11111111~ln1RIIIIIIIIIII PB96-109772 SAFETY OF HIGH SPEED GROUND TRANSPORTATION SYSTEMS: ANALYTICAL METHODOLOGY FOR SAFETY VALIDATION OF COMPUTER CONTROLLED SUBSYSTEMS. VOLUME 1. STATE-OF-THE-ART AND ASSESSMENT OF SAFETY VERIFICATION/VALIDATION METHODOLOGIES (u. S.) JOHN A. VOLPE NATIONAL TRANSPORTATION SYSTEMS CENTER CAMBRIDGE, MA SEP 95 Form Aptßroved REPORT DOCUMENTATION PAGE OMS No. 704-0180 Public reporting burden for this collection of information is estimated to average 1 hour per respose, includi~ the time for reviewing instructions( searchin? eXisti~ data sources, gathering and maintaining the data need, end comleting and reviewing the co lection 0 informa ion. Send comnts regarding this burden estimate or eny' other aspect of this collection of information, including suggestions for reding this burden, to Washi~ton He~rters Services. Directorate for Information O~~~t~~sA~~Ø~eports, 1215 JeffersonD~~vi~~H:H9~2r~1~~te 1 04, Arli"R~~~~X~ P89S-1097722. REPORT DATE . ,i.3. REPORT - TYPE AND. DATES COVERED 1111111111111111111111111111111 - . September 1995 Final April 1994 4. TITLE AND SUBTITLE 5. FUND I NG NUMBERS Safety of High Speed Ground T ransportat i on System: Analytical Methodlogy for Safety Validation of Comter Controlled Subsystem RR593/R50l9 Volll I: State-of-the-Art and Assessment of Safety Verification/Val idation Methodologies 6. AUTHOR(S) Jonathan F. Luedeke* 7. PERFORMING ORGANIZATION tIAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION Battelle REPORT NUMBER 505 King Avenue DOT-VNTSC-FR-95-8. I Columbus, OH 43201- 2693 9. SPONSORING/I~ONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR I NG/MO I TOR I NG U.S. Department of Transportation AGENCY REPORT NUMBER Federal Railroad Administration DOT/FR/ORD-95/l0.l Office of Research and Development Washington, DC 20590 1'. SUPPLEMENTARY NOTES U.S. Department of Transportation *under contract to: Research and Special Programs Administration Volpe National Transportation System Center Kendall Square, Cambridge, MA 02142 128. DISTRIBUTION/AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE This document is available to the pub lic through the National Technical Information Service, Springfield, VA 22161 13. ABSTRACT (Maximu 200 words) This report describes the developmnt of a methodology designed to assure that a sufficiently high level of safety is achieved and maintained in comter-based system which perform safety critical functions in high-speed rail or magnetic levitation transportation system. This report consists of two volums. Th is, the first presents a glossary of relevant comter technology terminology to assure consistency of use and unerstanding. A state-of-the-art review of safety verification and val idation processes worldwide is presented. Following the review, these processes are assessed relative to their degree of assured safety as well as their potential applicability to safety critical system in US rai i transport at i on system. The second volum bui lds upon the information develope in the first volum and describes a methodology which has been develope specifically for application to comter-controlled system used in railroad applications in the United States. 14. SUBJECT TERMS 15. NUMBER OF PAGES verification, val idation, software, hardware, methodlogy, safety, safety standards, high- 224 speed rai l, magnetic levitation, high-speed guided grou transportation system 16. PRICE CODE 17. SECURITY CLASSIFICATION 18. SECURITY CLASSIFICATION 19. SECURITY CLASSIFICATION 20. LIMITATION OF ABSTRACT OF REPORT OF THIS PAGE OF ABSTRACT Unclassified Unclassified Unclassified NSN 7540-01-280-5500 Stanaart: Form ?~!! (Rev. ~.:!!9¡ Prescribe by ANSI Std. 239-l8 298-102 LIST OF FIGURES Fieure Paee 3-1. US&S PRODUCT/SYSTEM SAFETY DESIGN PHIL030PHY . .. 3-12 3-2. HARMON'S ENGINEERING AND DEVELOPMENT CYCLE. .. .. 3-15 . LIST OF TABLES Table Paee 3-1. MAJOR SAFETY VERIFICA TION/V ALIDA TION ST ANDARDS/ GUIDELINES FOR COMPUTER-BASED SYSTEMS. .. 3-3 3-2. HARMON'S MAJOR PRODUCT DEVELOPMENT LIFE CYCLE PHASES The Federal Railroad Administration (FRA) is currently responsible for assuring the safety of cQnventional rail, high-speed rail and maglev systems deployed in this country. One of the I~A's primar concerns is the proper use of computer technology in the implementation of safeiy critical functio:1s in newer high-speed systems as well as in conventional rail systems. Existing federal regulations governing signallng and train control systems may need to be revised to adequately address the various issues associri~ °Ö with the utilization of this new technology. The Volpe National TransportaÜon Systems Center (Volpe Center) is assisting the FRA in identifying and addressing many of the pertinent safety issues. The primary interest in this overall