Functional Safety for Rail and Transport Applications
Functional safety for rail is built on EN 50126-1/-2 (RAMS), EN 50128 (software), EN 50129 (safety-related electronic systems) and EN 50159 (communication). The exam tests whether you can allocate integrity, build a safety case and challenge claims of independence.
Core rules
- Safety requirements flow from a system THR; SIL 4 is 1E-9 to 1E-8 per hour, SIL 3 is 1E-8 to 1E-7, SIL 2 is 1E-7 to 1E-6, SIL 1 is 1E-6 to 1E-5.
- SIL applies to a function, not to a box; software SIL follows system SIL, and EN 50128 requires an independent assessor for SIL 3 and 4.
- Systematic failures need process measures: specification, verification, configuration control and competence, not just failure-rate arithmetic.
- Common cause failure must be analysed whenever redundancy supports a SIL claim; diversity and segregation only help if independence is evidenced.
- Under CSM RA (EU) 402/2013, changes are assessed using a risk acceptance principle, often GAME (globally at least equivalent).
Worked example
An ATP function needs THR 1E-8 per hour. The supplier proposes two channels, each with 1E-4 dangerous failures per hour, and beta 1%. Reasoning: the 1oo2 failure rate is approximately beta times lambda = 0.01 x 1E-4 = 1E-6 per hour, two orders above target; the squared term is negligible and the beta term dominates. The claim fails; options are a lower channel failure rate, three independent channels, or a different architecture with evidence of independence.
Traps
Quoting reliability (MTBF) as THR; calling a SIL 3 component a SIL 3 function without system analysis; ignoring tool qualification and coding standards; accepting redundancy without CCF and separation evidence; forgetting that the safety case must show both random and systematic integrity.