CLC/TR 50506-2:2009.The UK participation in its preparation was entrusted by Technical CommitteeGEL/9
3、, Railway Electrotechnical Applications, to Subcommittee GEL/9/1,Railway Electrotechnical Applications - Signalling and communications.A list of organizations represented on this committee can be obtained onrequest to its secretary.This publication does not purport to include all the necessary provi
4、sions of acontract. Users are responsible for its correct application. BSI 2010ISBN 978 0 580 58285 1ICS 93.100Compliance with a British Standard cannot confer immunity fromlegal obligations.This Published Document was published under the authority of theStandards Policy and Strategy Committee on 31
5、 January 2010Amendments issued since publicationAmd. No. Date Text affectedBRITISH STANDARDPD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSITECHNICAL REPORT CLC/TR 50506-2 RAPPORT TECHNIQUE TECHNISCHER BERICHT December 2009 CENE
6、LEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secretariat: Avenue Marnix 17, B - 1000 Brussels 2009 CENELEC - All rights of exploitation in any form and by any means reserved worldw
7、ide for CENELEC members. Ref. No. CLC/TR 50506-2:2009 E ICS 93.100 English version Railway applications - Communication, signalling and processing systems - Application Guide for EN 50129 - Part 2: Safety assurance This Technical Report was approved by CENELEC on 2009-07-17. CENELEC members are the
8、national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, S
9、weden, Switzerland and the United Kingdom. PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSICLC/TR 50506-2:2009 2 Foreword This Technical Report was prepared by SC 9XA, Communication, signalling and processing systems, of Techni
10、cal Committee CENELEC TC 9X, Electrical and electronic applications for railways. The text of the draft was submitted to vote in accordance with the Internal Regulations, Part 2, Subclause 11.4.3.3 (simple majority) and was approved by CENELEC as CLC/TR 50506-2 on 2009-07-17. _ PD CLC/TR 50506-2:200
11、9Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSI 3 CLC/TR 50506-2:2009 Contents Page Introduction . 5 1 Scope . 6 2 References . 6 3 Terms, definitions, symbols and abbreviated terms . 7 3.1 Terms and definitions . 7 3.2 Symbols and abbreviated ter
12、ms . 8 4 Safety design for signalling subsystems . 10 4.1 Safety principles . 10 4.2 Components development guideline 19 4.3 Specific implementation examples . 25 5 Safety case structure in relation with associated documents and activities . 28 5.1 Introduction . 28 5.2 Safety Case for Signalling Sy
13、stems . 28 5.3 Recommendations regarding the fulfilment of the requirements of tables in EN 50129:2003, Annex E 62 6 Safety assessment and approval 68 6.1 Guidance on the concept of Safety assessment 68 6.2 Migration strategy from other Standards to CENELEC 73 6.3 Approval for modification and inter
14、nal adaptation 75 Annex A (informative) EN/IEC standards for safety analysis . 77 Annex B (informative) Documentation for approval 78 B.1 Introduction . 78 B.2 Documentation table structure 79 B.3 Liaison to EN 50129:2003, 5.5.2 79 Annex C (informative) Structure of the System Requirements Specifica
15、tion . 87 C.1 Part one General information 87 C.2 Part two Requirements 87 Bibliography 89 PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSICLC/TR 50506-2:2009 4 Figures Figure 1 Example for hierarchical composition of Functiona
16、l units 11 Figure 2 Example for creation and manifestation mechanisms of faults, errors, and failures 11 Figure 3 Example for the mechanisms of fundamental chain . 12 Figure 4 Relationships of faults, errors and failures . 12 Figure 5 Representation for failures of single and multiple natures . 14 F
17、igure 6 Inherent fail safe devices structure and associated threats . 15 Figure 7 Composite fail safe devices structure and associated threats . 17 Figure 8 Reactive fail safe devices structure and associated threats 18 Figure 9 Example of composite fail-safety with identical VLSI components 21 Figu
18、re 10 Example of reactive fail-safety with different VLSI components 23 Figure 11 Example of development process for VLSI components (FPGA, EPLD, etc.) . 25 Figure 12 Example of overall Safety Cases structure 30 Figure 13 Structure of the Technical Safety Report . 46 Figure 14 Example of inherent fa
19、il-safety . 50 Figure 15 Example for Relation between Design Functional Breakdown 55 Figure 16 Example of Relation breakdown from FMEA to FTA . 56 Figure 17 SRAC classification 58 Figure 18 Exported constraints and SRAC management 59 Tables Table 1 Examples for single and coupled failures types 14 T
