Electronics Guide

Braking Distance

A train braking at a constant deceleration a from a speed v stops in a distance

d = v² / (2a)

The expression assumes level track, constant deceleration, and no delay before the brakes take full effect. In practice, the train runs on at speed while the driver reacts and the brake force builds up, so the distance is closer to

d = v × t + v² / (2a)

where t is an equivalent delay: the time before the brake force starts to rise plus about half its build-up time, as in the ETCS brake model. The braking term grows with the square of speed, so doubling the speed quadruples it.

The decelerations are illustrative inputs, not the performance of any particular train. For comparison, a car braking from 100 km/h at an illustrative 7 m/s² stops in about 55 m. Gradient also matters. On a falling gradient G, expressed as a fraction, gravity removes about g × G from the available deceleration, where g = 9.81 m/s²; a rising gradient adds the same amount. On a 1 percent falling gradient, a deceleration of 0.7 m/s² falls to about 0.60 m/s², and the braking distance from 160 km/h grows by about 16 percent, from 1,411 m to 1,641 m.

At high speed, braking distances of several kilometers exceed the distance at which a driver can reliably read a signal, so the warning must come from signals placed at least a braking distance in advance or, at higher speeds, from displays in the cab.

Headway and Capacity

Headway is the time between successive trains passing the same point. A line running at a steady headway of h seconds carries at most 3,600/h trains per hour on each track. The signaling system sets a floor under the headway, because it fixes how much space must separate a following train from the one ahead, and stations, junctions, and dwell times add limits of their own.

Aspects

A signal aspect is the indication a signal displays. In a two-aspect color-light system, a stop signal shows red or green, and a separate distant signal, placed at least a braking distance before it, shows yellow or green to warn of what the stop signal displays. A three-aspect system combines the two roles in each signal: green means the next signal also shows proceed, yellow means the next signal is at stop, and red means stop. The distance from a yellow signal to the red one beyond it must be at least the braking distance from line speed.

On busy lines, a fourth aspect, double yellow, warns that the next signal shows a single yellow. The braking distance is then spread over two blocks, so each block can be shorter and trains can run closer together. Great Britain uses four-aspect signaling on many of its busiest routes.

Railways also differ in what an aspect tells the driver. Route signaling, the British practice, shows which route is set, often with a junction indicator, and the driver must know the speed allowed on it. Speed signaling, used in North America and on several continental European railways, conveys the speed at which the train may proceed. North American rulebooks use aspect names such as Clear, Approach, Restricting, and Stop.

Automatic and Controlled Signals

On plain line, automatic signals respond to train detection alone. At junctions and stations, controlled signals clear only after the interlocking has set and proved a route requested by a signaler or an automatic route-setting system. United States regulations distinguish automatic block signal systems from traffic control systems, in which, under 49 CFR 236.828, the indications of block signals authorize train movements and supersede the superiority of trains for both opposing and following movements on the same track. On unsignaled lines, often called dark territory, dispatchers issue written or electronically transmitted movement authorities instead.

Federal rules also link signaling to speed. Under 49 CFR 236.0, a block signal system is required where a passenger train is permitted to operate at 60 mph or more or a freight train at 50 mph or more, unless a PTC system approved by the Federal Railroad Administration (FRA) for that speed and those operating conditions is installed. Where any train is permitted to operate at 80 mph or more, a PTC system is required unless FRA has approved continued operation with an automatic cab signal, automatic train stop, or automatic train control system.

How Block Length Limits Headway

A simple model shows how fixed blocks set the minimum separation. Consider a three-aspect line on which trains run at a constant speed v and each block is just long enough to stop a train from that speed, so the block length B equals the braking distance D = v × t + v² / (2a). A following train sees no yellow signals if, when its driver first sights a signal, the train ahead has cleared the next two blocks and the overlap beyond them. The distance from the front of the following train to the front of the train ahead is then

s = S + 2B + O + L

where S is the sighting distance, O is the overlap, and L is the length of the train ahead. The plain-line headway is s/v. With illustrative values of S = O = L = 200 m, a = 0.7 m/s², and t = 2 s, a train at 160 km/h (44.4 m/s) has D ≈ 1,500 m, a separation of about 3,600 m, and a headway of about 81 s. Timetables allow much more, because stations, junctions, and speed changes dominate, but the model shows why shorter blocks and extra aspects buy capacity.

