Toward an Application Guide for Safety Integrity Level Allocation in Railway Systems

Abstract

The work in the article presents the development of an application guide based on feedback and comments stemming from various railway actors on their practices of SIL allocation to railway safety-related functions. The initial generic methodology for SIL allocation has been updated to be applied to railway rolling stock safety-related functions in order to solve the SIL concept application issues. Various actors dealing with railway SIL allocation problems are the intended target of the methodology; its principles will be summarized in this article with a focus on modifications and precisions made in order to establish a practical guide for railway safety authorities. The methodology is based on the flowchart formalism used in CSM (common safety method) European regulation. It starts with the use of quantitative safety requirements, particularly tolerable hazard rates (THR). THR apportioning rules are applied. On the one hand, the rules are related to classical logical combinations of safety-related functions preventing hazard occurrence. On the other hand, to take into account technical conditions (last safety weak link, functional dependencies, technological complexity, etc.), specific rules implicitly used in existing practices are defined for readjusting some THR values. SIL allocation process based on apportioned and validated THR values is finally illustrated through the example of "emergency brake" subsystems. Some specific SIL allocation rules are also defined and illustrated.

Risk Assessment in the Design of Railroad Control Command and Signaling Devices Using Fuzzy Sets

“…Recently, more and more attention has been paid to risk and safety assessment [14][15][16]. In rail transport, there are many documents that talk about the need to analyze and monitor risk; documents explaining the legal requirements, in particular, in terms of Regulation 402/2013 on the Common Risk Assessment Methodology [17][18][19]; and articles demonstrating the application of the FMEA method [20][21][22] or bowtie method [23] and showing the allocation of safety integrity levels [24,25]. But these documents do not specify the procedure and do not define the methods that should be used to analyze a given risk.…”

Engineering-Based Design Methodology for Embedding Ethics in Autonomous Robots

“…Generally, such standards are developed to provide a generic method of identification, classification, mitigation of hazards, and guide contingency protocols (e.g., safety case). Embedded within these standards are a number of risk assessment methods that aim to either amalgamate two or more dimensions of risk into a single index measure of risk (e.g., risk matrices and safety integrity levels [56]), or specify the consequences of a given event (e.g., fault tree analysis and failure mode and effects analysis). Certainly, many of these standards are applicable and valuable to the mitigation of any vulnerability generated in the design process.…”

Combining Task-level and System-level Scheduling Modes for Mixed Criticality Systems

“…High criticality tasks behavior: Each individual HC task starts at mode LO and can change its mode independently from the rest of tasks. By default, on the release of a new period the HC task runs LO mode and whenever C l overrun 2 The system pattern is then updated accordingly, P = Shrinking. 3 P = Regular.…”

“…Whenever the system scheduling mode is back to Normal and the current stretched periods expire, the stretching is interrupted and the LC tasks can then execute regularly. To amortize the slack time created by stretching, the scheduler applies a shrinking to LC task periods 2 . The shrinking pace depends on the system workload and the LC task periods length.…”

“…Examples are safety control systems in avionics [27] and automotive applications [1]. Mixed criticality systems are subjected to certifications dictated by the standards of different application areas, where different criticality levels require different assurance levels [2]. The consequences of missing a deadline vary in severity from task to task, according to the given criticality levels.…”