This EN 50128 compliance case study focuses on how compliance with the standards was achieved in a practical project situation.
The approval process of interlocking systems mandates adherence to the CENELEC standards EN 50126-1, EN 50126-2, EN 50128 and EN 50129 across European countries. Known collectively as EN 5012x, they describe the life cycle process for safety relevant Guided Transport Systems (GTS). For connected systems, the EN 5012x series is often applied in combination with IEC 62443-4-1.
Like the automotive, medical device and process industries, the railway sector based their functional standard on the industry agnostic functional safety standard IEC 61508. The resulting EN 5012x series has become the dominant railway functional safety standard, and its requirements and processes are becoming increasingly familiar across the world. The international standards IEC 62278, IEC 62279, and IEC 62280 very largely mirror EN 50126, EN 50128 and EN 50129 respectively.
In today’s railway systems, trains are constantly provided with information regarding what route to take, when to move or stop, and the prevailing speed limit. Digital Axle Counters provide information on whether a track section is free or occupied, permitting safe, trouble-free, and efficient signalling operations. To ensure that they achieve the levels of safety demanded of such a critical application, they are required to adhere to the EN 5012x series of standards.
G.G.Tronics’ latest product is MSDAC-G39, a Multi Section Digital Axle Counter. A fail-safe, reliable and user-friendly 2 out of 3 architecture-based design, MSDAC-G39 is compliant with RDSO/SPN/176/2013 Ver 3.0 and meets the SIL4 integrity level defined by EN50129.
Since its foundation in 1991, G.G.Tronics India Pvt. Ltd (G.G.Tronics) has pursued its vision to be a leading solution provider of design, development, manufacturing, testing and commissioning to the Guided Transport Systems (GTS) sector. Now part of the M/s. Nippon Signal Co. Ltd. of Japan and situated in Bengaluru – India’s own “Silicon Valley” – G.G.Tronics products include ATOBS, an approaching train operated warning system for railway level crossings, and Digital Axle Counters (DAC). G.G.Tronics is ISO 9001:2015 certified and approved by the Indian Railways’ Research Designs and Standards Organisation (RDSO).
Since its foundation in 1991, G.G.Tronics India Pvt. Ltd (G.G.Tronics) has pursued its vision to be a leading solution provider of design, development, manufacturing, testing and commissioning to the Guided Transport Systems (GTS) sector. Now part of the M/s. Nippon Signal Co. Ltd. of Japan and situated in Bengaluru – India’s own “Silicon Valley” – G.G.Tronics products include ATOBS, an approaching train operated warning system for railway level crossings, and Digital Axle Counters (DAC). G.G.Tronics is ISO 9001:2015 certified and approved by the Indian Railways’ Research Designs and Standards Organisation (RDSO).
G.G.Tronics selected the LDRA tool suite to help them meet these demanding objectives, applying static and dynamic analysis to improve the source code quality, confirm correct functionality, and to demonstrate and maintain requirements traceability in accordance with EN 50128.
Most industries have their own terminology for technical concepts, and the railways are no exception. Two terms pertinent to the project are:
Safety is paramount in signalling systems, and axle counters have a key part to play. Axle counters monitor each track section for the presence of a train. When the first axle of a train is detected within a section, a vital output is dropped to confirm occupancy. When all axles of the train have left the section, the vital output is driven again.
This output normally drives a 1000 ohms relay which is used in an interlocking circuit to ensure that if the output is dropped then no signal can be made to further train movement in that track section. Although the axle counter vital output relay is not directly driving the signals, any failure of the axle counter to confirm the train presence in the track section may lead accidents, with potential loss of life. By ensuring that the absence of a signal prevents access to the section, the system is designed to be failsafe.
A digital axle counter is an embedded system comprising of both hardware and software, and the safety of the system must be assured for both. Software of appropriate quality to achieve that aim can be achieved by adhering to the processes and techniques recommended by the EN50128 standard.
EN 50129 discusses the derivation and assignment of SILs, which range from Basic Integrity (formerly 0) to 4, where 4 is the most demanding.
