! "

#$$%
&'
#(
$
)


*
 

  '
&
 
 

$*

$

+ +
)*''

  

    



     ! "

   


#$$%
&'
#(
$
)


*
 

  '
&
 
 

$*

$

+ +
)*''

 
     
 

 

          


 
  
  ! "#$$%&  
 
 

      
 

  

    

    , ! "

    
 
#$$%
&'
#(
$
)


*
 

  '
&
 
 

$*

$

+ +
)*''

      




 '

 ( )

 *  +   , 

    -!!!- 

 




   
  

.   
/
01
  

 "#$$2&

  

    

    " ! "

     


#$$%
&'
#(
$
)


*
 

  '
&
 
 

$*

$

+ +
)*''

 3 4   

  

54
 44     
 6    
 





1


  6

 
 4 

 
      
 4  

  

 
    
   
    

  

    

    - ! "



   


#$$%
&'
#(
$
)


*
 

  '
&
 
 

$*

$

+ +
)*''

    

7

 
   

8 


 6   

/
    

9
:
 
 
 4  


74
        

  

    

    . ! "

#$$%
*
 
*%

  '
&
 
 

$*

$

+ +
)*''

  

    




     ! "

 

  
#$$%
*
 
*%

  '
&
 
 

$*

$

+ +
)*''

 

    
 
  
 


 
  
 

  

 
 


  
   
       

          !
" 
 

     
 # $ %
 


  
&
  & 
'  
   
 
 


    



  

    

     ! "


 
    

  
#$$%
*
 
*%

  '
&
 
 

$*

$

+ +
)*''

Main signals
(departure)

Block signal
with advance signal
Main signal
(arrival)

Main signal
(arrival)

Railswitch

Section block

PLC A

Main signals
(departure)

Advance
signal

PLC B

Safety-related
Non-safety-related
PLC C

Central operation
station

  

    

    / ! "

#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

  

    




     ! "



#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

74
 

  






!- ;<=$> " 


  !?!?! 
 @

      
 
&
-!!!- 

 ! =$<#; ! =$<#> ! =$<#A " 
 
  !- ;$#%> !- ;$#%A !- ;$#B=C& "

! =$<=A&

D >$$B

@/ 1@>>#-

!!! 



E    ! 

 

+   
 !- 


  
    

     ! "

 
  
#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

() *+,-.  /

  

 
 

 
  0 1
() *+,-2   
    


() *+,-3    
 
 
 

  

    

     ! "

 
   


#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

Railway authority
regulations

European directives

EN 50129

EN 50126

EN 50128

Hardware

SIS
lifecycle

Software

Europe

Prior railway
standards
(UK, France, others)

  

    

M 8004
(Germany)

IEC 61508

Generic requirements

Application sector standards

(railway)

MIL-STD-882C
(USA)

    , ! "

  !"#  $  


#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

/ 
   !- ;<=$>
 ! 




'  


 
     4  
 
  

  

  
     "*)& 
  



 
 
F
 
 " )7&  ! =$<#A

  

    

    " ! "

  !"#  $  


#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

    4
 
( .,*+3 
  () 
 
( .,*+3 
      
   
   15 3++6

( .,*+3  

 
   () 

 
  

 
 
0 1
!  
  
  
() *+,-2
 
   ! 
     
( .,*+3   
 

 7 8
() *+,-3 /      

   
 ( .,*+3  9 
      


   7

 +' + ' '   233 

+ 20) ., ''
  
    

    - ! "

    
 

#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

() *+,-2 9   
      

:/
  #    

       
 
 
   
 
  

 $


 
  9 
  
 

  
 
 

 
 
 

       




  
      
;
   
;
 
 
/ 
 

  

    

    . ! "

    
 

#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

  

    

Generic application (configuration)

Generic
product

Generic
product

Generic
product

Application specific conditions

Specific application

     ! "

  %$ 

 
 !" &#
#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

! =$<#>

)
   
