What a SIL is, and what it is not

A safety integrity level (SIL) is a discrete level, from 1 to 4, that expresses the integrity required of a safety-related function. In railway standards it covers two things at once: a target for the rate of hazardous random failures of the function, and a corresponding set of measures to control systematic failures in its design, implementation and verification.

Three points cause frequent confusion:

  • SILs apply to functions. "A SIL 4 interlocking" is shorthand for an interlocking that implements SIL 4 functions. Components inherit requirements from the functions they implement.
  • SIL is not a reliability figure. A highly reliable system can still be unsafe, and a SIL says nothing about availability.
  • Functions with low safety relevance are handled through basic integrity rather than a SIL, the term that replaced "SIL 0" in the current CENELEC suite.

The railway approach: from risk to tolerable hazard rate

The CENELEC railway standards take a top-down approach. EN 50126-2 covers the systems approach to safety, including risk assessment and the specification of safety requirements, while EN 50129 covers the safety integrity of safety-related electronic systems, chiefly for signalling. In outline:

  1. Identify hazards at the system level and the accidents they could lead to.
  2. Set the risk acceptance principle. In European practice these are application of codes of practice, comparison with a similar reference system, or explicit risk estimation. Other regimes, such as the "so far as is reasonably practicable" duty in Australian rail safety law, frame acceptance differently, so align the method with the regulator.
  3. Derive a tolerable hazard rate (THR) for each hazard, accounting for the barriers and probability of the hazard leading to an accident.
  4. Apportion the THR to the functions and subsystems that contribute to the hazard, typically using a fault tree.
  5. Assign a SIL to each function from its apportioned rate, using the standard's table of tolerable rates.

The 2017 edition of EN 50126-2 frames the apportioned target as a tolerable functional failure rate (TFFR) for each safety function, and many projects still use the older THR terminology. The bands themselves are well established:

SIL Tolerable rate of hazardous failure, per hour per function
SIL 4 10−9 ≤ rate < 10−8
SIL 3 10−8 ≤ rate < 10−7
SIL 2 10−7 ≤ rate < 10−6
SIL 1 10−6 ≤ rate < 10−5

Check the edition. Use the table, terminology and conditions in the edition of EN 50126-2 and EN 50129 your contract specifies. The table is a mapping for apportioned targets, not a substitute for the risk analysis that produces them.

Risk graphs and LOPA

Engineers arriving from process or machinery sectors often reach for the methods they know from IEC 61508 and IEC 61511:

  • Risk graph: a qualitative decision tree using parameters such as consequence, exposure, possibility of avoidance and demand rate to read off a SIL. It is fast and useful for screening, but calibration matters: a graph calibrated for a chemical plant does not transfer to a railway without justification.
  • Layer of protection analysis (LOPA): a semi-quantitative method that credits independent protection layers to find the risk reduction a safety function must provide. It is rigorous where layers are genuinely independent, and works well for some rail applications such as depots or fixed plant.

On main-line and metro signalling and train control, approval bodies generally expect to see SILs traced from hazard-level targets using the CENELEC approach. Risk graphs and LOPA can support that argument, for example in early screening, but they rarely replace it.

Common pitfalls

  • Assigning SILs by precedent. "It was SIL 4 on the last project" is not a derivation. Contexts, barriers and operating rules differ.
  • Double-counting barriers. Crediting the same protection in the THR derivation and again in apportionment inflates the allowable rate.
  • Ignoring common cause. Apportioning a target across redundant channels assumes independence; common cause failures can defeat it.
  • Forgetting systematic integrity. Meeting a numerical rate with hardware alone is not enough. Software and process measures for the SIL must be applied too, now under EN 50716 for railway software.
  • No feedback loop. When the design changes, re-check whether apportionments and SILs still hold, and update the hazard log.

Making it auditable

Record the SIL derivation as its own deliverable: the hazards considered, the risk acceptance principle, the THR derivation, the apportionment model, the resulting SILs, and every assumption. Link each SIL to the safety requirements it creates and to the hazard log entries it controls. An assessor should be able to follow any SIL back to the risk it addresses without asking the author.

Need help with this on a live project? Our railway RAMS and system safety team does this work every day.

Start a conversation

FURTHER READING

Standards are summarised here for guidance. Always work from the edition and national adoption named in your contract.