1、raising standards worldwideNO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationBS EN 50159:2010Railway applications Communication, signallingand processing systems Safety-related communicationin transmission systemsBS EN 50159:2010 BRITISH STANDARDNational
2、forewordThis British Standard is the UK implementation of EN 50159:2010. Itsupersedes BS EN 50159-1:2001 and BS EN 50159-2:2001 which arewithdrawn.The UK participation in its preparation was entrusted to TechnicalCommittee GEL/9, Railway Electrotechnical Applications.A list of organizations represen
3、ted on this committee can beobtained on request to its secretary.This publication does not purport to include all the necessaryprovisions of a contract. Users are responsible for its correct.application. BSI 2010 ISBN 978 0 580 67552 2 ICS 35.240.60; 45.020 Compliance with a British Standard cannot
4、confer immunity fromlegal obligations.This British Standard was published under the authority of theStandards Policy and Strategy Committee on 31 October 2010. Amendments issued since publicationDate T e x t a f f e c t e dBS EN 50159:2010EUROPEAN STANDARD EN 50159 NORME EUROPENNE EUROPISCHE NORM Se
5、ptember 2010 CENELEC European Committee for Electrotechnical Standardization Comit Europen de Normalisation Electrotechnique Europisches Komitee fr Elektrotechnische Normung Management Centre: Avenue Marnix 17, B - 1000 Brussels 2010 CENELEC - All rights of exploitation in any form and by any means
6、reserved worldwide for CENELEC members. Ref. No. EN 50159:2010 E ICS 35.240.60; 45.020 Supersedes EN 50159-1:2001, EN 50159-2:2001English version Railway applications - Communication, signalling and processing systems - Safety-related communication in transmission systems Applications ferroviaires -
7、 Systmes de signalisation, de tlcommunication et de traitement - Communication de scurit sur des systmes de transmission Bahnanwendungen - Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssysteme - Sicherheitsrelevante Kommunikation in bertragungssystemen This European Standard was app
8、roved by CENELEC on 2010-09-01. CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such nat
9、ional standards may be obtained on application to the Central Secretariat or to any CENELEC member. This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CENELEC member into its own langua
10、ge and notified to the Central Secretariat has the same status as the official versions. CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Ita
11、ly, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. BS EN 50159:2010EN 50159:2010 2 Foreword This European Standard was prepared by SC 9XA, Communication, signalling and processing system
12、s, of Technical Committee CENELEC TC 9X, Electrical and electronic applications for railways. It was submitted to the formal vote and was approved by CENELEC as EN 50159 on 2010-09-01. This document supersedes EN 50159-1:2001 and EN 50159-2:2001. The contents of both standards have been merged; the
13、informative Annex E gives a mapping between these previous editions and the present document. This European Standard is closely related to EN 50129:2003. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN and CENELEC shall not be
14、 held responsible for identifying any or all such patent rights. The following dates were fixed: latest date by which the EN has to be implemented at national level by publication of an identical national standard or by endorsement (dop) 2011-09-01 latest date by which the national standards conflic
15、ting with the EN have to be withdrawn (dow) 2013-09-01 This draft European Standard has been prepared under a mandate given to CENELEC by the European Commission and the European Free Trade Association and covers essential requirements of EC Directives 96/48/EC (HSR), recast by EC Directives 2008/57
16、/EC (RAIL). See Annex ZZ. _ BS EN 50159:2010 3 EN 50159:2010 Contents Introduction 51 Scope 62 Normative references 73 Terms, definitions and abbreviations 73.1 Terms and definitions 73.2 Abbreviations . 124 Reference architecture 135 Threats to the transmission system 166 Classification of transmis
17、sion systems 176.1 General 176.2 General aspects of classification . 176.3 Criteria for the classification of transmission systems . 176.4 Relationship between transmission systems and the threats 187 Requirements for defences . 187.1 Preface 187.2 General requirements 197.3 Specific defences 207.4
18、Applicability of defences 26Annex A (informative) Threats on open transmission systems 28A.1 System view . 28A.2 Derivation of the basic message errors . 29A.3 Threats. 30A.4 A possible approach for building a safety case . 31A.5 Conclusions . 35Annex B (informative) Categories of transmission syste
19、ms . 37B.1 Categories of transmission systems 37B.2 Relationship between the category of transmission systems and threats . 39Annex C (informative) Guideline for defences 40C.1 Applications of time stamps . 40C.2 Choice and use of safety codes and cryptographic techniques. 41C.3 Safety code 46C.4 Le
20、ngth of safety code 49C.5 Communication between safety-related and non safety-related applications 51Annex D (informative) Guidelines for use of the standard. 53D.1 Procedure 53D.2 Example . 54Annex E (informative) Mapping from previous standards . 59Annex ZZ (informative) Coverage of Essential Requ
21、irements of EC Directives 62Bibliography . 63BS EN 50159:2010EN 50159:2010 4 Figures Figure 1 Reference architecture for safety-related communication 15Figure 2 Cyclic transmission of messages . 21Figure 3 Bi-directional transmission of messages 22Figure A.1 Hazard tree . 29Figure A.2 Causes of thre
22、ats 32Figure C.1 Classification of the safety-related communication system 42Figure C.2 Model of message representation within the transmission system (Type A0, A1) . 43Figure C.3 Use of a separate access protection layer 44Figure C.4 Model of message representation within the transmission system (T
23、ype B0) 45Figure C.5 Model of message representation within the transmission system (Type B1) 46Figure C.6 Basic error model 49Figure C.7 Communication between non safety-related and safety-related applications . 52Figure D.1 Fault tree for the hazard “accident” . 55Figure D.2 Fault tree for case 1
24、56Figure D.3 Fault tree for case 2 58Tables Table 1 Threats/Defences matrix . 26Table A.1 Relationship between hazardous events and threats . 36Table B.1 Categories of transmission systems 38Table B.2 Threat/Category relationship 39Table C.1 Assessment of the safety encoding mechanisms . 48Table E.1
25、 Mapping from EN 50159-1:2001 into EN 50159:201X . 60Table E.2 Mapping from EN 50159-2:2001 into EN 50159:201X . 61BS EN 50159:2010 5 EN 50159:2010 Introduction If a safety-related electronic system involves the transfer of information between different locations, the transmission system then forms
