Universal Signalling, a UK startup that develops software for railway operators, has partnered with Germany’s Ferrous Systems to enhance its code.

The partnership focuses on the Rust programming language. Ferrous Systems, whose team includes multiple Rust contributors, provides consulting services to users of the language. It can familiarize a company’s developers with Rust and provide ongoing technical assistance. The firm also takes on software development work.

Ferrous Systems’ work with Universal Signalling will place particular emphasis on Ferrocene, a Rust distribution that the former firm offers alongside its consulting services. Ferrocene is identical to Rust in most respects. What sets it apart is a collection of safety features that makes it suitable for use in systems such as cars, industrial robots and medical devices. Universal Signalling and Ferrous Systems plan to add railway signaling systems to that list.

A railway signaling system has an analogous role to traffic lights. It’s a computer that monitors the stretch of railway ahead of a train. If there’s an obstacle, it displays a red light. The signal appears on a screen in the train driver’s cabin rather than on the side of the railway. When there’s no obstacle, the system informs drivers that they can proceed.

Universal Signalling is developing a series of railway signaling products written largely in Rust. Stephen Head, the company’s chief executive officer, told us that the products aim to provide a simpler way for railway operators to modernize their signaling infrastructure.

“Railway signalling is currently a large patchwork of different systems, ranging from modern digital signalling provided by large players such as Siemens, Hitachi and Alstom, through to 150-year-old mechanical signalling,” Head told Boardroom Insight. “There are large swaths of signalling in most European countries that require replacement, but it is unaffordable to do so at current market prices. Universal Signalling is constructing a low-cost, fast-to-deploy signalling offering targeting lower-density lines. Using Rust and our collaboration with Ferrocene are key building blocks in making signalling more affordable”

Universal Signalling has hired Ferrous Systems to develop a collection of Rust software assets called a qualification package. It will enable Universal Signalling to make its products’ Rust code compliant with EN 50716, a railway software safety standard. Achieving compliance could help accelerate the adoption of the company’s technology among risk-averse railway operators.

“The package will include qualification material for the Ferrocene toolchain and the Rust library components required by Universal Signalling’s application,” Universal Signalling chief innovation officer Sam Bemment told Boardroom Insight. “It will build on Ferrocene’s existing certification work for Rust’s core library, with the required components and supporting evidence tailored to the needs of this project.”

“It is important to distinguish this package from certification of the final signaling system,” Bemment added. “Ferrocene will provide the qualified tooling and supporting evidence that Universal Signalling can use as part of its EN 50716 certification activities; Universal Signalling will ultimately remain responsible for the certification of its product.”

“The overall objective is to give Universal Signalling a well-defined, certified and qualified foundation for using Rust in safety-critical railway software, while reducing the amount of toolchain and language certification and qualification work they would otherwise need to undertake themselves.”

The second focus of the company’s partnership is QOS, a specialized operating system that is widely used in the transportation sector. Universal Signalling uses it to power some of its products’ features. The collaboration will see Ferrous Systems build an integration between Rust and QOS. 

“QNX OS for Safety (QOS), as an operating system, provides functionality that Rust typically makes available through the standard library, so users do not need to manage the Foreign Function Interface (FFI) layer to the operating system themselves,” Bemment told us. “Providing this integration between QOS and Ferrocene reduces the development effort required for Rust applications targeting QOS.”

“Alongside the integration itself, Ferrocene will provide the relevant qualification material for the Ferrocene toolchain and required libraries. This gives Universal Signalling the technical evidence needed to support its use of Rust with QOS as part of the EN 50716 certification of its railway signaling software.”

Bemment also provided an overview of the technical considerations that drove Universal Signalling to adopt Rust in the first place. 

“Railway signalling is incredibly safe and reasonably reliable, but many of those benefits come at the cost of very slow deployment speed and massive financial expense,” Bemment said. “For example, the ECDP programme in the UK will take around 20 years from inception to delivery, cost over £2bn, and deliver digital signalling on just 100 km of 4-track railway.” 

“Proving that software (and by extension, the signalling built upon it) is safe today depends heavily on process, coding restrictions and exhaustive verification, partly to rule out whole classes of defects that languages like C allow. That’s a big reason new signalling systems take years or even decades to deliver. Rust’s compiler removes many of those defect classes at source, including memory-safety errors, data races and undefined behaviour. Engineering effort can then go into the signalling logic itself rather than defending against the language. For an industry that needs to digitise quickly without lowering its safety bar, that’s the prize: the same or better integrity, delivered much faster, and at much lower cost.”

“Universal Signalling was founded to deliver signalling in days rather than decades – this isn’t just a soundbite, it is what we are really doing. A qualified Rust toolchain is one of the foundations that makes that possible,” Bemment concluded. 

Photo courtesy of Unsplash