The trouble with this shit is the train literally moves a million people every fucking day from early in the morning to late at night. It's incredibly difficult to upgrade such a massive system while it's running.
The "safe" way to do it is leave the old system in place and running, and install the new system next to it. Let them both run simultaneously for an extended period of time, with the old system still in charge and the new system running and computing results, but its results aren't actually controlling anything; they are only recorded to verify that its behavior is always the same as the old system given the same inputs.
Once you've thoroughly tested and debugged the behavior of the new system that way, you flip the switch so that now the new system is in control and the old system is merely having its results recorded. Let the system run that way for a period of time; if anything goes wrong you can always flip the switch back again. If nothing goes wrong, you can either leave the old system in place as an emergency backup (for as long as it lasts), or decommission it.