anniversary issue 2015 - indian railway · gyandeep - anniversary issue ‘15 secondly, selecting...

8
Page 18 Gyandeep - Anniversary Issue 15 Development of Centre for Safety Critical Software for Signalling Applications - Initiative by IRISET/Secunderabad Shri.C.K.Prasad, Professor Telecom/IRISET 1.0 Introduction A safety-critical system is a system whose failure or malfunction may result in one (or more) of the following outcomes: death or serious injury to people loss or severe damage to equipment/property environmental harm Risks of this sort are usually managed with the methods and tools of safety engineering. A life-critical system is designed to lose less than one life per billion (10E9) hours of operation. Typical design methods include probabilistic risk assessment, a method that combines failure mode and effects analysis (FMEA) with fault tree analysis. Safety-critical systems are increasingly computer-based. 2.0 Reliability Regimes Several reliability regimes for safety-critical systems are used specific to application area Fail-operational systems continue to operate when their control systems fail. Examples of these include elevators, the gas thermostats in most home furnaces, and passively safe nuclear reactors. Fail- operational mode is sometimes unsafe. Nuclear weapons launch-on-loss-of- communications was rejected as a control system for the U.S. nuclear forces because it is fail-operational: a loss of communications would cause launch, so this mode of operation was considered too risky. Fail-safe systems become safe when they cannot operate. Railway signaling systems and sub-systems are design based on this principle. For example: Track circuits, Axle counters etc are fail-safe because if they fail, the signal to the corresponding route is put to ONthe most restrictive aspect. Many medical systems also fall into this category. For example, an infusion pump can fail, and as long as it alerts the nurse and ceases pumping, it will not threaten the loss of life because its safety interval is long enough to permit a human response. Famously, nuclear weapon systems that launch-on-command are fail-safe, because if the communications systems fail, launch cannot be commanded. Railway signaling is designed to be fail-safe. Fail-secure systems maintain maximum security when they cannot operate. For example, while fail-safe electronic doors unlock during power failures, fail-secure ones will lock, keeping an area secure. Fail-Passive systems continue to operate in the event of a system failure. An example includes an aircraft autopilot. In the event of a failure, the aircraft would remain in a controllable state and allow the pilot to take over and complete the journey and perform a safe landing. Fault-tolerant systems avoid service failure when faults are introduced to the system. An example may include Electronic Interlocking system in hot standby configuration with power supply and VDU all duplicated. The normal method to tolerate faults is to have several computers continually test the parts of a system, and switch on hot spares for failing subsystems. As long as faulty subsystems are replaced or repaired at normal maintenance intervals, these systems are considered safe. Interestingly, the PES(Programmable Electronics System)/computers, power supplies and control terminals used by operator must all be duplicated in these systems in some fashion. 3.0 Software engineering for safety-critical systems Software engineering for safety-critical systems is particularly difficult. There are three aspects which can be applied to aid the engineering software for life-critical systems. First is process engineering and management.

Upload: others

Post on 13-Mar-2020

3 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 18

Gyandeep - Anniversary Issue ‘15

Development of Centre for Safety Critical Softwarefor Signalling Applications- Initiative by IRISET/Secunderabad

Shri.C.K.Prasad, Professor Telecom/IRISET

1.0 IntroductionA safety-critical system is

a system whose failure ormalfunction may result inone (or more) of thefollowing outcomes:

• death or serious injury topeople• loss or severe damage to

equipment/property• environmental harm

Risks of this sort are usually managed withthe methods and tools of safety engineering. Alife-critical system is designed to lose less thanone life per billion (10E9) hours of operation.Typical design methods include probabilistic riskassessment, a method that combines failuremode and effects analysis (FMEA) with fault treeanalysis. Safety-critical systems are increasinglycomputer-based.

2.0 Reliability RegimesSeveral reliability regimes for safety-critical

systems are used specific to application area

• Fail-operational systems continue tooperate when their control systems fail.Examples of these include elevators, the gasthermostats in most home furnaces, andpassively safe nuclear reactors. Fail-operational mode is sometimes unsafe.Nuclear weapons launch-on-loss-of-communications was rejected as a controlsystem for the U.S. nuclear forces becauseit is fail-operational: a loss of communicationswould cause launch, so this mode ofoperation was considered too risky.