 :
    6    
! =$<#;
 ! =$<#A
/: 6            

4   
 

/:

 

1
   

G:
 4



  

 
 " :
&

  

    

     ! "

  %$ 

 
 !" &#
#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

Software
maintenance
Software quality
assurance

Personnel competence
and responsiblities

Software
requirements
in EN 50128

Software assessment

Software validation

  

    

Integration
with hardware

Software Quality
assurance plan
Software requirement
specification
Software architecture
Software design
and implementation

Software verification
and testing

    / ! "

  %$ 

 
 !" &#
  
    
  # 
$

Specification

Software development

#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

Software generation

Free text -> formal description

-> model -> consistency check

Code generation and

verification (simululation
code sequence)

Development of
test code

To be used for verification

Verification of software

Formal verification, testing

  

    

Scope of a
software
development
platform
(compiler)

Scope of a
software
development
environment

     ! "

   




 
 !" &#
#$$%
*
 

  '
#$$%
0 '
  '
*
'+
*
'
1'
&
 '
0 -
&
 
 

$*

$

+ +
)*''

  

 


      
 

 



 9/
    
 
  
7
Software
development
environment

Scope of
of article
by Nordland
and Lundteigen

How to

Software
specification

Some computerized
tools provide
(semi) automatic
support for:
free text ->
formal specification ->
consistency check ->
code generation ->
code verification

Safety
plan
How to
Software
quality
management

Software
quality
assurance
plan
How to

Compiler

Code
verification
and
validation

Outputs

  

    

Verification,
validiation,
assessments
reports

Software
code

     ! "

#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

  

    

 


     ! "

  
 
#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

 
  () *+,-2     <
    9  

 
  
 

 
  
 


 


     7
1
 
      

 

 
 4 
  
      


  

7
=   
" 
  
 
  7 7 " 
" 
 
 
  
" 
  
 
  

  

    

    , ! "

  
     '()
#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

 
   !
   
 
9    
/
      
/  

      

( .-*-* () *+,-2 7
0
  ! ,   ! 6  7
( .,*+3   
   >  ?0  
!7
@  
 /

<   
 


   
    
 ?0 
    
7
@    
    


      / !7

 2
' '%+
* &
+' 4
 '
5

'6  & *'
+   + %
&*'  * 
  
    

    " ! "


   (
#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

     !  
   
   



 >    %  ?0   !
9 
 
9  /
   ! 9 
  

  
9  /
   ! 9 
  

 
1  
   
   
 
 
 

    
   

77   
   

    


&  7
, *

$* $& *
  7
+
' '4 
+ 
+
'

  

    

    - ! "

*   
+$
   
 
#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

     
 

  
/
 > 
   
7

   9 
 /


   
   9 
 /

   

 
 
   
   

 

    
   


A
 /

 
 

A
 

  


  

    

    . ! "

,-  %$ 
       (
#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

Tolerable
Hazard Rate (THR)

HR THR
(random
hardware failures)

SIL requirement

SWSIL according
to SIL*

Avoidance/control of
random and
systematic failures
according to SIL*

* The SIL that corresponds to the THR or the SIL that is specified by regulations

  

    

     ! "

.    
   %$ 

#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

" ! 9 

   
 
 
   
 
    () 
 
 

9 
  
1
 1  7
?   
       
   B/7
0 
     
   


    %



)  
  )C  7

  

    

     ! "

.    
   %$ 

#$$%
*
 

  '
&
 
 

4

2
$*

$

+ +
)*''

Recommended
Technique 8

Technique 6
Technique 1
Technique 7

Technique 3
Technique 2

Technique 9

Technique 5

Mandatory

Technique 4
Technique 11

Technique 10

Highly recommended
Technique 13

Recommended
practise

Not recommended
Technique 12

Not recommended practise

  

    

    / ! "

#$$%
*
 

  '
&
 
 

$*

$

8*
&
8*
$*

+ +
)*''

