RAMS stands for reliability, availability, maintainability and safety. On the railway, these four properties are not managed one by one but as a single goal in which each affects the others. In Europe the framework for this is the EN 50126 series; its Part 1 defines a generic RAMS management process built on the system life cycle.
The family of standards has changed significantly over the past three years. According to the catalogue of EVS, Estonia's national standards body, the railway software standard EN 50128 was withdrawn from 1 December 2023 and replaced by EN 50716:2023. The 2026 edition of EN 50129, the standard for safety-related electronic systems for signalling, has been valid since 2 June 2026.
In short:
- EN 50126 sets out the system-level RAMS process and risk approach; EN 50129 covers safety-related electronic systems for signalling, and EN 50716 covers software.
- A safety integrity level (SIL) has four grades and is a property of a safety function, not of a system (IEC).
- For software, EN 50716 defines five levels, from Basic Integrity (the lowest) to SIL 4 (the highest).
What does RAMS stand for?
EN 50126-1 covers reliability, availability, maintainability and safety, and also how they interact. An extra safety check added to a signalling system, for example, can raise safety while stopping trains unnecessarily and lowering availability. The standard offers a process to manage such conflicts.
According to the summary in the EVS catalogue, EN 50126-1 applies to command, control and signalling, rolling stock and fixed installations, from complete systems down to components, including software. It covers new systems, integration into existing systems and modifications. It does not set RAMS targets for specific applications, nor does it define certification rules or an approval process. An amendment (A1) to the 2017 edition was added in 2024; the consolidated text has been valid since 2 December 2024.
How do EN 50126, EN 50128 and EN 50129 work together?
The three standards can be read as a chain that runs from the big picture down to the detail:
- EN 50126 (system): identifies hazards, assesses risk, determines how much risk reduction is needed against acceptance criteria and defines the system safety requirements. The introduction to EN 50716 summarises this systematic approach in five steps: hazard identification, necessary risk reduction, safety requirements, choice of architecture and planning to reach a validated safety integrity level.
- EN 50129 (signalling electronics): covers safety-related electronic systems, subsystems and equipment. According to the 2026 edition, it addresses functional safety only, leaves out other aspects such as occupational health, and focuses on phases 4 (specification of system requirements) to 10 (system acceptance) of the EN 50126-1 life cycle.
- EN 50716 (software): sets requirements for developing, deploying and maintaining software, as well as for organisational structure, division of responsibility and personnel competence.
The international counterpart of EN 50129 is IEC 62425. In the second edition of IEC 62425, published in May 2025, the requirements for the structure and content of the safety case were moved into a dedicated clause. The safety case is the set of documents that demonstrates, with evidence, that the system is safe, and it is the basis for independent assessment in rail projects.
Has EN 50128 been withdrawn, and what replaced it?
Yes. EN 50716:2023, approved by CENELEC on 30 October 2023, supersedes according to its foreword EN 50128:2011 and EN 50657:2017 (the rolling stock software standard), together with all their amendments. The latest date for national standards bodies to withdraw conflicting national standards was 30 October 2026. The new standard brings signalling software and on-board software under one roof.
One point matters: according to the text of the standard, EN 50716 is not intended to be retrospective. It applies primarily to new developments; it applies in full to existing systems only when they undergo major modification, and for minor changes only a single clause applies. In other words, the standard does not require unchanged existing software to be revisited on its own; but for new projects, it is worth checking which standard contracts and technical specifications refer to.
What is SIL and how is it used on the railway?
According to the functional safety FAQ of the International Electrotechnical Commission (IEC), a safety integrity level is one of four levels, each corresponding to a range of target likelihood of failure of a safety function. The distinction IEC draws is important: SIL is a property of the safety function, not of a system. A "SIL 4 device" only means something once it is clear which function it performs and under what conditions.
EN 50716 applies this structure to software and defines five levels: Basic Integrity and SIL 1 to 4. According to the standard:
- The techniques required for SIL 1 are the same as for SIL 2, and those for SIL 3 the same as for SIL 4.
- For functions with a safety impact below SIL 1, at least the Basic Integrity requirements apply; for non-safety functions a software quality assurance process is used.
- An assessor is appointed for SIL 1 to 4; no independent assessment is required for Basic Integrity.
- The standard does not decide which level suits which risk; that decision is made in the EN 50126 process.
Where should rail projects start?
The steps below are not a standard but a practical sequence:
- Fix the editions: Does the specification call for EN 50128 or EN 50716? Is the 2018 or the 2026 edition of EN 50129 the reference?
- Set up the life cycle from day one: If the RAMS plan, hazard log and verification plan are not prepared at the start, writing a safety case later becomes very hard.
- Tie SIL to the function: Derive the required level for each safety function from risk analysis; do not accept a product's catalogue SIL label automatically.
- Plan independence: The required independence of the assessor and verification team varies with the level; build the team structure accordingly.
For the machinery counterpart, see our article on ISO 13849-1 and IEC 62061.
Conclusion: is RAMS a document or an engineering discipline?
RAMS is a discipline that manages the reliability, availability, maintainability and safety of a railway system together, from project start to acceptance. EN 50126 governs the process, EN 50129 the signalling electronics and EN 50716 the software, and the family has been renewed since 2023. A practical recommendation: before a project starts, fix in writing which editions apply, and keep the SIL allocation of every safety function tied to risk analysis.
"Functional Safety and RAMS (Railway)" is part of Orient Global's corporate training catalogue; details are on the trainings page.
#interimmanagement #forwarddeployedengineering #rams #functionalsafety #railway