• Fail-safe systems become safe when theycannot operate. Railway signaling systemsand sub-systems are design based on thisprinciple. For example: Track circuits, Axlecounters etc are fail-safe because if they fail,the signal to the corresponding route is putto “ON” the most restrictive aspect. Manymedical systems also fall into this category.For example, an infusion pump can fail, and

as long as it alerts the nurse and ceasespumping, it will not threaten the loss of lifebecause its safety interval is long enough topermit a human response. Famously, nuclearweapon systems that launch-on-commandare fail-safe, because if the communicationssystems fail, launch cannot be commanded.Railway signaling is designed to be fail-safe.

• Fail-secure systems maintain maximumsecurity when they cannot operate. Forexample, while fail-safe electronic doorsunlock during power failures, fail-secureones will lock, keeping an area secure.

• Fail-Passive systems continue to operatein the event of a system failure. An exampleincludes an aircraft autopilot. In the event ofa failure, the aircraft would remain in acontrollable state and allow the pilot to takeover and complete the journey and performa safe landing.

• Fault-tolerant systems avoid service failurewhen faults are introduced to the system.An example may include Electron icInterlocking system in hot standbyconfiguration with power supply and VDU allduplicated. The normal method to toleratefaults is to have several computerscontinually test the parts of a system, andswitch on hot spares for failing subsystems.As long as faulty subsystems are replacedor repaired at normal maintenance intervals,these systems are considered safe.Interestingly, the PES(ProgrammableElectronics System)/computers, powersupplies and control terminals used byoperator must all be duplicated in thesesystems in some fashion.

3.0 Software engineering for safety-criticalsystems

Software engineering for safety-criticalsystems is particularly difficult. There are threeaspects which can be applied to aid theengineering software for life-critical systems. Firstis process engineering and management.

Page 2: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 19

Gyandeep - Anniversary Issue ‘15

Secondly, selecting the appropriate tools andenvironment for the system. This allows thesystem developer to effectively test the systemby emulation and observe its effectiveness.Thirdly, address any legal and regulatoryrequirements, such as General Rules, CENELEC/RDSO & CRS for Indian Rai lways, FAArequirements for aviation etc. By setting astandard for which a system is required to bedeveloped under, it forces the designers to stickto the requirements. The avionics industry hassucceeded in producing standard methods forproducing life-critical avionics software. Similarstandards exist for automotive (ISO 26262),Medical (IEC 62304) and nuclear (IEC 61513)industries. Rail Industry standards are based onCENELEC EN 50128 FOR . The standardapproach is to carefully code, inspect, document,test, verify and analyze the system. Anotherapproach is to certify a production system, acompiler, and then generate the system's codefrom specifications. Another approach usesformal methods to generate proofs that the codemeets requirements. All of these approachesimprove the software quality in safety-criticalsystems by testing or eliminating manual stepsin the development process, because peoplemake mistakes, and these mistakes are the mostcommon cause of potential life-threatening errors.

Safety Critical Systems in Rail TransportationRail Transportation systems use electronics for

subsystems previously controlled mechanically ormanually. As a result, rail systems deliver fargreater flexibility and are capable of real-timeadjustments for speed, route, and passengercomfort. While these new electronic control andmonitoring systems present many benefits toassure their safe operation, regulations mandatethat such systems comply with industry standardsfor hardware and software development and arethoroughly tested and documented.

In rail transportation, as more electronicsystems come into play, it becomes necessaryto do whatever is possible to assure correctoperation of these advanced systems.

Software used in safety-critical systems is, ofcourse, a key element in the correctness of thesystem's operation. Most commonly, this softwareconsists of an application running on top of anoperating system.

IEC 61508 Because it's critical that electronic systems

operate safely various government-sponsoredagencies and independent technical standardsorganizations have become involved in definingregulations for safety-critical systems. TheInternational Electro technical Commission (IEC),a worldwide organization for standardization,promotes international co-operation on allquestions concerning standardization in theelectrical and electronic fields. IEC- 61508, theinternational standard for electrical, electronic andprogrammable electronic safety-related systems,sets out the requirements for ensuring thatsystems are designed, implemented, operatedand maintained to provide the required safetyintegrity level (SIL).

