EN 50159:2026

• Abstract:

  This document is applicable to safety-related electronic systems using for digital communication purposes a transmission system which was not necessarily designed for safety-related applications. For transmission systems where the risk of unauthorized access is not negligible, the document defines the interface to the applicable cybersecurity standards. Both safety-related equipment and non-safety-related equipment can be connected to the transmission system. This document gives the specific requirements needed to achieve safety-related communication between safety-related equipment connected to the transmission system, while the general system requirements including allocation of safety requirements and content of the safety case are defined in EN 50129. This document is not applicable to existing systems which had already been accepted prior to the release of this document. However, so far as reasonably practicable, it is applicable to modifications and extensions to existing systems, subsystems and equipment. This document does not specify: - the transmission system; - equipment connected to the transmission system; - solutions (e.g. for interoperability); - which kind of data are safety-related and which are not. A safety-related equipment connected through an open transmission system can be subjected to many different cybersecurity threats, against which an overall program is defined encompassing management, technical and operational aspects.

• Status: Published
• Publication Date: 09-Jul-2026
• ICS: 35.240.60 - IT applications in transport
• ICS: 45.020 - Railway engineering in general
• Technical Committee: CLC/TC 9X - Electrical and electronic applications for railways
• Drafting Committee: CLC/SC 9XA - Communications, signalling and processing systems
• Current Stage: 6060 - Document made available - Publishing
• Start Date: 10-Jul-2026
• Due Date: 08-Jul-2026
• Completion Date: 10-Jul-2026
• Mandate: M/591 - Standardisation request to the European Committee for Standardisation and the European Committee for Electrotechnical Standardisation as regards railway products in support of Directive (EU) 2016/797
• Ref Project: SIST EN 50159:2026 - Railway Applications - Communication, signalling and processing systems - Safety-related communication in transmission systems

• Replaces: EN 50159:2010 - Railway applications - Communication, signalling and processing systems - Safety-related communication in transmission systems
• Effective Date: 23-Jan-2024
• Replaces: EN 50159:2010/A1:2020 - Railway applications - Communication, signalling and processing systems - Safety-related communication in transmission systems
• Effective Date: 23-Jan-2024
• Referred By: EN 16704-2-1:2016 - Railway applications - Track - Safety protection on the track during work - Part 2-1: Common solutions and technologies - Technical requirements for Track Warning Systems (TWS)
• Effective Date: 14-Jul-2026

Overview

EN 50159:2026 is a critical European standard developed by CLC for ensuring the safety of digital communications used in railway applications, focusing on communication, signalling, and processing systems. This standard provides requirements for achieving safety-related communication over transmission systems not originally intended for safety-critical scenarios, such as open network infrastructures. It addresses both safety-related equipment and non-safety-related equipment interconnected through these digital transmission systems, offering guidelines vital for railway systems integrators, manufacturers, and operators. EN 50159:2026 aims to protect train control, signalling, and other essential functions from communication-related hazards and unauthorized access risks.

Key Topics

• Scope and Applicability: EN 50159:2026 is applicable to new and modified railway systems where safety-related digital communication occurs over both closed and open transmission systems. It is not retroactive, but applies to extensions or changes made to pre-existing systems.
• Transmission System Classification: The standard classifies transmission systems into three categories:
  • Category 1: Closed systems with fixed, known participants and negligible risk of unauthorized access.
  • Categories 2 & 3: Open systems, with Category 3 specifically involving a non-negligible risk of unauthorized access.
• Safety-related Communication Requirements: EN 50159:2026 defines how to achieve authenticity, integrity, timeliness, and correct sequencing of safety-related messages, irrespective of whether the transmission medium was originally designed for safety applications.
• Cybersecurity Considerations: For transmission systems with substantial risk of unauthorized access (typically open networks), the standard interfaces with other railway-specific cybersecurity standards, ensuring both technical and operational defences are coordinated.
• Hazard Analysis: The document details processes for identifying and mitigating hazards arising from transmission systems, covering both systematic and random failures, potential cyber attacks, human errors, and natural events.

Applications

EN 50159:2026 is widely applicable across various domains of railway technology, enhancing functional safety and cybersecurity in:

• Train Control and Signalling: Ensures safe and reliable communication between interlockings, trackside equipment, and onboard control units via digital networks, supporting the deployment of advanced train control systems.
• Automatic Train Operation (ATO): Offers a framework for safe digital communication within automated systems, including those with mixed safety-related and non-safety-related equipment.
• Maintenance and Diagnostics: Applies to systems transmitting safety and maintenance information to remote facilities, enhancing overall operational safety.
• System Upgrades and Integrations: Guides the safe integration of new technologies into existing railway infrastructure, especially when communications are migrated onto open networks or shared IT environments.
• Cybersecurity Implementation: Assists railway operators in addressing cybersecurity threats, providing the interface for the deployment of applicable cybersecurity controls alongside functional safety elements.

