SIL 4 Computer-Based Interlocking — IEC 61508 / EN 50128¶

EXAMPLE · REFERENCE MODEL · model_sil/

A SIL 4 Computer-Based Interlocking (CBI) reference model for a mainline passenger railway station. The model spans system architecture, hardware decomposition, vital software components, deployment configuration, formal safety analysis under IEC 61508 / EN 50129 / EN 50128, and cybersecurity analysis under ISO/SAE 21434. It is the most demanding reference model in the repository, targeting the highest integrity level applicable to railway signalling.

Model scope¶

The model covers a single CBI at a two-platform station with a facing junction. The interlocking controls and supervises:

• Two home signals (one per direction)
• Two points machines (facing and trailing junction)
• Three track circuit sections (approach, Platform 1, Platform 2)
• One level crossing with automatically operated barriers

The CBI communicates with the signaller workstation over a management LAN, with trackside object controllers over an EN 50159 Category 2 field bus, and between its two processor channels over a dedicated cross-comparison Ethernet bus.

Standards applied:

• IEC 61508:2010 — Functional safety of E/E/PE systems; risk graph parameters for SIL determination
• EN 50129:2018 — Railway safety-related electronic systems; safety case structure
• EN 50128:2011+A1:2020 — Railway software; SIL 4 V-cycle, formal methods, diverse programming
• EN 50159:2010 — Railway safety communication; Category 2 (open transmission system, adversarial threat)
• ISO/SAE 21434:2021 — Cybersecurity engineering (CAL 3)
• NIS2 Directive (EU 2022/2555) — Critical infrastructure cybersecurity obligations

Architecture¶

InterlockingSystem (hardware PartDef)
└── InterlockingControlSoftware (software PartDef, isDeploymentPackage)
    │   ── vital partition (SIL 4, MPU-protected) ──────────────
    ├── VitalSoftwareBase (abstract, silLevel: 4)
    │   ├── RouteProcessor       ← route set/lock/release logic
    │   ├── ConflictChecker      ← formally-verified conflict matrix
    │   ├── PointsController     ← position command and detection
    │   ├── SignalController     ← aspect authority, 5-condition check
    │   └── SafetyCommLayer      ← EN 50159 Cat 2 framing
    │   ── non-vital partition ──────────────────────────────────
    └── DiagnosticMonitor        ← read-only health reporting

Deployed as: Deployment::Station1Interlocking
  ├── vitalProcessorA  ╲  2oo2D cross-comparison
  ├── vitalProcessorB  ╱  via VitalSafetyLink
  ├── objectController1  (home signals)
  ├── objectController2  (points + level crossing)
  ├── trackCircuit1/2/3
  └── softwareImage (7 SWC instances)

The 2oo2D architecture (two-out-of-two with diagnostics) means both processor channels independently compute every interlocking output. Any disagreement triggers an immediate fail-safe state — all signals to most-restrictive, all route locks preserved. This achieves the SIL 4 dangerous-failure-rate target of < 10⁻⁸ /h.

Hardware¶

Software components¶

Requirements¶

Safety (IEC 61508 / EN 50128)¶

Architecture and software process¶

Security¶

Safety analysis¶

HARA (IEC 61508 risk graph) identifies four hazardous events against three safety goals. The two highest-rated events use risk parameters Cd/Fb/Pb/W3, yielding a SIL 4 target.

Fault Trees demonstrate that the 2oo2D AND gate achieves the SIL 4 quantitative target:

FMEA tables cover 14 failure modes across the vital processor, safety communication subsystem, and trackside field equipment.

Security analysis¶

TARA-SIL-001 covers the operator workstation and field bus interfaces with 3 damage scenarios, 3 threat scenarios, 2 cybersecurity goals, and 3 security controls:

Test cases¶

Safety — SIL 4 interlocking (EN 50128)

Architecture and software process

Security

System integration

Running the validator¶

syscribe -m model_sil/ validate

The model produces 0 errors and 8 warnings, all advisory:

• W030 (x2) on damage scenarios with safety impact but no hazardRef, and W032 on a cybersecurity goal whose CAL is below what its critical-risk threats require (security co-analysis findings);
• W962 (x3) on damage scenarios that name no assets (ISO/SAE 21434 §15.3);
• W056 (x2) on the Station1Interlocking connection endpoints vitalProcessorA.vitalDataPort / vitalProcessorB.vitalDataPort, which do not resolve to a member port.