EN 50128:2011

Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems

1.1 This European Standard specifies the process and technical requirements for the development of software for programmable electronic systems for use in railway control and protection applications. It is aimed at use in any area where there are safety implications. These systems can be implemented using dedicated microprocessors, programmable logic controllers, multiprocessor distributed systems, larger scale central processor systems or other architectures. 1.2 This European Standard is applicable exclusively to software and the interaction between software and the system of which it is part. 1.3 This European Standard is not relevant for software that has been identified as having no impact on safety, i.e. software of which failures cannot affect any identified safety functions. 1.4 This European Standard applies to all safety related software used in railway control and protection systems, including – application programming, – operating systems, – support tools, – firmware. Application programming comprises high level programming, low level programming and special purpose programming (for example: Programmable logic controller ladder logic). 1.5 This European Standard also addresses the use of pre-existing software and tools. Such software may be used, if the specific requirements in 7.3.4.7 and 6.5.4.16 on pre-existing software and for tools in 6.7 are fulfilled. 1.6 Software developed according to any version of this European Standard will be considered as compliant and not subject to the requirements on pre-existing software. 1.7 This European Standard considers that modern application design often makes use of generic software that is suitable as a basis for various applications. Such generic software is then configured by data, algorithms, or both, for producing the executable software for the application. The general Clauses 1 to 6 and 9 of this European Standard apply to generic software as well as for application data or algorithms. The specific Clause 7 applies only for generic software while Clause 8 provides the specific requirements for application data or algorithms. 1.8 This European Standard is not intended to address commercial issues. These should be addressed as an essential part of any contractual agreement. All the clauses of this European Standard will need careful consideration in any commercial situation. 1.9 This European Standard is not intended to be retrospective. It therefore applies primarily to new developments and only applies in its entirety to existing systems if these are subjected to major modifications. For minor changes, only 9.2 applies. The assessor has to analyse the evidences provided in the software documentation to confirm whether the determination of the nature and scope of software changes is adequate. However, application of this European Standard during upgrades and maintenance of existing software is highly recommended.

Bahnanwendungen - Telekommunikationstechnik, Signaltechnik und Datenverarbeitungssysteme - Software für Eisenbahnsteuerungs- und Überwachungssysteme

Applications ferroviaires - Systèmes de signalisation, de télécommunication et de traitement - Logiciels pour systèmes de commande et de protection ferroviaire

Železniške naprave - Komunikacijski, signalni in procesni sistemi - Programska oprema za železniške krmilne in zaščitne sisteme

