Firmware patch to a SIL 4 ETCS onboard unit
A freight operator runs 78 locomotives equipped with an ETCS onboard unit at baseline 3 release 2. The supplier issues a patch that fixes a display bug but also changes the timing parameter in the odometry module. The change note classifies the patch as 'minor maintenance' under the supplier's internal procedure. Only 1 of the 14 software modules is touched, but that module is SIL 4 and the changed parameter shifts the brake intervention curve by about 15 m at 120 km/h. The supplier's safety case was valid for the previous release; no independent V&V has been performed on the patch, and the tool used to compile the module is not qualified to EN 50128. The operator wants to install the patch on all 78 locomotives within four weeks to meet a customer requirement. The safety manager asks you whether the change can be handled as a maintenance activity, what evidence is needed before fleet rollout, and who must be independent in the assessment. The operator's national safety authority has not been informed.
1. Can the patch be handled as 'minor maintenance'? Justify your classification.
Read the worked answer
No. 'Minor maintenance' is an internal label, not a safety classification. The relevant test is whether the change affects the safety function or its safety integrity. The patch touches a SIL 4 module and changes an odometry timing parameter, which shifts the brake intervention curve by 15 m at 120 km/h. That is a change to a safety-related parameter, so it requires an impact analysis under EN 50128 and, because the safety case is release-specific, an update of the safety case under EN 50129.
It is also a change to an interoperability constituent, so the CSM RA process applies and the change is likely to be significant unless justified by a risk assessment. The fact that only 1 of 14 modules is touched is irrelevant; the SIL 4 module is where the safety integrity resides. The supplier's classification should be rejected and the change managed as a safety change with independent assessment.
2. What evidence must exist before the patch is installed on all 78 locomotives?
Read the worked answer
Before fleet rollout I would require: a documented impact analysis and revised software requirements; verification of the changed module at unit and integration level, including boundary values of the timing parameter; evidence that the compiler or a verified output check compensates for the unqualified tool; target validation on a test train covering the brake curve at 120 km/h and the odometry failure modes; a safety case addendum demonstrating that the THR and SIL allocation still hold; an independent assessment of the change; and a controlled rollback and configuration management plan.
The operator should also notify the national safety authority and obtain any required authorisation before placing the change into service. A pilot installation on one locomotive with a defined observation period would be prudent, but it does not replace the independent assessment.
3. Who must be independent, and what independence criteria apply?
Read the worked answer
For a SIL 4 change, the verifier and validator must be independent of the developer, and EN 50128 requires an independent assessor for SIL 3 and 4 software. Independence means organisational and financial separation, no shared line management and no involvement in the design decisions being assessed; it is not enough for a colleague in the same team to sign. The independent assessor should review the impact analysis, the test evidence and the safety case addendum, and should have access to the supplier's change records.
The safety manager who proposes the four-week rollout cannot also be the assessor. If the supplier's own independent assessor is used, the operator's assessment body should confirm the scope and criteria; for a change of this safety significance, a second, operator-side assessment is proportionate.