1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI British StandardsWB9423_BSI_StandardColCov_noK_AW:BSI FRONT COVERS 5/9/08 12:55 Page 1Railway applications Communication, signalling andprocessing systems Applicationguide for EN 50129Part 2: Safety
2、assurancePD CLC/TR 50506-2:2009National forewordThis Published Document is the UK implementation of CLC/TR 50506-2:2009.The UK participation in its preparation was entrusted by Technical CommitteeGEL/9, Railway Electrotechnical Applications, to Subcommittee GEL/9/1,Railway Electrotechnical Applicati
3、ons - Signalling and communications.A list of organizations represented on this committee can be obtained onrequest to its secretary.This publication does not purport to include all the necessary provisions of acontract. Users are responsible for its correct application. BSI 2010ISBN 978 0 580 58285
4、 1ICS 93.100Compliance with a British Standard cannot confer immunity fromlegal obligations.This Published Document was published under the authority of theStandards Policy and Strategy Committee on 31 January 2010Amendments issued since publicationAmd. No. Date Text affectedBRITISH STANDARDPD CLC/T
5、R 50506-2:2009TECHNICAL REPORT CLC/TR 50506-2 RAPPORT TECHNIQUE TECHNISCHER BERICHT December 2009 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Central Secretariat: Avenue Marnix 17, B
6、- 1000 Brussels 2009 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members. Ref. No. CLC/TR 50506-2:2009 E ICS 93.100 English version Railway applications - Communication, signalling and processing systems - Application Guide for EN 50129 - Part 2:
7、Safety assurance This Technical Report was approved by CENELEC on 2009-07-17. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuani
8、a, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. PD CLC/TR 50506-2:2009CLC/TR 50506-2:2009 2 Foreword This Technical Report was prepared by SC 9XA, Communication, signalling and processing systems, of Tec
9、hnical Committee CENELEC TC 9X, Electrical and electronic applications for railways. The text of the draft was submitted to vote in accordance with the Internal Regulations, Part 2, Subclause 11.4.3.3 (simple majority) and was approved by CENELEC as CLC/TR 50506-2 on 2009-07-17. _ PD CLC/TR 50506-2:
10、2009 3 CLC/TR 50506-2:2009 Contents Page Introduction . 5 1 Scope . 6 2 References . 6 3 Terms, definitions, symbols and abbreviated terms . 7 3.1 Terms and definitions . 7 3.2 Symbols and abbreviated terms . 8 4 Safety design for signalling subsystems . 10 4.1 Safety principles . 10 4.2 Components
11、development guideline 19 4.3 Specific implementation examples . 25 5 Safety case structure in relation with associated documents and activities . 28 5.1 Introduction . 28 5.2 Safety Case for Signalling Systems . 28 5.3 Recommendations regarding the fulfilment of the requirements of tables in EN 5012
12、9:2003, Annex E 62 6 Safety assessment and approval 68 6.1 Guidance on the concept of Safety assessment 68 6.2 Migration strategy from other Standards to CENELEC 73 6.3 Approval for modification and internal adaptation 75 Annex A (informative) EN/IEC standards for safety analysis . 77 Annex B (infor
13、mative) Documentation for approval 78 B.1 Introduction . 78 B.2 Documentation table structure 79 B.3 Liaison to EN 50129:2003, 5.5.2 79 Annex C (informative) Structure of the System Requirements Specification . 87 C.1 Part one General information 87 C.2 Part two Requirements 87 Bibliography 89 PD CL
14、C/TR 50506-2:2009CLC/TR 50506-2:2009 4 Figures Figure 1 Example for hierarchical composition of Functional units 11 Figure 2 Example for creation and manifestation mechanisms of faults, errors, and failures 11 Figure 3 Example for the mechanisms of fundamental chain . 12 Figure 4 Relationships of fa
15、ults, errors and failures . 12 Figure 5 Representation for failures of single and multiple natures . 14 Figure 6 Inherent fail safe devices structure and associated threats . 15 Figure 7 Composite fail safe devices structure and associated threats . 17 Figure 8 Reactive fail safe devices structure a
16、nd associated threats 18 Figure 9 Example of composite fail-safety with identical VLSI components 21 Figure 10 Example of reactive fail-safety with different VLSI components 23 Figure 11 Example of development process for VLSI components (FPGA, EPLD, etc.) . 25 Figure 12 Example of overall Safety Ca
17、ses structure 30 Figure 13 Structure of the Technical Safety Report . 46 Figure 14 Example of inherent fail-safety . 50 Figure 15 Example for Relation between Design Functional Breakdown 55 Figure 16 Example of Relation breakdown from FMEA to FTA . 56 Figure 17 SRAC classification 58 Figure 18 Expor
