Following the obsolescence of the fault tolerant computer of the Rail Traffic Management control system, the Channel Tunnel operator, Eurotunnel, needed to implement a new fault tolerant system onto which the existing application could be ported. The control system?s functionality had recently been upgraded to provide safety protection functions in the event of fire incidents. With the original hardware manufacturer not providing a transparent upgrade path, Eurotunnel undertook a project to engineer both a new fault tolerant architecture and new error recovery system to handle all types of faults on the existing application. The real-time nature of the system, interfacing with a train protection and signalling system, imposed numerous constraints. This Practical Experience Report describes the project, its design constraints, discusses various implementation options and describes the new system architecture with the existing application. The paper also gives an overview of the European norms, and their application in high integrity railway systems.