  

    

 
 




    , ! "

   

 
#$$%
*
 

  '
&
 
 

$*

$

8*
&
8*
$*

+ +
)*''

  
 4  
 

 
 4    

     
 
 H     
 

 
    


     

   
 

  
 



   IJ 

 3 4 
 
 6
 
 
 
  

  IJ     6      /

  

    

    , ! "

 %$ $

 

#$$%
*
 

  '
&
 
 

$*

$

8*
&
8*
$*

+ +
)*''

  
 6
 
 
 
 

 

 
  +   4  


    
 
  6   :


 
 4     :
 


  4:
?4


7?I 6     ! =$<#>

'      
4
 
      
   4

   
 6
 
 
   
 


     
 
   

F

G    

  

    

    , ! "

 %$ 
     

#$$%
*
 

  '
&
 
 

$*

$

8*
&
8*
$*

+ +
)*''

Personnel competence

Verification
and
validation

Software
development platform

  

    

Software quality
assurance plan

    ,, ! "

 %$ 
     

#$$%
*
 

  '
&
 
 

$*

$

8*
&
8*
$*

+ +
)*''

Common for all

safety functions

Per SIS (and

per subsystem)

Software
(per subsystem)

SRS

Other
requirements

Non
Safety safety
System
requirement related related
specification

Software
requirement
specification

Programmer

Software
quality
assurance
plan

Software
development
platform

Important for achieving adequate software safety integrity

  

    

    ," ! "

#$$%
*
 

  '
&
 
 

$*

$

+ +
9
'
:2
)*''

  

    

  

    ,- ! "

 %$ 
     

#$$%
*
 

  '
&
 
 

$*

$

+ +
9
'
:2
)*''

 
  

,7 
 
 8! 9 
 
( .,*+3 () *+,-3

 () *+,-2 
-7 (   %
    
  
   
    
 

 
7
D7 (   %
   9 
 

A
 
 


< 
  


 
 
  

  

     
  7

"  '



 '  
  '*  ;
  
    

    ,. ! "

 %$ 
     

#$$%
*
 

  '
&
 
 

$*

$

+ +
9
'
:2
)*''

" 
         



(   %
 ( .,*+3 
  () 
 
9
 9 


- <
+ 
$'' & 20) .- =//>  0 '
  ' =!,> '+ 9$*
+'  '

   


  
    

    , ! "

/(  %$ 
 
 !" &#
#$$%
*
 

  '
&
 
 

$*

$

+ +
9
'
:2
)*''

 
            

   
 !
 "
 #
 
! $ 
%
%
&%
&%
" ' 
&%
&%
&%
&%
#    
(
&%
&%
&%
&%
 )  
)
)
)
)
* +
  
 
&%
&%
&%
&%
,  ( 

&%
&%
&%
&%
- 
( ( 
 


&%
&%
&%
&%
.    


&%
&%
&%
&%
/ 0




&%
&%
&%
&%
!1 

  
&%
&%
&%
&%
!! 2  
&%
&%
&%
&%
&%
&%
&%
&%
!"     
!# (   3   %
%
%
%
    
! $  4 5 

&%
&%
)
)
!* 0  

&%
&%
&%
&%
!,   

&%
&%
&%
&%
!- + 
   (
&%
&%
)
)
!. $ 66( 

7
7
7
7
!/ 89   


%
%
%
%

  

    

    , ! "

#$$%
*
 

  '
&
 
 

$*

$

+ +
)*''
)*''

  

    





    ,/ ! "


$

#$$%
*
 

  '
&
 
 

$*

$

+ +
)*''
)*''

  

 


   
/
 

 
 /
&
7
   
      
 

 
 7
   
    



 
E 

 
   
&9

 7
1     9 
     ()
*+,-% 
7
1
        

 

     


  
 9 
 

( .,*+37
"  
  9 
 
() *+,-3

 9   9 
 
( .,*+3  D7

  

    

    " ! "