DEUTA Technology for ETCS Baseline 3

As part of ETCS Baseline 3, the Subset-091 defines the European-wide uniform standardisation of the ETCS application, whereby for the first time the safe display and input of information is prerequisite for the compliance with ergonomic and safety-oriented specifications.

This means for the producers of Driver Machine Interfaces (DMI) for ETCS vehicles that their terminals must comply with a Safety Integrity Level of at least SIL 2 on the basis of a tolerable hazard rate of 7.4* 10-4. Railway vehicles and train protection producers justifiably expect SIL 3 from DMI producers already now in order to comply with the higher safety requirements in future.

For the safe entry and display of data one has to consider the following:

• Errors and obsolescences in modern complex computer cores, caches, graphic units, etc. need to be mastered.
  
  
• Errors have to be assessed in operating systems as well as complex software checked and documented with great expenditure. Changes make elaborate verifications and impact analyses necessary.
  
  
• The position of the touch input must be safely acquired and diagnosed. If not all error states can be diagnosed and a higher safety level is required, the acquisition of the position needs to occur redundantly.
  
  
• The project-specific assessment expenditure (time and money) should be kept as low as possible.
  
  
• The safely imaged representation at the input position is required. It has to be assured that the representation is appropriate for the triggered input function. For that reason, a safe display is always necessary for a safe input.
  
  
• Input safety for operating systems depends on the safety functions:
      o safe starting of an actuator which can generate a danger
      o safe stop / safe release
      o emergency stop function
  

A SIL 3 DMI of the latest generation does not generally cost more than a SIL1 terminal. For the macroeconomic assessment, not only the acquisition costs of the DMI but also the future security and the follow-up costs have to be considered. The safe IconTrustSelect module operates independently of the DMI.  Obsolescences in the DMI have no effect on the SIL certification. As a result, the lifecycle costs remain low.

DEUTA Trust Terminals offer you the following advantages:

• generic certification up to SIL 3
• safe input and output
• software and hardware from a single source
• integrated Trust technology
• cost-efficient validation
• easy assessment of application changes
• many successful project references with component and system expertise