program, conducted for the Volpe Center in support of the FRA, is the development of a methodology to assure that a sufficiently high level of safety is achieved and maintained in these computer-based systems. Adequate safety is necessary whether the systems are used in new applications or are used to replace or enhance existing signallng/train control equipment. - This document is the Final Report for the Base Task (or first of two major tasks) of the program relative to the development of this methodology. The report describes work performed and results obtained on three major activities or items of work. The first (i.e., Item AND1) involved the definition of terminology and acronyms relevant to the safety verification and ACTIVITIES. .. 3-161. INTRODUCTION validation of computer-controlled subsystems used in railroad and other fixed guideway applications including high-speed rail and maglev. The second (i.e., Item 2) involved a description of the state-of-tt~-ar in safety verification and validation methodologies and associated standards in computer-based systems worldwide. The third (i.e., Item 3) involved an assessment of the methodologies from the standp~int of their applicabilty and level of assured safety. Results of this work wil serve as a basis for the remaining task (i.e., Option Task) of this program in which a specific methodology wil be developed and recommended to the FRA. 1.1 BACKGROUND The evolution in the implementations of safety critical systems in the railroad industry from simple vital relays to more complex computer-based configurations has raised many issues among users as well as the FRA. Foremost among these issues is the need to assure similar or improved levels of safety to those currently provided by conventional fail-safe technology. This concern is heightened in newer high-speed rail and maglev systems which operate or are being designed to operate at considerably higher speeds and levels of automation than conventional rail systems. Computers are playing an increasing role in the safety critical functions in these newer ~ystems such as in train location determination, switch/route control (interlocking), control of braking/propulsion to ensure safe speed and headway, and communications among the trains, wayside and central elements. 1-1 end of development), it was necessar to investigate the ~ntire development life cycle of a systfm. As was observed during this study, there is a lack of common usage in the various methodologies and standards address~d relative to the terms "verification" and "validation" as well as "safety verification" and "safety validation." In many of the ~ethodologieslstandards reviewed, the terms verification and validation are used in a similar manner to that conveyed in the Institute of Electrical and Electronics Engineers (ffEF) document "Standard Glossary of Software Engineering Terminology," ffEE Std. 610.12- i 990. In that document, which pertains specifically to software, the terms verification and validation are defined as follows: . Verificaticn - The process of determining whether or not the products of a given phase of the (software) development life cycle fulfil the requirements established during the previous phase. Valiùation - The prCCC5& of evaluating (software) at the end of the software development process to ensure compliance with software requirements. It should be noted that the above definitions are not specifically directed to safety or safety requirements. Rather, they apply to software requir~ments in general. Many of the methodologies reviewed in this study use similar definitions when dealing with safety requirements for software, and also extend these definitions to address system and even hardware safety requirements. In these instances, the methodologies use terms such as safety verification, safety validation, system validation and even software and hardware verification and validation. Thus. many variations exist, and in order to determine the actual definition of one of these terms in a given methodology, it is necessar to understand the context in which it is used. In general. for purpose5 of this study. a safety validation is considered to be a process or set of activities performed on a system. software or hardware element to demonstrate compliance with safety reqi.irements. It typically is performed on a completed system or hardware or software element. A safety verification can be synonymous with safety validation, but it is considered in this program as an incremental confidence building activity or process performed following a given phase of system, software, or hardware development to determine compliance wit.h safety requirements established for that phase. Also, as a point of clarification, the phrase "safety V & V" is used