20、able 2 Guidance for threats mitigation in inherent fail-safe devices . 16 Table 3 Guidance for threats mitigation in composite fail-safe devices . 17 Table 4 Guidance for threats mitigation in reactive fail-safe devices . 18 Table 5 Example of documentation linked to Quality Management . 32 Table 6
21、Typical Example of some Safety Activities in the Lifecycle . 36 Table 7 Methods for Safety Analysis 37 Table 8 List of safety methods and reference Standards . 37 Table 9 Safety planning and quality assurance activities . 63 Table 10 System requirements specification 64 Table 11 Design phase documen
22、tation 66 Table 12 Operation and maintenance 67 Table 13 Typical assessor activity during the life cycle 69 Table 14 Possible Work split Approval for modification . 76 Table B.1 Documentation for Approval . 80 PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08
23、:10, Uncontrolled Copy, (c) BSI 5 CLC/TR 50506-2:2009 Introduction EN 50129 was developed in CENELEC and is now regularly called up in specifications. In essence, it lists factors that influence RAMS (see EN 50126-1) and adopts a broad risk-management approach to safety. EN 50129 is the basic standa
24、rd for safety related electronic systems for signalling. Use of EN 50129 has enhanced the general understanding of the issues, but also showed, that items like Safe Design, Safety Documents and Reports, Safety Assessment and Approval, and Cross-Acceptance need further explanation and clarification.
25、Therefore CENELEC decided to address those items in this Application Guideline. The Cross Acceptance is included in CLC/TR 50506-1. PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSICLC/TR 50506-2:2009 6 1 Scope This document is
26、a Technical Report about the basic standard. It is applicable to the same systems and addresses the same audience as the standard itself. It enhances information on specific items on the application of EN 50129. The following items are covered, within the scope of this Application Guideline of EN 50
27、129, as follows: Clause 4 deals with identification and mitigation of failures in the concept, specification and design phases. It is mainly dedicated to designers and verifiers and product safety engineers; Clause 5 deals with the preparation of a safety case, enhancing points providing the require
28、d evidence for safety assessment and approval. It is mainly dedicated to verifiers, validators, safety managers, quality managers and safety engineers; Clause 6 deals with the activities an Independent Safety Assessor has to carry out. It is mainly dedicated to safety assessors, safety authorities,
29、safety managers and safety approvals. In drafting this guidance, it is assumed that the reader is familiar with the basic structure of the standard. This document does not claim to be exhaustive. It is not a complete compilation of best practices, but only the translation of the knowledge of all the
30、 experts of the Working Group in charge of composition of this Application Guideline. 2 References This Application Guideline uses as basis for specific topics the following reference standards, already mentioned in the main EN 50129. For dated references, only the edition cited applies. For undated
31、 references, the latest edition of the referenced document (including any amendments) applies. CLC/TR 50506-1, Railway applications Communication, signalling and processing systems Application Guide for EN 50129 Part 1: Cross-acceptance EN 45004 1), General criteria for the operation of various type
32、s of bodies performing inspection EN 50121 series, Railway applications Electromagnetic compatibility EN 50121-4, Railway applications Electromagnetic compatibility Part 4: Emission and immunity of the signalling and telecommunications apparatus EN 50124-1, Railway applications Insulation coordinati
33、on Part 1: Basic requirements Clearances and creepage distances for all electrical and electronic equipment EN 50125-1, Railway applications Environmental conditions for equipment Part 1: Equipment on board rolling stock EN 50125-2, Railway applications Environmental conditions for equipment Part 2:
34、 Fixed electrical installations EN 50125-3, Railway applications Environmental conditions for equipment Part 3: Equipment for signalling and telecommunications 1)Superseded by EN ISO/IEC 17020:2004, General criteria for the operation of various types of bodies performing inspection (ISO/IEC 17020:19
