EN 50716: Unified Software Standard for Railway Systems (Replacing EN 50128 & EN 50657)

EN 50716 represents a paradigm shift in railway software engineering. Historically, the industry relied on separate standards for trackside signalling (EN 50128) and rolling stock (EN 50657). EN 50716 unifies these requirements into a single, Cross-Functional Standard valid for all railway software development.

This harmonization eliminates ambiguity for system integrators and suppliers, establishing a common rigorous methodology for the Software Development Lifecycle (V-Model), regardless of whether the code runs on a locomotive or an interlocking computer.

1. Scope: From Code to Certification

EN 50716 applies to all safety-related software used in railway control and protection systems. It dictates the process for:

• Software Requirements Specification (SRS): Defining exactly what the software must (and must not) do.
• Architecture & Design: Modular structure to prevent “Spaghetti Code.”
• Verification & Validation (V&V): Ensuring the code meets the requirements and is free of critical bugs.
• Maintenance: safely patching software without compromising existing safety functions.

2. Safety Integrity Levels (SIL) & Rigor

The standard categorizes software based on the risk it poses. A higher Safety Integrity Level (SIL) demands more rigorous testing and greater independence during validation. The following table illustrates the escalation of rigor:

3. The V-Model Methodology

EN 50716 mandates the “V-Model” lifecycle. Every step on the descending branch (Design) must have a corresponding verification step on the ascending branch (Testing):

1. System Requirements ↔ System Validation
2. Software Architecture ↔ Software Integration Test
3. Component Design ↔ Module/Unit Testing

This traceability ensures that no line of code exists without a requirement, and no requirement exists without a test case.

4. Managing COTS (Commercial Off-The-Shelf)

Modern trains use standard operating systems (like Linux or Windows) for non-critical functions. EN 50716 provides strict guidelines for integrating COTS software. You cannot simply install standard software in a SIL 4 environment; it must be encapsulated or proven “proven in use” to ensure it does not compromise the safety loop.