.png)
Guide · Rail & Metro · Built in India
EN 50716:2023 is the CENELEC standard for developing software in railway systems. Titled Railway applications, Requirements for software development, it covers software for control-command and signalling and for applications on board rolling stock, using five software integrity levels from Basic Integrity up to SIL 4. It superseded EN 50128:2011 and EN 50657:2017 with their amendments: national adoption was due by 30 October 2024 and conflicting national standards had to be withdrawn by 30 October 2026, so EN 50716 is now the single European railway software standard.
The short answer
EN 50716:2023 was prepared by CENELEC technical committee CLC/TC 9X and approved on 30 October 2023. It specifies process and technical requirements for developing software for programmable electronic systems used in control-command and signalling, and in applications on board rolling stock. It covers application programming (including PLC ladder logic), operating systems, support tools and firmware, as well as generic software configured by application data. Pre-existing software and tools can be used where its requirements are met, and software running on softcore processors in FPGAs and CPLDs is in scope. Electric traction power supply and conventional power supply and control, such as station power for offices and shops, are outside it. It is not retrospective: it applies mainly to new developments, and to existing systems in full only after major modifications. Clause numbering was kept as close as practicable to EN 50128 and EN 50657 to ease the transition.
Why it matters
Passenger announcement and information systems, IP CCTV recorders and remote diagnostics units on trains are software-controlled, so their onboard software now falls within the rolling-stock part of EN 50716. For functions that are not safety-related the standard asks for a software quality assurance process, which can be met with its Basic Integrity requirements, ISO/IEC/IEEE 90003 or another code of practice; where a function has a safety impact below SIL 1, at least Basic Integrity applies. The integrity level is decided at system level through the EN 50126 process, not chosen by the supplier. For station and wayside systems, whether EN 50716 applies depends on the system and the contract, so check the tender. Its deployment rules also suit fleets that receive regular software updates: recorded baselines, reproducible releases, a rollback procedure, embedded version identification and a deployment record.
Key requirements
A summary of what railway software specifications usually draw from EN 50716:2023. Always check the exact edition and the software integrity level named in your tender.
Software integrity is specified as one of five levels: Basic Integrity, the lowest, and then SIL 1 to SIL 4. The techniques and measures for each level are set out in the normative tables of Annex A, which this edition realigned to the lifecycle phases; SIL 1 uses the same techniques as SIL 2, and SIL 3 the same as SIL 4. If a highly recommended technique is not used, the reason must be recorded in the Software Quality Assurance Plan. The standard does not say which level suits a given risk: that comes from the EN 50126 process.
Development runs through defined phases with inputs, outputs and documents: software requirements, architecture and design, component design, implementation and testing, integration, overall software testing and final validation, then deployment and maintenance. No single lifecycle model is mandated; new informative guidance in Annex C gives waterfall, V and iterative examples, plus guidance on modelling. Systems configured by application data have their own clause covering how that data is produced, verified and validated.
Annex B describes the key roles: requirements manager, designer, implementer, tester, verifier, validator, assessor, project manager and configuration manager. At every level a verifier or validator cannot also be the requirements manager, designer or implementer, and the validator cannot be the project manager; at SIL 3 and SIL 4 the validator must not report to the project manager. Software assessment applies from SIL 1 to SIL 4, while Basic Integrity software must meet its requirements but needs no assessment.
Support tools are classed by their effect on the executable software: T1 tools produce no output that contributes to executable code or data (for example a text editor), T2 tools support test or verification (for example a static analysis or coverage tool), and T3 tools generate output that becomes executable code or data (for example a compiler). Pre-existing software such as operating systems and libraries can be used if set requirements are met. Before release the software baseline is recorded under configuration management, releases must be reproducible, a rollback procedure must be available and deployed software must identify its own version.
Related standards
EN 50716 is read together with EN 50126-1 and EN 50126-2, which define the RAMS process that allocates safety functions and integrity levels down to software; this edition is better aligned with them. EN 50129 covers safety-related electronic systems for signalling, and for safety-related FPGA and CPLD designs EN 50716 points to EN 50129:2018 Annex F, with EN 50155 covering non-safety-related ones. EN 50155:2021, the onboard electronics standard, still refers to the EN 50657 software lifecycle, so tenders may name either standard. EN 50716 does not set cybersecurity requirements; CLC/TS 50701 and IEC 62443 cover that. Internationally, IEC 62279:2015 is the IEC counterpart of EN 50128 for railway control and protection software and remains a current IEC standard.