Ta evropski standard določa procesne in tehnične zahteve za razvoj programske opreme programirljivih elektronskih sistemov za uporabo pri železniških krmilnih in zaščitnih aplikacijah. Namenjen je uporabi na vseh področjih glede varnosti. Ti sistemi so lahko izvedeni z namenskimi mikroprocesorji, programirljivimi logičnimi krmilniki, mikroprocesorsko porazdeljenimi sistemi, večjimi centralnimi procesorskimi sistemi ali drugimi arhitekturami. Ta evropski standard velja izključno za programsko opremo in interakcijo med programsko opremo in sistemom, katerega del je. Ta evropski standard ni pomemben za programsko opremo, ki ne učinkuje na varnost, tj. programsko opremo, katere odpovedi ne vplivajo na prepoznane varnostne funkcije. Ta evropski standard velja za vse programske opreme, povezane z varnostjo, ki se uporabljajo v železniških krmilnih in zaščitnih sistemih, vključno z/s – aplikacijskim programiranjem, - operacijskimi sistemi, - podpornim orodjem, - sistemskimi programi. Aplikacijsko programiranje zajema programiranje na visoki ravni, programiranje na nizki ravni in programiranje za posebne namene (na primer: programirljiv logični krmilnik z lestvično logiko). Ta evropski standard obravnava tudi uporabo predobstoječe programske opreme in orodij. Taka programska oprema se lahko uporabi, če so izpolnjene zahteve iz točk 7.3.4.7 in 6.5.4.16 za predobstoječo programsko opremo in iz točke 6.7 za orodja. Programska oprema, razvita v skladu s katero koli različico tega evropskega standarda, velja za skladno in zanjo ne veljajo zahteve za predobstoječo programsko opremo. Ta evropski standard upošteva, da se pri modernem načrtovanju aplikacij pogosto uporablja univerzalna programska oprema, ki je primerna kot osnova za različne aplikacije. Taka univerzalna programska oprema se nato konfigurira s podatki, algoritmi ali obojim, da nastane izvršljiva programska oprema za določeno aplikacijo. Splošne točke 1 do 6 in 9 tega evropskega standard veljajo za univerzalno programsko opremo in za aplikacijske podatke ali algoritme. Specifična točka 7 velja samo za univerzalno programsko opremo, medtem ko točka 8 podaja specifične zahteve za aplikacijske podatke ali algoritme. Ta evropski standard ne obravnava komercialnih vprašanj, ki naj se obravnavajo kot bistveni del kakršnega koli pogodbenega dogovora Vse točke tega evropskega standarda je treba skrbno upoštevati v vseh komercialnih situacijah. Ta evropski standard ni retrospektiven. Velja torej predvsem za nov razvoj in v celoti velja le za obstoječe sisteme, če pri njih pride do večjih sprememb. Pri manjših spremembah velja le točka 9.2. Ocenjevalec mora analizirati dokaze v dokumentaciji programske opreme, s katerimi potrdi, da je ugotavljanje narave in obsega sprememb programske opreme ustrezno. Uporaba tega evropskega standarda se kljub temu močno priporoča med nadgradnjami in vzdrževanjem obstoječe programske opreme.

General Information

• Status: Published
• Publication Date: 16-Jun-2011
• Withdrawal Date: 24-Apr-2017
• ICS: 35.240.60 - IT applications in transport
• ICS: 45.020 - Railway engineering in general
• ICS: 93.100 - Construction of railways
• Technical Committee: CLC/TC 9X - Electrical and electronic applications for railways
• Drafting Committee: CLC/SC 9XA - Communications, signalling and processing systems
• Parallel Committee: IEC/TC 9 - IEC_TC_9
• Current Stage: 6060 - Document made available - Publishing
• Start Date: 17-Jun-2011
• Completion Date: 17-Jun-2011
• Directive: 2001/16/EC - Directive 2001/16/EC of the European Parliament and of the Council of 19 March 2001 on the interoperability of the trans-European conventional rail system
• Directive: 2008/57/EC - Directive 2008/57/EC of the European Parliament and of the Council of 17 June 2008 on the interoperability of the rail system within the Community (Recast)
• Directive: 2016/797/EU - Directive (EU) 2016/797 of the European Parliament and of the Council of 11 May 2016 on the interoperability of the rail system within the European Union (Text with EEA relevance)
• Directive: 96/48/EC - Interoperability of the trans-European high-speed rail system
• Mandate: M/483 - Mandate for programming and standardisation addressed to the European standardisation bodies under directive 2008/57/EC in the field of the interoperability of the rail system within the European Union
• Ref Project: SIST EN 50128:2011 - Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems

Relations

• Replaces: EN 50128:2001 - Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems
• Effective Date: 28-Jan-2023
• Replaced By: EN 50716:2023 - Railway Applications - Requirements for software development
• Effective Date: 14-Mar-2023
• Replaced By: prEN 50126-5 - Railway applications - The Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) - Part 5: Functional Safety - Software
• Effective Date: 10-Jul-2012
• Amended By: EN 50128:2011/A2:2020 - Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems
• Effective Date: 22-Jan-2023
• Amended By: EN 50128:2011/A1:2020 - Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems
• Effective Date: 22-Jan-2023
• Corrected By: EN 50128:2011/AC:2014 - Railway applications - Communication, signalling and processing systems - Software for railway control and protection systems
• Effective Date: 28-Jan-2023

Standards Content (Sample)

