It's complicated, difficult, and the people who can do this are expensive. Railway signaling systems, alongside air and spacecraft, and sometimes consumer devices that would be expensive to firmware update during the warranty, are the few places software verification is used.

The specification we are verifying the software against must also be proven to be correct, including failing safe.

The hardware also has to perform, at all reasonable temperatures, humidities, with vibration, poor power, and for an expected life of at least 50 years.

The people installing the hardware must be checked, to ensure the work is done correctly. A crossed wire is a critical fault, I imagine there's a long and detailed procedure for connecting every wire.

[1] is an interesting read, a retrospective on a bad crash in 1988 in Britain which led to many improvements in signaling safety.

https://www.railengineer.uk/2014/01/06/25-years-after-clapha...

The signal lamp itself is probably a small part of the cost compared to all the wiring and the time spent installing it.

Edit: googling for "cost of railway signals" produces this very comprehensive PDF on the subject: www.credo-group.com/downloads/tco_of_rail_signalling_systems.pdf

However in the rail world signals encompasses much more than that red light. There's sensors on the track which detect when a train enters a section of the line and when it leaves, and on modern systems there's communication with the train itself to force the brakes on if the driver runs a red light, making it near impossible to enter a section with a train already in it.

All those parts need to communicate with each other, and they need to be ridiculously reliable, and capable of self-reporting when they fail, because in the worst case a failure in any one of those components results in a few hundred people dying in a dark underground tunnel.