EN 50716, EN 50128, EN 50657: railway software
For fifteen years, European railway software was developed to two CENELEC standards: EN 50128 for signalling and EN 50657 for software on board rolling stock. Both are now superseded by EN 50716:2023, "Railway Applications, Requirements for software development", whose date of withdrawal for conflicting national standards is 30 October 2026. The EU framework has moved with it: EN 50716 was added to the list of harmonised standards under Directive (EU) 2016/797 in March 2025, and in April 2026 the CCS TSI swapped EN 50128 for EN 50716 in its list of standards. This guide reads the forewords and scope clauses of the standards, the Official Journal and the TSI texts, sets out what changes, what stays (integrity levels, roles, IEC 61508 heritage, T1/T2/T3 tool classes), and lists the claims these texts contradict.
The CENELEC railway family in 2026
Section titled “The CENELEC railway family in 2026”The railway software standard does not stand alone. It sits under a system-level RAMS process and next to a standard for safety-related electronic systems for signalling. The editions below are those listed in the CCS TSI as amended in 2026 and in the harmonised standards decision.
| Reference | Edition | Title (short) | Role |
|---|---|---|---|
| EN 50126-1 | 2017 | RAMS, Part 1: Generic RAMS process | Lifecycle and RAMS process for any railway application. Harmonised under Directive (EU) 2016/797 (Decision (EU) 2023/2584). |
| EN 50126-2 | 2017 | RAMS, Part 2: Systems approach to safety | Hazard analysis, risk acceptance and the allocation of safety requirements down to software. To be used with EN 50126-1:2017. Harmonised. |
| EN 50129 | 2018 + AC:2019 | Safety related electronic systems for signalling | Safety case and acceptance of signalling electronic systems. Its Annex F gives guidance for FPGA and CPLD development. Harmonised. |
| EN 50716 | 2023 | Requirements for software development | Software for signalling and for rolling stock. Supersedes EN 50128 and EN 50657. Harmonised since Decision (EU) 2025/424. |
| EN 50128 | 2011 + AC:2014 + A1:2020 + A2:2020 | Software for railway control and protection systems | Superseded by EN 50716. Not in the list of Decision (EU) 2023/2584. |
| EN 50657 | 2017 + A1:2023 | Software on board rolling stock | Superseded by EN 50716. |
Environmental standards such as EN 50121 (railway EMC) and EN 50155 (electronic equipment on rolling stock, 2021 edition in the harmonised list) deal with hardware, not with the software process. EN 50716 clause 1.10 points to EN 50155:2017 for programmable logic in non-safety functions and to EN 50129:2018 Annex F for safety-related ones, while software running on a soft-core processor inside an FPGA is within the scope of EN 50716.
Timeline: from two standards to one
Section titled “Timeline: from two standards to one”| Date | Event | Source |
|---|---|---|
| 25 April 2011 | EN 50128:2011 approved by CENELEC (dop 25 April 2012, dow 25 April 2014). It supersedes EN 50128:2001. | EN 50128:2011 foreword |
| 11 May 2016 | Directive (EU) 2016/797 on interoperability adopted (technical pillar of the 4th Railway Package). | OJ L 138, 26.5.2016 |
| 16 June 2019 | Transposition deadline of Directive (EU) 2016/797, extendable by one year; national safety authorities could keep authorising under Directive 2008/57/EC until 16 June 2020 where notified. | Directive (EU) 2016/797, Articles 54 and 57 |
| 2020 | EN 50128 amendments A1:2020 and A2:2020. | EN 50716 supersession list |
| 2023 | EN 50657 amendment A1:2023. | EN 50716 supersession list |
| 10 August 2023 | New CCS TSI, Implementing Regulation (EU) 2023/1695, lists EN 50128:2011+A2:2020 in Table A 3. It repeals Regulation (EU) 2016/919. | OJ L 222, 8.9.2023 |
| 30 October 2023 | EN 50716:2023 approved by CENELEC (published November 2023). | EN 50716 title page |
| 15 November 2023 | Decision (EU) 2023/2584 publishes the harmonised standards under Directive (EU) 2016/797: EN 50126-1:2017, EN 50126-2:2017 and EN 50129:2018 are in, EN 50128 is not. | OJ L, 21.11.2023 |
| 30 October 2024 | dop of EN 50716: national adoption due. | EN 50716 foreword |