SLOVENSKI STANDARD
01-september-2011
1DGRPHãþD
SIST EN 50128:2002
äHOH]QLãNHQDSUDYH.RPXQLNDFLMVNLVLJQDOQLLQSURFHVQLVLVWHPL3URJUDPVND
RSUHPD]DåHOH]QLãNHNUPLOQHLQ]DãþLWQHVLVWHPH
Railway applications - Communication, signalling and processing systems - Software for
railway control and protection systems
Bahnanwendungen - Telekommunikationstechnik, Signaltechnik und
Datenverarbeitungssysteme - Software für Eisenbahnsteuerungs- und
Überwachungssysteme
Applications ferroviaires - Systèmes de signalisation, de télécommunication et de
traitement - Logiciels pour systèmes de commande et de protection ferroviaire
Ta slovenski standard je istoveten z: EN 50128:2011
ICS:
35.240.60 Uporabniške rešitve IT v IT applications in transport
transportu in trgovini and trade
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD
EN 50128
NORME EUROPÉENNE
June 2011
EUROPÄISCHE NORM
ICS 35.240.60; 45.020; 93.100 Supersedes EN 50128:2001
English version
Railway applications -
Communication, signalling and processing systems -
Software for railway control and protection systems
Applications ferroviaires -  Bahnanwendungen -
Systèmes de signalisation, de Telekommunikationstechnik,
télécommunication et de traitement - Signaltechnik und
Logiciels pour systèmes de commande et Datenverarbeitungssysteme -
de protection ferroviaire Software für Eisenbahnsteuerungs- und
Überwachungssysteme
This European Standard was approved by CENELEC on 2011-04-25. CENELEC members are bound to
comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European
Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on
application to the Central Secretariat or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CENELEC member into its own language and
notified to the Central Secretariat has the same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia,
Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania,
Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom.

CENELEC
European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung

Management Centre: Avenue Marnix 17, B - 1000 Brussels

© 2011 CENELEC - All rights of exploitation in any form and by any means reserved worldwide for CENELEC members.
Ref. No. EN 50128:2011 E
Contents
Foreword . 6
Introduction . 7
1 Scope . 10
2 Normative references . 11
3 Terms, definitions and abbreviations . 11
3.1 Terms and definitions . 11
3.2 Abbreviations . 15
4 Objectives, conformance and software safety integrity levels . 16
5 Software management and organisation. 17
5.1 Organisation, roles and responsibilities . 17
5.2 Personnel competence . 20
5.3 Lifecycle issues and documentation . 21
6 Software assurance . 23
6.1 Software testing . 23
6.2 Software verification . 25
6.3 Software validation . 27
6.4 Software assessment . 28
6.5 Software quality assurance. 30
6.6 Modification and change control. 33
6.7 Support tools and languages . 34
7 Generic software development . 37
7.1 Lifecycle and documentation for generic software . 37
7.2 Software requirements . 37
7.3 Architecture and Design . 40
7.4 Component design . 46
7.5 Component implementation and testing . 49
7.6 Integration . 50
7.7 Overall Software Testing / Final Validation . 52
8 Development of application data or algorithms: systems configured by application data or
algorithms . 54

- 3 - EN 50128:2011
8.1 Objectives . 54
8.2 Input documents . 55
8.3 Output documents . 55
8.4 Requirements . 55
9 Software deployment and maintenance . 60
9.1 Software deployment . 60
9.2 Software maintenance . 62
Annex A (normative) Criteria for the Selection of Techniques and Measures . 65
A.1 Clauses tables . 66
A.2 Detailed tables . 73
Annex B (normative) Key software roles and responsibilities . 79
Annex C (informative) Documents Control Summary . 88
Annex D (informative) Bibliography of techniques . 90
D.1 Artificial Intelligence Fault Correction . 90
D.2 Analysable Programs . 90
D.3 Avalanche/Stress Testing . 91
D.4 Boundary Value Analysis . 91
D.5 Backward Recovery . 92
D.6 Cause Consequence Diagrams . 92
D.7 Checklists . 92
D.8 Control Flow Analysis. 93
D.9 Common Cause Failure Analysis . 93
D.10 Data Flow Analysis. 94
D.11 Data Flow Diagrams . 94
D.12 Data Recording and Analysis . 95
D.13 Decision Tables (Truth Tables). 95
D.14 Defensive Programming . 96
D.15 Coding Standards and Style Guide . 96
D.16 Diverse Programming . 97
D.17 Dynamic Reconfiguration . 98
D.18 Equivalence Classes and Input Partition Testing. 98
D.19 Error Detecting and Correcting Codes . 98
D.20 Error Guessing . 99
D.21 Error Seeding . 99
D.22 Event Tree Analysis . 99
D.23 Fagan Inspections. 100
D.24 Failure Assertion Programming . 100
D.25 SEEA – Software Error Effect Analysis . 100
D.26 Fault Detection and Diagnosis . 101
D.27 Finite State Machines/State Transition Diagrams . 102
D.28 Formal Methods . 102
D.29 Formal Proof . 108