In Europe, CENELEC—the EuropeanCommittee for Electro technical Standardization—governs European railway standards, and thesestandards are beginning to make their way intothe North American railway and public transportmarket as well. The CENELEC standards EN50126, EN 50128 and EN 50129 are typicallyapplied to define appropriate safety analysis forsuch systems:

EN 50126 deals with Reliability, Availability,Maintainability and Safety for the entire railwaysystem.

EN 50129 applies to safety-relatedelectronic control and protection systems.

EN 50128 applies to safety-related softwarefor railway control and protection systems.

IEC standards are applied at various "SafetyIntegrity Levels" (SIL), representing varyingdegrees of criticality based on the system's use.IEC EN 61508 outlines the toleration of aprobability for failure at each level with the mostcritical aspects of the system (i.e., SIL 4) havingthe least tolerance for failure. As detailed inFigure-2, the standard defines both a system'sPFD (Probability of Failure on Demand) and RRF(Risk Reduction Factor) for each SIL level. Theterm Probability of Failure on Demand (PFD)means the likelihood that the system will fail whenasked to perform a particular operation for whichit is designed. The Risk Reduction Factor (RRF)is the amount of risk that can be reduced byimplementing the corresponding SIL system.

Page 3: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 20

Gyandeep - Anniversary Issue ‘15

SIL PFD RRF

1 0.1-0.01 10-100

2 0.01-0.001 100-1000

3 0.001-0.0001 1000-10,000

4 0.0001-0.00001 10,000-100,000

Figure-2

PFD and RRF for SIL Levels

Common Regulatory ElementsAll international safety-critical software

standards incorporate common elements thatapply to all software systems, regardless of theirend application. While the different standardshave their own particular phraseology andindividual features, they all generally require thatsoftware is developed according to a well-documented plan, and that its operation isconsistent with the plan.

In particular, safety-critical software mustdemonstrate, through rigorous testing anddocumentation that it is well designed andoperates safely.

• Process: The process through which the soft-ware was designed, developed, and testedmust be fully described and shown to be con-sistent. This is broken down into several subcategories:

Planning - the objectives of the system arestated, along with the plan for achieving andverifying that these objectives have beenachieved.Requirements - the functional requirementsof the system are explicitly identified andcorrelated with the system capabilities.Design - the system design is specified,including hardware and software, with theoryof operation and other aspects of design thatenable examiners to understand how thesystem intends to achieve its objectives.Development - the development process,including the tools used, code reviews, testplan, documentation, and staff training.Verification - the process of assuring thatthe system performs in accordance with therequirements or specifications, and that itachieves its functional objectives. (Theproduct is built the right way)Validation – the process of assuring that

the right product is being built.Configuration management - control ofincremental revisions over time, enablingreproducibility of results and protectingagainst the introduction of faults that cannotbe backed out.Quality assurance - processes andprocedures that assure that the system hasbeen developed and produced in accordancewith its goals, and that it delivers thecapabilities it is intended to provide.Techniques and methodologies need todefined with mutual agreement between theproduct development organization andcertifiying agency to ensure the quality of theproduct.

Code refers to the source code produced bythe developers or development tool and it in-cludes all system and application source code,test code, scripts, and object code. This codeis to be reviewed as part of the regulatory com-pliance process, and must agree with the ac-tual code used in the system.Test includes specific tests performed to verifythe correct operation of the code, as well as itsability to achieve all design goals and systemrequirements. Testing includes Structural cov-erage analysis to insure that all program in-structions are tested. Finally, unit/white-box,integration/black-box, and final acceptancetesting generally are included.Results consist of complete results of all testscompiled into a unit and integration test report.Manufacturers of rail transportation systems

have development teams that are fully capableof generating the documentation required tocomply with these safety-critical standards, asrequired by applicable regulations and have doneso for years.

However, there are some aspects of this workthat developers would like to avoid or that posechallenges. As safety-critical systems evolve incomplexity and make use of more powerfulmicroprocessors, they increasingly employcommercial RTOS technology. The real-timeoperating system controls and manages theapplication software to maximize systemresources for a given processor.4.0 Software reliability

Software reliability is a special aspect ofreliability engineering. System reliability, bydefinition, includes all parts of the system,

Page 4: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 21

Gyandeep - Anniversary Issue ‘15

including hardware, software, supportinginfrastructure (including critical externalinterfaces), operators and procedures.Traditionally, reliability engineering focuses oncritical hardware parts of the system. Since thewidespread use of digital integrated circuittechnology, software has become an increasinglycritical part of most electronics and, hence, nearlyall present day systems.