| 4 March 2025 | Decision (EU) 2025/424 inserts EN 50716:2023 as row 114a of the harmonised list. | OJ L, 6.3.2025 |
| 15 April 2026 | Implementing Regulation (EU) 2026/693 amends the CCS TSI: EN 50716 replaces EN 50128 in Table A 3. In force on 5 May 2026. | OJ L, 15.4.2026 |
| 30 October 2026 | dow of EN 50716: conflicting national standards (the EN 50128 and EN 50657 adoptions) withdrawn. Also the date used in the CCS TSI transition tables. | EN 50716 foreword; Regulation (EU) 2026/693 |
What EN 50716 changes, clause by clause
Section titled “What EN 50716 changes, clause by clause”The EN 50716 foreword lists the significant technical changes with respect to EN 50128:2011 and EN 50657:2017. The table sets each one against the clause it touches. EN 50716 keeps the old numbering where it can: some entries are "intentionally left blank" so that a reader of EN 50128 finds requirements in the same place.
| Area | EN 50128:2011 | EN 50716:2023 |
|---|---|---|
| Scope (1.1) | Software for railway control and protection applications | Software for control, command for signalling applications and for applications on board rolling stock; electric traction power supply fixed installations excluded (EN 50562 applies) |
| Software with no safety impact (1.3) | "Not relevant for software that has been identified as having no impact on safety" | 1.3 left blank; the standard applies to any software for railway applications, with Basic Integrity as the lowest level |
| Software developed to an earlier version (1.6) | Considered compliant and not subject to the pre-existing software requirements | 1.6 left blank |
| Integrity levels | SSIL 0 to 4 | Basic Integrity, then SIL 1 to 4 |
| System references | EN 50126-1:1999 and EN 50129:2003 | EN 50126-1:2017 and EN 50126-2:2017, with aligned definitions |
| Organisation and roles (Clause 5) | Organisation, independence, competence | Requirements rewritten for readability, organisational options kept broadly unchanged |
| Techniques (Annex A) | Tables by SSIL | Updated to align with lifecycle phases; Table A.17 on modelling |
| Lifecycle (Annex C) | No lifecycle mandated; illustrative documents | Still no lifecycle mandated; new C.1 with linear (waterfall, V) and iterative lifecycle examples |
| Modelling | Not in the 2011 text | New C.2 guidance on modelling for software development |
| Mixed integrity levels | Listed as new in the EN 50716 foreword | Additional guidance for software components of different integrity levels |
| Programming languages | Requirements on programming languages | Requirements generalised (Table A.15, suitable programming languages) |
| Cybersecurity | Not mentioned in the foreword, introduction or scope | Introduction says the standard does not specify security requirements and points to dedicated cybersecurity standards |
| Minor changes (1.9) | Only 9.2 applies; the assessor checks the change classification | Only 9.2 applies |
Software integrity levels
Section titled “Software integrity levels”The integrity level drives the techniques and measures selected from the normative tables of Annex A, the independence of roles and the depth of verification. Both standards say the same thing about the levels in between: "the required techniques for level 1 are the same as for level 2, and the required techniques for level 3 are the same as for level 4". In practice there are three tiers of technique tables, not five.
| EN 50128:2011 | EN 50716:2023 | Technique tables in Annex A |
|---|---|---|
| SSIL 0 | Basic Integrity | Own column |
| SSIL 1, SSIL 2 | SIL 1, SIL 2 | Same requirements for both levels |
| SSIL 3, SSIL 4 | SIL 3, SIL 4 | Same requirements for both levels |
The level is not chosen at software level. The EN 50716 introduction says that it is within the scope of EN 50126-1 and EN 50126-2 to define the safety-related functions allocated to software, and that the standard "does not give guidance on which level of software integrity is appropriate for a given risk". The allocation descends from hazard analysis and system architecture: as the specification is decomposed into systems and components, integrity levels are allocated further until they reach the software.
