EN5028-标准培训文档幻灯片.ppt

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,*,EN50128 2011 Seminar Summary,Yao Jun,Feb.27,2012,1,EN50128 2011 Seminar,北京英华经纶交通运输有限公司（劳氏北京）于2012年2月9日在北京举办了EN50128新版标准研讨会，会议由 Professor Ali Hessami 讲解（欧标修订工作组WG11主席，负责EN50128:2011的修订)。Ali Hessami教授介绍了系统安全保障的基本概念，并从标准制定者的角度介绍了新版的EN50128，同时还谈到了EN50126系列标准的整合和未来。,下面的ppt文档是基于本次研讨会的总结，也加入了个人的理解，并把我的提问和回答也都列出。如果有不正确的或者遗漏的地方，请及时指出，谢谢！,2,Main Differences between EN50128 2011 and EN50128 2001,Main differences in New EN50128 are the following contents:,Organization and role,Personnel competence,Support tools,Application data or algorithms,Deployment and maintenance,3,Organization and Role,Organization,role and independence requirements(section 5.1),Add the role of RQM(requirement manager),INT(Integritor)and TST(Tester),Add the description of these roles,The independent requirements for roles are clearly explained.,Example:,4,Person competence,Personnel competencies are added in Annex B of EN50128 2011.An example is shown:,5,Support Tools(1/2),Support Tools and Languages(Section 6.7),Provide evidence that potential failures of tools do not adversely affect the integrated toolset output in a safety related manner.,Classification,Three classes of tools so far as reliability and safety impact is concerned as T1,T2 and T3.,Each class will place different requirements on the required assurance,6,Support Tools(2/2),T1 class(section 3.1.42),generates no outputs which can directly or indirectly contribute to the executable code(including data)of the software,Example,：,a text editor,configuration control tools.,T2 class(section 3.1.43),supports the test or verification of the design or executable code,where errors in the tool can fail to reveal defects but cannot directly create errors in the executable software.,Example,：,a test coverage measurement tool,and,a static analysis tool,T3 class(section 3.1.44),generates outputs which can directly or indirectly contribute to the executable code (including data)of the safety related system,Example,：,a source code compiler,A simple way to understand the three types of tools:T1-SIL0,T2-SIL1&2,T3-SIL3&4,7,Application Data or algorithms,This part is emphasized in the new EN50128.(section 8),“,The requirements for the development of application algorithms are the same as the development of generic software as described in Clauses 1-7 and 9.“emphasize the importance of this part.,Example,8,Software Deployment,Software deployment(section 9.1):,To ensure that the software performs as required,preserving the required software safety integrity level and dependability when it is deployed in the final environment of application.,Key,requiremnts,Follow ISO 90003 as a minimum,Define and maintain baseline(Example:using CC),Release Notes,Error Detection in Transport,Deployment Manual,9,Other Changes(1/6),SIL0 is not viewed as non-safety,which has safety impact below SIL1.Some requirements for SIL0 still needs to be achieved.,Example:,10,Other Changes(2/6),Predeveloped software and COTS software are uniformly named as Pre-exisitng software(7.3.4.7).,Example:,11,Other Changes(3/6),Overall Software Test is added to test the software requirements,Objective:,To,analyse,and test the integrated software and hardware to ensure compliance with the Software Requirements Specification.,Example:,12,Other Changes(4/6),Software module is modified as software component.,Example,13,Other Changes(5/6),SWSIL is changed as SIL,Example,14,Other Changes(6/6),Add software interface specification in the architecture design stage,Example:,15,New Trends in EN standards,EN50126-X will be published in 2014(estimated),EN50126-1 RAMS in Railways(EN50126:1999),EN50126-2 Tools and Methods(New),EN50126-3 SMS for Railways(Many parties do not agree),EN50126-4 Functional Safety of Electronic Systems(EN50129:2003),EN50126-5 Software for Railway Applications(EN50128:2011),16,Q&A(1/3),1.,1.Section 7.3.4.7,b)For all software safety integrity levels the pre-existing software shall be included in the validation process of the whole software.,Question:,What is the real meaning of this sentence?Actually all of the pre-existing(COTS)software is included in the system validation.Do we need to carefully validate the pre-existing software especially and independently before validating the whole software or system?,Answer(Ali,Hessami,):Yes.We shall do more than before about the pre-existing software.It is recommended that all of the functions of pre-existing software shall be checked.If the pre-existing software has passed the certification,only reviewing documents is enough.If the pre-exiting software does not have the certificate,all of the functions needs to be carefully tested before using.,17,Q&A(2/3),2.Diverse programming(D16),Diverse programming is a difficult method for implementation.If we can not assess the level of diversity,how could we claim that our own software diversity method is effective or not?For instance,we can implement two different methods in one computer or two different methods in two computers to achieve software diversity.Could you give us a suggestion which is better?,Answer(Ali,Hessami,):It depends on the problem you want to solve.If two different methods in one CPU can achieve the goal(Hardware unrelated problem),it is OK.Or else,two different methods in two CPUs are necessary(hardware related problem).,18,Q&A(3/3),3.SIL,Traceability,In developing safety critical software,the software with SIL4 could be traced by SIL4 and SIL0 software module.It is reasonable.But in some cases,the software with SIL0 may be traced by SIL4 software module.The reason is during implementing software,some software modules with SIL0 can not clearly isolated with SIL4 software modules.Therefore although the software requirement is SIL0,the implementing software module is SIL4.In principle,this scenario is not allowed but it indeed exists in the real software development.Could you tell us how to solve this problem?,Answer(Ali,Hessami):Usually,we need to reconsider the SIL of software components if later these software,components(Originally,SIL0)indicate that they can not be clearly isolated from SIL4 software components.,19,