.png)
Guide · Rail & Metro · Built in India
EN 50657 is the CENELEC standard for software on board rolling stock. It sets process and technical requirements for developing, deploying and maintaining software in programmable electronic systems on trains, using five software integrity levels from basic integrity up to SIL 4. EN 50657:2017 adapted the signalling software standard EN 50128:2011 for rolling stock and was amended in 2023. Both are now superseded by EN 50716:2023, which brings railway software development into one standard; conflicting national standards are withdrawn by 30 October 2026.
The short answer
EN 50657:2017 (Railway applications, Rolling stock applications, Software on board rolling stock) was prepared by CENELEC sub-committee SC 9XB and amended as EN 50657:2017+A1:2023. It applies to safety-related and non-safety-related software for programmable electronic systems in rolling stock, including application programming, operating systems, support tools and firmware, and to generic software configured by application data. Software in onboard signalling equipment, and software that does not contribute to rolling-stock operational functions and is segregated from them, are outside its scope. It keeps the structure and clause numbering of EN 50128:2011 and accepts software developed to EN 50128. It is not retrospective: existing systems come under it mainly after major modifications. Its successor, EN 50716:2023 (Railway applications, Requirements for software development), covers both signalling and rolling-stock software.
Why it matters
Passenger announcement and information systems, IP CCTV recorders and remote diagnostics units are all software-controlled. The rolling-stock electronics standard EN 50155:2021 asks that the software design process is visible and auditable, and that software design follows a tailored lifecycle model according to EN 50657:2017, laid down in the quality plan; buyers who need process details for tender evaluation should define them in the tender documents. The integrity level for each software function is not picked by the supplier: it comes from the system safety process of the EN 50126 series. The higher the level, the more techniques, documentation and independence the standard asks for.
Key requirements
A summary of what onboard software specifications usually draw from EN 50657 and its successor EN 50716. Always check the exact edition and integrity level named in your tender.
EN 50657 defines five software integrity levels: basic integrity, the lowest, and then SIL 1 to SIL 4. The techniques and measures for each level are set out in the normative tables of Annex A; SIL 1 uses the same techniques as SIL 2, and SIL 3 the same as SIL 4. The standard does not say which level fits a given risk: that allocation comes from the EN 50126 RAMS process. The basic integrity concept was first introduced in the EN 50126 series.
Development runs through defined phases with inputs, outputs and documents: software requirements, architecture and design, component implementation and testing, integration, overall software testing and validation, then deployment and maintenance. Each phase is verified and requirements stay traceable through to tests. No single lifecycle model is mandated; EN 50716 gives waterfall, V and iterative examples in Annex C.
The finished software is validated against its requirements and assessed. The standard sets requirements for organisation and personnel competence and defines roles such as requirements manager, designer, implementer, tester, verifier, validator, assessor, project manager and configuration manager. The independence required between these roles grows with the software integrity level.
Support tools are classed by their effect on the executable software: T1 tools produce no output that contributes to executable code or data (for example a text editor), T2 tools support test or verification (for example a static analyser or coverage tool), and T3 tools generate output that becomes part of the executable code or data (for example a compiler). Evidence grows from T1 to T3. Pre-existing software such as operating systems and libraries may be used if set requirements are met, and configuration management and change control apply throughout the life of the software.
Related standards
EN 50126-1 and EN 50126-2 define the RAMS process that allocates safety functions and integrity levels down to software, and EN 50657 is read together with that series. EN 50128:2011 is the equivalent software standard for railway control and protection (signalling) systems; for SIL 1 to SIL 4 the EN 50657 requirements are equivalent to it. EN 50155 covers the onboard electronic equipment itself and points to EN 50657 for the software lifecycle. Cybersecurity is covered separately by CLC/TS 50701 and IEC 62443. EN 50716:2023 supersedes both EN 50128 and EN 50657, so agree at tender stage which standard and edition apply.
Checklist
Use these points when writing a specification or comparing suppliers. Ask for documented evidence for the exact software version rather than relying on a datasheet statement.
Standard and edition: does the specification name EN 50657:2017+A1:2023 or EN 50716:2023, and say how the October 2026 withdrawal of EN 50657 will be handled during the project?
Integrity level: which software integrity level, basic integrity or SIL 1 to SIL 4, has the system safety process allocated to each software function?
Lifecycle and plans: will the supplier provide a quality plan with a tailored lifecycle model, plus plans for software verification, validation and configuration management?
Traceability: can each software requirement be traced through architecture, design and code to tests, with verification records for every phase?
Independence and roles: who acts as verifier, validator and assessor, and is the independence between those roles right for the integrity level?
Tools and pre-existing software: which T2 and T3 tools, operating systems and libraries are used, and what evidence supports each of them?
Updates and sourcing: how will software updates, change control and long-term support be handled over the life of the fleet, and does your programme favour Built in India / Make in India manufacturing?
Envision TechWorks
Envision TechWorks products are designed, manufactured and tested in an ISO 9001:2015 facility in India: production-ready and Built in India for Make in India programmes. PAPIS onboard passenger announcement and information hardware is built to EN 50155, and production includes in-circuit and functional test, AOI and X-ray inspection, and thermal cycling. Share the software requirements named in your tender, such as the standard, edition and integrity levels, and the team can discuss your requirements.
Related
The rolling-stock electronics standard for onboard equipment, covering temperature classes, power supply, shock and vibration, EMC and testing.
Read the EN 50155 guide →Passenger announcement and information system for metro trainsets, with hardware built to EN 50155.
See PAPIS product details →Onboard and station IP surveillance with centralised video management and vandal-resistant cameras for rolling stock and stations.
See IP CCTV product details →Railway cybersecurity with IEC 62443: zones and conduits, security levels SL 1 to SL 4 and secure development for onboard and station systems.
Read the TS 50701 guide →Platform and concourse displays that show route maps, arrivals, service status and emergency messages on sunlight-readable screens, managed centrally from the control room.
See Station PIS product details →IoT remote diagnostics for locomotive and rolling stock fleets — edge data acquisition, cloud analytics and predictive maintenance alerts, Built in India.
See RDPMS product details →FAQ
EN 50657 is the CENELEC standard Railway applications, Rolling stock applications, Software on board rolling stock. It sets process and technical requirements for developing, deploying and maintaining software in programmable electronic systems on trains, from basic integrity up to SIL 4. The last edition is EN 50657:2017+A1:2023, now superseded by EN 50716:2023.
Scope. EN 50128:2011 covers software for railway control and protection systems, that is signalling. EN 50657:2017 adapted it for software on board rolling stock, keeping the same structure and clause numbering, while onboard signalling software stays outside EN 50657. EN 50716:2023 now replaces both with one standard.
Basic integrity is the lowest of the five software integrity levels in EN 50657, below SIL 1 to SIL 4. The concept comes from the EN 50126 series. Software at basic integrity still follows a defined lifecycle and the techniques and measures listed for that level in Annex A of the standard.
EN 50716:2023 supersedes EN 50657:2017 and EN 50128:2011 with their amendments. Its European foreword set 30 October 2024 for national adoption and 30 October 2026 for withdrawal of conflicting national standards. Projects already under way follow their contract and any transition rules, so check which standard your tender names.
Envision TechWorks designs, manufactures and tests products in an ISO 9001:2015 facility in India. Share the software requirements named in your tender, such as the standard, edition and integrity levels, and the team can discuss your requirements, Built in India.
Share the software standard, edition and integrity levels named in your tender, and the team will discuss your requirements, Built in India.