If a railway system is SIL 4, can we simply call it safe?
Not necessarily.
In railway engineering, SIL 4 is often treated as shorthand for “extremely safe.” But that interpretation misses an important distinction: Safety Integrity Level (SIL) describes the integrity requirements associated with a safety-related function—not the safety of an entire railway system in isolation.
A SIL 4 subsystem can be exceptionally well engineered and still be integrated into an overall system containing hazards, inadequate interfaces, operational weaknesses or poorly defined requirements.
That is why railway RAMS and safety assurance requires engineers to look beyond SIL.
What Does SIL Actually Mean?
In railway functional safety, SIL is associated with the capability of a safety-related function to achieve its specified safety performance under defined conditions.
The SIL concept is fundamentally concerned with risk reduction and dangerous failures. Higher SILs correspond to more demanding requirements for controlling the likelihood of dangerous failures of the relevant safety function.
However, SIL does not mean:
- The entire railway system is safe.
- Every hazard has been eliminated.
- The system has zero risk.
- The complete project automatically satisfies all safety requirements.
- The subsystem can be considered safe regardless of its application or interfaces.
Therefore, “SIL 4 railway” should be understood in its proper engineering context: SIL applies to specified safety functions or systems within a defined scope.
SIL vs Overall System Safety
Consider a CBTC system.
A particular train protection function may have stringent safety integrity requirements. But overall railway signalling safety also depends on factors such as:
- Trackside equipment and interfaces
- Onboard systems
- Train detection
- Communication networks
- Braking performance
- Human interaction
- Operational rules
- Maintenance
- Degraded modes
- Environmental conditions
- System integration
A highly reliable subsystem cannot compensate for an incorrectly defined safety requirement elsewhere in the system.
This is why SIL should be viewed as one part of a broader safety engineering process.
From Hazard to Safety Evidence
A simplified engineering chain looks like this:
Hazard → Risk → Safety Requirement → SIL/Safety Target → Implementation → Verification → Safety Evidence
For example, imagine a hypothetical signalling system where an incorrect movement authority could allow a train to enter an occupied section.
1. Hazard Identification
Engineers identify the hazardous event:
Incorrect movement authority permits unsafe train movement.
2. Risk Analysis
The team considers potential consequences, likelihood and existing controls. The resulting risk is then evaluated against the project's applicable risk acceptance approach.
3. Safety Requirement
A requirement may be established that the signalling function shall prevent an unsafe movement authority under defined operating conditions.
4. Safety Target / SIL
The required integrity or risk-reduction target is determined using the applicable safety methodology and system context.
5. Implementation
Engineers design appropriate hardware, software, architecture, diagnostics, interfaces and fail-safe behaviour.
6. Verification and Validation
They then demonstrate that requirements have been correctly implemented and that the resulting system behaves safely in its intended operational context.
7. Safety Evidence
The final safety argument is supported by evidence such as analyses, test results, verification records, configuration information and other assurance documentation.
The important point is that SIL appears within this chain; it does not replace the chain.
Why Architecture and Failure Modes Matter
SIL-related engineering cannot be separated from how a system actually fails.
Engineers need to understand:
- Dangerous and safe failure modes
- Failure detection and diagnostics
- Common-cause failures
- Independence
- Diversity
- Redundancy
- Fault tolerance
- Interfaces between safety-related functions
For example, adding redundant channels does not automatically make a system safer. If both channels can fail because of the same common-cause condition, apparent redundancy may provide considerably less protection than expected.
Similarly, a SIL-rated component can be incorrectly applied, configured or integrated.
Verification Is Not the Same as “It Works”
A system successfully passing functional tests does not automatically demonstrate that every safety claim has been justified.
Verification asks whether specified requirements have been correctly implemented.
Validation considers whether the resulting system satisfies its intended purpose and safety requirements in its operational context.
The broader railway safety assurance process then brings together the technical evidence and safety argument needed to demonstrate that identified risks have been appropriately controlled.
Common SIL Misconceptions
Some mistakes engineers should avoid include:
- Treating SIL 4 as a blanket safety certificate.
- Assuming higher SIL automatically means zero risk.
- Assigning SIL before properly understanding the hazard.
- Confusing component certification with system safety.
- Ignoring interfaces between subsystems.
- Treating redundancy as automatically fail-safe.
- Focusing only on random hardware failures while overlooking systematic failures.
- Treating verification as proof of overall system safety.
- Ignoring operational, maintenance and degraded-mode conditions.
What Railway Engineers Should Ask Before Saying “It Is Safe”
Before making that statement, ask:
- What specific hazard are we controlling?
- What is the identified risk and how was it estimated?
- What safety requirement addresses that risk?
- What safety target or integrity level applies, and why?
- Have all relevant interfaces and failure modes been analysed?
- What happens when the system enters a degraded or abnormal state?
- Have independence, diversity and common-cause failures been considered?
- What verification and validation evidence supports the safety claims?
- Is the safety argument supported by sufficient objective evidence?
- Does the evidence cover the complete operational context—not merely the subsystem?
SIL Is Important. But SIL Is Not the Whole Safety Story.
Modern railway engineering requires more than knowing what SIL 1, SIL 2, SIL 3 or SIL 4 railway means. Engineers need to understand the reasoning connecting hazards, risk, safety requirements, architecture, implementation, verification and safety evidence.
That is the foundation of effective railway RAMS engineering and safety assurance.
For professionals looking to develop this systems-level understanding, the Professional Certificate in Advanced Railway RAMS and Safety Assurance Engineering from Railway Academy provides a focused learning opportunity around practical RAMS methods, risk acceptance and safety assurance.