Track Circuits

A track circuit uses the two running rails as conductors. At one end of a section, a source drives current through the rails; at the other end, a relay or electronic receiver detects it. While the section is clear, the receiver is energized and reports clear. When a train enters, its wheels and axles form a low-resistance path, or shunt, between the rails. The current bypasses the receiver, which reports occupied. Insulated rail joints, or tuned electrical boundaries in jointless designs, separate one section from the next.

The arrangement fails safe in the most common ways. A broken wire, a failed supply, or, in many designs, a broken rail interrupts the current and produces an occupied indication. The circuit can still fail on the wrong side if a train does not shunt it well. Rusty or contaminated rails, leaf residue, sand, and very light vehicles all raise the resistance between wheel and rail. In the United States, 49 CFR 236.56 requires each track circuit that controls a home signal or approach locking to register occupied when a 0.06 ohm shunt is connected across the dry rails, including the fouling sections of turnouts.

Ballast adds a second difficulty. Current leaks from rail to rail through the ties and ballast, and the leakage rises when the ballast is wet or fouled. A circuit adjusted to keep its receiver energized through heavy leakage in wet weather is harder for a train to shunt in dry weather, so its length and adjustment are a compromise between the two conditions. Direct-current, power-frequency, coded, and audio-frequency track circuits apply the same principle, and coded circuits can also carry cab signal information to the train. On electrified lines, the rails also carry traction return current, as described in Railway Traction Systems, and the track circuit must reject it.

Axle Counters

An axle counter detects trains by counting wheels. A counting head at each boundary of a section registers each passing wheel and its direction of travel, and an evaluator compares the number of axles that entered the section with the number that left. When the counts match, the section is clear. Axle counters need no insulated joints, cover long sections, and are unaffected by ballast resistance or rail contamination. They do not detect broken rails, however, and a power interruption or a disturbance can leave them unable to trust their count. The section then shows occupied until it is reset. Because a reset declares a section clear without proof from the counters, railways surround it with procedures, such as requiring the next train to proceed at a speed that lets it stop short of any obstruction.

Train-Reported Position and Train Integrity

Radio-based systems add a third source of information: the train's own report of where it is. On-board odometry measures distance with wheel sensors, radar, or accelerometers and corrects its accumulated error at fixed references such as balises or transponders, so the front of the train is known within a confidence interval that grows between references. The rear is harder. A train that has divided leaves vehicles behind, so a system that separates trains by reported position must also know that each train is complete. ETCS treats train integrity monitoring as outside its own scope, but it reports integrity to the Radio Block Centre when an on-board monitoring system or the driver confirms it. The application guide of the European Union Agency for Railways (ERA) notes that train integrity and length information can be very important on lines using hybrid train detection or moving block.

Magnetic levitation removes the wheel altogether, so a maglev vehicle can neither shunt a track circuit nor be counted by an axle counter. High-speed maglev systems derive occupancy from their propulsion system instead, as described in Maglev Transportation Systems.

Route Setting and Locking

When a signaler requests a route, usually by selecting its entrance and exit, the interlocking checks that the route is available, commands the point machines, waits until detection proves each switch in position, locks the points, and only then clears the signal. The harder case comes when a signal is put back to stop in front of an approaching train. A driver who has already seen a proceed aspect may be unable to stop, so the route cannot simply be released.

United States regulations define the two main protections. Approach locking, under 49 CFR 236.760, applies while a train is approaching, within a specified distance, a signal displaying a proceed aspect. If the signal is put back to its most restrictive aspect, the switches, movable-point frogs, and derails in its route stay locked until a predetermined time interval has expired. Route locking, under 49 CFR 236.767, takes effect when the train passes the signal and locks those devices in advance of the train within the route entered. It can be arranged to release as the train clears each track section.

The full set of conditions for every route is written in control tables. For each signal, they list the points it requires, the sections that must be clear, the routes it locks out, and the conditions for release. Control tables are the specification from which an interlocking is designed and against which it is tested.

