EN50128 标准培训.ppt

1、EN50128 2011 Seminar Summary,Yao Jun Feb.27,2012,EN50128 2011 Seminar,北京英华经纶交通运输有限公司（劳氏北京）于2012年2月9日在北京举办了EN50128新版标准研讨会，会议由 Professor Ali Hessami 讲解（欧标修订工作组WG11主席，负责EN50128:2011的修订) 。 Ali Hessami教授介绍了系统安全保障的基本概念，并从标准制定者的角度介绍了新版的EN50128，同时还谈到了EN50126系列标准的整合和未来。 下面的ppt文档是基于本次研讨会的总结，也加入了个人的理解，并把我的提问和回

2、答也都列出。如果有不正确的或者遗漏的地方，请及时指出，谢谢！,Main Differences between EN50128 2011 and EN50128 2001,Main differences in New EN50128 are the following contents: Organization and role Personnel competence Support tools Application data or algorithms Deployment and maintenance,Organization and Role,Organization, rol

3、e and independence requirements (section 5.1) Add the role of RQM (requirement manager) , INT(Integritor) and TST(Tester) Add the description of these roles The independent requirements for roles are clearly explained.,Example:,Person competence,Personnel competencies are added in Annex B of EN50128

4、 2011. An example is shown:,Support Tools (1/2),Support Tools and Languages (Section 6.7) Provide evidence that potential failures of tools do not adversely affect the integrated toolset output in a safety related manner. Classification Three classes of tools so far as reliability and safety impact

5、is concerned as T1,T2 and T3. Each class will place different requirements on the required assurance,Support Tools (2/2),T1 class (section 3.1.42) generates no outputs which can directly or indirectly contribute to the executable code (including data) of the software Example： a text editor, configur

6、ation control tools. T2 class (section 3.1.43) supports the test or verification of the design or executable code, where errors in the tool can fail to reveal defects but cannot directly create errors in the executable software. Example：a test coverage measurement tool and a static analysis tool T3

7、class (section 3.1.44) generates outputs which can directly or indirectly contribute to the executable code (including data) of the safety related system Example： a source code compiler A simple way to understand the three types of tools: T1 -SIL0 T2 -SIL1&2 T3 -SIL3&4,Application Data or algorithms

8、,This part is emphasized in the new EN50128. (section 8) “The requirements for the development of application algorithms are the same as the development of generic software as described in Clauses 1-7 and 9. “ emphasize the importance of this part. Example,Software Deployment,Software deployment (se

9、ction 9.1): To ensure that the software performs as required, preserving the required software safety integrity level and dependability when it is deployed in the final environment of application. Key requiremnts Follow ISO 90003 as a minimum Define and maintain baseline (Example: using CC) Release

10、Notes Error Detection in Transport Deployment Manual,Other Changes(1/6),SIL0 is not viewed as non-safety, which has safety impact below SIL1. Some requirements for SIL0 still needs to be achieved. Example:,Other Changes(2/6),Predeveloped software and COTS software are uniformly named as Pre-exisitng

11、 software (7.3.4.7). Example:,Other Changes(3/6),Overall Software Test is added to test the software requirements Objective: To analyse and test the integrated software and hardware to ensure compliance with the Software Requirements Specification. Example:,Other Changes(4/6),Software module is modi

12、fied as software component. Example,Other Changes(5/6),SWSIL is changed as SIL Example,Other Changes(6/6),Add software interface specification in the architecture design stage Example:,New Trends in EN standards,EN50126-X will be published in 2014(estimated) EN50126-1 RAMS in Railways(EN50126:1999)

13、EN50126-2 Tools and Methods (New) EN50126-3 SMS for Railways (Many parties do not agree) EN50126-4 Functional Safety of Electronic Systems (EN50129:2003) EN50126-5 Software for Railway Applications (EN50128: 2011),Q&A (1/3),1. 1. Section 7.3.4.7 b) For all software safety integrity levels the pre-ex

14、isting software shall be included in the validation process of the whole software. Question: What is the real meaning of this sentence? Actually all of the pre-existing (COTS) software is included in the system validation. Do we need to carefully validate the pre-existing software especially and ind

15、ependently before validating the whole software or system? Answer (Ali Hessami): Yes. We shall do more than before about the pre-existing software. It is recommended that all of the functions of pre-existing software shall be checked. If the pre-existing software has passed the certification, only r

16、eviewing documents is enough. If the pre-exiting software does not have the certificate, all of the functions needs to be carefully tested before using.,Q&A (2/3),2. Diverse programming (D16) Diverse programming is a difficult method for implementation. If we can not assess the level of diversity, h

17、ow could we claim that our own software diversity method is effective or not? For instance, we can implement two different methods in one computer or two different methods in two computers to achieve software diversity. Could you give us a suggestion which is better? Answer (Ali Hessami): It depends

18、 on the problem you want to solve. If two different methods in one CPU can achieve the goal (Hardware unrelated problem), it is OK. Or else, two different methods in two CPUs are necessary (hardware related problem).,Q&A (3/3),3. SIL Traceability In developing safety critical software, the software with SIL4 could be traced by SIL4 and SIL0 software module. It is reasonable. But in some cases, the software with SIL0 may b