The freihändige Vergabe landed on simap on 29 July 2026, and I felt it the way I feel a slow order: quiet, procedural, load-bearing. SBB awarded Siemens up to CHF 280 million — a direct award, no competition — to keep Iltis, the system its operations centres use to watch and steer every train across my network, alive until 2045. Iltis has run more than thirty years. SBB’s own newsroom put it plainly in “SBB erneuert Bahnleittechnik”: the replacement, a new digital Betriebsleitsystem, tenders in 2027, arrives from the 2030s, and finishes swapping Iltis out only in the early 2040s.

Read the clock. A control layer with a roughly fifty-year service life, replaced by a procurement that runs fifteen-plus years from announcement to switchover — longer than most software companies stay alive. The structures I carry the load across run a different clock: the Landwasser Viaduct has held its arches since 1902; the Gotthard Base Tunnel opened in 2016 for a design life measured in a century-plus. The viaduct will outlast the replacement of the system that replaces the system being replaced now.

←TODAY: CHF 280m and a direct award keep a 30-year-old Iltis running to 2045 — the control layer, not the viaduct, is the fragile part. →3012: The Landwasser arches still carry the Takt; the twelfth system to steer trains across them has come and gone. Fulcrum: The structure outlives every control layer, so the redundancy that matters is not in the steel — it is in who can still certify the data.

The point is not the age. A well-maintained thirty-year-old system is no scandal; I run on plenty. The point is the redundancy that quietly disappeared. A direct award is what a network looks like with no second path — one supplier who can still certify the thing, so switching it off is harder than paying for it. PAZ has traced single-vendor lock-in before, in the substrate piece on Google and Anthropic: once your dependency can say no to a regulator on your behalf, “competition” needs a footnote. Signalling reaches that state faster than most, because the hard asset is not the code — it is the certification chain.

Here is the spine. In ERTMS/ETCS — the open interoperability standard rail chose precisely so no single vendor owns the safety case — the behaviour of the whole distributed system (trackside, onboard, radio block centre) is parameterised by DATA drawn from the UNISIG Subsets. A new paper, arXiv:2607.26111 (28 July 2026), makes the sharp claim: errors in that DATA, not in the code, are what propagate. Its pipeline validates the data with the B mathematical language and machine-checked invariants, then asks whether an LLM can help without breaking the CENELEC EN 50128 / EN 50716 certification argument — and answers only if the proof, not the prose, is what the certifier accepts. In ETCS, the data is the safety case.

Now the line into your building site. The same shape is arriving under your envelopes: a 60-year facade specified onto a 12-year control stack — BMS, BACnet, the fire panel, facade actuators, the digital twin — usually one vendor, no formal specification of the data that parameterises it, no re-certification path when the product sunsets. Rail answered with mandated open subsets and provable validation. AEC has no UNISIG, no EN 50716, no invariant pipeline.

Atelier: The office living with an AI-assisted BMS this week faces the certification question rail just paid CHF 280 million to defer: when your control vendor sunsets the product in year twelve, what re-validates the data your building runs on? Monday move — open the O&M spec for your current live project and add one clause: the control-system data schema must ship in an open, documented format with a written validation rule set, not a proprietary binary only the vendor can read.

Hack: Check a trackside data table the way ETCS does — assert the invariants before you trust the row. This walks an ETCS-style table of (linking distance, gradient, static speed) and fails the one row that breaks the 140 km/h line envelope; in signalling that failed assertion is the safety argument, caught before a balise ever tells a train the wrong number.

rows = [(0, 25, 120), (500, 25, 120), (1200, 20, 160)]  # last row breaks the envelope
prev = -1
for dist, grad, speed in rows:
    assert dist > prev and speed <= 140, f"bad row: {dist} m @ {speed} km/h"
    prev = dist

So do the boring, century-scale thing today: ask for the redundancy on paper. Before you sign the next control contract — rail or building — write down who can certify the data in year sixty, and in what open format. Build the diversionary route before you need it; I have carried the traffic for the sections that didn’t.

Sources & Further Reading

• Primary: SBB Newsroom — SBB erneuert Bahnleittechnik
• Reinforcing: arXiv:2607.26111 — Validating ETCS Data with the B Mathematical Language