Lifecycle and documentation
Section titled “Lifecycle and documentation”Neither standard imposes a V-model. EN 50128 says it "does not mandate the use of a particular software development lifecycle"; EN 50716 repeats this and adds iterative lifecycle examples in Annex C.1. What both require is a set of phases with defined inputs, outputs and verification:
- software requirements (SRS) and, in parallel, the software architecture (7.2 and 7.3),
- component design, implementation and testing (7.4 and 7.5),
- integration on the target hardware (7.6),
- overall software testing and final validation (7.7),
- deployment and maintenance (9.1 and 9.2),
- for generic software configured by application data, the separate process of Clause 8.
Cross-cutting assurance activities run through the whole development: testing (6.1), verification (6.2), validation (6.3), assessment (6.4), quality assurance (6.5), modification and change control (6.6), and support tools and languages (6.7).
Roles and independence
Section titled “Roles and independence”Clause 5.1 sets the organisation and independence of roles, and Annex B describes the key software roles and responsibilities (Requirements Manager, Designer, Implementer, Tester, Verifier, Integrator, Validator, Assessor, Project Manager, Configuration Manager). The required independence between them grows with the integrity level, and Figure 2 of EN 50716 illustrates the organisational structure. The foreword states that the Clause 5 rewrite kept "existing options for organization broadly unchanged", so an organisation set up for EN 50128 does not need to be rebuilt.
On ETCS, the CCS TSI changes who performs the assessment. Point 4.2.1 of the CCS TSI says that, when the Table A 3 standards are used for an ETCS subsystem or interoperability constituent, the independent safety assessment activities those standards require "shall be carried out by a CSM assessment body" accredited or recognised under Annex II of Regulation (EU) No 402/2013 in the control-command and signalling field, "instead of a CENELEC independent safety assessor". All three types of independence (A, B and C) allowed by Regulation (EU) No 402/2013 are permitted.
Support tools: T1, T2, T3
Section titled “Support tools: T1, T2, T3”Clause 6.7 classifies software support tools by their effect on the executable software. EN 50716 keeps the three classes and adds Table 1, which maps each class to the applicable subclauses.
| Class | Definition | Typical examples |
|---|---|---|
| T1 | Generates no outputs that can directly or indirectly contribute to the executable code (including data) | Text editor, requirements or design support tool without code generation, configuration control tool |
| T2 | Supports test or verification of the design or executable code; errors in the tool can fail to reveal defects but cannot directly create errors in the executable software | Static analyser, test coverage measurement tool, test harness generator |
| T3 | Generates outputs that can directly or indirectly contribute to the executable code (including data) of the safety-related system | Compiler, linker, code generator, data or algorithm compiler |
The class follows the actual use of the tool in the project, not its product category. A generator that only produces test reports and a generator that produces embedded configuration data are in different classes.
Pre-existing software
Section titled “Pre-existing software”Pre-existing software (operating systems, libraries, components from earlier projects, commercial off-the-shelf software) may be used if the requirements of 7.3.4.7 and 6.5.4.16 on pre-existing software, and of 6.7 for tools, are met: clause 1.5 says so in both EN 50128 and EN 50716. One shortcut is gone: EN 50128 clause 1.6 stated that software developed according to any version of EN 50128 is considered compliant and not subject to the pre-existing software requirements. EN 50716 leaves clause 1.6 intentionally blank.
