Code on the Rails: Navigating EN 50657 for Rolling Stock Software

What is EN 50657?

EN 50657 is the specific European Standard titled “Railways Applications – Rolling stock applications – Software on Board Rolling Stock.” It governs the development, testing, and maintenance of software specifically installed on railway vehicles, such as the Train Control and Monitoring System (TCMS), door control units, and traction control software.

Historically, all railway software fell under EN 50128. However, as the industry matured, a split occurred: EN 50128 became dedicated to “Signalling and Telecommunications” (infrastructure/trackside), while EN 50657 was created to address the specific needs of the “Rolling Stock” (on-board) domain. While technically very similar, EN 50657 is tailored to the lifecycle and supply chain realities of train manufacturers rather than signaling companies.

The Software V-Model Lifecycle

Like its predecessor, EN 50657 mandates the use of the V-Model for software development. This ensures that every line of code can be traced back to a specific safety requirement.

• Left Side (Design): Software Requirements Specification → Architecture → Design → Coding.
• Right Side (Verification): Unit Testing → Integration Testing → Software Validation → System Acceptance.
• Process: It requires strict independence between the person who writes the code and the person who tests it, especially for higher safety levels.

Software Safety Integrity Levels (SIL)

Not all software on a train is equally critical. EN 50657 categorizes software based on the risk associated with its failure (derived from EN 50126).

Basic Integrity: Software for non-critical functions (e.g., Passenger Information Displays). Failure causes inconvenience but no safety risk.
SIL 1 & SIL 2: Mid-level safety functions (e.g., slip/slide protection).
SIL 3 & SIL 4: High-risk functions (e.g., Door control, Emergency Braking). These require the most rigorous mathematical proof, formal methods, and extensive validation.

Comparison: EN 50128 vs. EN 50657