26、an integral part of the safety-related system and it shall be shown that the end to end communication is safe in accordance with EN 50129. The transmission system considered in this standard, which serves the transfer of information between different locations, has in general no particular precondit
27、ions to satisfy. It is from the safety point of view not trusted, or not fully trusted. The standard is dedicated to the requirements to be taken into account for the communication of safety-related information over such transmission systems. Although the RAM aspects are not considered in this stand
28、ard it is recommended to keep in mind that they are a major aspect of the global safety. The safety requirements depend on the characteristics of the transmission system. In order to reduce the complexity of the approach to demonstrate the safety of the system, transmission systems have been classif
29、ied into three categories: Category 1 consists of systems which are under the control of the designer and fixed during their lifetime; Category 2 consists of systems which are partly unknown or not fixed, however unauthorised access can be excluded; Category 3 consists of systems which are not under
30、 the control of the designer, and where unauthorised access has to be considered. The first category was covered by EN 50159-1:2001, the others by EN 50159-2:2001. When safety-related communication systems, which have been approved according to the previous standards, are subject of maintenance and/
31、or extensions, the informative Annex E can be used for traceability purposes of (sub)clauses of this standard with the (sub)clauses of the former series. BS EN 50159:2010EN 50159:2010 6 1 Scope This European Standard is applicable to safety-related electronic systems using for digital communication
32、purposes a transmission system which was not necessarily designed for safety-related applications and which is under the control of the designer and fixed during the lifetime, or partly unknown or not fixed, however unauthorised access can be excluded, or not under the control of the designer, and a
33、lso unauthorised access has to be considered. Both safety-related equipment and non safety-related equipment can be connected to the transmission system. This standard gives the basic requirements needed to achieve safety-related communication between safety-related equipment connected to the transm
34、ission system. This European Standard is applicable to the safety requirement specification of the safety-related equipment connected to the transmission system, in order to obtain the allocated safety integrity requirements. Safety requirements are generally implemented in the safety-related equipm
35、ent, designed according to EN 50129. In certain cases these requirements may be implemented in other equipment of the transmission system, as long as there is control by safety measures to meet the allocated safety integrity requirements. The safety requirement specification is a precondition of the
36、 safety case of a safety-related electronic system for which the required evidence is defined in EN 50129. Evidence of safety management and quality management has to be taken from EN 50129. The communication-related requirements for evidence of functional and technical safety are the subject of thi
37、s standard. This European Standard is not applicable to existing systems, which had already been accepted prior to the release of this standard. This European Standard does not specify the transmission system, equipment connected to the transmission system, solutions (e.g. for interoperability), whi
38、ch kind of data are safety-related and which are not. A safety-related equipment connected through an open transmission system can be subjected to many different IT security threats, against which an overall program has to be defined, encompassing management, technical and operational aspects. In th
39、is European Standard however, as far as IT security is concerned, only intentional attacks by means of messages to safety-related applications are considered. This European Standard does not cover general IT security issues and in particular it does not cover IT security issues concerning ensuring c
40、onfidentiality of safety-related information, preventing overloading of the transmission system. BS EN 50159:2010 7 EN 50159:2010 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. Fo
41、r undated references, the latest edition of the referenced document (including any amendments) applies. CLC/TR / EN 50126 series, Railway applications The specification and demonstration of Reliability, Availability, Maintainability and Safety (RAMS) EN 50129:2003, Railway applications Communication
42、, signalling and processing systems Safety related electronic systems for signalling 3 Terms, definitions and abbreviations 3.1 Terms and definitions For the purposes of this document, the following terms and definitions apply. 3.1.1 absolute time stamp time stamp referenced to a global time which i
43、s common for a group of entities using a transmission system 3.1.2 access protection processes designed to prevent unauthorised access to read or to alter information, either within user safety-related systems or within the transmission system 3.1.3 additional data data which is not of any use to th
44、e ultimate user processes, but is used for control, availability, and safety purposes 3.1.4 authentic message message in which information is known to have originated from the stated source 3.1.5 authenticity state in which information is valid and known to have originated from the stated source 3.1
45、.6 closed transmission system fixed number or fixed maximum number of participants linked by a transmission system with well known and fixed properties, and where the risk of unauthorised access is considered negligible 3.1.7 communication transfer of information between applications 3.1.8 confident
46、iality property that information is not made available to unauthorised entities 3.1.9 corrupted message type of message error in which a data corruption occurs BS EN 50159:2010EN 50159:2010 8 3.1.10 cryptographic techniques producing output data, calculated by an algorithm using input data and a key
47、 as a parameter NOTE By knowing the output data, it is impossible within a reasonable time to calculate the input data without knowledge of the key. It is also impossible within a reasonable time to derive the key from the output data, even if the input data are known. 3.1.11 cyclic redundancy check
48、 cyclic code, used to protect messages from the influence of data corruption 3.1.12 data part of a message which represents some information (see also user data, additional data, redundant data) 3.1.13 data corruption alteration of data 3.1.14 defence measure incorporated in the design of a safety-related communication system to counter particular threats 3.1.15 delayed message type of message error in which a message is received at a time later than intended 3.1.16 deleted message type of message error in which a message is removed from the message stream 3.1.17 double time