D.30 Forward Recovery . 108
D.31 Graceful Degradation . 108
D.32 Impact Analysis . 109
D.33 Information Hiding / Encapsulation . 109
D.34 Interface Testing .
...

SLOVENSKI STANDARD
01-september-2011
Nadomešča:
SIST EN 50128:2002
Železniške naprave - Komunikacijski, signalni in procesni sistemi - Programska
oprema za železniške krmilne in zaščitne sisteme
Railway applications - Communication, signalling and processing systems - Software for
railway control and protection systems
Bahnanwendungen - Telekommunikationstechnik, Signaltechnik und
Datenverarbeitungssysteme - Software für Eisenbahnsteuerungs- und
Überwachungssysteme
Applications ferroviaires - Systèmes de signalisation, de télécommunication et de
traitement - Logiciels pour systèmes de commande et de protection ferroviaire
Ta slovenski standard je istoveten z: EN 50128:2011
ICS:
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

NORME EUROPÉENNE
EN 50128
EUROPÄISCHE NORM
Juin 2011
EUROPEAN STANDARD
ICS 35.240.60; 45.020; 93.100 Remplace EN 50128:2001

Version française
Applications ferroviaires -
Systèmes de signalisation, de télécommunication et de traitement -
Logiciels pour systèmes de commande et de protection ferroviaire

Bahnanwendungen -  Railway applications -
Telekommunikationstechnik, Communication, signalling and processing
Signaltechnik und systems -
Datenverarbeitungssysteme - Software for railway control and protection
Software für Eisenbahnsteuerungs- und systems
Überwachungssysteme
La présente Norme Européenne a été adoptée par le CENELEC le 2011-04-25. Les membres du CENELEC
sont tenus de se soumettre au Règlement Intérieur du CEN/CENELEC qui définit les conditions dans lesquelles
doit être attribué, sans modification, le statut de norme nationale à la Norme Européenne.

Les listes mises à jour et les références bibliographiques relatives à ces normes nationales peuvent être
obtenues auprès du Secrétariat Central ou auprès des membres du CENELEC.

La présente Norme Européenne existe en trois versions officielles (allemand, anglais, français). Une version
dans une autre langue faite par traduction sous la responsabilité d'un membre du CENELEC dans sa langue
nationale, et notifiée au Secrétariat Central, a le même statut que les versions officielles.

Les membres du CENELEC sont les comités électrotechniques nationaux des pays suivants: Allemagne,
Autriche, Belgique, Bulgarie, Chypre, Croatie, Danemark, Espagne, Estonie, Finlande, France, Grèce, Hongrie,
Irlande, Islande, Italie, Lettonie, Lituanie, Luxembourg, Malte, Norvège, Pays-Bas, Pologne, Portugal,
République Tchèque, Roumanie, Royaume-Uni, Slovaquie, Slovénie, Suède et Suisse.

