SIL Determination
Railway safety integrity levels from the Tolerable Hazard Rate (EN 50126 / EN 50129)
In the CENELEC railway standards a safety integrity level is assigned to a safety-related function based on its Tolerable Hazard Rate (THR) – the hazard rate per hour and per function that is still acceptable after risk analysis. Enter the THR to see which SIL band it falls into.
Safety integrity level
-
THR → SIL bands
| SIL | THR per hour and per function |
|---|---|
| SIL 4 | 10⁻⁹ ≤ THR < 10⁻⁸ |
| SIL 3 | 10⁻⁸ ≤ THR < 10⁻⁷ |
| SIL 2 | 10⁻⁷ ≤ THR < 10⁻⁶ |
| SIL 1 | 10⁻⁶ ≤ THR < 10⁻⁵ |
Bands as used in EN 50126 / EN 50129 for railway signalling. A THR below 10⁻⁹/h lies outside the table; a THR of 10⁻⁵/h or more does not require a SIL.
Convert between MTTF, failure rate and FIT (assuming a constant failure rate, λ = 1/MTTF) and compare the result with the SIL bands. A THR counts only failures that lead to the hazard, so the total failure rate of a component is a conservative upper bound. SIL 3/4 targets are normally reached through architecture (redundancy, diagnostics), not by a single component.
Failure rate λ
FIT
MTTF
Expected failures per year
SIL band if λ were the THR
The normative lists of techniques and measures, with their recommendation level for each SIL, are given in the annexes of EN 50128 (software) and EN 50129 (safety-related electronic systems), within the lifecycle defined by EN 50126. The overview below shows typical examples only – always check the edition of the standard that applies to your project.
All SILs – process foundation
- Hazard analysis and hazard log
- Failure modes and effects analysis (FMEA) and fault tree analysis (FTA)
- Traceability of safety requirements
- Configuration and change management
- Planned and documented verification and validation
- Safety Case as evidence for approval
SIL 1–2 – typical emphasis
- Structured design and a modular approach
- Coding standard and static analysis
- Functional (black-box) and interface testing
- Fault detection and on-line diagnostics
SIL 3–4 – additional rigour
- Formal or semi-formal specification and design methods
- Defensive programming
- Structural coverage testing
- Fail-safe hardware architecture (composite, reactive or inherent fail-safety), e.g. 2oo2 or 2oo3 voting
- Greater independence of verification, validation and assessment