Modification and change control
Section titled “Modification and change control”Clause 6.6 governs modification and change control, and 9.2 software maintenance. Clause 1.9 of both standards says they are not retrospective: they apply in full to existing systems only if these undergo major modifications, and for minor changes only 9.2 applies. EN 50128 adds that the assessor analyses the software documentation to confirm that the nature and scope of the change were classified correctly.
At system level, the operative EU term is "significant change", not "substantial modification". Under Article 4 of Regulation (EU) No 402/2013, the proposer decides whether a change is significant against the criteria of Article 4(2); if it is, the risk management process of Article 5 applies and an assessment body must assess it; if not, documentation justifying the decision is enough. The CCS TSI also lists, for error corrections, conditions such as "the result of the safety judgement (e.g. safety case according to EN 50126) remains unchanged".
TSIs, harmonised standards and authorisation
Section titled “TSIs, harmonised standards and authorisation”Directive (EU) 2016/797 is the interoperability directive of the 4th Railway Package. Under Article 17, subsystems and interoperability constituents that conform to harmonised standards published in the Official Journal are presumed to conform to the essential requirements those standards cover. Under Article 15, the applicant draws up the "EC" declaration of verification of a subsystem after the conformity assessment bodies it selected have carried out the EC verification procedure. Under Article 21, a vehicle authorisation for placing on the market is issued by the European Union Agency for Railways, or, when the area of use is limited to one Member State and the applicant so requests, by that national safety authority.
CCS TSI. Appendix A, Table A 3 of Implementing Regulation (EU) 2023/1695 lists the standards whose application is "an appropriate means to fully comply to the risk management process" of Annex I to Regulation (EU) No 402/2013. When other standards are applied, at least equivalence must be proven. Since Regulation (EU) 2026/693 the table reads:
| No | Standard | Version | Note |
|---|---|---|---|
| A1 | EN 50126-1 | 2017 | Harmonised |
| A2 | EN 50716 | 2023 | Previous EN 50128 can still be used according to Tables B1.1 and B2 |
| A3 | EN 50129 | 2018 + AC:2019 | Harmonised |
| A4 | EN 50159 | 2010 + A1:2020 | Harmonised |
| A5 | EN 50126-2 | 2017 | Harmonised; to be used with EN 50126-1:2017 |
The transition tables set when EN 50716 bites:
| Subsystem | Situation | EN 50716 in place of EN 50128 |
|---|---|---|
| CCS on-board (Table B1.1) | Design phase started after 28 September 2023 | Directly applicable |
| CCS on-board (Table B1.1) | Design phase started before 28 September 2023 | Applicable if the design phase ends after 30 October 2026 |
| CCS on-board (Table B1.1) | Production phase, vehicle in operation | Not applicable |
| CCS trackside (Table B2) | All | After 30 October 2026 |
Harmonised status of EN 50716. Decision (EU) 2025/424 inserted EN 50716:2023 into the list of Decision (EU) 2023/2584. Its recital 5 limits the presumption: the standard confers, within the limits of its scope, presumption of conformity with certain requirements of Regulation (EU) 2016/919, the CCS TSI repealed in 2023, insofar as Article 14 of Regulation (EU) 2023/1695 keeps it applying.
LOC&PAS TSI. Regulation (EU) No 1302/2014 and its 2023 amendment, Implementing Regulation (EU) 2023/1694, do not cite EN 50657, EN 50128 or EN 50716. For on-board software outside the CCS subsystem, the software standard is reached through the risk assessment and the contract, not through a TSI reference.
ERTMS is the European control-command system. It combines ETCS (European Train Control System) with a railway mobile radio: GSM-R today, FRMCS for the future, whose on-board specifications the 2023 CCS TSI still describes as "not considered complete for the purpose of tendering".
Link with CE marking
Section titled “Link with CE marking”Railway subsystems are placed in service through EC verification and the "EC" declaration of verification under Directive (EU) 2016/797, not through the CE marking route of the product directives. Some on-board equipment can still fall under other Union legislation in parallel, such as the Radio Equipment Directive for an on-board transmitter. The CE marking page covers the general framework and presumption of conformity.