Related Standards

• EN 50129: Covers general system requirements, including the allocation of safety requirements and the structure of the safety case for railway signalling systems.
• CLC/TS 50701: Specifies cybersecurity requirements for railway applications, closely interfaced with EN 50159 where cybersecurity risks are non-negligible.
• IEC 63452: Addresses cybersecurity in rail applications, complementing the safety-related aspects highlighted in EN 50159:2026.
• EN 50126 / EN 50128: Define broader concepts of RAMS (Reliability, Availability, Maintainability, Safety) management and software lifecycle procedures relevant to railway applications.

Practical Value

Implementing EN 50159:2026 is essential for:

• Ensuring end-to-end safety and integrity in digital railway communication, especially over non-dedicated or public network infrastructures.
• Mitigating hazards and risks stemming from technical failures and cybersecurity threats, directly supporting regulatory compliance.
• Improving the interoperability and safe extension of existing railway systems in line with the latest European and international standards.
• Enabling safe digital transformation in the railway industry, supporting modern operational scenarios involving open networks and mixed criticality applications.

By aligning with EN 50159:2026, railway organizations enhance passenger safety, maintain system resilience, and fulfill both functional safety and cybersecurity obligations.

SLOVENSKI STANDARD
01-oktober-2026
Železniške naprave - Komunikacijski, signalni in procesni sistemi - Varnostna
komunikacija v prenosnih sistemih
Railway Applications - Communication, signalling and processing systems - Safety-
related communication in transmission systems
Bahnanwendungen - Telekommunikationstechnik, Signaltechnik und
Datenverarbeitungssysteme - Sicherheitsrelevante Kommunikation in
Übertragungssystemen
Applications ferroviaires - Systèmes de signalisation, de télécommunication et de
traitement - Communication de sécurité sur des systèmes de transmission
Ta slovenski standard je istoveten z: EN 50159:2026
ICS:
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN 50159
NORME EUROPÉENNE
EUROPÄISCHE NORM July 2026
ICS 35.240.60; 45.020 Supersedes EN 50159:2010; EN 50159:2010/A1:2020
English Version
Railway applications - Communication, signalling and processing
systems - Safety-related communication in transmission systems
Applications ferroviaires - Systèmes de signalisation, de Bahnanwendungen - Telekommunikationstechnik,
télécommunication et de traitement - Communication de Signaltechnik und Datenverarbeitungssysteme -
sécurité sur des systèmes de transmission Sicherheitsrelevante Kommunikation in
Übertragungssystemen
This European Standard was approved by CENELEC on 2026-06-15. CENELEC members are bound to comply with the CEN/CENELEC
Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.
Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC
Management Centre or to any CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation
under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the
same status as the official versions.
CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic,
Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the
Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Türkiye and the United Kingdom.