18、ted constraints and SRAC management 59 Tables Table 1 Examples for single and coupled failures types 14 Table 2 Guidance for threats mitigation in inherent fail-safe devices . 16 Table 3 Guidance for threats mitigation in composite fail-safe devices . 17 Table 4 Guidance for threats mitigation in re
19、active fail-safe devices . 18 Table 5 Example of documentation linked to Quality Management . 32 Table 6 Typical Example of some Safety Activities in the Lifecycle . 36 Table 7 Methods for Safety Analysis 37 Table 8 List of safety methods and reference Standards . 37 Table 9 Safety planning and qual
20、ity assurance activities . 63 Table 10 System requirements specification 64 Table 11 Design phase documentation 66 Table 12 Operation and maintenance 67 Table 13 Typical assessor activity during the life cycle 69 Table 14 Possible Work split Approval for modification . 76 Table B.1 Documentation for
21、 Approval . 80 PD CLC/TR 50506-2:2009 5 CLC/TR 50506-2:2009 Introduction EN 50129 was developed in CENELEC and is now regularly called up in specifications. In essence, it lists factors that influence RAMS (see EN 50126-1) and adopts a broad risk-management approach to safety. EN 50129 is the basic
22、standard for safety related electronic systems for signalling. Use of EN 50129 has enhanced the general understanding of the issues, but also showed, that items like Safe Design, Safety Documents and Reports, Safety Assessment and Approval, and Cross-Acceptance need further explanation and clarifica
23、tion. Therefore CENELEC decided to address those items in this Application Guideline. The Cross Acceptance is included in CLC/TR 50506-1. PD CLC/TR 50506-2:2009CLC/TR 50506-2:2009 6 1 Scope This document is a Technical Report about the basic standard. It is applicable to the same systems and address
24、es the same audience as the standard itself. It enhances information on specific items on the application of EN 50129. The following items are covered, within the scope of this Application Guideline of EN 50129, as follows: Clause 4 deals with identification and mitigation of failures in the concept
25、, specification and design phases. It is mainly dedicated to designers and verifiers and product safety engineers; Clause 5 deals with the preparation of a safety case, enhancing points providing the required evidence for safety assessment and approval. It is mainly dedicated to verifiers, validator
26、s, safety managers, quality managers and safety engineers; Clause 6 deals with the activities an Independent Safety Assessor has to carry out. It is mainly dedicated to safety assessors, safety authorities, safety managers and safety approvals. In drafting this guidance, it is assumed that the reade
27、r is familiar with the basic structure of the standard. This document does not claim to be exhaustive. It is not a complete compilation of best practices, but only the translation of the knowledge of all the experts of the Working Group in charge of composition of this Application Guideline. 2 Refer
28、ences This Application Guideline uses as basis for specific topics the following reference standards, already mentioned in the main EN 50129. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies
29、. CLC/TR 50506-1, Railway applications Communication, signalling and processing systems Application Guide for EN 50129 Part 1: Cross-acceptance EN 45004 1), General criteria for the operation of various types of bodies performing inspection EN 50121 series, Railway applications Electromagnetic compa
30、tibility EN 50121-4, Railway applications Electromagnetic compatibility Part 4: Emission and immunity of the signalling and telecommunications apparatus EN 50124-1, Railway applications Insulation coordination Part 1: Basic requirements Clearances and creepage distances for all electrical and electr
31、onic equipment EN 50125-1, Railway applications Environmental conditions for equipment Part 1: Equipment on board rolling stock EN 50125-2, Railway applications Environmental conditions for equipment Part 2: Fixed electrical installations EN 50125-3, Railway applications Environmental conditions for
32、 equipment Part 3: Equipment for signalling and telecommunications 1)Superseded by EN ISO/IEC 17020:2004, General criteria for the operation of various types of bodies performing inspection (ISO/IEC 17020:1998). PD CLC/TR 50506-2:2009 7 CLC/TR 50506-2:2009 EN 50126-1:1999 + corr. May 2006, Railway A
33、pplications The specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) Part 1: Basic requirements and generic process EN 50128, Railway applications Communication, signalling and processing systems Software for railway control and protection systems EN 50129:
34、2003, Railway applications Communication, signalling and processing systems Safety related electronic systems for signalling EN 50155, Railway applications Electronic equipment used on rolling stock EN 50159-1, Railway applications Communication, signalling and processing systems Part 1: Safety rela
