Software Assurance 81

In railway projects, it is important to put in place a managerial strategy

(job description, skill sets, identification of requisite prior training, etc.),
which can be used to demonstrate that the external personnel are adequately
skilled and are capable of assuming the roles assigned to them.

For subcontracting (where work is done for a flat fee by an outside party),
it is necessary to demonstrate that the subcontractor has a skill-management
scheme and is able to assign the various roles in the projects to the
appropriate people, but it is crucial for the customer to perform at least one
audit to check that this skill management works properly. In general, this
audit of the subcontractor is performed at the same time as the audit to
demonstrate ISO 9001:2008 conformance.

Appendix B in CENELEC 50128:2011 and in IEC 62279:2014 presents

the roles and, for each role, identifies the responsibilities and skills required
(see Table 4.3). It should be noted that for each role, we find the need for
knowledge (at least familiarity with the part of the project in question) and
for familiarity with the regulatory framework.

Role: requirements manager: RQM

Responsibilities:
– must be in charge of specifying the software requirements;
– must deliver the specifications laid out by the software requirements;
– must establish and maintain traceability to and from the requirements at system level;
– must ensure that the requirements relating to the specifications and the software are
taken into account in the management of the modifications and of the configuration,
including the state, version and authorization status;
– must ensure consistency and completeness in the specification of the software
requirements (with reference to the requirements of the end user and the final
environment of application);
– must develop and maintain the requirement documents relating to the software.
Main skills:
– must be competent in requirements engineering;
– must have experience in the field of application;
– must have experience in the safety criteria in the field of application;
– must understand the overall role of the system and the environment of its application;
– must understand the analytical techniques and their results;
– must understand the applicable regulations;
– must understand the requirements set out by CENELEC 50128.

Table 4.3. Extract from Table B.1 in CENELEC 50128:2011

82 CENELEC 50128 and IEC 62279 Standards

For management of the external people involved in the project, it is

important to request certification of training in CENELEC 50128:2011 (the
request may also be extended to the whole of the CENELEC framework)
and in the legislative context.

Figure 4.8 introduces an example of a process of resources which is

organized around a phase of allocation. At entry into the allocation phase,
we have job sheets which, for each role, define the requisite skills and level
of training, and the list of people both within and outside the company who
need to be involved in the project. Upon completion of the allocation phase,
we must find justifying factors which demonstrate that the people to whom
each role has been assigned are competent for those roles. In order to do so,
we need to be capable of linking a person to a role, and we must have
elements of justification which show that the requisite skills have been
acquired, or that further training must be undertaken.

Figure 4.8. Process of resource and skill management

4.5. Configuration management

The software forms part of a set of a piece of equipment whose

configuration must be managed. For this reason, at system level, we must
have a “Configuration Management Plan” (CMP). The CMP must cover all