European Committee for Electrotechnical Standardization
Comité Européen de Normalisation Electrotechnique
Europäisches Komitee für Elektrotechnische Normung
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2026 CENELEC All rights of exploitation in any form and by any means reserved worldwide for CENELEC Members.
Ref. No. EN 50159:2026 E
Contents Page
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms, definitions and abbreviations . 5
3.1 Terms and definitions . 5
3.2 Abbreviations . 15
4 Reference architecture . 16
5 Hazards arising from the transmission system. 18
6 Classification of transmission systems . 20
6.1 General . 20
6.2 General aspects of classification . 20
6.3 Specific aspects for the classification of transmission systems . 20
6.4 Relationship between transmission systems and basic message errors . 21
7 Requirements for safety defences . 22
7.1 Preface . 22
7.2 General requirements . 22
7.3 Specific defences . 24
7.4 Applicability of defences . 30
Annex A (informative) Hazards arising from transmission systems . 31
A.1 System view . 31
A.2 Derivation of the basic message errors . 32
A.3 Network failure modes . 33
A.4 A possible approach for hazard identification . 35
A.5 Conclusions . 39
Annex B (informative) Categories of transmission systems . 41
B.1 Categories of transmission systems . 41
B.2 Relationship between Categories of transmission systems and basic message errors . 42
B.3 Guidance for the determination of the transmission system category . 42
Annex C (informative) Guideline for defences . 44
C.1 Applications of time stamps . 44
C.2 Choice and use of safety codes and cryptographic algorithms . 45
C.3 Safety code . 50
C.4 Length and quality of safety code . 52
C.5 Communication between safety-related and non-safety-related applications . 55
C.6 Deriving requirements for cybersecurity defences . 56
Annex D (informative) Guidance for a Change Management Process of Railway Duty Holders . 60
D.1 Handling of changes in transmission systems . 60
D.2 Process for changes in transmission systems . 60
Bibliography . 63
European foreword
This document (EN 50159:2026) has been prepared by CLC/SC 9XA “Communication, signalling and
processing systems”.
The following dates are fixed:
• latest date by which this document has to be (dop) 2027-07-31
implemented at national level by publication of
an identical national standard or by
endorsement
• latest date by which the national standards (dow) 2029-07-31
conflicting with this document have to be
withdrawn
This document supersedes EN 50159:2010 and all of its amendments and corrigenda.
Requirements and guidance have been added on the following topics:
— Clause 3: harmonization of terminology, in particular with cybersecurity domain;
— Clauses 4 and 7.2: generalization to cover mixed safety integrity contexts;
— Clauses 6 and 7.2: coordination of cybersecurity requirements for Category 3 transmission systems;
— Clause C.6: guidance on separation between safety and cybersecurity;
— Annex D: guidance on the change management process for railway duty holders.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. CENELEC shall not be held responsible for identifying any or all such patent rights.
Any feedback and questions on this document should be directed to the users’ national committee. A
complete listing of these bodies can be found on the CENELEC website.
Introduction
If a safety-related electronic system involves communication of information, the transmission system forms an
integral part of the safety-related system and it is understood that the communication is safe in accordance
with EN 50129, with respect to random and systematic faults.
The transmission system considered in this document, which serves the transfer of information between
different locations, has in general no particular preconditions to satisfy. It is from the safety point of view not
trusted or not fully trusted.
This document is dedicated to the requirements to be taken into account for the communication of safety-
related information over such transmission systems.
Although the RAM aspects are not considered in this document, it is recommended to keep in mind that they
are a major aspect of the operational safety.
The safety requirements depend on the characteristics of the transmission system. In order to reduce the
complexity of the approach to demonstrate the safety of the system, transmission systems have been
classified into three categories:
— Category 1: closed transmission systems;
— Category 2 and Category 3: open transmission systems.
For safety purposes application messages using Category 3 transmission systems need protection against
unauthorized access that can corrupt the integrity of data. This document only provides general requirements
to protect in case of Category 3 transmission systems. For a complete set of cybersecurity requirements,
specific cybersecurity standards are applicable.
1 Scope
This document is applicable to safety-related electronic systems using for digital communication purposes a
transmission system which was not necessarily designed for safety-related applications. For transmission
systems where the risk of unauthorized access is not negligible, the document defines the interface to the
applicable cybersecurity standards.
Both safety-related equipment and non-safety-related equipment can be connected to the transmission
system.
This document gives the specific requirements needed to achieve safety-related communication between
safety-related equipment connected to the transmission system, while the general system requirements
including allocation of safety requirements and content of the safety case are defined in EN 50129.
This document is not applicable to existing systems which had already been accepted prior to the release of
this document. However, so far as reasonably practicable, it is applicable to modifications and extensions to
existing systems, subsystems and equipment.
This document does not specify:
— the transmission system;
— equipment connected to the transmission system;
— solutions (e.g. for interoperability);
— which kind of data are safety-related and which are not.
A safety-related equipment connected through an open transmission system can be subjected to many
different cybersecurity threats, against which an overall program is defined encompassing management,
technical and operational aspects.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
EN 50129, Railway applications - Communication, signalling and processing systems - Safety related
electronic systems for signalling
CLC/TS 50701:2023, Railway applications - Cybersecurity
EN IEC 63452, Railway applications – Cybersecurity (IEC 63452)
3 Terms, definitions and abbreviations
3.1 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
— IEC Electropedia: available at https://www.electropedia.org

