Functional Safety in Railway

No, and the guide devotes a section to why the equals sign fails. A railway SIL is allocated to a safety-related function against a quantitative integrity target, a tolerable functional unsafe failure rate expressed per operating hour. An ASIL is assigned to a safety goal associated with a hazardous event, derived from severity, exposure and controllability, and it scales development rigor without attaching a probability target to the hazard. The two labels therefore classify different objects, arrive by different derivations, and are backed by different evidence packages. What is genuinely comparable is the idea of grading rigor with consequence, and the fact that both domains express rate targets in events per hour. Reuse across the aisle is legitimate, but it means re-arguing the evidence against the receiving objectives, not presenting a certificate.

EN 50126 carries the RAMS process and the twelve-phase lifecycle, telling you when a hazard analysis, an apportionment or a validation happens. EN 50129 is the safety-acceptance standard for safety-related electronic signalling systems: it defines the six-part safety case structure, technical safety evidence, random hardware fault control and the THR, TFFR and SIL framework. EN 50716:2023 is the railway software standard, merging the earlier EN 50128 for control and protection software with EN 50657 for rolling stock software. EN 50159 governs safety-related communication over transmission systems that are not themselves trusted. EN 50155 covers electronic equipment on rolling stock and is deliberately not a functional safety standard: it says the box survives the environment, not that its function is safe.

A tolerable hazard rate is the rate at which a hazardous state may occur such that, after the credited barriers do their statistical work, the resulting harm stays inside the risk acceptance criteria. It belongs to the hazard. Because engineers build functions rather than hazards, the target changes hands: EN 50129 uses the tolerable functional unsafe failure rate, the TFFR, as the per-function target. Where a single function guards the hazard the handover is direct; where several independent functions can each cause it, the THR is apportioned into slices that sum to it, and that apportionment is only legitimate if the independence, including independence from common systematic faults, is justified. The SIL is then a lookup from the resulting TFFR band, and it buys both a rate target and a package of measures against systematic faults.

Because the physics permits it. A train follows the track and cannot evade, so route-conflict hazards are largely controlled by preventing or holding movement, and a century of engineering made the restrictive reaction the one the construction falls into: the closed-circuit principle, gravity return in signalling relays, and the automatic continuous brake that applies when pipe pressure drops. It does not always hold. A train stopped in a long tunnel with a fire aboard, on a viaduct, or across a level crossing can be in a worse place than one still moving. The safe state is therefore a defined term per function and per operating context, recorded with the hazard analysis, and where a residual risk remains the operating rules carry part of the argument.

The guide argues that the divergence is economic and mathematical rather than cultural. Formal proof pays when the specification can be completed, the behavior is discrete, the volume is low and the change rate is slow. An interlocking is all four: safety logic over a finite track topology, with site configuration data that is a finite discrete structure with exact required properties, which is why formally validated interlocking data is routine industrial practice. A perception and driver assistance stack is the opposite on all four counts, so testing and process carry more of the weight there. Neither choice is a failure of nerve; each culture optimized honestly for its own problem shape.

Fifteen chapters: the physics that shaped the discipline; the CENELEC and EU legal rulebook; risk acceptance with ALARP, GAME, MEM and the CSM-RA routes; the derivation from hazard to THR, TFFR and SIL; the EN 50126 RAMS lifecycle and hazard log; fail-safe construction; the quantitative hardware argument and the vital computing architectures; EN 50716 software with technique tables, roles and tool classes; EN 50159 safe communication; interlocking, train detection, headway and ETCS; the six-part safety case and the assessment and authorization chain; and three comparison chapters on risk models, metrics and mechanisms, and process and ecosystem, closing with one worked function traced end to end plus a reference card and glossary.