Understanding SIL4: Why the highest Safety Integrity Level is critical for railway safety

Key takeaways

• SIL4 (Safety Integrity Level 4) is the highest of four safety classification levels (SIL1–SIL4) used to measure how reliably a safety function performs when it is needed.
• It originates from IEC 61508, the generic functional safety standard, and is implemented for the rail sector through the CENELEC EN 50126, EN 50128 and EN 50129 standards.
• SIL4 is required for the most safety-critical railway functions, such as train detection, interlocking logic, automatic train protection (ATP), ETCS, and CBTC train separation — functions whose failure could lead to collisions or derailments.
• A SIL4 system must achieve an extremely low tolerable failure rate, generally below one failure per million hours of operation for continuous-mode functions.
• SIL4 compliance is not optional: it is mandated by railway safety authorities and verified through an independent Safety Case, covering quality management, safety management and technical/functional safety evidence.

What is the SIL (Safety Integrity Level) standard?

The Safety Integrity Level is a measure of the required performance of a safety function — in practical terms, the probability that a safety-related function will fail to perform correctly when it is called upon. Safety Integrity Level is a measure of the required safety performance of a safety function — the probability that the function fails to perform correctly when demanded by the system.

The concept did not originate in the railway industry. The concept of Safety Integrity Level (SIL) is a direct result of the IEC 61508 standard, which is not specific to railways. To adapt this generic framework to the specific risks of rail transport, the European Committee for Electrotechnical Standardization (CENELEC) developed a dedicated set of standards: EN 50126 (the specification and demonstration of Reliability, Availability, Maintainability and Safety — RAMS), EN 50128 (software for railway control and protection systems), and EN 50129 (safety-related electronic systems for signalling), derived from IEC 61508 to meet the specific requirements of the railways.

SIL provides a structured, risk-based way to match the level of engineering rigour to the severity of consequences should a function fail — rather than treating every system as equally critical. Not all safety functions need the same reliability: a system that prevents a catastrophic failure carries different consequences than one controlling a low-risk function, so requiring identical engineering effort for both would be wasteful and impractical.

The four SIL levels, from SIL1 to SIL4

Railway safety functions are categorized into discrete levels, from the lowest to the highest. The SIL concept is a way of categorizing safety functions into five discrete levels: SIL0 to SIL4. As a practical illustration, safety-critical functions such as the emergency brake of a train or the logic of an interlocking system are typically associated with SIL3/4, while safety-related functions such as emergency announcement speakers or warning lamps at level crossings are typically associated with SIL1/2.

This classification spans a wide range of railway applications. SIL is a metric used to define the level of risk reduction offered by a safety system, classifying systems into four levels — SIL1, SIL2, SIL3 and SIL4 — with each level representing a different degree of required reliability for critical functions such as signalling, braking or train control.

Why SIL4 compliance matters: lessons from real incidents

The CENELEC railway safety framework was not developed in the abstract — it was shaped by real accidents caused by inadequate verification of safety-critical software and systems. In 1994, a software fault in the signalling system at Cowden, Kent, allowed conflicting movement authorities to be issued simultaneously to two trains on a single-line section, resulting in a head-on collision that killed five people; the investigation found that the software had not undergone the systematic testing needed to reveal the fault, and at the time no mandatory standard defined what "adequate" testing meant for railway safety systems. This accident, along with Ladbroke Grove in 1999 and similar incidents across Europe, accelerated the development and adoption of the CENELEC railway safety standards as a structured framework for quantifying and demonstrating safety.

This history explains why SIL4 compliance today is treated as a non-negotiable engineering and regulatory requirement rather than a best practice: it directly reduces the probability of catastrophic, life-threatening failures in train control and signalling.

How Alpha Innovations supports SIL4 requirements: the Jade 3 project with Infrabel and Alstom

SIL4 is not just a theoretical benchmark for Alpha Innovations — it is a concrete engineering requirement embedded in one of our flagship railway programmes: the manufacturing of Jade 3 track circuits for the Belgian rail network, in partnership with Infrabel (the Belgian rail infrastructure manager) and Alstom.

In 2024, Infrabel signed an €80 million, ten-year contract with Alstom for the supply of approximately 10,000 next-generation Jade 3 track circuits — the safety-critical sensors that detect the presence of a train on a given section of track. These devices work by injecting an electrical current into the rails: when a train's wheelset passes, it short-circuits the current, allowing the system to confirm track occupancy. This occupancy status directly determines whether a train movement can be authorised, making track circuits one of the most safety-sensitive components of the entire signalling chain.

Within this programme, Alpha Innovations acts as a manufacturing partner for Alstom, alongside Connect Group, producing Jade 3 equipment at industrial scale in Belgium — bringing back local production of strategic rail components that had previously been manufactured abroad. As with all train detection equipment integrated into the signalling chain, the Jade 3 cabinets are designed and built to meet SIL4, the highest safety integrity level for systems linked to passenger transport, in line with EN 50129.

Beyond core train detection, the Jade 3 architecture goes further by integrating a continuous monitoring system (UCC) that tracks the health of its modules in real time. Rather than simply confirming that the equipment is working, this monitoring layer is designed to detect early signs of ageing and anticipate a potential failure before it occurs — supporting predictive maintenance instead of purely reactive repairs. Combined with simplified cabling and remote diagnostics, this reduces both the risk of in-service failure and the long-term cost of ownership for the infrastructure manager.

For Infrabel, modernising track-circuit signalling is a direct lever for improving punctuality: signalling-related issues account for a measurable share of train delays on the Belgian network, and the rollout of more reliable, SIL4-rated Jade 3 equipment is expected to keep contributing to punctuality gains over the coming years. The contract also includes 20 years of maintenance, reflecting the long operational lifecycle expected of SIL4-certified railway equipment.

This partnership illustrates how Alpha Innovations translates SIL4 requirements into industrial reality: rigorous fail-safe design, redundant and continuously monitored architectures, and manufacturing processes audited against EN 50126/50128/50129 — delivered at scale, locally, for one of Europe's most demanding rail safety authorities.