Under preparation. Stage at the time of publication: prEN IEC 63452:2025.
3.1.1
absolute time stamp
time stamp referenced to a global time which is common for a group of entities using a transmission system
[SOURCE: IEC 60050-821:2017, 821-11-01]
3.1.2
access control
protection of system resources against unauthorized access
Note 1 to entry: Unauthorized access can be physical or logical. In this document, this definition applies only to logical
access to data transmission.
[SOURCE: CLC/TS 50701:2023, 3.1.3, modified — Note 1 to entry has been added.]
3.1.3
additional data
data which are not of any use to the ultimate user processes, but are used for control, availability, and safety
purposes
[SOURCE: IEC 60050-821:2017, 821-11-03]
3.1.4
attack
attempt to gain access to an information processing system in order to produce damage
Note 1 to entry: The damage can be e.g. destruction, disclosure, alteration, disruption, unauthorized use.
Note 2 to entry: In this document, this definition applies only to data transmission.
[SOURCE: CLC/TS 50701:2023, 3.1.12, modified — Note 2 to entry has been added.]
3.1.5
authentic message
message in which information is known to have originated from the stated source
[SOURCE: IEC 50050-821:2017, 821-11-04]
3.1.6
authenticity
state in which information is known to have originated from the stated source
[SOURCE: IEC 60050-821:2017, 821-11-05, modified — “valid and” has been removed.]
3.1.7
basic message error
message error such as repetition, deletion, insertion, re-sequencing, corruption, delay and masquerade
3.1.8
closed transmission system
transmission system with a fixed number or fixed maximum number of participants having well-known and
fixed properties, and where the risk of unauthorized access is negligible
[SOURCE: IEC 60050-821:2017, 821-11-06, modified – “transmission system with a” has been added. “linked
by a transmission system with” has been replaced with “having”. “considered” has been removed.]
3.1.9
communication
information transfer according to agreed conventions
[SOURCE: IEC 60050-701:2016, 701-01-04]
3.1.10
conduit
logical grouping of communication channels, connecting two or more zones, that share
common security requirements
Note 1 to entry: A conduit is allowed to traverse a zone as long as the security of the channels contained within the conduit
is not impacted by the zone.
[SOURCE: EN IEC 62443-4-2:2019, 3.1.11]
3.1.11
confidentiality
assurance that information is not disclosed to unauthorized individuals, processes, or devices
[SOURCE: CLC/TS 50701:2023, 3.1.27]
3.1.12
corrupted message
type of message error in which a data corruption occurs
[SOURCE: IEC 60050-821:2017, 821-11-08]
3.1.13
countermeasure
action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by
eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that
corrective action can be taken
[SOURCE: CLC/TS 50701:2023, 3.1.1, modified – Note 1 to entry has been omitted.]
3.1.14
cryptographic algorithm
algorithm based on the science of cryptography, including encryption algorithms, cryptographic hash
algorithms, digital signature algorithms, and key agreement algorithms
[SOURCE: IEC/TS 62443-1-1:2009, 3.2.3, modified - “upon” has been replaced with “on”.]
3.1.15
cryptographic safety code
safety code based on a cryptographic algorithm
Note 1 to entry: A cryptographic safety code can be based on a cryptographic algorithm, which exhibits weaknesses with
regards to security. In the safety context only the properties for error detection of the cryptographic safety code are
relevant (rather than resistance to intentional attacks).
3.1.16
cybersecurity
set of activities and measures taken with the objective to identify, protect against, detect,
respond to, and recover from unauthorized access or cyberattack which could lead to an accident, an unsafe
situation, or railway application performance degradation
Note 1 to entry: It is recognized that the term “cybersecurity” has a broader meaning in other standards and guidance,
often including non-malevolent threats, human errors, and protection against natural disasters. Those aspects, except
human errors degrading security controls, are not included in this document.
[SOURCE: CLC/TS 50701:2023, 3.1.32]
3.1.17
cyclic redundancy check
cyclic code used to protect messages from the influence of data
corruption
[SOURCE: IEC 60050-821:2017, 821-11-10]
3.1.18
data
part of a message which represents some information
Note 1 to entry: See also user data, additional data, redundant data.
[SOURCE: IEC 60050-821:2017, 821-11-11, modified – Note 1 to entry has been added.]
3.1.19
data corruption
alteration of data
[SOURCE: IEC 60050-821:2017, 821-11-13]
3.1.20
defence
measure incorporated in the design of a safety-related communication system to counter particular hazards
[SOURCE: IEC 60050-821:2017, 821-11-14, modified – “safety” has been replaced with “safety-related”.
“threats” has been replaced with “hazards”.]
3.1.21
delayed message
type of message error in which a message is received at a time later than intended
[SOURCE: IEC 60050-821:2017, 821-11-15]
3.1.22
deleted message
type of message error in which a message is removed from the message stream
[SOURCE: IEC 60050-821:2017, 821-11-16]
3.1.23
double time stamp
case when two entities exchange and compare their time stamps
Note 1 to entry: In this case the time stamps in the entities are independent of each other.
[SOURCE: IEC 60050-821:2017, 821-11-17]
3.1.24
encryption
transformation of data in order to hide their semantic content using cryptography