Working from a specification written for EN 50657? Read: What is EN 50657?
What is EN 50657? Rolling-stock software explained →Specifying cybersecurity alongside software integrity? Read: What is CLC/TS 50701?
What is CLC/TS 50701? Railway cybersecurity explained →Checklist
Use these points when writing a specification or comparing suppliers. Ask for documented evidence for the exact software version and configuration rather than relying on a datasheet statement.
Standard and edition: does the specification name EN 50716:2023, and how will work started under EN 50128 or EN 50657 be handled now that those standards have been withdrawn?
Integrity level: which software integrity level, Basic Integrity or SIL 1 to SIL 4, has the system safety process allocated to each software function, and which functions are not safety-related?
Plans: will the supplier provide a Software Quality Assurance Plan with the chosen lifecycle model and Annex A technique selection, plus verification, validation and configuration management plans?
Roles and independence: who acts as verifier, validator and, where required, assessor, and does their independence match the integrity level?
Tools and pre-existing software: which T2 and T3 tools, operating systems and libraries are used, and what evidence supports each of them?
Deployment and updates: how are releases baselined, made reproducible, rolled back and identified on the train, and which deployment records will be delivered?
Cybersecurity and sourcing: how will security updates be balanced with safety validation under CLC/TS 50701 or IEC 62443, and does your programme favour Built in India / Make in India manufacturing?
Envision TechWorks
Envision TechWorks products are designed, manufactured and tested in an ISO 9001:2015 facility in India: production-ready and Built in India for Make in India programmes. PAPIS onboard passenger announcement and information hardware is built to EN 50155, and production includes in-circuit and functional test, AOI and X-ray inspection, and thermal cycling. Share the software requirements named in your tender, such as the standard, edition and software integrity levels, and the team can discuss your requirements.
Related
Railway RAMS explained: the 12-phase lifecycle, risk acceptance, SIL apportionment and the safety case.
Read the EN 50126 guide →Passenger announcement and information system for metro trainsets, with hardware built to EN 50155.
See PAPIS product details →Onboard and station IP surveillance with centralised video management and vandal-resistant cameras for rolling stock and stations.
See IP CCTV product details →Railway cybersecurity with IEC 62443: zones and conduits, security levels SL 1 to SL 4 and secure development for onboard and station systems.
Read the TS 50701 guide →Platform and concourse displays that show route maps, arrivals, service status and emergency messages on sunlight-readable screens, managed centrally from the control room.
See Station PIS product details →IoT remote diagnostics for locomotive and rolling stock fleets — edge data acquisition, cloud analytics and predictive maintenance alerts, Built in India.
See RDPMS product details →FAQ
EN 50716:2023, Railway applications, Requirements for software development, is the CENELEC standard for developing, deploying and maintaining software for railway control-command and signalling and for applications on board rolling stock. It defines five software integrity levels, from Basic Integrity to SIL 4, and replaced EN 50128 and EN 50657 with a single standard.
EN 50716:2023 supersedes EN 50128:2011, the software standard for railway control and protection (signalling) systems, and EN 50657:2017, the standard for software on board rolling stock, together with their amendments. Its European foreword set 30 October 2024 for national adoption and 30 October 2026 for withdrawal of conflicting national standards.
According to its foreword, EN 50716 is better aligned with EN 50126-1 and EN 50126-2, rewrites the organisation and roles requirements of clause 5 for readability, realigns the Annex A technique tables with the lifecycle phases, adds Annex C guidance on lifecycle models and modelling, adds guidance for components of different integrity levels and generalises the programming-language requirements.
No. EN 50716 states that it does not specify requirements for the security policies or services needed to meet cybersecurity requirements, and that appropriate cybersecurity standards should be applied; in railway projects that usually means CLC/TS 50701 and IEC 62443. It also notes that fast security updates have to be balanced with the testing and validation that safety-related software needs.
Envision TechWorks designs, manufactures and tests products in an ISO 9001:2015 facility in India. Share the software requirements named in your tender, such as the standard, edition and software integrity levels, and the team can discuss your requirements, Built in India.
Share the software standard, edition and integrity levels named in your tender, and the team will discuss your requirements, Built in India.