.png)
Guide · Rail & Metro · Built in India
EN 50159 is the CENELEC standard for safety-related communication in railway transmission systems. Titled Railway applications, Communication, signalling and processing systems, Safety-related communication in transmission systems, it sets out how to keep end-to-end digital messages authentic, intact, timely and in sequence when the transmission medium was not necessarily designed for safety. It merges the earlier closed-system and open-system parts (EN 50159-1 and EN 50159-2) into one document. The current edition, EN 50159:2026, was approved by CENELEC on 15 June 2026 and supersedes EN 50159:2010 and its A1:2020 amendment: national adoption is due by 31 July 2027 and conflicting national standards must be withdrawn by 31 July 2029, so tenders may cite either edition until then.
The short answer
EN 50159 is prepared by CENELEC subcommittee CLC/SC 9XA, Communication, signalling and processing systems. It applies to safety-related electronic systems that use a transmission system for digital communication where that transmission system was not necessarily designed for safety-related applications. Both safety-related and non-safety-related equipment may share the network. The standard gives the communication-related requirements needed to achieve safety-related communication between safety-related equipment, while the general system requirements, allocation of safety integrity and the safety case structure sit in EN 50129. It does not specify the transmission technology, the connected equipment, interoperability solutions, or which data are safety-related. On cybersecurity it addresses intentional attacks by means of messages to safety-related applications and, for Category 3 systems, defines the interface to applicable cybersecurity standards such as CLC/TS 50701 and EN IEC 63452; it does not cover confidentiality of safety-related information or preventing overload of the transmission system as general IT-security topics.
Why it matters
Passenger announcement and information systems, IP CCTV and remote diagnostics often share Ethernet, Wi-Fi or other networks with many devices. When any of that traffic carries safety-related messages, or when onboard electronics sit beside a signalling or train-control link that does, EN 50159 is the standard that classifies the transmission system and requires defences against basic message errors. Networked PIS, CCTV or diagnostics units are not themselves signalling systems, and this guide does not claim they are certified to EN 50159. They commonly sit on Category 2 or Category 3 transmission systems when the path is open or not fully under the designer’s control. Whether EN 50159 applies is decided by the system safety process and the contract, so check the tender.
Key requirements
A summary of what safety-related communication specifications usually draw from EN 50159. Always check which edition, 2010+A1:2020 or 2026, and which transmission-system category your tender names.
EN 50159 classifies transmission systems so that the set of defences matches how much control the designer has. Category 1 is a closed system: the number of participants is known and fixed, the physical characteristics are fixed for the life of the system, and the risk of unauthorised access is negligible. Category 2 is an open system that is partly unknown or not fixed, but unauthorised access can still be excluded. Category 3 is an open system that is not under the designer’s control and where unauthorised access must be considered. Category 1 can use a reduced set of defences; Categories 2 and 3 need a more comprehensive set, and Category 3 also needs protection against unauthorised access that can corrupt message integrity, coordinated with cybersecurity standards.
The main hazard is failing to obtain a valid message at the receiving end in terms of authenticity, integrity, sequence and timeliness. Hazardous events can be accidental or deliberate, but they map to a short list of basic message errors: repetition, deletion, insertion, re-sequencing, corruption, delay and masquerade. Masquerade is particularly relevant on open systems. Each project still needs its own threat or hazard analysis; the standard’s lists are a guide, not a complete safety case.
Against those errors the standard expects fundamental safety services for message authenticity, integrity, timeliness and sequence, and a library of defences that includes sequence numbers, time stamps, time-outs, source and destination identifiers, feedback messages, identification procedures, safety codes and cryptographic techniques. Safety requirements are generally implemented in the safety-related equipment designed according to EN 50129; in some cases they may be implemented elsewhere in the transmission system if safety measures still meet the allocated integrity. Safety-related and non-safety-related messages that share a network must remain distinguishable, typically by applying a safety code so a non-safety message cannot be corrupted into a safety one.
According to its European foreword, EN 50159:2026 supersedes EN 50159:2010 and all amendments. It harmonises terminology with the cybersecurity domain, generalises coverage of mixed safety-integrity contexts, coordinates cybersecurity requirements for Category 3 transmission systems, adds guidance on separation between safety and cybersecurity, and adds guidance on change management for railway duty holders. Until conflicting national standards are withdrawn by 31 July 2029, programmes may still see the 2010+A1:2020 consolidated edition on tenders.
Related standards
EN 50159 supports the safety case defined in EN 50129: communication-related evidence of functional and technical safety sits beside the quality and safety management evidence taken from EN 50129. EN 50126-1 and EN 50126-2 define the RAMS process that identifies hazards and allocates safety integrity requirements to functions that may rely on communication. EN 50716 covers software for railway control and signalling applications, and EN 50129 points to EN 50159 for safety-related communication. EN 50155 covers electronic equipment on rolling stock, including environmental and power conditions for onboard devices that may use the transmission system. For Category 3 systems, EN 50159:2026 points to cybersecurity standards including CLC/TS 50701:2023 and EN IEC 63452 rather than trying to specify a full IT-security programme itself.
