Safety Integrity Level (SIL)
A Safety Integrity Level is a measure, from SIL 1 to SIL 4, of how reliably a safety function must perform to reduce risk to a tolerable level. In railways it is defined by the CENELEC standards EN 50126, 50128 and 50129, and signaling functions such as interlocking and train protection are typically required to meet SIL 4, the highest level.
How it works
The process starts with hazard analysis: identifying what could go wrong and how severe the consequences would be. Each safety function is assigned a tolerable hazard rate, expressed as dangerous failures per hour, and that rate maps to a SIL. SIL 4 corresponds to a tolerable hazard rate below one dangerous failure per hundred million hours of operation.
Achieving a SIL involves both the hardware, which must be designed with redundancy and diagnostics to meet the failure rate, and the software, which must be developed under the rigorous, documented process defined in EN 50128. The result is a safety case that an independent assessor reviews before the system is authorised for service. Any later change to hardware or software can require the case to be revisited.
Why it matters for security
SIL is the reason rail OT cannot be secured the way IT is. A SIL 4 interlocking or onboard unit cannot have an antivirus agent installed, cannot be patched on a monthly cycle and cannot be actively scanned without risking its certification and its safe behaviour. Security controls have to work around certified systems, not inside them.
SIL also addresses random and systematic failures, not deliberate attack. A system can be SIL 4 and still be trivially vulnerable to someone who sends it well-formed but malicious commands. This gap is what rail cybersecurity standards such as TS 50701 and IEC 63452 were created to fill, using security levels alongside safety integrity levels.
Related solution
Supporting compliance with TS 50701 / IEC 63452
Security that respects safety certification: non-intrusive monitoring of SIL-rated systems.
See the solution →
