Back to basics: Interlocking

Part 1

Francis How

This, the third in a series of articles on ‘back 2. When a train has been given authority to move:
to basics’ themes, looks at the essentials • points in the section of track are prevented
of ‘interlocking’. Interlocking is central from being moved, and
to railway signalling, as it ensures that • other trains are prevented from entering the
the components of a signalling system same section of track.
act together in a manner which is safe
for the routing and movement of trains. until the train has passed through the
Whole books could be written about the section of route.
subject, and this article is no more than an There is more to interlocking than this, as we shall
introduction, intended for IRSE members see, but this is the essence of what it is all about.
new to the industry rather than those who
are experienced in specifying, designing and What does interlocking not do?
“Interlocking testing signalling systems. Interlocking does not check that everything is safe
for the passage of a train. A section of railway track
does not check This article focuses primarily on the technology
must be safe for the passage of trains in many
used for interlocking. Next month there will be
that everything a further article, in which we will look at the
other ways as well. For instance, the distance
is safe for the between the rails must be correct, the track-bed
functionality of an interlocking – what it actually
must be capable of supporting the weight of a
passage of a does in practice.
train, and the train’s cross-sectional dimensions
train” What is interlocking? (the dynamic envelope) must be compatible with
the positioning of items such as platforms and
If you ask a signal engineer about interlocking,
bridges, so that the train will not hit them. These
they may well point to an equipment room full
can also cause collision or derailment – but
of relays, or a cabinet of computer equipment
they are not generally the concern of the signal
in a control centre, or perhaps even some
engineer. Railway engineers have other methods
complicated-looking arrangement of metalwork
for ensuring the integrity of these other features
underneath a lever frame in a signal box. It is
upon which train safety depends.
true that all these things are ‘interlockings’, but
‘interlocking’ is defined as a feature of a control Interlocking safety
system that makes the state of two functions
Interlocking functions (such as moving a set of
mutually dependent. In the context of railway
points or clearing a signal) must be executed only
signalling, interlocking is used to keep trains
when it is safe to do so. Industrial control systems
safe from collision and derailment. The primary
(of which railway signalling is an example) are
purposes of these interlocking features are
designed to meet a specified ‘safety integrity level’
to ensure that:
(SIL). There are five such levels, from 0 to 4, and
1. Before a train is given authority to move along the interlocking functions in a modern main line or
a section of track from one signal to the next: metro railway signalling system must usually meet
• points are in the correct position (to SIL 4 requirements – the highest level possible.
avoid derailment), This means the likelihood of an unsafe failure is
incredibly small.
• there are no trains already on the track (to
avoid collision), and The underlying safety principle traditionally
• no conflicting train movements are already associated with railway signalling, and particularly
authorised (also to avoid collision). with the interlocking, is known as the ‘fail-safe’

16
 IRSE News | Issue 265 | April 2020

principle. This means that if an interlocking system have left the section – without any knowledge of
develops a fault, it is designed so that it will fail in whether in practice it had done so!
a manner which stops trains, by putting signals
Not surprisingly, it didn’t take long for accidents
to danger. This fail-safe property is achieved in
to demonstrate the need for safer ways of
various ways, including the use of inherently fail-
controlling the movement of trains. This article
safe components, the design of the interlocking
does not explore the evolution of railway
logic, and the system architecture.
signalling, but there were some key milestones
It is important to note that ‘fail-safe’ does not in its development which are worth noting. One
mean that the signalling of trains is 100% safe. This was the introduction of the electric telegraph, so
is partly because in practice the occurrence of that someone at one end of section of railway line
unsafe failures cannot be completely eliminated, could communicate with someone at the other
and partly because if trains have been stopped end. This eliminated the need for ‘time interval
by a (safe) failure of the signalling system, the working’ by enabling the person controlling entry
movement of trains then depends largely upon to a section of line to receive positive confirmation
the application of operational procedures, with the when the whole of the preceding train had left the
associated risk of human error. section and therefore the line was again ‘clear’.
Not all parts of a signalling system need to be A second crucial development was the
ultra-safe. In modern systems the use of high introduction of the signal box, to enable signals
integrity (SIL 4) design techniques is usually and points to be controlled from one place.
restricted to those parts of the system which are Previously the setting up of a route for a train had
essential for safety – including the interlocking relied upon people walking about on the track to
functionality. Other parts, such as the control move points and operate signals. Centralisation
panel or desk, are usually of a lower integrity of these activities was not only more efficient and
(typically SIL 0 to SIL 2). You might wonder why reduced the possibility of misunderstanding, it
we do not design all parts of the signalling system also facilitated the introduction of ‘interlocking’
to achieve SIL 4 levels of safety. The answer is – mechanical equipment in the signal box that
Figure 1 – The that designing systems to meet high levels of helped to prevent mistakes being made by
Chippenham, UK, factory safety integrity is complex, time-consuming the signaller when moving points or operating
of Westinghouse Brake and expensive, and can lead to lower levels signals. Even in the age of computerisation, it is
& Saxby Signal Company
of reliability. remarkable to look back at how railway engineers
in 1927. Some 60 years
after the invention of the of the 19th century invented mechanical logic
A little history… systems that largely overcame the risk of human
interlocking skilled teams
were still assembling When railways first appeared, they had no error when signalling trains.
complex lever frames – signalling in the form that we would recognise
some of which are still in So, the way was paved for the introduction
today. The concept of a signal box did not exist,
use today. of ‘interlocking’ according to a defined set of
signals were very rudimentary (originally just a
Photo WB&S Archive/ principles or rules – which for the most part still
man with a flag), and giving permission for a train
Chippenham Museum & apply today, albeit they vary in some respects from
Heritage Centre.
to enter a section of track relied simply upon
railway to railway.
allowing sufficient time for the preceding train to