Note 1 to entry: The reverse process is called decryption.
Note 2 to entry: In former version of this document the term “enciphering” was used.
[SOURCE: IEC 60050-171:2019, 171-08-09, modified — Note 2 to entry has been added.]
3.1.25
error
discrepancy between a computed, observed or measured value or condition and the true, specified or
theoretically correct value or condition
Note 1 to entry: An error can be caused by a faulty item, e.g. a computing error made by faulty computer equipment.
Note 2 to entry: A human error can be seen as a human action or inaction that can produce an unintended result.
[SOURCE: IEC 60050-192:2024, 192-03-02, modified – Notes 1 and 2 to entry have been modified.]
3.1.26
failure
loss of ability to perform as required
Note 1 to entry: Qualifiers, such as catastrophic, critical, major, minor, marginal and insignificant, can be used to
categorize failures according to the severity of consequences, the choice and definitions of severity criteria depending
upon the field of application.
Note 2 to entry: Qualifiers, such as misuse, mishandling and weakness, can be used to categorize failures according to
the cause of failure.
Note 3 to entry: “Failure” is an event, as distinguished from “fault”, which is a state.
[SOURCE: IEC 60050-821:2017, 821-11-19, modified – “may” has been changed with “can” in notes 1 and 2
to entry. Note 3 to entry has been added.]
3.1.27
fault
abnormal condition that could lead to an error in a system
Note 1 to entry: A fault can be random or systematic.
[SOURCE: IEC 60050-821:2017, 821-11-20]
3.1.28
feedback message
response from a receiver to the sender, via a return channel
[SOURCE: IEC 60050-821:2017, 821-11-21]
3.1.29
hazard
condition that can lead to an accident
[SOURCE: EN 50129:2018, 3.1.21, modified – Note 1 to entry has been omitted.]
3.1.30
hazard analysis
process of identifying hazards and analysing their causes, and the derivation of requirements to limit the
likelihood and consequences of hazards to a tolerable level
[SOURCE: IEC 60050-821:2017, 821-11-23]
3.1.31
hazardous event
event that can cause harm
Note 1 to entry: A hazardous event can occur over a short period of time or over an extended period of time.
[SOURCE: IEC 60050-903:2013, 903-01-04]
3.1.32
implicit data
additional data that is not transmitted but is known to the sender and receiver
[SOURCE: IEC 60050-821:2017, 821-11-12]
3.1.33
information
knowledge concerning objects, such as facts, events, things, processes, or ideas (including concepts) that,
within a certain context, has a particular meaning
Note 1 to entry: Information can be represented for example by signs, symbols, pictures or sounds.
[SOURCE: IEC 60050-171:2019, 171-01-01]
3.1.34
inserted message
type of message error in which an additional message is implanted in the message stream
[SOURCE: IEC 60050-821:2017, 821-11-25, modified – “type of message error in which an” and “is” have
been added. “which leads to an error” has been removed.]
3.1.35
integrity
state in which information is complete and not altered
[SOURCE: IEC 60050-821:2017, 821-11-26]
3.1.36
manipulation detection code
function of the whole message without a secret key
Note 1 to entry: In contrast to a MAC there is no secret key involved. By the whole message is meant also any implicit
data of the message which are not sent to the transmission system. The MDC is often based on a hash function.
[SOURCE: IEC 60050-821:2017, 821-11-27, modified – Some editorial corrections in the note 1 to entry.]
3.1.37
masqueraded message
type of inserted message in which a non-authentic message is intentionally designed to appear to be
authentic
[SOURCE: IEC 60050-821:2017, 821-11-28, modified – “non-authentic” has been replaced with “type of”.
“which is” has been replaced with “in which a non-authentic message is intentionally”.]
3.1.38
message
information which is transmitted in one or several packets from a sender to one or
more receivers
[SOURCE: IEC 60050-821:2017, 821-11-29]
3.1.39
message authentication code
cryptographic function of the whole message and a secret or public key
Note 1 to entry: By the whole message is meant also any implicit data of the message which is not sent to the
transmission system.
[SOURCE: IEC 60050-821:2017, 821-11-30, modified – Some editorial corrections in the note 1 to entry.]
3.1.40
message errors
set of all possible message failure modes which can lead to potentially dangerous situations, or to reduction in
system availability
Note 1 to entry: There can be a number of causes of each type of error.
[SOURCE: IEC 60050-821:2017, 821-11-32]
3.1.41
message integrity
message in which information is complete and not altered
[SOURCE: IEC 60050-821:2017, 821-11-33]
3.1.42
message stream
ordered set of messages
[SOURCE: IEC 60050-821:2017, 821-11-34]
3.1.43
negligible risk
risk which is so low that it is not reasonable to implement additional measures
Note 1 to entry: The risk of unauthorized access to the transmission system can be treated as negligible if the location
and physical security of all points at which an item of equipment could be connected to the transmission system is such
that it is not credible that a potential attacker could gain access.
Note 2 to entry: Negligible risks are considered as insignificant and adequately controlled without defining further
requirements.
3.1.44
open transmission system
transmission system with an unknown number of participants, having unknown, variable and non-trusted
