Multi-domain comparison of safety standards Philippe Baufreton, Jean-Paul Blanquart, J. Boulanger, H Delseny, J. Derrien, J. Gassino, G Ladier, E Ledinot, M Leeman, P Quéré, et al. To cite this version: Philippe Baufreton, Jean-Paul Blanquart, J. Boulanger, H Delseny, J. Derrien, et al.. Multi-domain comparison of safety standards. ERTS2 2010, Embedded Real Time Software & Systems, May 2010, Toulouse, France. hal-02264379 HAL Id: hal-02264379 https://hal.archives-ouvertes.fr/hal-02264379 Submitted on 7 Aug 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Multi-domain comparison of safety standards P. Baufreton1, JP. Blanquart2, JL. Boulanger3, H. Delseny4, JC. Derrien1, J. Gassino5, G. Ladier4, E. Ledinot6, M. Leeman7, P. Quéré8, B. Ricque1 1: Sagem Défense Sécurité, 180 Avenue de Paris, 91300 Massy, France 2: Astrium Satellites, 31 rue des cosmonautes, 31402 Toulouse Cedex 04, France 3: CERTIFER, 1 place de Boussu, 59416 Anzin, France 4: Airbus, 316 route de Bayonne, 31060 Toulouse Cedex 09, France 5: Institut de Radioprotection et de Sûreté Nucléaire (IRSN), BP 17, 92262 Fontenay-Aux-Roses, France 6: Dassault Aviation, 78 quai Marcel Dassault, 92552 Saint-Cloud Cedex, France 7: Valeo, 2 Avenue Fernand Pouillon, 94042 Créteil, France 8: Renault, 1 avenue du Golf, 78288 Guyancourt, France Abstract: This paper presents an analysis of safety It elaborates proposals, recommendations, standards and their implementation in certification roadmaps etc. based on collaborative work and strategies from different domains such as discussions in dedicated thematic working groups. aeronautics, automation, automotive, nuclear, A team of about 20 experts and contributors to this railway and space. This work, performed in the activity has been working for one year. They have context of the CG2E (“Club des Grandes Entreprises the opportunity to share their expertise within a de l’Embarqué”), aims at identifying the main transversal approach between the companies similarities and dissimilarities, for potential cross- involved in this working group. domain harmonization. We strive to find the most Our meeting discussions led us to initiate the comprehensive ‘trans-sectorial’ approach, within a elaboration of a common terminology to address all large number of industrial domains. Exhibiting the these topics. ‘true goals’ of their numerous applicable standards, Dedicated seminars helped us perform deep related to the safety of system and software, is a first analyses of the main system and software important step towards harmonization, sharing standards, used in 6 industrial domains (civil common approaches, methods and tools whenever aviation, automotive, space, automation and possible. industrial control, nuclear plants, railway). Keywords: standards, safety, cross-domain This constitutes the basis for a comparative analysis comparison, software, certification and synthesis of the relevant standards for these major industrial domains, taking care of both 1. Introduction, Objectives technological and economical factors, without losing the main focus on safety. CG2E (“Club des Grandes Entreprises de l’Embarqué”) is an initiative launched (mid 2007) by This paper presents a summary of the main topics major industrial companies involved in the that are addressed in more details in a deliverable of development of critical embedded systems in a wide our working group, currently under preparation. spectrum of application domains. Today this organization comprises more than twenty large, 2. History and positioning of standards medium and small innovative companies, covering This section presents a brief overview of the history six important industrial fields that will be referred to and positioning of the analysed standards. We first in this paper. present the generic multi-domain IEC 61508 Several technical working groups have been standard and the more specific standards derived launched in 2008, one of them addressing from it, applicable mainly in automation, railway and “standards & norms”, mainly related to the safety of automotive domains. Then we present the situation critical embedded systems and software. After a in three other domains which for various reasons use wide state of the art survey performed in 2009, standards not directly related to the IEC 61508: comparing the various standards and practices in nuclear, aeronautics and space. many different industrial fields, several areas were identified including “dependability and certification”, 2.1. IEC 61508, automation, rail, automotive the object of this paper. In September 1985, the International The CG2E objectives are the leverage of the Electrotechnical Commission (IEC) set up a Task domain-specific best practices in the development of Group to assess the viability of developing a generic software intensive safety critical embedded systems. standard for Programmable Electronic Systems Page 1/10 (PESs). The outcome of which was the setting up of The project is currently in Draft International a working group to develop a system-based Standard (DIS) status. approach. A working group has previously been set Standards derived IEC61508 include standards for up to deal with safety-related software. Both working process industries, machinery (IEC 61511:2003, groups collaborated on the development on an 62061:2005), power drive systems, programmable international standard that was to become IEC controllers (IEC 61800:1997, 61131-6(CDV)), 61508. communication networks (61784-3:2007), explosive The original scope of PESs was extended to include atmospheres, detection, measurement, apparatus all types of electro-technical based technologies (EN 60079, 50271, 5042), medical devices (IEC (electrical, electronic and programmable electronic 60601:2005), railway (EN 50126, 50128, 50129) and systems (E/E/PE). Parts 1-7 of IEC 61508 were automotive (ISO/DIS 26262). published during the period 1998-2000. In 2005 IEC 2.2. Nuclear domain Technical Report 61508-0 was published. A review process initiated in 2002 to update and improve the The IAEA (International Atomic Energy Agency) was standard will be completed with the publication of created in 1957 within the United Nations to promote IEC 61508 Edition 2 targeted by March / April 2010. and support the safe use of nuclear technology for The standard came up to meet the demand for peaceful applications, and has currently 151 Member moving from a prescriptive approach to a States. performance-based approach. The intention of the In particular, its Safety Guide [IAEA NS-G-1.3] workgroup was to produce a base standard, i.e. provides general guidance on “Instrumentation and according to IEC rules a standard to be used only to Control (I&C) Systems Important to Safety in Nuclear write other standards. However, the reality today is Power Plants”. This guide addresses the that IEC 61508 is directly used by industries. Sector classification, safety requirements, and design of specific standards have been derived from IEC these systems. 61508, the closest one being IEC 61511 for process [IAEA NS-G-1.3] was published in 2002; it combines industries as most of the IEC61508 workgroup were and revises earlier guides published in 1980 (50-SG- coming from this sector. This resulted also in D3: Protection System and related features) and standard application conflicts between industry 1984 (50-SG-D8: Safety-Related Instrumentation sectors having already operational standards with a and Control Systems). holistic approach to systems. This is mainly the case with aeronautics. The paternity of IEC61508 over This chronology shows that the Protection System some standards is subject to controversy as some was regarded as the most important one and was “sector-specific” standards (e.g. IEC61513 nuclear addressed first in 1980, followed by the other sector) were issued earlier and developed a very systems important to safety in 1984. The revision different safety approach. and combination of these guides into NS-G-1.3 was motivated in particular by the need to take into Concerning the automotive domain, in the 90’s, account the evolution in computer-based systems because of the increasing number and complexity of and to include guidance on the classification of the safety critical systems embedded in a car, it has systems. been felt that a common reference to define the state of the art was needed in order to avoid liability According to an agreement with IAEA, the Technical issues. Some carmakers and suppliers started to Committee 45 of IEC (International Electrotechnical use the IEC 61508. Although the IEC 61508 Commission) developed standards to implement framework is considered very useful, many IAEA safety principles in technical details. difficulties were experienced using this standard The approach of the following IEC-TC45 standards coming from process automation industry. Therefore, to design and verify computer-based systems has it was quickly felt in the community that a strongly been tailored since the 1980’s to meet the needs of adapted variant of IEC61508 was needed.