Mechanical and Relay Interlocking

The earliest interlockings were mechanical: locking bars between the levers in a signal box made it physically impossible to pull conflicting levers. Relay interlocking replaced mechanical locking with circuits of safety signal relays, built so that their dangerous failure modes can be treated as incredible. The armature returns to the de-energized position by gravity when current is removed, and the contact materials are chosen so that a front contact cannot weld closed. Because the de-energized state is always the restrictive one, a relay circuit that loses power or breaks a wire fails safe.

Computer-Based Interlocking

Computer-based interlockings implement the same rules in software. Generic software applies the signaling principles and is assessed once for the product. Application data describes each installation: its layout, routes, and control tables. Field equipment is increasingly connected through object controllers near the track, linked to the central interlocking by data networks instead of individual cable cores.

An ordinary processor has no inherently safe failure mode, so the architecture must make faults detectable and their effects restrictive. CENELEC's 2009 application guide for EN 50129, CLC/TR 50506-2, describes three structures for fail-safe devices. Inherent fail-safety relies on physical properties that make hazardous failure modes incredible, as in a gravity-return safety relay. Composite fail-safety performs each safety function in at least two independent channels and allows a permissive output only when they agree; a two-out-of-two arrangement that shuts down on disagreement is the usual example. Reactive fail-safety performs the function in a single channel but detects and negates any hazardous fault fast enough, for example through continuous self-testing with an independent means of forcing outputs to the safe state. Many products add redundancy for availability, such as two-out-of-three voting, and use diverse hardware or software so that one design error is less likely to affect every channel.

Application data is a serious source of risk in its own right. An error in a control table, or in the data prepared from it, can produce an interlocking that runs flawlessly and still permits a conflicting movement. Railways therefore check application data independently of its preparation, simulate the interlocking against its control tables, and test the installed system before it enters service.

Intermittent Protection

Intermittent systems act at discrete points, usually at signals. A track-mounted magnet, inductor, or balise transfers a small amount of information as the train passes, and the on-board equipment reacts, for example by requiring the driver to acknowledge a caution or by braking a train that passes a stop signal or approaches it too fast. Examples include the Automatic Warning System and the Train Protection and Warning System in Great Britain, PZB in Germany, and KVB in France. Intermittent protection is relatively inexpensive, but the train learns of a change only at the next transmission point.

Continuous Protection and Cab Signaling

Continuous systems keep the train informed at all times. Coded track circuits send codes through the rails that on-board equipment decodes into cab signal aspects, a technique long used in North America. Germany's LZB uses cable loops laid in the track, and TVM, on French high-speed lines, sends its information through the track circuits. With a continuous link, the cab can display the permitted speed, and a less restrictive indication reaches the driver as soon as it occurs. At high speed, cab signaling also removes the need to read lineside signals at all, which is one reason high-speed lines rely on it.

Braking Curves

Modern ATP computes braking curves on board. The equipment knows the train's braking characteristics and receives a description of the track ahead, including speed limits, gradients, and the end of its movement authority. From these it calculates, for each point ahead, the highest speed from which the train can still stop or slow in time, and it compares the actual speed with that limit.

ETCS is a representative example. For the end of a movement authority, its on-board equipment calculates an emergency brake deceleration curve from the train's safe deceleration, reaching zero speed at the supervised location, and a service brake deceleration curve from the expected deceleration, reaching zero speed at the end of authority. The supervised location is the end of the overlap, if the authority includes one; otherwise a danger point, if one is given; and otherwise the end of authority itself. From these curves it derives supervision limits, from an indication to the driver through the permitted speed and a warning to service and emergency brake interventions.

Components

At the trackside, Eurobalises are transponders mounted between the rails that pass data to a train as it runs over them. A balise can send fixed data, such as a track description, or variable data supplied by a lineside electronic unit (LEU) connected to the signaling. The Radio Block Centre (RBC) is, in the words of the ETCS System Requirements Specification (SUBSET-026), "a computer-based system that elaborates messages to be sent to the train," using information from trackside systems and from the trains; the main purpose of those messages is to provide movement authorities.

On the train, the ETCS on-board equipment reads balises through a balise transmission module, measures distance by odometry, exchanges messages with the RBC over Euroradio, shows information on the driver machine interface (DMI), acts on the brakes through the train interface, and records juridical data for incident investigation.

Application Levels

ETCS application levels describe the operating relationship between track and train. They are not grades of performance. The Baseline 4 System Requirements Specification, SUBSET-026 version 4.0.0, defines four levels.