For the vocabulary (SIL, RAMS, safety case, PES, T1/T2/T3), see the glossary.
See also
Section titled “See also”- IEC 61508: functional safety and SIL
- ISO 26262: automotive functional safety
- IEC 62443: industrial cybersecurity
- DO-178C and DO-254: avionics software and hardware
- DO-326A and ED-202A: avionics cybersecurity airworthiness
- MIL-STD-461 and MIL-STD-464, defense EMC standards
- AEC-Q100, Q101, Q200: automotive component qualification
Claims the texts contradict
Section titled “Claims the texts contradict”| Claim | What the text says |
|---|---|
| "EN 50128 and EN 50657 are the current railway software standards." | EN 50716:2023 supersedes both, with all amendments and corrigenda. Conflicting national standards must be withdrawn by 30 October 2026 (EN 50716 foreword). |
| "EN 50716 adds cybersecurity requirements." | Its introduction says it does not specify requirements for security policies or services and that appropriate cybersecurity standards should be applied. It only notes the trade-off between fast security updates and safety approval. |
| "The standards impose a V-model." | Both state they do not mandate a particular lifecycle. EN 50716 Annex C.1 gives V, waterfall and iterative examples. |
| "SSIL 1 is lighter than SSIL 2, and SSIL 4 stricter than SSIL 3." | The required techniques for level 1 are the same as for level 2, and for level 3 the same as for level 4 (introduction of both standards). |
| "SSIL 0 has no requirement beyond ISO 9001." | EN 50128 Annex A has a column for level 0. EN 50716 replaces level 0 with Basic Integrity, which has its own column. |
| "EN 50129 allocates the SIL to the software." | The EN 50716 introduction places the definition of safety functions allocated to software in EN 50126-1 and EN 50126-2 (2017 editions). EN 50129:2018 deals with signalling electronic systems. |
| "IEC 61508 says the sector standard prevails, so rail never refers back to it." | That sentence is not a quote. What the texts show is narrower: EN 50128 based its tools clause on EN 61508 (2010), and the CCS TSI lists the CENELEC railway standards, not IEC 61508. |
| "Every TSI references EN 50126, EN 50128, EN 50129 and EN 50657; the LOC&PAS TSI references EN 50657." | Only the CCS TSI lists railway safety standards (Table A 3). The LOC&PAS TSI, Regulation (EU) No 1302/2014 and its 2023 amendment, cites none of them. |
| "The CCS TSI explicitly mandates EN 50128 for ETCS." | Table A 3 is "an appropriate means"; other standards are allowed if at least equivalence is proven. Since Regulation (EU) 2026/693 it lists EN 50716, with EN 50128 kept only under the transition tables. |
| "The ISA for SSIL 3-4 must be an external company accredited by the national safety authority." | For ETCS, the CCS TSI requires a CSM assessment body accredited or recognised under Regulation (EU) No 402/2013, instead of a CENELEC independent safety assessor, and allows independence types A, B and C. |
| "ERA now issues every vehicle authorisation." | Article 21(8) of Directive (EU) 2016/797 lets the national safety authority issue it when the area of use is within one Member State and the applicant asks. |
| "A significant software change is a 'substantial modification' under Regulation 402/2013." | The regulation uses "significant change", assessed against the criteria of Article 4(2). |
Pitfalls observed in the field
Section titled “Pitfalls observed in the field”- Starting a new project on EN 50128 in late 2026. For CCS on-board subsystems whose design phase started after 28 September 2023, EN 50716 is directly applicable under the amended CCS TSI, and for trackside it applies after 30 October 2026. Check the transition tables and the contract before freezing the plan.
- Relying on EN 50128 clause 1.6. Software developed to an earlier EN 50128 version was exempt from the pre-existing software requirements. EN 50716 does not carry that sentence, so reuse arguments should be prepared against 7.3.4.7 and 6.5.4.16.