There are significant differences, however, inhow software and hardware behave. Mosthardware unreliability is the result of a componentor material failure that results in the system notperforming its intended function. Repairing orreplacing the hardware component restores thesystem to its original operating state. However,software does not fail in the same sense thathardware fails. Instead, software unreliability isthe result of unanticipated results of softwareoperations. Even relatively small softwareprograms can have astronomically largecombinations of inputs and states that areinfeasible to exhaustively test. Restoring softwareto its original state only works until the samecombination of inputs and states results in thesame unintended result. Software reliabilityengineering must take this into account.

Despite this difference in the source of failurebetween software and hardware, several softwarereliability models based on statistics have beenproposed to quantify what we experience withsoftware: the longer software is run, the higherthe probability that it will eventually be used in anuntested manner and exhibit a latent defect thatresults in a failure.

As with hardware, software reliability dependson good requirements, design andimplementation. Software reliability engineeringrelies heavily on a disciplined softwareengineering process to anticipate and designagainst unintended consequences. There is moreoverlap between software quality engineering andsoftware reliability engineering than betweenhardware quality and reliability. A good softwaredevelopment plan is a key aspect of the softwarereliability program. The software developmentplan describes the design and coding standards,peer reviews, unit tests, conf igurationmanagement, software metrics and softwaremodels to be used during software development.

A common reliability metric is the number of

software faults, usually expressed as faults perthousand lines of code. This metric, along withsoftware execution time, is key to most softwarereliability models and estimates. The theory is thatthe software reliability increases as the numberof faults (or fault density) decreases or goesdown. Establishing a direct connection betweenfault density and mean-time-between-failure isdifficult, however, because of the way softwarefaults are distributed in the code, their severity,and the probability of the combination of inputsnecessary to encounter the fault. Nevertheless,fault density serves as a useful indicator for thereliability engineer. Other software metrics, suchas complexity, are also used. This metric remainscontroversial, since changes in softwaredevelopment and verification practices can havedramatic impact on overall defect rates.

Testing is even more important for softwarethan hardware. Even the best softwaredevelopment process results in some softwarefaults that are nearly undetectable until tested.As with hardware, software is tested at severallevels, starting with individual units, throughintegration and full-up system testing dependingon the Safety Integrity levels. Unlike hardware, itis inadvisable to skip levels of software testing.During all phases of testing, software faults arediscovered, corrected, and re-tested. Reliabilityestimates are updated based on the fault densityand other metrics. At a system level, mean-time-between-failure data can be collected and usedto estimate reliability. Unlike hardware, performingexactly the same test on exactly the samesoftware configuration does not provide increasedstatistical confidence. Instead, software reliabilityuses different metrics, such as code coverage.

Eventually, the software is integrated with thehardware in the top-level system, and softwarereliability is subsumed by system reliability. TheSoftware Engineering Institute's capabilitymaturity model is a common means of assessingthe overall software development process forreliability and quality purposes.

5.0 Initiation of Proposal to Signing of theConsultancy Agreement for setting up ofCentre for Safety Critical Software forSignaling Applications

IRISET proposed to set up a Centre for SafetyCritical Software for Signaling Applications whichshall provide advance training and a structuredpla tform for knowledge transfer of key

Page 5: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 22

Gyandeep - Anniversary Issue ‘15

technologies in various signaling systems onIndian Railways. The signaling system on therailways for the safety critical application hasundergone major transformation. The presenttechnology system and sub-systems are basedon mission critical hardware with embeddedsafety critical software specific to rail industry.

The Electronic Interlocking(EI) installations onIndian Railway are from multiple OEM’s, same isthe case with other software embedded signalingsystem like MSDAC, TPWS etc. The executivesoftware, application development software suiteand simulator software system are propriety ofthe OEM’s. In EI itself there are multiple OEMsystems from Ansaldo STS, Invensys RailSystems, GE transportation, AZD Praha, MedhaSystems, Siemens etc. installed on various ZonalRailways. Hence maintaining these systemsrequire training on complete suite of applicationdevelopment software, testing software, validationsoftware and simulator including version updatesto be procured, deployed, maintained andsupported during its life cycle.

