DEUTA Technology for ETCS Baseline 3

As part of ETCS Baseline 3, the Subset-091 defines the European-wide uniform standardization of the ETCS application, whereby for the first time the safe display and input of information is prerequisite for compliance with ergonomic and safety-oriented specifications.

For the producers of Driver Machine Interfaces for ETCS vehicles this means that their terminals must comply with a Safety Integrity Level of at least SIL 2 on the basis of a Tolerable Hazard Rate of 7.4* 10-7. Railway vehicles and train protection producers justifiably expect SIL 3 from DMI producers already now in order to comply with higher safety requirements in future.

For the safe entry and display of data you have to consider the following:

• Errors and obsolescences in modern complex computer cores, caches, graphic units, etc. need to be mastered.
  
  
• Errors have to be assessed in operating systems and complex software and checked and documented with great expenditure. Changes make elaborate verifications and impact analyses necessary.
  
  
• The position of the touch input must be safely acquired: the input unit must be diagnosed. If not all error states can be diagnosed and a higher safety level is required, then position acquisition must occur redundantly.
  
  
• The project-specific expertise expenditure (time and money) should be kept as low as possible.
  
  
• The safely imaged representation at the input position is required. It has to be assured that the representation is appropriate for the triggered input function. For that reason, a safe display is always necessary for a safe input.
  
  
• Input safety for operating systems depends on the safety function:
      o safe starting of an actuator which can generate a danger
      o safe stop / safe release
      o emergency stop function
  

A SIL 3 DMI of the latest generation does not generally cost more than a SIL1 terminal. For the macroeconomic assessment, not only the acquisition costs of the DMI but also the future security and the follow-up costs must be considered. The safe IconTrustSelect module operates independently of the DMI.  Obsolescences in the DMI have no effect on the SIL expertise. As a result, the life cycle costs remain low.

DEUTA Trust terminals offer you the following advantages:

• generic certification up to SIL 3
• safe input and output
• software and hardware from a single source
• integrated Trust technology
• cost-efficient validation
• easy assessment of application changes
• many successful project references with component and system certification