17
IRSE News | Issue 265 | April 2020

Interlocking technologies Gradually engineers began to introduce simple

electro-mechanical locking in combination
Mechanical interlocking
with the mechanical locking, to prevent a lever
The earliest form of interlocking was purely from being moved unless its electric lock was
mechanical. Signal boxes were usually two storey energised. Energisation of the lock (via an
buildings, with the signaller working upstairs electrical circuit) required other levers to be
and the interlocking downstairs. To allow a electrically proved to be in the correct position.
train to move, the signaller would operate large Further conditions were progressively added to
levers, separate ones being provided for each the lock circuits to improve safety, such as the
set of points and for each signal. These levers requirement for relevant track circuits to be clear
were directly connected via mechanical rods before a signal or set of points could be moved.
and/or wires to the points and signals outside,
and therefore could require considerable Safety features were also added to the block
effort to move. systems that controlled the movement of trains
between neighbouring signal boxes, to prevent a
On the ground floor of the signal box, underneath signaller from sending a train from the area that he
the levers, was an arrangement of metal bars that controlled to that of the next signal box unless it
were connected to the levers, with other bars at was safe to do so.
right-angles to the first. The physical interlocking
of the two sets of bars prevented the signaller Mechanically interlocked signal boxes are still in
from moving a lever unless other levers were in use on railways in many parts of the world, well
the correct position. So, for instance, he could over 125 years since they were introduced.
not move a signal lever to allow a train to move
unless the relevant points levers were in the
correct position.

How does mechanical interlocking work?

A flat metal bar (called a tappet) is of one lever is prevented or permitted the notch in the tappet of Lever 4 and
attached to the end (tail) of each lever. according to whether a locking piece is is not free to move out of it. Thus Lever
All the tappets are held within a locking held in a notch in the tappet, or is clear 1 locks Lever 4. The converse is also
box, so that each one moves in one of (or free to move out of) the notch. true. If Lever 1 is normal and Lever 4 is
direction when the corresponding lever The use of bevelled edges enables a reverse, Lever 4 locks Lever 1 normal,
is pulled to its reverse position, and in tappet, when free to move, to force the as shown in Figure 2c (this is called
the opposite direction when the lever is locking piece out of the notch. reciprocal locking and is an inherent
pushed back to its normal position. feature of mechanical locking). Much
In Figure 2a below, when Lever 1 is
more complicated locking arrangements
To create a lock, a bevelled notch is cut pulled from normal to reverse, the
can be created than the simple one
in the side of a tappet, and a locking tappet will move in the direction of the
shown, with levers being locked in both
piece (sometimes called a nib) is cut arrow. The positions of the tappets and
normal and reverse positions by multiple
to fit the notch. If a horizontal bar is locking pieces will then be as shown in
other levers, and with locking of one
placed in the locking box with one Figure 2b, and Lever 4 is locked in the
lever by another being conditional on
end connected to the locking piece, normal position. It cannot be moved
the position of a third lever.
and the other end is connected to because the second locking piece
another locking piece, the movement (connected to the first) has engaged in

