Six disciplines of building software for public transit

A fare system is judged at the moment a rider taps and the validator has to decide, in under half a second, whether to let them board. Most of the effort in our industry goes into the case where everything works. My attention goes to the cases where it does not: a bus out of mobile coverage, a back office that cannot be reached, a card never seen before, a reader at minus thirty-five that has just woken from a cold start. Our validators accept contactless bank cards, agency cards and mobile tickets, store taps securely when offline and check them against a list of cards that recently failed payment. Whether a validator accepts an unknown card when it cannot reach the back office is a fare-policy decision, and I ask every agency to make it in writing before launch. Since 2023 offline acceptance has accounted for about 0.2 per cent of taps, and the fare revenue lost through it has stayed below 0.1 per cent.

About a fifth of our revenue comes from agencies in Quebec and New Brunswick, and many Ontario customers serve francophone riders as well. Since November 2020 no rider-facing feature has shipped in one language before the other. The rule changed how we work. French UX writers sit inside product teams rather than at the end of the line; stop and street names come from each agency's official list rather than a translation tool; voice announcements are recorded and checked by native speakers. Quebec's Charter of the French Language, amended in 2022, has made public bodies there more exacting about the language of the products and documents they acquire, and our contracts in Quebec are negotiated and signed in French. I treat language parity as a release condition beside security review, because a rider reading in French deserves the same answer at the same moment. Our support centre in Moncton answers in either language from the first word of a call.

Every rider-facing screen we build meets the WCAG 2.1 guidelines at level AA as a floor, and we test with screen readers on both major phone platforms before release, not after a complaint. Accessibility law in Canada is layered. The Accessible Canada Act covers federally regulated organisations, while most transit agencies answer to provincial rules, such as Ontario's accessibility standards, which include requirements written for transportation providers, and the Accessibility for Manitobans Act. I do not want our product quality to depend on the province a rider lives in, so we build to the strictest expectation any customer faces. The most useful work has come from our rider accessibility panel, set up in 2017: fourteen paid members, among them blind riders, wheelchair users and people with cognitive disabilities. The panel persuaded us to give validators distinct tones for accepted and declined taps, to keep the telephone an equal channel for specialised transit and to write trip instructions as short numbered steps.

Transit agencies buy through open competitions, publish their evaluation criteria and pay from budgets governed by different rules. Hardware and implementation are often paid from capital, with help from federal and provincial transit programmes, while software subscriptions and support come from operating budgets that councils set each year and fares only partly cover. A pricing model that ignores that split will lose to one that respects it, however attractive its total. I own pricing and packaging for all three Halvery product lines. Since 2022 our fare contracts charge a fixed annual fee per equipped vehicle and per station, pass card-processing costs through at cost plus a disclosed fixed margin, and pay the agency service credits when availability falls below agreed levels. We publish a list price for each module so that smaller agencies, which often have no procurement specialists, can compare us without hiring a consultant. I review every bid in which a contract term would tie our revenue to an agency's fare policy, and I decline those terms.

Account-based fare payment and real-time trip planning both produce records of where identifiable people travel and when. In most of our contracts the agency is responsible for that information under provincial public-sector privacy law, and Halvery handles it on the agency's behalf. Our own commercial activity, such as rider accounts in the app, falls under federal private-sector privacy law or, in Quebec, the province's own regime, which was substantially tightened between 2022 and 2024. Rather than build to the minimum in each, we set defaults that any agency can defend in public. Tap records linked to an identified account are kept in identifiable form for 60 days and then aggregated; trip-planner location is used for the journey and not stored against a person; all rider data is held in Canada. Agencies may choose longer retention, but only through a written decision they are willing to publish. I report on privacy to our Audit and Risk Committee twice a year, including every incident, however small.

Specialised transit, often called paratransit, carries riders who cannot use fixed-route buses, and it is the service where a software decision touches a person's day most directly. Trips are booked ahead, demand exceeds vehicles on busy days, and a refused booking can mean a missed dialysis session or shift. Our booking product serves eleven agencies, about 58,000 registered riders and 2.6 million trips a year. I insist on one booking engine behind every channel, so that a rider calling an agent and a rider using the app see the same trips at the same moment, and I publish booking success by channel to each agency every month. When our largest customer for the product asked in 2023 for app-only booking and an earlier booking window for app users, I declined both requests and offered a faster agent screen instead. Online booking has since risen to 49 per cent of trips without any incentive, while telephone riders lost nothing.