EN 50716:2023 - Railway Applications - Requirements for Software Development 5.1: Organization and independence of roles

Aim: organise everyone with software responsibilities so that independence between roles cuts the chance of shared misconceptions and repeated mistakes, and so that people judging whether a product or process is acceptable for safety are shielded from peer, management or commercial pressure. The supplier implements organisation and personnel-management requirements (EN ISO 9001 can satisfy them). People assigned to development or maintenance roles are named and recorded. For SIL 1 to 4 an Assessor is appointed, by supplier or customer, from any stakeholder organisation, independent of the project team and organisationally a separate entity, and given authority to assess. The Validator agrees or disagrees with each release. Role assignment rules at every level including Basic Integrity: roles may be shared and combined unless forbidden; Verifier and Validator never act as Requirements Manager, Designer or Implementer; those three neither manage nor report to a Validator; the Validator is not the Project Manager; the Configuration Manager is not a Validator; Verifier and Validator entities are fixed for the project and any personnel change is documented and justified. For SIL 1 to 4: a Validator doing tester work has that work reviewed by another Validator; a Verifier doing tester work is reviewed by another Verifier or a Validator; whoever specified, designed or coded a component does not test that same component (the same principle can extend to integration and overall testing where independence is shown). For SIL 3 and 4 the Validator does not report to the Project Manager, and a Validator doing verification is reviewed by a second Validator.