35、98). PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSI 7 CLC/TR 50506-2:2009 EN 50126-1:1999 + corr. May 2006, Railway Applications The specification and Demonstration of Reliability, Availability, Maintainability and Safety (RA
36、MS) Part 1: Basic requirements and generic process EN 50128, Railway applications Communication, signalling and processing systems Software for railway control and protection systems EN 50129:2003, Railway applications Communication, signalling and processing systems Safety related electronic system
37、s for signalling EN 50155, Railway applications Electronic equipment used on rolling stock EN 50159-1, Railway applications Communication, signalling and processing systems Part 1: Safety related communication in closed transmission systems EN 50159-2, Railway applications Communication, signalling
38、and processing systems Part 2: Safety related communication in open transmission systems EN 61508 series, Functional safety of electrical/electronic/programmable electronic safety-related systems (IEC 61508 series) EN ISO 9001:2000 2), Quality Management Systems Requirements (ISO 9001:2000) ESA PSS
39、01-403, Hazard Analysis and Safety Risk Assessment ISO/IEC Guide 73:2002, Risk management Vocabulary Guidelines for use in standards The following standard is mentioned as complementary source of information: EN ISO/IEC 17020 (former EN 45004), General criteria for the operation of various types of
40、bodies performing inspection (ISO/IEC 17020) 3 Terms, definitions, symbols and abbreviated terms 3.1 Terms and definitions For the purposes of this document, the terms and definitions given in EN 50126-1:1999, EN 50128:2001, EN 50129:2003 and the following apply. 3.1.1 generic application system wit
41、h specific functions that are related to “a category of applications” associated with a general environmental and operational context, which is developed on the basis of criteria of standardization and parameterization of its elements, so as to render it serviceable for various tangible applications
42、. By combining generic products or combining these with other generic applications, it is possible to obtain a new generic application 3.1.2 generic product component or product capable of performing certain functions, with specific performance level, in the environmental and operational conditions
43、stated in the reference specifications. It can be combined with other products and Generic Applications to form other generic applications 2)Superseded by EN ISO 9001:2008, Quality management systems Requirements (ISO 9001:2008). PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STAN
44、DARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSICLC/TR 50506-2:2009 8 3.1.3 specific application specific application addresses a specific installation for a dedicated project with specific implementation, as for instance data configuration 3.1.4 risk analysis systematic use of all available info
45、rmation to identify hazards and to estimate the risk ISO/IEC 73:2002, Clause A.10 3.1.5 safety analysis subset of risk analysis solely focused on hazards which have a potential for causing accident which may cause harm to people 3.2 Symbols and abbreviated terms For the purposes of this document, th
46、e following symbols and abbreviated terms apply. AC Alternating Current ASIC Application Specific Integrated Circuit ATC Automatic Train Control ATP Automatic Train Protection C Customer CCF Common-cause failure COTS Commercial-Off-The-Shelf CV Curriculum Vitae DC Direct Current DMA Direct Memory Ac
47、cess EM Electro Magnetic EMI Electro Magnetic Interference ESA PSS Spacecraft and Associated Equipment Procedures, Standards and Specifications ESD Electro Static Discharge EU European Union EPLD Erasable and Programmable Logic Device ETA Event Tree Analysis FMEA Failure Mode Effects Analysis (see a
48、lso below) FMECA Failure Mode Effects and Criticality Analysis FPGA Field Programmable Gate Array PD CLC/TR 50506-2:2009Licensed Copy: Wang Bin, ISO/EXCHANGE CHINA STANDARDS, 15/04/2010 08:10, Uncontrolled Copy, (c) BSI 9 CLC/TR 50506-2:2009 FTA Fault Tree Analysis FTI Formal Technical Inspection HA
49、ZOP Hazard and Operability Study HW Hardware I/O Input / Output ISA Independent Safety Assessor LRU Line Replaceable Unit PAL Programmable Array Logic PCB Printed Circuit Board PHA Preliminary Hazard Analysis PLC Programmable Logic Controller QAP Quality Assurance Plan QMS Quality Management System R Recommended RAM Reliability Availability Maintainability RAMS Reliability Availability Mai