- Choosing the integrity level from the software side. The level comes from the system safety process (EN 50126-1 and EN 50126-2) and the architecture. Fixing it before the system allocation is done inverts the order the standards describe.
- Reading five tiers where there are three. Since levels 1 and 2, and levels 3 and 4, share the same technique requirements, the cost step is between Basic Integrity, the 1-2 pair and the 3-4 pair.
- Classifying a tool by its product name. T1, T2 and T3 depend on what the output does in this project. A tool whose output ends up in the executable or its data is T3.
- Treating a change as minor without a recorded decision. Clause 9.2 handles minor changes, but at system level Regulation (EU) No 402/2013 asks for documentation justifying why a change is not significant.
Further reading
Section titled “Further reading”This page covers the framework and the switch to EN 50716. Topics that merit dedicated treatment:
- the structure of the safety case under EN 50129:2018 and its link with the software documentation,
- tool qualification evidence for T2 and T3 tools under clause 6.7 and Table 1 of EN 50716,
- the use of pre-existing software under 7.3.4.7 and 6.5.4.16,
- the link between railway software and cybersecurity requirements (CLC/TS 50701, IEC 62443),
- the split of roles between ERA and national safety authorities in vehicle authorisation.
Sources & references
- EN 50716:2023, Railway Applications, Requirements for software development (BSI preview: title page, supersession list, European foreword with dop and dow), CENELEC (via BSI preview) www.en-standard.eu/publicdoc/bs-en-50716-2023-preview-1.pdf
- EN 50128:2011, Software for railway control and protection systems (NSAI preview: foreword, introduction, scope), CENELEC (via NSAI preview) www.intertekinform.com/preview/98701753852.pdf?sku=859692_saig_nsai_nsai_2045205
- Directive (EU) 2016/797 on the interoperability of the rail system within the European Union, EUR-Lex eur-lex.europa.eu/eli/dir/2016/797/oj
- Implementing Regulation (EU) 2023/1695, TSI for control-command and signalling (CCS TSI), Appendix A, Table A 3, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2023/1695/oj
- Implementing Regulation (EU) 2026/693 amending the CCS TSI (EN 50716 replaces EN 50128 in Table A 3, transition tables B1.1 and B2), EUR-Lex eur-lex.europa.eu/eli/reg_impl/2026/693/oj
- Implementing Decision (EU) 2023/2584 on harmonised standards for the interoperability of the rail system, EUR-Lex eur-lex.europa.eu/eli/dec_impl/2023/2584/oj
- Implementing Decision (EU) 2025/424 amending Decision (EU) 2023/2584 (adds EN 50716:2023), EUR-Lex eur-lex.europa.eu/eli/dec_impl/2025/424/oj
- Implementing Regulation (EU) No 402/2013, common safety method for risk evaluation and assessment (CSM RA), EUR-Lex eur-lex.europa.eu/eli/reg_impl/2013/402/oj
- Regulation (EU) No 1302/2014, TSI for locomotives and passenger rolling stock (LOC&PAS TSI), EUR-Lex eur-lex.europa.eu/eli/reg/2014/1302/oj
- European Union Agency for Railways (ERA), Technical Specifications for Interoperability (TSI), ERA www.era.europa.eu/domains/technical-specifications-interoperability_en
- 4th Railway Package, European Commission, Mobility and Transport, European Commission transport.ec.europa.eu/transport-modes/rail/railway-packages_en
- IEC 61508, Functional safety of electrical/electronic/programmable electronic safety-related systems, IEC www.iec.ch/functional-safety
Frequently asked questions
- Are EN 50128 and EN 50657 still valid?