properties, used for unknown telecommunication services and having the potential for unauthorized access
Note 1 to entry: In this document an open transmission system designates a transmission system of Category 2 or
Category 3.
[SOURCE: IEC 60050-821:2017, 821-11-36, modified – Note 1 to entry has been added.]
3.1.45
railway duty holder
body with the overall accountability for operating a railway system within the legal framework
Note 1 to entry: Railway duty holder accountabilities for the overall system or its parts and life cycle activities are
sometimes split between one or more bodies or entities. For example:
— the owner(s) of one or more parts of the system assets and their purchasing agents;
— the operator of the system;
— the maintainer(s) of one or more parts of the system.
Note 2 to entry: Typically, the railway duty holders are railway undertakings and the infrastructure managers. Such splits
are based on either statutory instruments or contractual agreements. Such responsibilities are defined at the earliest
stages of a system life cycle.
[SOURCE: EN 50126-1:2017, 3.48]
3.1.46
random failure
failure that occurs randomly in time
[SOURCE: IEC 60050-821:2017, 821-11-38]
3.1.47
redundancy check
type of check that a predefined relationship exists between redundant data and user data within a message, to
prove message integrity
[SOURCE: IEC 60050-821:2017, 821-11-39]
3.1.48
redundant data
additional data, derived from the user data, by a safety-related transmission function
[SOURCE: IEC 60050-821:2017, 821-11-40]
3.1.49
relative time stamp
time stamp referenced to the local clock of an entity
Note 1 to entry: In general, there is no relationship to clocks of other entities.
[SOURCE: IEC 60050-821:2017, 821-11-41]
3.1.50
repeated message
type of message error in which a single message is received more than once
[SOURCE: IEC 60050-821:2017, 821-11-42]
3.1.51
re-sequenced message
type of message error in which the order of messages in the message stream is changed
[SOURCE: IEC 60050-821:2017, 821-11-43]
3.1.52
safe fall-back state
safe state of a safety-related equipment or system as a deviation from the fault-free state and as a result of a
safety reaction leading to a reduced functionality of safety-related functions, possibly also of non-safety-
related functions
[SOURCE: IEC 60050-821:2017, 821-11-44, modified – “and possibly” has been replaced with “possibly”.
“non-safety-related” has been replaced with “non-safety-related”.]
3.1.53
safety
freedom from unacceptable risk
[SOURCE: IEC 60050-903:2013, 903-01-19]
3.1.54
safety case
documented demonstration that the product (e.g. a system, subsystem or equipment) complies with the
specified safety requirements
[SOURCE: IEC 60050-821:2017, 821-12-53]
3.1.55
safety code
redundant data included in a safety-related message to permit data corruptions to be detected by the safety-
related transmission function
Note 1 to entry: Also, codes based on cryptographic algorithms can be used as safety codes such as hash block codes
or MAC with fixed keys. For such cryptographic safety codes the same requirements apply.
[SOURCE: IEC 60050-821:2017, 821-11-45, modified – Note 1 to entry has been added.]
3.1.56
safety integrity level
one of a number of defined discrete levels for specifying the safety integrity requirements of safety-related
functions allocated to the safety-related systems
3.1.57
safety reaction
safety-related protection taken by the safety process in response to an event (such as a failure of the
transmission system), which can lead to a safe fall back state of the equipment
[SOURCE: IEC 60050-821:2017, 821-11-47]
3.1.58
safety-related
carries responsibility for safety
Note 1 to entry: A function, component, product, system, or procedure is called safety-related if at least one of its
properties is used in the safety argument for the system in which it is applied. These properties can be of functional or
non-functional nature.
[SOURCE: IEC 60050-821:2017, 821-01-73, modified – Note 1 to entry has been added.]
3.1.59
safety-related transmission function
function incorporated in the safety-related equipment to ensure authenticity, integrity, timeliness and sequence
of data
3.1.60
sequence number
number that changes in a predefined way from message to message
[SOURCE: IEC 60050-821:2017, 821-11-48, modified - “additional data field containing a” has been removed.]
3.1.61
source and destination identifier
identifier which is assigned to each entity
Note 1 to entry: This identifier can be a name, number or arbitrary bit pattern. This identifier will be used for the safety-
related communication.
Note 2 to entry: Usually the identifier is added to the user data.
[SOURCE: IEC 60050-821:2017, 821-11-49, modified – Notes 1 and 2 to entry have been modified.]
3.1.62
systematic failure
failure that occurs repeatedly under some particular combination of inputs, or under some particular
environmental condition
[SOURCE: IEC 60050-192:2015, 192-03-10, modified – “consistently” has been removed. “under particular
conditions of handling, storage or use” has been replaced with “repeatedly under some particular combination
of inputs, or under some particular environmental condition”. Notes 1 and 2 to entry have been omitted.]
3.1.63
threat
circumstance or event with the potential to adversely affect operations (including mission,
functions, image or reputation), assets, control systems or individuals via unauthorized access, destruction,
disclosure, modification of data or denial of service
