Topic · EN 50128

What is EN 50128, and how do I keep railway software true in CI?

Gist

EN 50128 is CENELEC software for railway control and protection. SIL 0 through 4 is the cost ladder, not a badge on the safety case. Proof runs Kind2 on those shalls with proof realize, then fails the merge when the graph is stale.

proof realize specs/system ./... --diagnose

Keep the notified-body assessment if you need a certificate. Keep LDRA or VectorCAST if a qualified C toolchain has to stamp structural coverage. Proof is not that certificate, and it is not EN 50126 RAMS.

Request demo Last SIL pack vs this graph

01 · Railway, not the industrial parent

IEC 61508 is the parent. EN 50128 is the interlocking that has to stay true after this push.

A route-setting function, an ATP kernel, a interlocking Boolean. Same SIL idea. Different document. Last year's safety case does not reopen Kind2 on this commit.

The industrial parent lives on IEC 61508. Automotive is ISO 26262. Airborne software is DO-178C-style when you are not certifying, and DO-333 for the formal-methods supplement. This page is the railway software document: run Kind2 on the shalls you already gate, then fail the merge when they go stale.

IEC 62279 is the IEC republication of the same text. EN 50657 is onboard rolling-stock software. One URL. EN 50126 is RAMS at system level. EN 50129 is the electronic safety case. Proof does not write those. SIL 0 through 4 is still your classification. Formal methods get more recommended as SIL rises. Kind2 realizability is that method on the shalls you actually wrote.

proof validate --preflight
proof realize specs/system ./... --diagnose
proof audit --fail-level warn

The first command rejects a sentence the templates cannot parse. The second is Kind2 on the loaded shalls, with a counterexample when they cannot all be true. The third is the standing gate. A green suite on last year's SIL pack is how the contradiction survived the interlocking change.

02 · The exhibit

Same SIL on the safety case. A date, or this graph.

The pack still says SIL 4. The shalls moved. Click the tabs.

Word / NoBo pack

Cover SIL 4 from last assessment
SW-SSR-9 still in the appendix

Sections present

This push

Two shalls now contradict. The pack did not reopen Kind2.

No diagnose

Word / NoBo pack

Still last assessment. Still a date.

Keep the certificate path

Proof

Ask are the shalls co-satisfiable
Gate audit --fail-level warn

Merge blocked if Kind2 returns a counterexample

Same SIL on the safety case. A date, or this graph. Click the tabs.

Who	What they notice	What they lose
EN 50128 / CENELEC	Railway control and protection software. SIL 0 through 4. Formal methods at the high SILs.	They write the requirement. Keep them. Proof does not replace the standard and is not a qualified tool.
EN 50126 / EN 50129	System RAMS, and the electronic safety case	Different H1s. Proof does not run RAMS or write the safety case.
IEC 61508	Parent industrial functional safety. Part 3 is software.	Different H1. The parent lives on IEC 61508.
VectorCAST / LDRA	A qualified C toolchain and structural coverage of object code	They still win when a notified body stamps the kit. Proof measures the Go you ship. C stays with them.
Proof	Kind2 on this tree, then the same audit on every push	No SIL assignment. No EN 50126. FLIP MC/DC is specification-level. Tests are not executed.

SIL 4 programmes still want structural coverage, including MC/DC in many interlocking kernels. That instrument is a different command:

proof mcdc measure ./... --engine go
proof audit --fail-level warn

Unknown requirement language fails before the solver. A thin graph makes a thin check. Treat the Kind2 result as a view of the shalls, not as a second source of SIL. We have not run this against a frozen EN 50128 corpus, and we have not scored it against LDRA or VectorCAST on the same pack. The loss is named, not scored.

03 · The honest loss

A green Proof audit is not EN 50128 credit.

Credit under the standard requires a qualified tool and a human who can sign. Proof is not that qualification. A named reviewer is not a notified body.

Proof does not pick a SIL. SIL 0 through 4 are your classification. We measure the shalls in the tree you pointed at. We do not map that measurement onto a SIL table and call it done. Object-code coverage on C still wants the qualified toolchain. That H1 lives on MC/DC for Go and on Proof vs LDRA. Proof generates inputs. It does not run them. Keep go test.

EN 50126 is RAMS. EN 50129 is the electronic safety case. EN 50657 is onboard rolling stock. IEC 62279 is the same software text under an IEC number. Those stay FAQs on this URL. IEC 61508 is the parent industrial standard; that H1 lives on IEC 61508. Jama still authors.

Request demo How the install is bought

04 · Nearby questions

What people type next.

What is IEC 62279? The IEC republication of EN 50128. Same cluster. This URL.

What is EN 50657? Onboard rolling-stock software. Related, not a twin. Keep it as a mention here until a distinct product surface exists.

What is EN 50126? Railway RAMS at system level. Proof does not run reliability, availability, maintainability, or safety analysis. Keep the RAMS engineer.

What is EN 50129? The electronic safety case for signalling. Proof does not write it.

What is IEC 61508? Parent industrial functional safety. Different H1. IEC 61508.

What is DO-178C-style verification outside aerospace? The four jobs, not the Type Certificate. DO-178C-style.

How do I measure MC/DC coverage for my Go code? The instrument, not the standard. MC/DC for Go.

What is a requirements traceability matrix, and how do I keep it true? EN 50128 still wants the links re-derived, not pasted. RTM.