EN 50126 / EN 50128 / EN 50129 - Railway Applications RAMS 50129:B.3.2: Influences between items

Where simultaneous malfunction of items could be hazardous, independence between them is a mandatory precondition for safety against single random faults, for composite fail-safety (between the items performing the function) and reactive fail-safety (between the item and its checking function); rules or guidelines ensuring independence are fulfilled, effective for the whole life cycle, and the design minimises the consequences of a loss of independence from a systematic fault. Four types of influence are distinguished: physical internal (type A), functional internal (B), physical external (C) and functional external (D); functional influences via transmitted information need case-by-case measures. For SIL 3 and 4, type A is countered by primary independence between main items (galvanic insulation at reinforced-insulation distances per EN 50124-1 on boards, cables, transformers and opto-couplers with temperature limits; protection of internal interfaces by inherently fail-safe devices; protection against cross-talk by separate supply networks or low ground impedance, demonstrated separation distances, shielding) and by relaxed secondary independence between a main item and its checking item (basic insulation, no inherent properties required, voltage monitoring independent of the supply); type C by measures against EMI and ESD per EN 50121-4, climatic conditions, mechanical stress per EN 50125-1 and -3, chemical stress, non-permitted supply voltages disclosed by voltage monitoring that enforces a safe state, and external voltages at input and output ports. For SIL 1 and 2 the same provisions apply with stated exceptions.