The short answer
| Question | Answer |
|---|---|
| Is EN 50128 still valid? | Standards catalogues list EN 50128:2011+A1+A2 as withdrawn from 1 December 2023, the date from which EN 50716:2023 is valid. According to public presentations of EN 50716, the new standard is not retroactive. |
| Must software developed to EN 50128 be redone? | Generally no. It can remain acceptable under conditions. New developments and changes are what the new standard targets. |
| Who decides which standard applies to a project? | The customer, the independent assessor and the authority, based on the application clause. Have the decision written into the quality assurance plan. |
| Should you throw away your EN 50128 templates? | No. The main families of documents carry over into EN 50716. You need to update the references, the roles and the register of techniques. |
What changes, according to public presentations
| Topic | EN 50128:2011 | EN 50716:2023 |
|---|---|---|
| Scope | signalling, control and protection | signalling, control and protection, and rolling stock on-board software |
| Levels | SIL 0 to SIL 4 | basic integrity, then SIL 1 to SIL 4 |
| Link with the RAMS standards | EN 50126, EN 50129 | stronger alignment with EN 50126 and EN 50129 |
| Roles | detailed roles and allowed combinations | roles and responsibilities clarified and simplified |
| Methods | V cycle as the reference | explicit consideration of model-based development and iterative life cycles |
| Tools | classes T1, T2, T3 | tool classification and qualification kept |
The catalogue entry of EN 50716 describes its scope as the development of software for programmable electronic systems used in railway control, command and signalling and on board rolling stock. Electric traction power supply (fixed installations) stays outside, under EN 50562.
What does not change: the logic of EN 50128
Both standards share the same architecture. The integrity level comes from the system safety analysis (EN 50126, EN 50129), and it drives the organisation, the documents and the techniques.
| Part | What it requires | EN 50128 sections |
|---|---|---|
| Organisation | roles, independence, competence | §5.1, §5.2 |
| Life cycle | phases, documents, exit criteria | §5.3, §7.1 |
| Assurance | testing, verification, validation, assessment, quality assurance, changes, tools | §6.1 to §6.7 |
| Development | requirements, architecture and design, components, implementation, integration, overall test | §7.2 to §7.7 |
| Application data | preparation and verification | §8 |
| Operation | deployment, maintenance | §9.1, §9.2 |
Annex A of EN 50128 is the practical core. Table A.1 lists the life cycle documents, tables A.2 to A.11 rate the techniques per level (mandatory, highly recommended, recommended, no recommendation, not recommended), and tables A.12 to A.23 go into detail on some of them (coding standards, static analysis, coverage and so on).
The documents of a project, under either standard
| Family | Documents |
|---|---|
| Plans | SQAP (quality assurance, organisation, life cycle), SCMP (configuration management), verification plan (SVERP) and validation plan (SVALP), maintenance plan (SMP) |
| Choice of techniques | register of techniques per Annex A table, with the justification for every technique set aside |
| Specifications | software requirements (SRS) and overall test specification, architecture and integration test specification, component design and component test specification |
| Reports | verification report for each phase, test reports, validation report, release note |
| Tools | T1, T2, T3 classification and a confidence sheet for every T2 and T3 tool |
The habit that saves the most time: write the test specifications at the same time as the specifications they verify (SRS and overall test, architecture and integration, component and component test), not after the code.
What changes with the level
| Point | SIL 0 | SIL 1 and 2 | SIL 3 and 4 |
|---|---|---|---|
| Independent assessor | to be confirmed in §6.4 | yes | yes |
| Independence of the verifier | recommended | according to the combinations allowed in §5.1 | required with respect to the designer and the implementer |
| Validator's reporting line | to be set in the SQAP | to be justified | outside the project manager's reporting line |
| Highly recommended techniques | few | many | very many |
The Annex A tables often group SIL 1 and 2 on one side, SIL 3 and 4 on the other. If your software is SIL 1 or SIL 3, still check the exact column for your level.
Moving a project to EN 50716 without rewriting everything
- Have the applicable standard decided by the customer and the assessor, and record the decision in the SQAP.
- Keep the document structure: plans, register of techniques, specifications, reports.
- Update the references document by document with your copy of EN 50716. A "References" appendix at the end of each document, listing the sections cited and their subject, turns this into mechanical work.
- Rework the organisation with the roles of EN 50716 and check the combinations allowed for your level.
- Redo the register of techniques with the tables of EN 50716.
- If you develop with models or in iterations, describe it explicitly in the life cycle: this is one of the contributions of the new standard.
- If the project changes existing EN 50128 software, decide with the assessor which standard governs the change, and write it down.
The mistakes that cost most at assessment
- A combination of roles not allowed for the level.
- A validator reporting to the project manager at SIL 3 or 4.
- Highly recommended techniques set aside without justification.
- A register of techniques filled in at the end of the project.
- Overall tests written after the code.
- T3 tools without evidence of confidence, or a tool version change without impact analysis.
- A change after entry into service with no impact analysis and no reverification.
- The assessor involved too late.
Starting from a structured document set
The EN 50128 kit provides 20 Word templates in three sets (SIL 0, SIL 1 and 2, SIL 3 and 4), an Excel workbook of verification checklists with references to the standard, a traceability matrix preset for EN 50128 and a 13-page implementation guide with a chapter on the move to EN 50716. The templates refer to EN 50128:2011 + A1 + A2. The kit does not contain the text of the standards, so you still need your own copy, and it grants no certification. EN 50657 is not covered as such. The plan verification checklist (SIL 1 and 2) is free on the same page.
Sources
- CENELEC EN 50128:2011 and amendments A1, A2, Railway applications, Software for railway control and protection systems (sections cited, text not reproduced)
- CENELEC EN 50716:2023, Railway applications, Requirements for software development
- CENELEC EN 50657:2017, rolling stock on-board software
- CENELEC EN 50126 and EN 50129, RAMS and safety-related electronic systems
- Estonian Centre for Standardisation, EVS-EN 50716:2023 catalogue entry (scope, validity dates)
- Public presentations of EN 50716 by standards bodies and tool vendors (summary, to be checked against your copy)
- Sources read on 2026-10-27