Note 1 to entry: In this document, this definition applies only to data transmission.
[SOURCE: CLC/TS 50701:2023, 3.1.84, modified — “and/or” has been replaced with “or”. Note 1 to entry has
been added.]
3.1.64
time stamp
representation of information concerning time of transmission attached to a message by the sender
[SOURCE: IEC 60050-821:2017, 821-11-52, modified – “representation of” has been added.]
3.1.65
timeliness
state in which information is available at the right time according to the requirements
[SOURCE: IEC 60050-821:2017, 821-11-53]
3.1.66
tolerable risk
risk which is accepted in a given context based on the current values of society
Note 1 to entry: The terms “acceptable risk” and “tolerable risk” are considered to be synonymous.
[SOURCE: IEC 60050-903:2013, 903-01-12, modified – Note 1 to entry has been added.]
3.1.67
transmission code
redundant representation of information, added to the safety and non-safety message of the transmission
system in order to ensure the integrity of the message during transmission
[SOURCE: IEC 60050-821:2017, 821-11-54, modified – “representation of” has been added. “non-safety” has
been replaced with “non-safety”. ”non-trusted” has been removed. “during the transmission” has been
replaced with “during transmission”.]
3.1.68
transmission system
service used by the application to communicate
message streams between a number of participants, who are sources or sinks of information
[SOURCE: IEC 60050-821:2017, 821-11-55, “can be“ has been replaced by “are”.]
3.1.69
trusted
which has properties used as evidence to support the safety demonstration
3.1.70
unauthorized access
situation in which user information or information within the transmission system is accessed or changed by
unauthorized persons
[SOURCE: IEC 60050-821:2017, 821-11-56, modified – “, or accessed and changed” and “or hackers” have
been removed.]
3.1.71
user data
data which represent the states or events of a user process, without any additional data
Note 1 to entry: In case of communication between safety-related equipment, the user data contains safety-related data.
[SOURCE: IEC 60050-821:2017, 821-11-57]
3.1.72
valid message
message whose form meets in all respects the specified user requirements
[SOURCE: IEC 60050-821:2017, 821-11-58]
3.1.73
validity
state of meeting in all respects the specified user requirements
[SOURCE: IEC 60050-821:2017, 821-11-59]
3.2 Abbreviations
For the purpose of this document, the following abbreviations apply.
BCH Bose Chaudhuri Hocquenghem Code
BME Basic Message Errors
BSC Binary Symmetric Channel
CAN Controller Area Network
CRC Cyclic Redundancy Check
EMI Electromagnetic Interference
FRMCS Future Railway Mobile Communication System
GPRS General Packet Radio Service
GSM-R Global System for Mobile communication – Railways
HE Hazardous Events
HW Hardware
LAN Local Area Network
LoRaWAN Long Range WAN
MAC Message Authentication Code
MDC Manipulation Detection code
MD4, MD5 Message Digest algorithms
MH Main Hazard
MVB Multi-purpose Vehicle Bus
NFC Near Field Communication
PROFIBUS Process Field Bus
QSC q-nary symmetric channel
RAM Reliability, Availability, Maintainability
SIL Safety Integrity Level
SR System Requirement (in Security)
SRAC Safety-Related Application Condition
SW Software
TS Technical Specification
WAN Wide Area Network
4 Reference architecture
This document defines the safety requirements for safe communication between safety-related equipment via
a transmission system, which can either be closed or open. Both safety-related and non-safety-related
equipment can be connected to the transmission system. Clause 4 defines possible configurations of the
safety-related communication in transmission systems including the definition of functional layers involved.
Particular requirements to be fulfilled by these blocks are specified in further clauses.
A combined view of the principal architecture is shown in Figure 1, where all communication elements are
linked according to the information flow to exchange safety-related information between safety-related
equipment (A and B in Figure 1, but perhaps of different safety integrity). The reference architecture also
shows another non-safety-related information exchange (represented by C that can communicate with any
other application X, possibly also A or B).
NOTE 1 Typical use cases could be for diagnostic messages routed to a maintenance centre, lower safety integrity
messages of other applications or even messages with the same safety integrity, but for other applications.
NOTE 2 As a concrete example the train-borne part of an automated train control system can be considered, where all
components are connected to the same train bus as a transmission system. The messages exchanged can be train
control data (usually between SIL 4 functions), automated train operation data (between SIL 2 functions or lower), juridical
recording data (for example between basic integrity functions) and diagnostic data (non-safety-related functions).
Figure 1 — Reference architecture for safety-related communication
Besides the source and destination of safety-related communication, the reference architecture deals with a
safety-related communication system, which can be divided into:
— safety-related transmission functions incorporated in the safety-related equipment. These functions
ensure authenticity, integrity, timeliness and sequence of data;
— safety-related access control functions which protect the safety-related message. These techniques