The effective working of the centre requiresknowledge transfer, manpower training anddevelopment of competency in the softwaresystems and sub-systems. The OEM’s are waryof transferring the complete technology andtechnical knowledge of the software systems dueto Intellectual Property Rights (IPR’s) issues.

The safety critical centre proposed to be setup will bridge the gap which exists in the railwaysin terms of safety critical software knowledge,processes, competency etc, and will develop thehuman resource and make them competent tooperate and maintain these systems which willhelp in enhanced reliabil ity, availabil ity,maintainability and safety of the software basedsignaling systems. These systems have directbearing on line capacity, smooth running of trainservices and higher level of safety in trainoperations.

IRISET signed the Consultancy Agreementwith Indian Institute of Technology Kharagpurfor Setting of the Centre for Safety CriticalSoftware for Signalling Applications at IRISET,Secunderabad on 28th April 2015.6.0 Scope of Consultancy:6.1 The Consultancy covers the following as-

pects.a) Identify and document the qualifications and

training requirements of the Signalling &Telecommunication personnel to be postedat the Centre.

b) Work out detailed syllabus for impartingtraining in Software Engineering, ReliabilityEngineering, Safety Standards includingCENELEC, Software Testing, Verificationand Validation, Version Control, SafetyCases, etc.

c) Specification and Configuration of SafetyCritical Data Centre. This includesspecif ications for servers, hypervisor,operating system, rack, storage, securityinfrastructure, bandwidth, networkinghardware, work station etc.

d) Suggest Software Verification tools to beprocured and set up at the Centre.

7.0 Methodology and Roadmap- Jointlyagreed by IRISET & RDSO for development ofthe Centre for Safety Critical Software7.1 Scope of work

The broad scope of the work is as under:

7.1.1 Identify and document the qualificationsand training requirement of Signalling &Telecommunication personnel to beposted at Centre.

7.1.2 Work out detailed syllabus for impartingtraining in Software Engineering, Reliabil-ity Engineering, and Safety Standards in-cluding CENELEC, Software Testing, Veri-fication and Validation, Version Control.Safety cases etc.

7.1.3 Specification and Configuration of SafetyCritical Data Centre. Including specifica-tions for networking hardware, work sta-tion etc and execution of the work.

7.1.4 Software Application, Data preparation,Simulation, Verification, Validation andtesting tools to be procured and set up atthe Centre in consultation with RDSO,carrying out preparation of application datafor all kinds of modern electronic equip-ment for requirement of zonal railways,along with modifications in present work-ing installation using the tools as well asat manual level. The tools procured willbe utilised for fulfilling the training needsof S&T personnel.

7.1.5 Validation and Verification of ApplicationData at Lab level before issue for imple-mentation and verification by zonal rail-ways.

Page 6: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 23

Gyandeep - Anniversary Issue ‘15

7.1.6 Study in detail the relevant reliability issuesfor modern electronic equipment and pro-vide inputs to RDSO for identification ofsolution and impact on implementation.

7.1.7 Create, Maintain and update database ofall electronic equipment in complete de-tail, including failure position by coordinat-ing with zonal railways and carry out quar-terly analysis to find the trends and iden-tify relevant issues and propose solutionsin consultation with RDSO.

7.1.8 Roll out the network connectivity to allstakeholders, monitor, maintain and up-date the relevant items on network for useby all stakeholders.

8.0 Role of RDSO:8.1 IRISET in consultation with RDSO shall

finalise on the infrastructure to be devel-oped along with the software and hard-ware tools to be procured by IRISET.

8.2 RDSO shall collaborate with IRISET indeveloping the Centre for Safety CriticalSoftware and its operationalisation.

8.3 RDSO shall lay down the process, provideall necessary technical assistance andknowledge sharing to IRISET, who will beanalysing the defects/errors in the soft-ware based signalling systems/sub-sys-tems from various manufacturers installedin the field and providing necessary tech-nical inputs to the OEM/Signalling Vendor/Zonal Railways as the case may be. Thiswill be extremely useful in monitoring andenhancing the RAMS(Reliability Availabil-ity Maintainability & Safety) of the system/sub-system.

8.4 It is understood that RDSO is executing aproject on formalization of Interlockingrules and safety assessment in circuit de-sign for yard layouts. The system beingdeveloped by RDSO can be utilized on re-ciprocal basis by IRISET for training andimparting knowledge to the S&T person-nel from the Zonal Railways. The formalverification tool for modeling simulationand validation of interlocking requirementsbeing as envisaged in the RDSO proposalshall be made accessible over a networkinfrastructure so that it can be gainfully uti-lized by all the Zonal Railways and IRISET.

