Book a call
What we do

Railway Software Engineering

Senior engineers for rail and transport product companies. We work inside your QMS, deliver the engineering and the evidence, and help you get ready for the Cyber Resilience Act.
How we engage
5
engineers in our dedicated squad for a European rail-technology group
Rail case below
1–3 mo
until a dedicated squad is operational in your tools and QMS
Engagement models
12 mo
after which you can take over the whole team
Exit by Design

MetaProject provides software engineering for railway and transport product companies: onboard systems, signalling and traffic control, operations and planning software, and infrastructure inspection and analytics. Our engineers work inside your QMS and tools. You keep the product and the safety case; we deliver the engineering and the evidence behind it.

Demand and regulation are both growing faster than most rail engineering teams. New operators, retrofits and tenders keep adding work to the same roadmap, and the EU Cyber Resilience Act now applies to products already in the field.

Who we work with

Onboard systems and driver advisory teams building software that runs in passenger and freight service
Signalling and traffic control vendors working under EN 50716 and IEC 62443
Operations and planning software teams for timetables, dispatch and resource planning
Infrastructure inspection and analytics platforms turning track and asset data into decisions
Rolling stock suppliers moving into software and data adding connectivity, analytics and cloud services
Rail-tech groups integrating acquired products aligning systems and QMS after an acquisition
Transport operators with in-house product teams running their own digital roadmaps
Teams preparing for the Cyber Resilience Act for products already in the field

What makes rail software different

1.
Every change needs evidence.
Rail software is developed to EN 50716, which replaced EN 50128, with RAMS under EN 50126 and security under IEC 62443. A feature is done when its requirements, design, tests and verification reports exist and trace to each other.
2.
The CRA is live.
Vulnerability reporting under the EU Cyber Resilience Act has applied since September 2026, including to products already in the field. Full requirements and CE marking follow in December 2027.
3.
Every project is a variant.
Retrofits and mid-life upgrades multiply the configurations and package releases you have to maintain, trace and support alongside new releases.
4.
Hardware companies are becoming software companies.
AI analytics, cloud systems and APIs need skills the core team was not hired for, while backlogs from new accounts and tenders grow faster than hiring.

What we work on

Onboard and driver advisory software
Features, modernisation and test automation for onboard units and driver advisory systems in passenger and freight service.
Operator and fleet integrations
Integrations for new operators and fleets, each with its own requirements, kept consistent and traceable by a dedicated requirements engineer.
Traffic management and planning interfaces
Interfaces with traffic management, dispatch and planning systems, including protocol work such as SFERA and EULYNX.
RAMS and safety analysis
RAMS analysis to EN 50126, including hazard analysis, and the verification process set-up that proves it.
Cybersecurity and CRA readiness
Vulnerability analysis and remediation, secure-by-design development to IEC 62443-4-1, and DevSecOps pipelines that produce audit evidence.
Requirements and traceability tooling
Tooling set-up and artefact migration for automated traceability across product variants and retrofits.
Data, AI and infrastructure analytics
Infrastructure and topology data modelling, validation pipelines, and ML for inspection and analytics, from our Centre of Excellence.

Three ways to add capacity

Model 1

Dedicated product squad

3–10 engineers who join your roadmap and work in your tools under your management. Operational in 1–3 months; take the team over after 12 months.

Model 2

Capability on demand

1–5 senior specialists for a defined gap, such as RAMS analysis, a compliance gap assessment, DevSecOps or verification set-up. They hand over and step out.

Model 3

R&D hub

A remote unit of 5+ engineers with its own lead, working to your governance and QMS across several product streams.

All three models run inside your QMS and compliance framework, and you can switch between them as your needs change. How the handover works: Delivery as Training and Exit by Design.

Why rail teams work with us

Inside your QMS
Our engineers work in your tools and processes. Engineering evidence and documents follow your QMS, so the audit trail stays in one place.
Evidence built in
Requirements engineers keep every variant traceable to its source, and V-model deliverables are produced with the code instead of being rebuilt before an audit.
Knowledge stays with you
Replacement cover comes with a full handover, and every engagement ends with the know-how in your documentation and your team.
Exit by design
Take over a dedicated squad after 12 months, or switch models as your needs change.

Case: scaling the engineering behind real-time rail optimisation

Client (NDA)
A European rail-technology company, part of a global rail systems group. Its software calculates the best speed profile for each train in real time and turns it into simple advice for the driver. It runs in passenger and freight service across Europe.
Challenge
New operators and fleets kept coming, each with its own integration requirements. The delivery roadmap grew faster than in-house engineering capacity.
What we do
A dedicated product squad of five works inside the client's own processes and tooling on features, modernisation, test automation and technical debt. A senior requirements engineer, on demand, owns requirements across operator integrations and keeps them consistent and traceable.

When to bring us in

Your roadmap is growing faster than your engineering team.
A CRA, RAMS or cybersecurity deadline is coming and the skill is not in-house.
New operators or retrofits keep adding variants you have to trace and support.
You have acquired a product and need to align its systems and QMS with the group.
You need ML, data or cloud skills the core team was not hired for.
You want to scale R&D with one accountable unit instead of more headcount to manage.

Railway software FAQ

Do you work to EN 50716 and EN 50126?

Yes. Our engineers work inside your QMS and produce the lifecycle evidence your process requires: requirements, architecture and design specifications, test specifications and verification reports for each V-model phase. You keep the Manufacturer role and the safety case; we deliver the engineering and the evidence.

What is a CRA readiness assessment?

A fixed-scope, fixed-price review of a product against the EU Cyber Resilience Act: the vulnerability reporting duties that apply since September 2026 and the essential requirements that apply from December 2027. You get the gaps, a scoped solution and a prioritised remediation plan.

How fast can a team start?

Individual specialists join in weeks. A dedicated squad of 3–10 engineers is usually operational in one to three months, including onboarding into your QMS, tools and domain.

Can we take the team over?

Yes. A dedicated squad can be bought out or taken over in full after 12 months. In capability-on-demand assignments, findings, artefacts and know-how are handed into your documentation and team before the expert steps out.

Who owns the IP and the data?

You do. Engineers work in your systems, environments and repositories. In the R&D hub model they share patterns through our Centre of Excellence, while your IP and data stay yours.

Scale your roadmap, not the risk.

Bring your backlog to a 60-minute team planning session: we propose a team composition and send matching CVs within a week. Or start with a CRA readiness assessment at a fixed scope and price.