Derby-based Universal Signalling has signed a partnership with the team behind the Ferrocene Rust toolchain to build what both call the first railway certification package for Rust under EN 50716, the European standard for railway software. Universal Signalling already writes most of its signalling products in Rust on top of QNX OS for Safety. The missing piece was never the code. It was the qualification evidence a safety assessor needs before signing off on the compiler and libraries.
Under the deal, the Ferrocene team will supply a Rust integration layer for QNX plus qualification materials for the toolchain and the required libraries, delivered in an upcoming Ferrocene release. “Without adequate certification and qualification, it cannot be deployed in real-world applications,” said Universal Signalling CTO Dr Nicholas Wright. Ferrocene managing director Felix Gilcher made the same point: rail needs a qualified toolchain and the processes around it, not just a memory-safe language.
Aviation has a harder ceiling. Until late 2025, qualified Rust compilers only supported DO-178C projects up to DAL C, because the top level, DAL A, requires Modified Condition/Decision Coverage (MC/DC): proof that every condition in a decision independently changes the outcome. rustc gained a partial MC/DC implementation in 2024 behind an unstable flag, and the Rust project removed it in 2025 over the maintenance burden. On October 5, AdaCore said it is working with the Rust Foundation to rebuild MC/DC properly inside the open-source compiler, with a target of the end of this year.
Rust makes this new ground for certifiers. A match with or-patterns and guards does not map cleanly onto the classic conditions-and-decisions model written for C and Ada, so AdaCore relies on its earlier work and a peer-reviewed paper to define what counts as an independent condition. The same work found the rustc coverage workflow only needs TQL-5, the lowest tool qualification level under DO-330. AdaCore says GNAT Pro for Rust is already qualified up to ASIL D under ISO 26262, including certified libcore and liballoc, with DO-178C qualification in progress.
Rust is also moving into the firmware under everyday hardware. NXP wrote on October 5 that Microsoft picked its MCX A5 microcontroller as the platform for Rust enablement under Microsoft’s Open Device Partnership, and that the two companies delivered validated Rust drivers and system firmware for MCX A devices used in Windows hardware. NXP says the work will extend to more of its silicon and notes that its chips already sit inside the Microsoft Surface lineup.
For N23D, which is being built in Rust across CAD, PLM, QMS, and the rest of the stack, the takeaway is practical: in regulated industries, the hard part of using Rust is now producing certification evidence, not writing the code. Coverage reports, qualified toolchain records, and traceable requirements are exactly what a QMS and PLM system has to hold for every release. Teams weighing Rust for safety work should watch for the Ferrocene rail package and the upstream MC/DC work landing before year end.
Sources
- Agreement seeks to bring Rust programming language to rail, Rail Business UK (Oct. 5, 2026)
- Universal Signalling Selects Ferrocene to Develop the First Rust-Based Railway Certification Package, Embedded Computing Design (Oct. 1, 2026)
- Rust for DO-178C and ISO 26262, AdaCore (Oct. 5, 2026)
- Securing a Digital Foundation: Building a More Secure Standard for Windows Devices With Microsoft, NXP (Oct. 5, 2026)
Featured photo: Signal gantry on Midland Mainline southwards by Andrew Tatlow, CC BY-SA 2.0, via Wikimedia Commons.