8.5 Development of new technology in Signal-ling and train control systems, its deploy-ment and absorption of technology is a

dynamic and continuous process andhence RDSO shall frame the methodol-ogy and extend its support for continuouslyaugmenting the requirement of the pro-posed software centre

9.0 Role of IRISET:9.1 IRISET will frame the necessary bid docu-

ments in consultation with RDSO andbased on the consultant’s report.

9.2 IRISET to carry out, Procurement of Tools,Training Material and training to staff forsoftware centre by OEMs, in collaborationwith RDSO, including development ofknowledge for design and verification ofApplication Data.

9.3 IRISET shall setup a software Verificationand Validation process with necessarytools and technology with multi-site licenceas part of the project for evaluation of Sig-nalling and Interlocking software in col-laboration with RDSO.

9.4 IRISET will execute the work for devel-opment of centre for Safety Critical Soft-ware in consultation with RDSO.

9.5 IRISET will train the design staff from thezonal railways in phased manner on vari-ous software driven systems / sub systemsdeployed / approved for deployment onthe railways to develop application logicand data preparation, however such timetill confidence level is generated in ZonalRailways, IRISET shall carry out prepara-tion of application data, modifications inapplication data and verification and vali-dation of the same, staff for same may bedeputed to IRISET by zonal railways forthis purpose.

9.6 IRISET will train the project executing or-ganization/field units in a phased manneron testing and verification of the applica-tion before installation and commission-ing of the Signalling system/sub-system.

9.7 IRISET wil l train the maintenanceOrganisation personals on testing & veri-fication of the application, fault identifica-tion, rectification and debugging of theapplication software pertaining to the Sig-nalling system/sub-system.

9.8 The software & simulation tools for devel-oping/modification of the application logicfor each of the systems/sub-systems ofvarious OEM/Vendors will be procured/acquired from the Zonal Railways, as the

Page 7: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 24

Gyandeep - Anniversary Issue ‘15

case may be, and installed in the applica-tion server at IRISET.

9.9 The centre will develop competency un-der guidance of RDSO in analyzing theerror logs of critical failures of Softwarebased Signalling and Train Control sys-tems installed over Indian Railways andsuggest remedial action by taking inputsfrom the Zonal Railways.

9.10 The infrastructure so developed at IRISETwill be provided over a private cloud ar-chitecture wherein all the simulation toolsand data preparation applications for in-terlocking and yard layout will be hostedand made accessible to the zonal head-quarters, RDSO and the field units over asecure network infrastructure.

9.11 The inventory of all the software applica-tions, simulation tools and verification andvalidation software will be maintained andmanaged at the data proposed data cen-tre. The activity like version control, soft-ware updates and other software mainte-nance activities will be managed from thecentre.

9.12 The software’s for applications logic forexisting systems / sub-systems and newsystems approved by RDSO will be hostedin IRISET and can be accessed by theZonal HQ’s over the MPLS VPN Networkin a secured environment.

10.0 Role of Zonal Railways:10.0 Identify and share the list of S&T

personnel’s for training on Software sys-tems.

10.1 Zonal Railway will provide the initial dataof all the software based signalling sys-tems to IRISET along with version of theexisting configuration and the yard / lay-out data version of the systems.

10.2 Provide a copy of the application data,Data preparation tool and simulator for thesystems installed/ in pipe-line to IRISET.

10.3 Provide copy of the relevant documenta-tion available with them.

11.0 Benefits:11.1 The project is oriented towards develop-

ment of competency in the area of Appli-cation software, Data preparation and test-ing by simulation of field functions forsafety critical signaling and train controlsystems by training and skilling the de-sign off ice team in the Zonall

Railways,Divisional units, as well as in theconstruction and project units. The designteam in the Headquarters will be trainedin the development of the applications pro-gram and data preparation for various Sig-nalling and Train Control systems and subsystems deployed and/or approved for de-ployment on Indian Railways. Prominentamong them are EI, MSDAC, SSDAC,AWS, TPWS, TCAS, ETCS etc.