Level 1 is an overlay on existing signaling. Because a train learns that a signal has cleared only when it passes the balise group at that signal, it must approach the stopping location below a release speed unless infill is fitted. In Level 2, the RBC knows each train by its ETCS identity, follows its reported position, and sends each train its own movement authority and track description by radio.

Earlier baselines also defined a Level 3, in which the RBC separated trains using their reported position and integrity without relying on trackside detection. In SUBSET-026 version 4.0.0, the section that defined Level 3 is marked "Intentionally deleted," and the Level 2 definition now lets the RBC perform train detection and separation, as the table shows.

Baselines, System Versions, and the TSI

The specifications evolve in baselines, and trains and lines built to different baselines must work together; ERA's compatibility assessments found, for example, that Baseline 3 on-board equipment can run on Baseline 2 trackside. The mandatory set in Appendix A of the CCS TSI is ETCS Baseline 4 Release 1, with GSM-R Baseline 1 Maintenance Release 1 and Future Railway Mobile Communication System (FRMCS) Baseline 0 for radio, and automatic train operation (ATO) Baseline 1 Release 1.

The TSI is Commission Implementing Regulation (EU) 2023/1695 of August 10, 2023, amended by Commission Implementing Regulation (EU) 2026/693 of March 19, 2026, as regards new testing specifications, a set of reduced specifications, and transitional measures. The amendment describes two reduced ETCS system versions, 2.1 and 2.2, alongside the complete version 3.0. According to ERA's application guide, an on-board unit needs system version 2.2 or higher to run in Automatic Driving mode on a line with ATO trackside equipment, and an on-board unit that adds FRMCS should be upgraded at the same time to version 3.0, which supports ETCS over FRMCS.

Modes and Automatic Train Operation

ETCS on-board equipment always operates in one of a defined set of modes, which determine what it supervises and who is responsible. Full Supervision applies when all the train and track data needed for complete supervision is on board. On Sight lets a train enter a section that could already be occupied or obstructed. Staff Responsible lets the driver move the train under his or her own responsibility when the system does not know the route, for example after start-up. Baseline 4 also includes Automatic Driving, in which the ATO on-board equipment drives the train according to a journey profile from the ATO trackside.

The 2023 TSI introduced ATO at grades of automation 1 and 2. ERA's application guide explains that the ATO specifications mainly describe grade 2, in which ATO drives the train, and also provide grade 1 functionality in the form of a driver advisory system.

Architecture

A CBTC system divides its work among three groups of equipment. Train-borne controllers determine the train's position, supervise its speed against its movement authority, and, where ATO is fitted, drive it. Wayside controllers, usually organized by zone, track every train in their territory, work with the interlocking functions, and issue movement authorities. A data communication network, usually radio, carries the continuous exchange between train and wayside, while automatic train supervision regulates the service by setting routes and managing dwell times and schedule adherence. In many systems, train position comes from odometry corrected at transponders fixed to the track, so it is resolved far more finely than the length of a track circuit.

Moving Block

Because the wayside knows each train's position continuously, it need not reserve whole fixed blocks. In moving block operation, the end of a following train's movement authority is placed a safety margin behind the confirmed rear of the train ahead, and it advances as that train moves. Treating the train ahead as a stationary obstacle, as the fixed-block model does, the front-to-front separation becomes

s = D + M + L

where D = v × t + v² / (2a) is the braking distance including the equivalent delay, M is the safety margin, and L is the length of the train ahead. Real systems also allow for uncertainty in reported positions. With the illustrative values used for fixed block and a 50 m margin, a train at 160 km/h needs about 1,750 m instead of 3,600 m, and the plain-line headway falls from about 81 s to about 39 s. At 80 km/h, the fixed-block model gives about 63 s and the moving-block model about 29 s.

The model also shows that capacity does not keep rising with speed. Dividing the separation by the speed gives the moving-block headway

h = t + v/(2a) + (M + L)/v

The braking term grows with speed while the length term shrinks, so for fixed t, a, M, and L the headway is smallest where its derivative with respect to v is zero, at v = √(2a(M + L)). With the illustrative values, that is about 18.7 m/s, or 67 km/h, where the headway is about 28.7 s, barely below the 29.1 s at 80 km/h. Above that speed, running faster shortens journeys but lowers plain-line capacity.