CENELEC
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
European Committee for Electrotechnical Standardization

Management Centre: Avenue Marnix 17, B - 1000 Bruxelles

© 2011 CENELEC - Tous droits d'exploitation sous quelque forme et de quelque manière que ce soit réservés dans le monde entier aux
membres du CENELEC.
Ref. n° EN 50128:2011 F
Sommaire
Foreword . 5
Introduction . 7
1 Domaine d'application . 10
2 Références normatives. 11
3 Termes, définitions et abréviations . 11
3.1 Termes et définitions . 11
3.2 Abréviations . 15
4 Objectifs, conformité et niveaux d'intégrité de sécurité du logiciel . 16
5 Organisation et gestion du développement logiciel . 17
5.1 Organisation, rôles et responsabilités . 17
5.2 Compétence du personnel . 21
5.3 Questions relatives au cycle de vie et à la documentation . 21
6 Assurance du logiciel . 24
6.1 Test du logiciel . 24
6.2 Vérification du logiciel . 26
6.3 Validation du logiciel . 28
6.4 Évaluation du logiciel . 29
6.5 Assurance Qualité du Logiciel . 31
6.6 Contrôle des modifications et des évolutions . 34
6.7 Outils et langages . 35
7 Développement de logiciel générique . 39
7.1 Cycle de vie et documentation pour logiciel générique. 39
7.2 Exigences relatives au logiciel . 39
7.3 Architecture et Conception . 42
7.4 Conception du Composant . 48
7.5 Réalisation et Test des composants . 51
7.6 Intégration . 52
7.7 Tests d'Ensemble du Logiciel / Validation Finale . 54
8 Développement de données d'application ou d'algorithmes d'application : systèmes
configurés par des données d'application ou par des algorithmes d'application . 56
8.1 Objectifs . 56
8.2 Documents en entrée. 57

- 3 - EN 50128:2011
8.3 Documents en sortie. 57
8.4 Exigences . 57
9 Déploiement et maintenance du logiciel . 62
9.1 Déploiement du logiciel . 62
9.2 Maintenance du logiciel . 64
Annexe A (normative) Critères de sélection des techniques et mesures . 67
A.1 Tableaux d'articles . 68
A.2 Tableaux détaillés . 76
Annexe B (normative) Principaux rôles et responsabilités relatifs au logiciel . 82
Annexe C (informative) Résumé du contrôle des documents . 91
Annexe D (informative) Bibliographie des techniques . 93
D.1 Intelligence artificielle - Correction des défauts . 93
D.2 Programmes analysables . 93
D.3 Tests en avalanche/en surcharge . 94
D.4 Analyse des valeurs aux limites . 94
D.5 Rattrapage par régression . 95
D.6 Schémas de cause et de conséquence . 95
D.7 Listes de contrôle . 95
D.8 Analyse de Flux de Contrôle . 96
D.9 Analyse des défaillances de mode commun . 96
D.10 Analyse du flux de données . 97
D.11 Organigrammes des données . 97
D.12 Enregistrement et analyse des données. 98
D.13 Tables de décision (Tables de vérité) . 99
D.14 Programmation défensive . 99
D.15 Normes de codage et Guide de style. 100
D.16 Programmation diversifiée . 100
D.17 Reconfiguration dynamique . 101
D.18 Tests de classes d'équivalence et de partition d'entrée . 101
D.19 Codes de détection et de correction d'erreurs . 102
D.20 Supposition d'erreurs . 102
D.21 Insertion d'erreurs . 102
D.22 Analyse par arbre des événements . 103
D.23 Inspection de Fagan . 103
D.24 Programmation par assertion des défaillances . 103
D.25 AEEL – Analyse des Effets des Erreurs du Logiciel . 104
D.26 Détection des défauts et diagnostic . 105
D.27 Automates à états finis/Schémas de transitions d'état . 105
D.28 Méthodes formelles . 106
D.28.1 CSP - Processus Séquentiels de Communication . 107
D.28.2 CCS - Algèbre des Systèmes de Transmission . 107
D.28.3 HOL - Logique d'Ordre Supérieur . 107
D.28.4 LOTOS . 108
D.28.5 OBJ . 108
D.28.6 Logique temporelle . 109

D.28.7 VDM - Méthode de Développement de Vienne . 109
D.28.8 Méthode Z . 109
D.28.9 Méthode B .
...