Safety Controls for Railway Signals

Safety controls for railway signaling systems

What is it about?

Development of a real-world project for safety-critical railway signaling systems (hardware and software) with EN 5012x requirements for SIL-4.

Hitex was commissioned to develop a safety controller for railway signaling systems in accordance with CENELEC EN 5012x for SIL 4. Before starting the hardware and software development, the project partners agreed on a concept phase at an early stage. The system certifier (TÜV) was also involved.
The controls are carried out via a secure industrial fieldbus and must meet approximately 150 system requirements, over 300 software requirements (architecture) as well as more than 500 test requirements (positive and negative tests).

The standard requires a 2oo2 (two out of two) system architecture, in which two microcontrollers are constantly monitoring each other.

Microcontroller selection

To fulfill the above mentioned requirements, we chose AURIX™ from Infineon as the microcontroller solution for this project. The AURIX™ TC3x and TC4x have been originally designed for the automotive industry. Including the customer's opinion, the microcontroller was chosen for its multilayer safety architecture, relevant certifications like ASIL-D and SIL-3, guaranteed availability until 2045 and production in the European Union. To achieve the necessary SIL-4 requirement, the TC3x and the TC4x were able to be used in the 2oo2 architecture due their shared technological basis: TriCore™

Challenges

The safety requirements and the chosen safety architecture entailed quite a few challenges. The higher the security integrity level (SIL), the stricter the necessary separation between integrator, tester, verifier and validator needs to be. This includes much higher documentation and testing expenses compared to a SIL-3 project, resulting in a greater development cost – both in time and workforce.

Recommendations

For development projects with a high SIL or ASIL level, we recommend:

- Involving certifiers as early as possible

- Testing and verifying during the development phase, not at the end

- Choosing a fitting HIL-testing system (e.g. miniHIL)

- Automating the tests with continuous integration

Additionally, do not underestimate the correct specification, requirement-management, process-oriented documentation as well as testing and verification.

Conclusion

Our customer story proves that the AURIX™ security architecture as well as a thought-out testing strategy are essential for the success of railway projects with high security standards. Throughout development, it is important to be aware of the project's scope and specification and to always keep the potential challenges in mind that arise with SIL 4 development.

Hitex assists customers throughout the entire process – from replacing the central microcontroller and porting the existing software system to providing verification documentation in accordance with CENELEC/SIL4. With our extensive experience in embedded systems, railway technology, control- and safety technology, safety engineering as well as verification/validation, Hitex is the perfect partner for your embedded development project.

Return to overview

More about AURIX™