11.2 The software centre will get involved rightfrom the beginning at the stage of typeapproval / cross acceptance of the sys-tem/technology for deployment on IndianRailways. IRISET will work with RDSO andOEM/vendor community to adopt the bestpractices to standardize the process ofdeveloping the application logic, datapreparation, verification, validation, test-ing and troubleshooting procedures.

11.3 The project will help in creating Subjectmatter experts (SME) in the zonal head-quarters for design, development & Veri-fication of application logic based on SIP,TOC etc for the software based systems& sub systems.

11.4 The center will aid in developing testing,verification and trouble-shooting capabil-ity with in the field units who will be di-rectly executing the work on ground andmaintaining the systems.

11.5 The application for the yard can be pre-tested by the simulation/data validationtool or compiler etc by the design/testingteam before it is deployed in the Interlock-ing system in the field ex: before loadingand burning in the EPROM.

12.0 Organisation & Human Resource12.1 It is envisaged that to keep pace with fast

growing developments in the fields of soft-ware engineering the selection criteria forS&T engineers to be posted at the pro-posed centre shall include minimummatching skill set of a Graduate Engineerwith Bachelor’s degree in Computer Sci-ence / Computer Engineering / SoftwareEngineering with domain knowledge ofSignalling. If needed some officers canalso be sponsored for M. Tech / Ph. D pro-grams in Computer Science / Engineer-ing / Software Engineering preferably withsome project on assessment and valida-tion of safety critical software.

Page 8: Anniversary Issue 2015 - Indian Railway · Gyandeep - Anniversary Issue ‘15 Secondly, selecting the appropriate tools and environment for the system. This allows the system developer

Page 25

Gyandeep - Anniversary Issue ‘15

12.2 It is proposed that the centre may beheaded by an officer in SAG who in turnshall be assisted by an officer in JAG/SGand team of 12JS/SS officers,12 SE/SSEand 2 JE(IT), out of this proposed strength4 officers (JS/SS) and 4 Supervisors shallbe allocated to RDSO/Lucknow on Per-manent basis for coordination, collabora-tion and adoption of new technologies andfurther dissemination of know-how fromRDSO to IRISET. A separate cadre willbe required to be created for supervisorsat IRISET/RDSO to maintain continuity infuture, the cadre posted in this categoryshall remain devoted permanently.

12.3 The tenure of officers selected and postedin this centre shall be minimum ten yearsdepending upon the requirement. Thereis need to protect the career growth andpromotion prospects of the officers postedin the centre. If need be by upgrading thepost itself.

14.0 Proposed stage-wise implementation:Stage 1:

i) Engaging consultants to provide acomprehensive approach and deliverablesas per the scope of work.

ii) Training of the identified S&T personnel onsafety standards for railway signaling.

iii) Creation of posts, identification of personneland their postings in IRISET and RDSO.

Stage 2:i) Setting up of a data centre with private cloud

platform connected to zonal and divisionalheadquarters over secure MPLS, VPNnetwork.

ii) Procurement of simulation tools andapplication/data preparation tool for EI,MSDAC, SSDAC, TPWS etc. from the OEMswhich shall be hosted over the private cloudplatform. (for the new systems for whichRDSO may consider for giving type approval/ cross acceptance the OEM shall offer thesimulation tool and application developmenttool in advance to the Centre for SafetyCritical Software and give a Crash courseto the concerned S&T personnel. This will

help to seamlessly integrate the newinterlocking / Train Control system with theexisting systems and streamline the adoptionof new technology /systems on the railways.

iii) Identification and nomination of S&Tpersonnel involved in design and executionof work connected with EI, MSDAC, SSDAC,TPWS etc.

iv) Training and Skill development of the designteam in zonal headquarters and theexecution team in the field as mentioned inthe SI no. 3 & 4.

v) Training of the IRISET faculty and instructorson the data centre technology, deploymentof application and simulation tools over theprivate cloud archi tecture, inventorymanagement and maintenance of software.

Stage 3:i) Training of the identified S&T personnel for

RDSO and Zonal Railways on softwareengineering practices, reliability engineering,software language like C / C++ and areasgiven by the consultant.

ii) Development and deployment of softwareverif ication and validation tool beingdeveloped by RDSO.

iii) Training of identified S&T personnel on thesoftware verification and validation tool.

iv) Post completion of stage 3 regular courseswill be held by IRISET.

v) As required by Zonal Railways, support forData Preparation shall be provided byIRISET.