35、ted communication in closed transmission systems EN 50159-2, Railway applications Communication, signalling and processing systems Part 2: Safety related communication in open transmission systems EN 61508 series, Functional safety of electrical/electronic/programmable electronic safety-related syst
36、ems (IEC 61508 series) EN ISO 9001:2000 2), Quality Management Systems Requirements (ISO 9001:2000) ESA PSS 01-403, Hazard Analysis and Safety Risk Assessment ISO/IEC Guide 73:2002, Risk management Vocabulary Guidelines for use in standards The following standard is mentioned as complementary source
37、 of information: EN ISO/IEC 17020 (former EN 45004), General criteria for the operation of various types of bodies performing inspection (ISO/IEC 17020) 3 Terms, definitions, symbols and abbreviated terms 3.1 Terms and definitions For the purposes of this document, the terms and definitions given in
38、 EN 50126-1:1999, EN 50128:2001, EN 50129:2003 and the following apply. 3.1.1 generic application system with specific functions that are related to “a category of applications” associated with a general environmental and operational context, which is developed on the basis of criteria of standardiz
39、ation and parameterization of its elements, so as to render it serviceable for various tangible applications. By combining generic products or combining these with other generic applications, it is possible to obtain a new generic application 3.1.2 generic product component or product capable of per
40、forming certain functions, with specific performance level, in the environmental and operational conditions stated in the reference specifications. It can be combined with other products and Generic Applications to form other generic applications 2)Superseded by EN ISO 9001:2008, Quality management
41、systems Requirements (ISO 9001:2008). PD CLC/TR 50506-2:2009CLC/TR 50506-2:2009 8 3.1.3 specific application specific application addresses a specific installation for a dedicated project with specific implementation, as for instance data configuration 3.1.4 risk analysis systematic use of all avail
42、able information to identify hazards and to estimate the risk ISO/IEC 73:2002, Clause A.10 3.1.5 safety analysis subset of risk analysis solely focused on hazards which have a potential for causing accident which may cause harm to people 3.2 Symbols and abbreviated terms For the purposes of this doc
43、ument, the following symbols and abbreviated terms apply. AC Alternating Current ASIC Application Specific Integrated Circuit ATC Automatic Train Control ATP Automatic Train Protection C Customer CCF Common-cause failure COTS Commercial-Off-The-Shelf CV Curriculum Vitae DC Direct Current DMA Direct
44、Memory Access EM Electro Magnetic EMI Electro Magnetic Interference ESA PSS Spacecraft and Associated Equipment Procedures, Standards and Specifications ESD Electro Static Discharge EU European Union EPLD Erasable and Programmable Logic Device ETA Event Tree Analysis FMEA Failure Mode Effects Analys
45、is (see also below) FMECA Failure Mode Effects and Criticality Analysis FPGA Field Programmable Gate Array PD CLC/TR 50506-2:2009 9 CLC/TR 50506-2:2009 FTA Fault Tree Analysis FTI Formal Technical Inspection HAZOP Hazard and Operability Study HW Hardware I/O Input / Output ISA Independent Safety Ass
46、essor LRU Line Replaceable Unit PAL Programmable Array Logic PCB Printed Circuit Board PHA Preliminary Hazard Analysis PLC Programmable Logic Controller QAP Quality Assurance Plan QMS Quality Management System R Recommended RAM Reliability Availability Maintainability RAMS Reliability Availability M
47、aintainability and Safety RBD Reliability Block Diagram RS Rolling Stock S Supplier SART Structured Analysis for Real Time SC Safety Case SADT Structured Analysis and Design Techniques SRAC Safety Related Application Condition SHA System Hazard Analysis SIL Safety Integrity Level SMP Safety Manageme
48、nt Process SRIL Safety Related Item List SRS System Requirements Specification SSRS Subsystem Requirements Specification SW Software PD CLC/TR 50506-2:2009CLC/TR 50506-2:2009 10 TSR Technical Safety Report VHDL VHSIC (Very High Speed Integrated Circuit) Hardware Description Language VLSI Very Large
49、Scale Integration V components development guidance, mainly for programmable devices. 4.1 Safety principles This subclause is in line with EN 50129:2003, 5.4 and gives more details on how to fulfil all the requirements specified in this subclause of the standard to provide technical evidences for the safety of the design and in particular for the identification and the mitigation of