Stations Set the Practical Limit

In a metro, the binding constraint is usually the station. Under moving block, a following train can brake smoothly into the platform only if the end of its authority has reached the stopping point by the moment it must start braking, so the train ahead must by then have moved its own length plus the safety margin from rest. The worked example below ignores the delay before braking and uses illustrative values: a 120 m train, a 50 m margin, constant acceleration and braking of 1.0 m/s², an approach speed of 80 km/h (22.2 m/s), and a 30 s dwell.

1. The train ahead must move 170 m from rest at 1.0 m/s², which takes √(2 × 170 / 1.0) ≈ 18.4 s. It is then moving at about 66 km/h, below the approach speed, so constant acceleration is consistent.
2. The following train brakes from 22.2 m/s to a stop at 1.0 m/s², which takes 22.2 s and covers about 247 m.
3. The following train then dwells at the platform for 30 s.
4. The interval between successive departures is 18.4 s + 22.2 s + 30 s ≈ 71 s, or about 51 trains per hour.

Practical design headways add margins for braking uncertainty, equipment delays, and irregular dwell times, and turnbacks and junctions often limit capacity before plain-line or station headway does. The calculation shows why dwell time and acceleration, not signaling alone, set the capacity of a busy metro line.

Degraded Operation and Automation

A CBTC line must keep running when a train's equipment fails or an unequipped work train enters. Many systems therefore keep secondary train detection, typically axle counters, together with wayside signals or procedures that let unequipped or failed trains move under restricted conditions. CBTC is also the platform for higher grades of automation. IEC 62290-1 defines grades of automation from GoA0, on-sight operation, through GoA1, in which a driver operates the train under ATP, and GoA2, in which the system accelerates and brakes the train while a driver remains in the cab, to GoA3, with no driver in the cab but staff on board, and GoA4, unattended operation. Unattended lines often add platform screen doors and intrusion detection, because no one on board is watching the track ahead.

Periodic Inspection and Testing

Regulators and infrastructure managers prescribe inspections and tests at defined intervals. In the United States, 49 CFR Part 236 sets inspection and test requirements for signal and train control equipment, including the shunting sensitivity requirement described earlier. Typical tasks include proving that each track circuit detects a test shunt, that point machines lock and detect correctly and refuse to show a switch in position when an obstruction holds the switch rail away from the stock rail, that signals display the correct aspects, and that standby batteries can carry the load. Many of these tests deliberately create a fault condition to prove that the system responds restrictively.

Testing After Alterations

A signaling system is especially vulnerable while it is being changed. At 8:10 a.m. on December 12, 1988, a crowded commuter train ran into the rear of a stationary train just south of Clapham Junction station in London and then struck a third, oncoming train. Thirty-five people died, and nearly 500 were injured, 69 of them seriously. The formal investigation, held by Anthony Hidden QC, traced the collision to wiring errors made during resignaling work. An old wire that should have been disconnected at both ends was left connected at one end, and its loose other end made contact at a relay. The resulting false feed of current bypassed a track relay, so the signal protecting the track circuit kept showing a proceed aspect while a train occupied the circuit. The report called the testing of the work "the last defence" and devoted a chapter to its failure.

The lessons apply to any signaling change. Alterations need design checking by someone other than the designer, installation checks such as wire counts and correspondence tests between the wiring and the design, functional testing of every route against its control table, and testers who are independent of the installers. For computer-based systems, the equivalent disciplines are strict configuration management of software and application data, regression testing, and simulation before commissioning.

Condition Monitoring and Diagnostics

Electronic monitoring now watches much of the equipment continuously. Point machines are monitored for motor current and operating time, which reveal rising friction, obstructions, or poor adjustment before a switch fails to lock. Track circuit receiver levels reveal gradual changes from ballast deterioration or rail contamination, and axle counters log disturbances and resets. Computer-based interlockings, RBCs, and CBTC wayside equipment keep event logs that show what the system saw and did. Radio networks are monitored for coverage and lost messages, because a lost ETCS radio connection or CBTC data link can stop trains.

These data support a shift from fixed-interval maintenance toward condition-based maintenance, in which measured condition decides when work is done. The shift does not remove periodic safety tests: monitoring can show that equipment is degrading, but only a deliberate test proves that a safety function still works.