In July 2026, Digital Transit Limited (DTL) carried out the final Independent Safety Assessment (ISA) audit of a SIL 2 Automatic Train Protection (ATP) system for maintenance vehicles, developed by Critical Software in Coimbra, Portugal. The outcome was a good one. It brings to a close a programme of independent assessment that has run over several years, through a series of audits and assessments at each stage of the project lifecycle.

Professor Howard Parkinson, who led the assessment for DTL, marked the occasion on LinkedIn on the day of the final audit, congratulating the Critical Software team on a job well done. That post prompted a thoughtful response from the other side of the table, which we are delighted to share here.

A project of unusual complexity

This was not a straightforward assessment. The project brought together an unusual vehicle fleet, demanding supplier interfaces and, perhaps most challenging of all, the reverse engineering of an ATP system originally designed in the 1980s. Bringing legacy technology of that age up to the standard expected under EN 50126, EN 50128 and EN 50129 requires rigour, patience and a very clear understanding of what the original system was intended to do.

As Independent Safety Assessor, the role of DTL has been to provide an objective, evidence-based judgement, phase by phase, on whether the safety case is sound. Across a programme of this length, that judgement depends on consistent, high-quality evidence being placed in front of us time after time, and this is where the Critical Software team truly stood out.

The view from Critical Software

Following the post from Howard, Joaquim Tojal, Technology Director for Mobility at Critical Software, reflected on what the assessment had meant for his team. He described it as one of the most demanding and complex projects he had ever worked on, and noted that while the formal result was good, it was not the part that stayed with him most. His observations match our own experience across the whole programme:

  • Complexity managed well. The team took on a scope far larger than anyone originally anticipated and kept control of it throughout.
  • Documentation that was always ready. At every audit and assessment, the evidence we requested was available, complete and delivered promptly. On a project of this size and duration, that is far from the norm, and it makes a significant difference to the efficiency and confidence of an assessment.
  • Openness from start to finish. The team never felt the need to obstruct or hold anything back, and we never encountered reluctance. The relationship was built on honesty and cooperation, which is exactly what independent assessment depends upon.
  • A team that held together. Safety programmes that run over several years test people as much as processes. This team remained cohesive to the very end.

Why this matters

Independent safety assessment is sometimes perceived as adversarial. It does not need to be. Independence is essential, but the best outcomes arise when the assessor and the development team share a common goal: a system that is demonstrably safe. When a supplier embraces transparency and treats the ISA as a partner in that goal over the life of a project, assurance becomes faster, clearer and more robust.

As the rail industry faces further transformation, from digital signalling to AI-enabled systems and ever-increasing integration, the lesson from Coimbra is clear. Technical excellence must be matched by openness and teamwork. When the two come together, safety wins.

In the words of Joaquim Tojal: “This was a real partnership.” We could not agree more.

Congratulations and thank you to everyone at Critical Software who contributed to this achievement over the past few years.

Digital Transit Limited provides Independent Safety Assessment, railway safety engineering and cybersecurity assurance for rail projects in the UK and internationally. To discuss how we can support your project, contact us at info@digitaltransit.co.uk.