Functional Safety in Railway

A tolerable hazard rate is the rate at which a hazardous state may occur such that, after the credited barriers do their statistical work, the resulting harm stays inside the risk acceptance criteria. It belongs to the hazard. Because engineers build functions rather than hazards, the target changes hands: EN 50129 uses the tolerable functional unsafe failure rate, the TFFR, as the per-function target. Where a single function guards the hazard the handover is direct; where several independent functions can each cause it, the THR is apportioned into slices that sum to it, and that apportionment is only legitimate if the independence, including independence from common systematic faults, is justified. The SIL is then a lookup from the resulting TFFR band, and it buys both a rate target and a package of measures against systematic faults.

Because the physics permits it. A train follows the track and cannot evade, so route-conflict hazards are largely controlled by preventing or holding movement, and a century of engineering made the restrictive reaction the one the construction falls into: the closed-circuit principle, gravity return in signalling relays, and the automatic continuous brake that applies when pipe pressure drops. It does not always hold. A train stopped in a long tunnel with a fire aboard, on a viaduct, or across a level crossing can be in a worse place than one still moving. The safe state is therefore a defined term per function and per operating context, recorded with the hazard analysis, and where a residual risk remains the operating rules carry part of the argument.

The guide argues that the divergence is economic and mathematical rather than cultural. Formal proof pays when the specification can be completed, the behavior is discrete, the volume is low and the change rate is slow. An interlocking is all four: safety logic over a finite track topology, with site configuration data that is a finite discrete structure with exact required properties, which is why formally validated interlocking data is routine industrial practice. A perception and driver assistance stack is the opposite on all four counts, so testing and process carry more of the weight there. Neither choice is a failure of nerve; each culture optimized honestly for its own problem shape.

Fifteen chapters: the physics that shaped the discipline; the CENELEC and EU legal rulebook; risk acceptance with ALARP, GAME, MEM and the CSM-RA routes; the derivation from hazard to THR, TFFR and SIL; the EN 50126 RAMS lifecycle and hazard log; fail-safe construction; the quantitative hardware argument and the vital computing architectures; EN 50716 software with technique tables, roles and tool classes; EN 50159 safe communication; interlocking, train detection, headway and ETCS; the six-part safety case and the assessment and authorization chain; and three comparison chapters on risk models, metrics and mechanisms, and process and ecosystem, closing with one worked function traced end to end plus a reference card and glossary.