Tappet connected Tappet connected

to Lever 1 to Lever 4
1 4 4 1

Connecting
bar
1 4

Locking nibs
Figure 2a Figure 2b Figure 2c

18
 IRSE News | Issue 265 | April 2020

Figure 3 – The Electrical interlocking smaller, and were often designed to plug into
introduction of relay- bases to which all the wiring was connected, so
based signalling allowed
The advantages of using electrical locking
became even more evident when colour light making it easy to replace a faulty one as well as
control centres to move
signals and electric point machines began to be enabling hundreds or even thousands of them to
to the use of complex
panels. These UK introduced. Mechanical locking could be entirely be housed in a much smaller space. All the wiring
examples are from Carlisle replaced by electric locking, and large levers were and the relays and their bases were mounted on
(left) and London Bridge no longer necessary for operating points and vertical racks, and a large interlocking might have
(right) power signal boxes,
signals, since no great physical effort was required dozens of such racks, all housed in a ‘relay room’.
commissioned in the
1970s.
by the signaller to switch an electric signal Not sure what a relay is?
Photos WB&S Archive/ or point machine.
A relay is an electromechanical switch, with an
Chippenham Museum &
Early all-electric signal boxes used miniature electromagnetic coil, an armature and various
Heritage Centre.
mechanical levers on a desk, replicating in contacts. When the coil is energised, the armature
a more modern form the row of levers in moves and closes a number of contacts (‘front’ or
mechanical boxes. This evolution led in time to ‘normally open’ contacts) and opens others (‘back’
the introduction of control panels, with switches or ‘normally closed’ contacts). These contacts
and buttons on the panel being used to set are used in other circuits to create the logic
whole routes from one signal to the next, without conditions for operating other relays, powering
the signaller needing to set the points in the point machines, illuminating the aspects of signals
Figure 4 – Different route individually. etc. When the coil is de-energised the armature
approaches to relay
design. Below, the type N
returns to its original position, opening the front
The ‘route setting’ approach eventually became
relay, bottom the type C. contacts and closing the back contacts.
the preferred form of control. The role of the
Photos Siemens Mobility interlocking was crucial in this. Instead of being
and E Dold & Söhne KG.
Relay interlocking architecture and design
a passive system for determining whether it was The architecture of relay interlockings varies from
safe to operate a set of points or a signal (as railway to railway (even within a single country),
mechanical locking had been), it became an active and from country to country. We are not going
system that interpreted and acted on requests to explore all the variations here, but it is worth
received from the control panel. In simple form, understanding a little about the basic design
the request to set a route from one signal to the philosophies that characterise almost all relay
next is set up by the signaller using switches and interlockings.
buttons on the control panel (which has a diagram
of the track layout on it). The interlocking then In the early days all relay interlockings were ‘free
moves the relevant points provided it is safe to do wired’. With this approach, each circuit, whatever
so, checks that the track is clear of other trains, its purpose or function, was individually designed
and clears the entrance signal for the route. and wired, usually in accordance with a set of
templated (standard) circuits. In time an alternative
Relays approach emerged, whereby manufacturers
The fundamental building block of the traditional provided a range of factory-wired, pre-tested
route-setting interlocking is the relay. Before the sets of relays known as ‘geographical’ units. Each
relay interlocking gained prominence, relays had type of unit was designed to provide the standard
already been used for track circuits and for other interlocking functions required for a specific
simple circuits in mechanical and early electric combination of signals, points and train detection
signal boxes. These relays had generally been sections. By connecting the appropriate units
relatively large devices, often designed to sit on together (usually with plug-coupled cables) to
shelves. But as relay interlockings became more mimic the actual layout of the track and signalling,
popular, relays were progressively made physically the required route-setting functionality could be

19
IRSE News | Issue 265 | April 2020

Figure 5 – Route relay

interlockings have
been very successful
in a huge range of
applications world-wide.
In this example from the
original Singapore MRT
scheme the interlocking
is interfaced to coded
track circuits allowing
a high performance
automatic train protection
and automatic train
operation system to be
implemented.
Photo WB&S Archive/
Chippenham Museum &
Heritage Centre.

