Railway Applications — Software for railway control and protection systems

Scope

Specifies the process and technical requirements for developing software for programmable electronic systems in railway control and protection applications, defining software safety integrity levels (SIL 0-4) and the lifecycle techniques and measures required at each level. Long the benchmark used by signalling suppliers, assessors and safety authorities for railway software assurance, it has been superseded by EN 50716:2023, which merges EN 50128 and EN 50657 into a single railway software standard.

EN 50128 specified the process and technical requirements for developing software used in programmable electronic systems for railway control and protection applications, defining software safety integrity levels from SIL 0 to SIL 4 and prescribing the lifecycle techniques and verification and validation measures required at each level. For over a decade it was the benchmark standard signalling suppliers, independent safety assessors and safety authorities used to assure the safety of trackside and interlocking software, working alongside the broader hardware, system-level and RAMS safety standards in the same CENELEC family. It has been superseded by EN 50716:2023, which merges EN 50128 and the on-board software standard EN 50657 into a single railway software development standard, reflecting the sector's move toward common software assurance requirements regardless of whether software runs trackside or on board. EN 50128 was formally withdrawn on 27 November 2023 following the publication of its successor. Its international counterpart, IEC 62279, remains separately published and has not itself been withdrawn, so it continues to be used as a reference standard in markets outside the CENELEC area.