protect the safety-related message in a Category 3 transmission system against cybersecurity threats
and are not needed in the case of a Category 1 or Category 2 transmission system;
— a non-safety-related, open or closed transmission system which can itself include transmission functions
or access control functions, or both.
The characteristics of closed transmission systems (Category 1) are as follows:
— the number of pieces of connectable equipment – either safety-related or not – to the transmission
system is known and fixed;
— the risk of unauthorized access is negligible;
— the physical characteristics of the transmission system (at least those used in the safety argument e.g.
transmission media, environment according to design hypothesis, etc.) are fixed and unchanged during
the life cycle of the system.
The open transmission system (Category 2 or Category 3) can contain some or all of the following:
— elements which read, store, process or re-transmit data produced and presented by users of the
transmission system in accordance with a program not known to the user. The number of users is
generally unknown, and safety-related and non-safety-related equipment, and equipment which is not
related to railway applications, can be connected to the open transmission system;
— transmission media of any type with transmission characteristics and susceptibility to external influences,
which are unknown to the user;
— network control and management systems capable of routing (and dynamically re-routing) messages via
any path made up from one or more than one type of transmission media between the participants of an
open transmission system, in accordance with a program not completely known to the user;
— other users of the transmission system, not known to the safety-related application designer, sending
unknown amounts of information, in unknown formats.
The difference between Category 2 and Category 3 is that in Category 2 the risk of unauthorized access is
negligible, while the open transmission system of Category 3 is subject to unauthorized access to the
transmission system for malicious purposes.
The reference architecture is not intended to restrict implementations; different structures are possible, see
examples in the informative Annex C and in particular Clause C.5 for communication between safety-related
and non-safety-related systems.
5 Hazards arising from the transmission system
The main hazard to safety-related communication is to accept a valid message in terms of authenticity,
integrity, sequence and timeliness, that contains errors which are not detected by the defences at the
receiving end. This document considers basic message errors impacting these message properties arising
from the transmission system, see Table A.1. EN 50129 shall be followed in relation to hazards to the safety-
related equipment.
However, meeting the requirements of this document does not give protection against intentional or
reasonably foreseeable misuse coming from authorized sources.
Further guidance on hazard analysis and safety case is included in informative Annex A. An analysis shall be
conducted for each project, so although the methodology for message errors of Annex A can be included, it
will not on its own necessarily be complete.
Hazardous events identified can include the following:
— systematic failure;
— broken wires;
— cabling errors;
— antenna misalignment;
— performance loss;
— HW random failure and ageing;
— human error;
— maintenance error;
— EMI;
— crosstalk;
— thermal noise;
— fading effects;
— overloading of transmission system;
— magnetic storm;
— fire;
— earthquake;
— lightning;
as well as deliberately caused events such as
— wiretapping;
— damage or unauthorized change to HW;
— unauthorized change to SW;
— monitoring of channels (as a preparation for intentional misuse);
— transmission of unauthorized messages.
However, although there can be a wide range of hazardous events, the basic message errors are one of the
following:
— repetition;
— deletion;
— insertion;
— re-sequencing;
— corruption;
— delay;
— masquerade.
Table A.1 suggests which basic message errors to the transmission system can be caused by each type of
hazardous event. Having identified the hazardous events – not protected by other means – that can occur for
a particular system, the table can be used as a guide to identify the basic message errors to be considered for
that system.
Table A.1 does not contain probabilities of occurrence; this shall be part of hazard analysis.
6 Classification of transmission systems
6.1 General
Clause 6 defines the process to be used to classify all transmission systems, identifying the basic message
errors relevant for such systems that affect the choice of defences for inclusion in the safety application.
6.2 General aspects of classification
There are many factors which can influence the hazards to a safety-related communication system.
For example, it is possible that transmission services can be obtained by the railway duty holder from private
or public telecommunications service providers. Under such service provision contracts, the responsibility of
the service provider for guaranteeing performance of the transmission system can be limited.
Therefore, the significance of basic message errors (and hence the requirements for defences) depend on the
extent of control exercised by the user over the transmission system, including the following issues:
— the technical properties of the system, including guarantees of reliability or availability of the system, the
...