Building a safety case that includes signalling electronics? Read: What is EN 50129?
What is EN 50129? Signalling safety explained →Developing the software that runs with safety-related communication? Read: What is EN 50716?
What is EN 50716? Railway software explained →Checklist
Use these points when writing a specification or comparing suppliers. Ask for documented evidence for the exact product version, transmission category and application rather than relying on a datasheet statement.
Standard and edition: does the specification name EN 50159:2010+A1:2020 or EN 50159:2026, and how will the change of edition be handled before conflicting national standards are withdrawn by 31 July 2029?
Transmission category: is the network Category 1, 2 or 3, who controls it for the life of the system, and is unauthorised access excluded or must it be considered?
Safety services and defences: which defences address authenticity, integrity, timeliness and sequence, and how are safety codes or cryptographic techniques justified for the allocated integrity?
Shared networks: how are safety-related and non-safety-related messages distinguished so a non-safety frame cannot be accepted as a safety message?
Interfaces and allocation: which safety requirements sit in the EN 50129 equipment versus other parts of the transmission system, and who owns each defence?
Cybersecurity for Category 3: which requirements from CLC/TS 50701 or EN IEC 63452 cover intentional message-based attacks, and how is separation between safety and cybersecurity documented?
Evidence and sourcing: what communication-related evidence will appear in the safety case, and does your programme favour Built in India / Make in India manufacturing for the connected electronics?
Envision TechWorks
Envision TechWorks makes onboard and station electronics, including passenger information, IP CCTV, remote diagnostics and industrial control products, rather than signalling systems or safety-related communication stacks. Products are designed, manufactured and tested in an ISO 9001:2015 facility in India: production-ready and Built in India for Make in India programmes. PAPIS onboard passenger announcement and information hardware is built to EN 50155, and production includes in-circuit and functional test, AOI and X-ray inspection, and thermal cycling. Where your project needs displays, CCTV, diagnostics units or control panels that share a network with safety-related traffic, share the interface requirements and the evidence named in your tender, and the team can discuss your requirements.
Related
Safety-related signalling electronics explained: safety cases, SILs, the 2026 edition and buyer checks.
Read the EN 50129 guide →Passenger announcement and information system for metro trainsets, with hardware built to EN 50155.
See PAPIS product details →Onboard and station IP surveillance with centralised video management and vandal-resistant cameras for rolling stock and stations.
See IP CCTV product details →Railway cybersecurity with IEC 62443: zones and conduits, security levels SL 1 to SL 4 and secure development for onboard and station systems.
Read the TS 50701 guide →Platform and concourse displays that show route maps, arrivals, service status and emergency messages on sunlight-readable screens, managed centrally from the control room.
See Station PIS product details →IoT remote diagnostics for locomotive and rolling stock fleets — edge data acquisition, cloud analytics and predictive maintenance alerts, Built in India.
See RDPMS product details →FAQ
EN 50159, Railway applications, Communication, signalling and processing systems, Safety-related communication in transmission systems, is the CENELEC standard that defines requirements for safety-related digital communication over transmission systems that were not necessarily designed for safety. It classifies systems as Category 1, 2 or 3 and requires defences so messages remain authentic, intact, timely and in sequence.
According to its European foreword, EN 50159:2026 supersedes EN 50159:2010 and its amendments. It harmonises terminology with cybersecurity, covers mixed safety-integrity contexts, coordinates Category 3 cybersecurity requirements, adds guidance on separating safety and cybersecurity, and adds change-management guidance for duty holders. National adoption is due by 31 July 2027 and withdrawal of conflicting national standards by 31 July 2029.
Not usually as the governing product standard. EN 50159 applies when safety-related electronic systems use a shared or non-trusted transmission system for digital communication. PIS, IP CCTV and diagnostics often share such networks and may need to respect the category and interface rules when they sit beside safety-related traffic, but whether the standard applies is decided by the system safety process and the tender.
EN 50129 defines the safety-related electronic system and its safety case; EN 50159 supplies the communication-related requirements and evidence for messages that travel over the transmission system. For Category 3 systems, EN 50159:2026 interfaces to cybersecurity standards such as CLC/TS 50701 rather than replacing them.
Envision TechWorks makes onboard and station electronics, not signalling systems or certified safety communication stacks, in an ISO 9001:2015 facility in India. Where your project needs displays, CCTV, diagnostics units or control panels on a network that also carries safety-related traffic, share the interface and evidence requirements named in your tender and the team can discuss them, Built in India.
Share the standards, editions, transmission category and interface requirements named in your tender, and the team will discuss your requirements, Built in India.