Rail signaling with AI — the unit does not leave the shop until the SIL file adds up.
An interlocking, a Eurobalise transponder or a trackside ETCS unit are SIL4 items: the traceability of every PCB, every test and every firmware change has to be demonstrable to the notified body. iLEAN cross-checks optical inspection, bench tests and EN 50126/50128/50129 records, and holds the unit if something does not add up. The person signs.
The unit is built in weeks — the SIL file takes months to close.
Releasing a rail signaling unit to the customer (an infrastructure manager, an operator, a rail OEM) is not about assembling electronics. It is about closing, at the same time, three things that live in different places:
- Manufacturing inspection — the PCB after reflow, the consistency of the mechanical assembly, the functional bench tests, the environmental tests (climatic, vibration, EMC). Every step signed by a different person.
- Software and configuration traceability — the exact version of the firmware loaded, the interlocking configuration parameters, the transponder data. The binary hash has to be reproducible from the repository, at any moment, for the entire service life of the unit (decades).
- SIL4 file — the dossier that proves to the notified body (ERA, ANSF, AEFE) that the V-cycle of EN 50126/50128/50129 was followed, that the hazard analyses are closed, that the V&V records are signed, and that the human-in-the-loop exists wherever the standard demands it.
The quality director knows all this. But when the customer asks for the file of unit number 47, someone has to rebuild what already exists: go down to SMT, pull the images, call whoever signed which bench test, export the firmware version, recompile the dossier. Weeks of expert work to prove what was already done right.
iLEAN does not add another SIL management system — it seals the joints between the ones you already have.
The problem in signaling is not a lack of information: it is information living on islands — SMT, bench tests, firmware repository, ERP, document manager — that does not arrive together at the moment the SIL dossier has to be closed. iLEAN acts as the putty that fills those gaps, without touching critical equipment or the validation flow the plant already has certified.
Edge sees the PCB in line. Connect reads the bench tests, the certificates and the firmware repository. The agent cross-checks against EN 50128/50129 and, if something does not add up, holds the unit. The person signs — never the other way round.
The three iLEAN pieces applied to rail signaling equipment control:
- Edge — a machine-vision terminal (CNN) over the SMT line and the final assembly bench. It compares every PCB against the golden image, detects the usual defects (cold joint, solder bridge, rotated component, missing component) in milliseconds and captures an image linked to the serial number. It works with no network and without touching the OT network of the firmware programming bench.
- Connect — captures the result of the bench tests even when the test equipment is proprietary, reads the calibration certificates from the EMC lab, and indexes the firmware repository by hash. And it captures what comes from outside: an ERA alert about a change in the ETCS TSI enters at second zero, on the same thread where the affected unit is being closed.
- Agent — cross-checks, by serial number, everything above against the SIL4 standards (EN 50126 RAMS, EN 50128 software, EN 50129 systems) and returns the unit's SIL file: PCB traceability, signed bench tests, firmware hash, closed V&V plan, linked hazard analysis. If a link is missing, it says so before you submit to the notified body.
Closing the SIL file by hand vs. closing it cross-checked with iLEAN
| Aspect | Today (PDFs + folders + meetings) | With iLEAN Edge + Connect + Agent |
|---|---|---|
| PCB inspection | Visual + AOI not tied to the unit's trace | Edge captures an image linked to the serial number |
| Functional bench tests | Results in Excel/CSV, one file per bench | Connect indexes them by serial number and standard |
| Firmware traceability | Repository + manual scripts to reproduce the hash | Hash linked to the unit inside the dossier |
| Hazard analysis and V&V | Document folder, recompiled by hand | Linked requirement by requirement when the unit closes |
| Closing the SIL4 file | Weeks of an expert engineer | Minutes of human review over a coherent dossier |
| OT security | Informal isolation of the firmware bench | Three formalized rings, signed file drop |
Impact estimate for your plant — to be validated with your numbers.
