At the chemical factory where I work we have been slowly been migrating from Siemens Apacs+ control software run on Pentium 4s because some critical hardware for it is no longer manufactured. We have some on Allen Bradley, but somebody decided to go with DeltaV with a modern server/thin clients setup.
The old software is so better written that it flies on a Pentium 4, 512 EDIT: KB MB ram, 32GB HDD compared to the newer stuff. It's response is near instant and the new stuff has a significant lag time and doesn't always respond. Apacs+ also is much more intuitive, keeps better logs and is easier to control. We've been migrating in pieces and the new software is so full of bugs.
My impression isn't just because I have more time with that software, I have shown people trained on the newer systems how fast and easy the about 20 year old system is and they are in complete agreement, then I show them what it is running on. IDE cables and everything. The control systems are also isolated from the outside world, the software really isn't secure by any means. Probably the same with the rail software.
The software to run the rail may be as good as it needs to be and getting the software/pc hardware/rail hardware to all match, all at once may be a heck of a job and might be why it has been put off so long.
Similar occupation. I have a bunch of sortation systems in multiple distribution centers, many still run off old DOS systems with STD Bus I/O from the 80s and 90s using custom written software in Watcom C. Those systems download tables over custom sockets and place them into memory in B-tree structures for high speed lookups on the business logic side. The 'PLC' is essentially custom, they can look up an entry in a 350K record in memory structure in under 20ms, similar to the scan time on a PLC. Anything over 25ms lookup and it shuts the equipment down, due to not knowing if it detected input states or not, just like a PLC fault caused by going outside its scan time.
We also have a variety of systems from Windows XP based controls software (old Steeplechase, and Beckhoff), windows NT boxes from the late 90s running some very custom HMIs to display running systems.
So, replacing one of the physical systems is anywhere from 3M to 40M. Upgrading the controls I/O and software software ranges from ~500K to ~2M. I have ~55 of these in total spread across 9 locations. We're building out a new system to replace a 40YO one right now that is ~35-45M.
The 'normal' IT world is clueless about these types of systems. I've had so many IT architect types ask 'when are you going to upgrade X', my standard answer is 'That'll be about 6-18 months and $1.5M minimum, get that approved and get me off project Y to do your upgrade and we got a deal.' They know they can't do that so they just spin in circles.
A control cabinet, just the hardware, can easily cost 250K. Some of these systems have multiple control cabinets. These things cost so much, take so long to put in, and are so disruptive to existing operations to upgrade, corporations put them in figuring on using them for 30+ years. This is totally normal. This is why you have firewalls.