Georedundancy in Digital Signalling and Control Systems
Increasing threats such as extreme weather events and deliberate acts of damage are placing growing pressure on railway infrastructure. Against this backdrop, signalling and control systems must be designed with georedundancy in mind. In practice, this means that if one data centre fails, another geographically separate site can take over its functions. This helps ensure system availability and compliance with requirements for critical infrastructures (KRITIS).
The digitalisation of signalling and control systems (LST – Leit- und Sicherungstechnik) is fundamentally transforming the architecture of the railway system. Functions that were previously distributed across numerous decentralised interlockings are now being consolidated in centralised data centres – known as Digital Technical Centres (DTZ). This centralisation enables economies of scale, more efficient operations management and simplified maintenance. At the same time, however, it also creates new requirements for system resilience and fault tolerance.
In this context, georedundancy is becoming increasingly important as a strategic resilience concept. Georedundancy means that a geographically separate fallback site can assume the functions of a primary site in the event of a failure. For critical infrastructures such as the railway system, this is not only an operational necessity but also a regulatory requirement, for example under the KRITIS framework of the German Federal Office for Information Security (BSI).
One solution that can be implemented in the short term is the so-called “cold standby” approach. In this model, identical components are installed at a fallback site alongside the primary system. Under normal operating conditions, these components remain inactive and are only activated in the event of a disruption or disaster. This approach can already be realised using current signalling and control products and provides additional fault tolerance relatively quickly. However, it also involves increased hardware and maintenance requirements.
In the long term, DB InfraGO is pursuing a more automated and efficient target architecture: the so-called “warm standby” approach based on virtualised signalling and control functions. In this model, fallback instances already run during normal operations, remain technically integrated and keep their dynamic status data synchronised, while requiring only limited resources. In the event of a fault, they can be transitioned to full operation within a short period of time. In addition, virtualisation on vendor-independent standard hardware enables more flexible use of computing capacity, reduces costs and obsolescence risks, and improves energy efficiency.
The introduction of georedundant signalling and control systems is therefore far more than a technical upgrade. It is a key building block for ensuring that railway operations in Germany and across Europe remain resilient, secure and fit for the future in the face of growing risks.
Further details can be found in a recent technical article published in the magazine SIGNAL+DRAHT (March 2026).
The full article is available here.