- They are being withdrawn. EN 50716:2023, "Railway Applications, Requirements for software development", was approved by CENELEC on 30 October 2023 and supersedes EN 50128:2011 and EN 50657:2017 with all their amendments and corrigenda (EN 50128 AC:2014, A1:2020, A2:2020 and EN 50657 A1:2023). Its European foreword fixes the date of publication at national level (dop) at 30 October 2024 and the date of withdrawal of conflicting national standards (dow) at 30 October 2026. After that date national standards bodies must have withdrawn their EN 50128 and EN 50657 adoptions. Projects already under way follow the transition rules of the contract or of the applicable TSI, not a blanket cut-off.
- What is the difference between EN 50128 and EN 50657?
- Scope. EN 50128:2011 covers software for programmable electronic systems in railway control and protection applications, that is signalling. EN 50657:2017 covers software for programmable electronic systems on board rolling stock. EN 50716:2023 merges the two: its clause 1.1 covers both control, command for signalling applications and applications on board rolling stock, and excludes electric traction power supply fixed installations (for which the foreword points to EN 50562). EN 50716 keeps the clause numbering of its predecessors where it can, leaving some entries intentionally blank.
- What is an SSIL, and what does EN 50716 use instead?
- EN 50128:2011 defines five software safety integrity levels, 0 to 4, and states that it is not relevant for software identified as having no impact on safety. EN 50716:2023 defines five software integrity levels too, but the lowest is called Basic Integrity, a concept first introduced in the EN 50126 series, followed by safety integrity levels 1 to 4. In both standards the techniques required for level 1 are the same as for level 2, and those for level 3 are the same as for level 4. Neither standard says which level fits a given risk: the allocation comes from the system safety process of EN 50126-1 and EN 50126-2.
- How do EN 50128 and EN 50716 relate to IEC 61508?
- IEC 61508 is the generic functional safety standard for electrical, electronic and programmable electronic safety-related systems. The railway standards borrow from it: the EN 50128:2011 foreword says its new clause on tools was based on the 2010 edition of EN 61508. But a railway project is assessed against the railway standards, and the CCS TSI lists EN 50126-1, EN 50126-2, EN 50129 and, since Regulation (EU) 2026/693, EN 50716 as the appropriate means to comply with the CSM risk management process. It does not list IEC 61508.
- What do the T1, T2 and T3 tool classes mean?
- They classify support tools by their effect on the executable software. A T1 tool generates no output that can contribute, directly or indirectly, to the executable code or data (a text editor, for example). A T2 tool supports test or verification: an error in it can fail to reveal a defect but cannot directly create one (static analysers, coverage measurement). A T3 tool generates outputs that contribute directly or indirectly to the executable code or data (a compiler). The requirements of clause 6.7 grow with the class, and EN 50716 keeps the scheme in a table that maps each tool class to the applicable subclauses.
- Does the CCS TSI require EN 50128 or EN 50716?
- Neither, strictly. Appendix A, Table A 3 of the CCS TSI, Implementing Regulation (EU) 2023/1695, lists standards whose application is an appropriate means to fully comply with the risk management process of Regulation (EU) No 402/2013; other standards may be used if at least equivalence is proven. The 2023 text listed EN 50128:2011+A2:2020. Implementing Regulation (EU) 2026/693, published on 15 April 2026, replaced it with EN 50716:2023 and added a note that the previous EN 50128 can still be used according to the transition tables: for on-board subsystems whose design phase started before 28 September 2023, EN 50716 applies if the design phase ends after 30 October 2026.
- Is EN 50716 a harmonised standard?
- Yes, with a narrow scope. Commission Implementing Decision (EU) 2025/424 of 4 March 2025 inserted EN 50716:2023 as row 114a of the list of harmonised standards under Directive (EU) 2016/797. Recital 5 states that it confers, within the limits of its scope, presumption of conformity with certain requirements of the old CCS TSI, Regulation (EU) 2016/919, insofar as Article 14 of Regulation (EU) 2023/1695 applies. EN 50128 does not appear in the list published by Implementing Decision (EU) 2023/2584, while EN 50126-1:2017, EN 50126-2:2017 and EN 50129:2018 do.