In brief, a SIL can be assigned to any safety-related system, sub-system or component performing a safety relevant function. The process starts with the identification of potential hazardous events. Then a Tolerable Hazard Rate (THR) is assigned for each hazardous event, expressed as a probability per unit of time and taking into account risk reduction measures.
Each hazard is then associated with a functional failure of a function or set of functions, and the THR used to derive a Tolerable Function Failure Rate (TFFR), from which a SIL can be assigned.
The detection of each axle depends purely on MSDAC-G39 hardware. Software safety functions include axle counting and comparing entry and exit counts to confirm that an entire train has left a section. A software failure here could result in an axle counter driving its vital output with a train still occupying the track section, potentially permitting another train to enter the same section with life threating consequences.
Because a bug in axle counter software has the potential to lead to a wrong-side failure of the system, it is therefore mandatory for it to meet Safety Integrity Level (SIL) 4.
Although the EN 5012x standards do not insist on the use of automated test tools, in practical terms it is the sensible route for anything other than a trivial application.
Mr. Rajganesh Marappan, Software Quality Manager of G.G.Tronics, takes up the story.
“We were of course aware that LDRA has many competitors in this market, but for us the choice was an easy one to make” said Rajganesh.
“From the outset, TUV approval was important to us. Seeking a similar level of assurance for unapproved tools represents a major overhead. LDRA tools are approved by TUV SUD and TUV SAAR for safety related development in accordance with EN 50128, right up to SIL 4.”
“Then came the evaluation phase. LDRA has a team of software verification and validation experts with strong knowledge of Functional Safety standards. Their support ensured a wonderful evaluation experience which underpinned our confidence in LDRA.”
“Finally, we wanted to invest in a tool that could accommodate the future. Our priority for MSDAC-G39 was for functional safety, but we will need to consider cybersecurity too. The TBmanager component of the LDRA tool suite is capable of concurrently tracing IEC 62443 and EN 50128 objectives to source code and test cases. And LDRA have successfully demonstrated that the tool suite is configurable to support multiple embedded environments”.
“Our decision was right” concluded Rajganesh. “The completeness of the LDRA tool suite and the skillset of the LDRA support team have helped us to achieve EN 50128 SIL 4 certification for our railway safety systems.”
The LDRA tool suite was used in accordance with EN 50128 objectives. Code quality was enhanced with static analysis, and the functionality of the source code proven by performing dynamic analysis in accordance with the standard. The TBmanager component helped to maintain both the software requirements themselves, and their traceability to low level functions.
There was a measurable improvement in the software code quality, as the table suggests.
| Initial Code Quality | Final Code Quality after using LDRA tools | |
| Testability | 90.5% | 100% |
| Maintainability | 84.75% | 100% |
| Clarity | 89% | 100% |
| Code Review Violations | 698 Violations (15 Mandatory, 438 Required, 245 Advisory) |
200 Violations (200 Advisory) |
The project was a successful experience for LDRA and G.G.Tronics alike. “We are proud of our involvement with G.G.Tronics who are innovating in India for India and the world” said Shinto Joseph (Director, South East Asia Operations, LDRA).“MSDAC-G39 has been RDSO approved and certified in accordance with EN 50128 SIL 4. We are very happy to see the world-class products being built in India. It is a great milestone in railway indigenization.”
Mark Pitchford has over 30 years’ experience in software development for engineering applications. He has worked on many significant industrial and commercial projects in development and management, both in the UK and internationally. Since 2001, he has worked with development teams looking to achieve compliant software development in safety and security critical environments, working with standards such as DO-178, IEC 61508, ISO 26262, IIRA and RAMI 4.0.
Mark earned his Bachelor of Science degree at Nottingham Trent University, and he became a Chartered Engineer over 35 years ago. He now works as Technical Specialist with LDRA Software Technology.
Email: info@ldra.com
EMEA: +44 (0)151 649 9300
USA: +1 (855) 855 5372
INDIA: +91 80 4080 8707