The block below is an estimate to be validated with the specific data of your plant. We put it forward so the committee has an order of magnitude; we refine it during the diagnostic.
- Signaling equipment plant (interlockings, transponders, ETCS units), volume in the hundreds of units per year, SIL4 certification demanded by the end customer.
- Focused pilot: optical PCB inspection with Edge + automatic closing of the SIL file by serial number with an Agent. First value expected within a few weeks.
- Indicative payback between 4 and 9 months. Hard levers: certification staff hours saved closing files, fewer units sent back for an incomplete dossier (≥30%), capacity recovered at the validation bottleneck.
- On reliability: hallucination is a problem of free generation, not of anchored tasks. In tasks anchored to the source (reading a PCB, extracting a parameter from a bench test, linking a firmware hash to a serial number), the best models brought error below 1.5%[1]. And even so, what is critical is never decided alone — the person signs, and the three safety rings guarantee it.
[1] OpenAI paper “Why Language Models Hallucinate”, 2025 — on the reliability of AI in anchored tasks.
What people ask about rail signaling with AI
Which SIL standards apply to a rail signaling unit?
Modern rail signaling revolves around EN 50126 (RAMS), EN 50128 (railway software) and EN 50129 (safety-related electronic systems). The typical target level for interlockings, Eurobalise transponders and trackside ATP/ATO is SIL4 — the most demanding one. In practice that means full traceability: every PCB, every component lot, every functional test, every firmware change has to be demonstrable to the notified body (ERA, ANSF, AEFE). The file matters as much as the unit.
How do you inspect a signaling PCB in line without breaking SIL?
With machine vision (CNN) that detects the usual defects (cold joint, solder bridge, rotated component, missing component) in milliseconds, before the functional test. iLEAN Edge reads the PCB after the reflow pass, captures an image of the top and bottom faces, links it to the serial number and compares it against the golden image. If something does not add up, it holds the board. SIL integrity is preserved because the critical decision stays with the person — Edge proposes, the quality engineer signs or rejects, and a signed record of the human-in-the-loop required by EN 50129 remains.
Can iLEAN generate the SIL validation file for the notified body?
That is exactly what the Agents piece does. For every finished unit (an interlocking, a transponder, a trackside ETCS unit), the agents cross-check: component traceability (lot, manufacturer, certificate), the PCB image at the end of SMT, the results of the functional tests (bench tests, climatic, vibration), the firmware version loaded and signed, and the V&V validation plan. The result is a coherent dossier, ready to submit to the notified body, with nothing rebuilt by hand. What used to be weeks of an expert certification engineer becomes minutes of human validation.
How does iLEAN handle OT security for signaling equipment on the shop floor?
With the three safety rings. Ring 1 (the OT network hosting the bench tests and firmware programming) accepts no inbound connections — it only reads from a hardened, validated mailbox. Ring 2 (the validation chamber) checks that any data reaching ring 1 is signed and matches reality. Ring 3 (the AI horsepower) runs inference, captures and proposes, without touching critical OT. This architecture formalizes what the rail industry already does informally, and it lines up naturally with IEC 62443 and the cybersecurity requirements that the CRA and EN 50701 are consolidating in signaling.
How much does it cost to deploy iLEAN in a signaling equipment plant?
The typical pilot focuses on one critical sub-operation (optical inspection of SMT PCBs, or automatic closing of the SIL file by serial number) and delivers first value in a few weeks. Indicative payback between 4 and 9 months — the hard lever is the cost of a single unit sent back by the notified body, or a certification delay on a multi-million project. Estimate to be validated with your data. Send us your annual unit volume and your average file-closing time and we will send you the estimated ROI in 48h.
Tell us your case and in 48h we'll send you the estimated ROI of this AI project for your rail signaling equipment plant.
We work on your plant's real data, not ours. Diagnostic with no commitment.
Request estimated ROI in 48h See aerospace, defense and rail