Approval of Software & Specification of Software Presentation at Banekonferencen

Transcription

1 Approval of Software & Specification of Software Presentation at Banekonferencen

2 Background of the speaker Troels Winther, TÜV-SÜD Danmark, Software CV Year Company Program Role SW language Bombardier Sternol Programmør C Bombardier Ebilock 850 Test Integrator Assembler Chartec up, Motorola Project Manager C / embedded KMS VisIT Programmør Pascal/C++ Windows Det Norske Veritas -- Assessor Member WG EN50128: Atkins/DSB Safety Departm. SW-approvals Current TÜV-SÜD Danmark -- Assessor SW-approvals

3 CMS assessor Software error SIL2 in TCMS Hardware SIL3 Emergency fail (pushbutton) AND Hazard Train can not brake Collision Software SW-assessor, Report about SIL2 fullfilment Train computer CMS assessor - SVR 5/7/2015 3

4 EN50126-suiten EN50126 (Safety Management) EN50129 (Safety case, SIL-determination) EN50128 (Software) EN50155 (Equipment) EN50121 (EMC and noise) Safety concerns functions: The two most important? Rolling stock: Emergency brake Fire Detection Equipment Pass. Information System Infrastructure: Driving permit Allowed track speed Train Dispatching (TMS)

5 About TÜV-SÜD - European capacity 1/2 Mail-answer from Dr. Jan Richard, Zurich, concerning EN50128 and TSI: To my understanding, the TSI CCS itself do not have any requirement to SW The TSI CCS contains requirements to so called Interoperability Constituents. Such an IC can be a SW module or SW application The interoperability relevant requirements are given on a functional and system level, refer to Annex A TSI CCS is referring to mandatory EN norms as well This EN norms then contain requirements regarding the development and manufacturing of SW (especially EN50128) Chapter of TSI CCS is stating some requirements regarding the assessment of ICs

6 About TÜV-SÜD - European capacity 2/ : Uanset hvilket modul der er valgt, gælder bestemmelserne i bilag A, indeks 47, indeks A1, indeks A2..der er underlagt kravene i grundparameteren sikkerhed

7 Software 1/6 As media About software: Software is a physical file with billions of 0- og 1-numbers Software is help- and useless without hardware to execute the software Software is made by many people, who don t know each other => Not suited for approval EN50128 definition software intellectual creation comprising the programs, procedures, rules, data and any associated documentation pertaining to the operation of a system software baseline complete and consistent set of source code, executable files, configuration files, installation scripts and documentation that are needed for a software release. Information about compilers, operating systems, preexisting software and dependent tools is stored as part of the baseline. This will enable the organisation to reproduce defined versions and be the input for future releases at enhancements or at upgrade in the maintenance phase

8 Software 2/6 Function IF Button = 001 AND Data = 011 THEN Colour on screen = 101 ELSE Relay pulls = 111 Push button IF Colour on screen Detect smoke AND THEN Gate opens Data-file ELSE Relay pulls 111..

9 Software 3/6 Input/outputs Push button Detect smoke Colour on screen Gate opens Data-file 00 el. 01 Relay pulls 111..

10 Software 5/6 Component testing Push button 0, Colour on screen Detect smoke Gate opens Data-file 00, 01, 10, 11 Data Button 0 Component test Relay pulls Is it a software change, when data is changed?

11 Software 6/6 - Arkitecture Push button 0, 1 Detect smoke Data-file 00, 01, 10, 11 Tool 2 Datagenerering Compon Compon. 4 Library 1 Component 5 COTS-code from industry 1 Component 2 Newly developed code Component 3 Old code from mother company Component 6 Hardware micro code Tool 1 Linker det hele sammen til en fil Colour on screen Gate opens Relay pulls Install-fil

12 Pandoras box for infra structure Set train route 0, 1 Train detection Comp TMS Train drives Global Stop Data-file 00, 01, 10, 11 Balise ERTMS GSM-R Radio block Tool 2 Datagenerering Tool 1 Transmission chanels ERTMS. Level

13 CSM Where is the system? Push button Smoke detection C1 C4 C2 C3 C5 Colour on screen Gate opens Cause Hazard Consequence Risk Change is red dot SW failure - in green path, Gate is not opening Smoke poisoning => safety requirement: EN50128, SIL2

14 Difficult arguments The supplier sent two very competent guys. We where sitting all weekend together, fixing the bugs, testing the software, and now I am very confident that it works It is old software, the supplier say they can not fulfill EN50128 The changes are very small and does not concern the safety functions It is only data changes, the software has not been changed 5/7/

15 Approval & Specifying Independency Software requirements Tracability ISO9001 is basis Natural Language & Decision Tables 5/7/

16 Example from EN50128 om issue Test coverage Specification: The supplier is recommended to state test coverage Approval: The number gives confidence in approval the supplier knows what they are doing l 5/7/

17 Summary ISO9001 is basis Tracability Architecture Independency Validator Releases Natural Language & Decision Tables Configuration Management 5/7/

18 Final last words Var CSM_System: THandle; // Global variabel // This function decides whether Software in CSM-System is approved Function Software_Approved Boolean; Var Test_done, Proces_done: Boolean; Begin Result := False; If ((EN50128_followed = True) OR (Test_done = True AND Proces_done = True)) Then Begin If ISA_Report = SIL_Fulfilled Then Begin Result := True; end Else.To be done end; 5/7/

19 Q + A, Discussion 5/7/