built up relatively easily. There are advantages and with the passage of the trains. By contrast, the
disadvantages with both approaches, including dependable fail-safe nature of the type N relay
cost, flexibility, speed of design and testing. makes it generally unnecessary to include this
additional complexity.
Secondly, the relay interlocking circuits (both
free-wired and geographical types) vary in form In all interlockings the circuits are designed to
according to the type of relay used. There are, exploit the safety characteristics of the relays.
broadly speaking, two generic types of relay used Usually this is done by requiring a relay to be
for all interlockings. One type is inherently ‘fail- energised to allow a less restrictive state (e.g. to
safe’, meaning that if the coil is de-energised, the allow a signal to show a proceed aspect, or to
“A route relay front contacts will always open, and it is virtually allow a set of points to move). If the relay or the
interlocking is, in impossible for a failure to occur whereby front power supply fails, or there is a disconnection in
effect, a and back contacts are in the ‘closed’ position at the circuit, the relay de-energises, so causing the
the same time. The use of non-welding materials signalling equipment to revert to a safer state.
hard-wired for the contacts makes it impossible for a contact
parallel to weld in the closed position. This type of relay Computer-based interlockings (CBI)
processing logic is known generically as type N in UIC standard With the development of electronic logic gates in
736i. The best-known family of signalling relays the form of integrated circuits, and subsequently
machine.” in this category is probably the BR930 series, the with the emergence of the microprocessor and
development of which, incidentally, involved the programmable logic controllers (PLCs), it was a
IRSE. There are at least 200 variations of this same natural step to see how this technology could
basic relay, with different operating characteristics be applied to interlockings. Early experimental
(slow to energise, slow to de-energise etc), installations were implemented in the 1960s
different numbers and types of contacts, and and 1970s, but it was in the mid-1980s that
different operating voltages. the electronic software-based interlocking first
became a reality. One of the best known of
The other generic type of relay used in some these was SSI – the ‘Solid State Interlocking’,
interlocking systems is known as type C in UIC developed in the UK.
standard 736i. It is not guaranteed to behave in
the inherently fail-safe manner described above. The use of software-driven electronic logic
Specifically, it is possible for a contact to weld presented a whole new set of challenges for
so that it remains closed when it should be open system designers. A route relay interlocking is,
although, as with a type N relay, the mechanical in effect, a hard-wired parallel processing logic
design prevents any front and back contacts being machine. If it goes wrong it could initiate unsafe
closed at the same time, even if welding occurs (a actions, but the potential failure modes and
feature known as ‘forcibly guided’ contacts). Such their causes are well-understood and, by good
relays have the advantage of being considerably design practice and by testing it to make sure
less expensive and smaller. But in order for the the locking conforms to the application rules,
interlocking as a whole to behave in a fail-safe the probability of an unsafe failure is very low. A
manner, the circuits are more complicated as computer-based interlocking (CBI), which makes
a consequence of using additional contacts to use of microprocessors, is another matter entirely,
prove that relays have de-energised correctly, however. Microprocessors comprise hardware and
and because of the need to check that the embedded software, and these are not designed
circuits are operating in the correct sequence to meet the high integrity safety requirements

20
 IRSE News | Issue 265 | April 2020

Processing Processing Processing Processing Processing Processing

channel A channel B channel A channel B channel C channel D

Vote Vote Vote

Action

Action

Figure 6 – Achieving safety and availability in

interlocking systems typically involves the adoption of
one of the architectures shown here. Processing Processing Processing
channel A channel B channel C
Above left, ‘two out of two’ requires both processing
channels to determine a course of action which will
only be carried out if both agree. If either fails then the
system shuts down to a safe state.

Above right, duplicating two sets of ‘two out of two’

Vote
and switching between the two pairs increases system
availability.

Right, ‘two out of three’ uses three processing channels. Action

At least two channels must agree on an action before it
is taken, but failure of a single channel will not lead to a
shut down.

necessary for an interlocking. Failure modes of dependable. A simple electronic comparator that
microprocessor-based systems are much more is monitoring the two outputs is not sufficient.
complex and unpredictable than in relay logic, Secondly, there is the problem of common mode
and their causes can be difficult to trace. These failure. Since both channels are executing the
causes include electrical interference, unstable same task, there could be processor problems
supply voltages, poor programming (leading or programming errors which would affect both
to memory stack overflows, race conditions, channels in the same way. In such circumstances
deadlock, etc), derived requirement errors and there would be no disagreement between the
manufacturing defects. outputs presented to the comparator, and the
system would consequently not shut down.
The architecture of the software-based
interlocking must be designed so that the overall There are various solutions to these problems, of
“Failure modes of level of safety is at least as safe as the best relay course, and different system manufacturers adopt
interlocking, despite the relatively low integrity of different approaches. These may involve:
microprocessor- the component parts and the complexity of their
based systems failure modes. The basic approach is to have two
• using different hardware and/or software for
the two channels to reduce the likelihood of
are much more separate processing channels in the interlocking,
common mode failure (often called ‘diversity’).
complex and each one executing the route requests from the
control panel (or desk/VDU) in accordance with • more complex cross-checking of internal
unpredictable the signalling principles and application rules for states, inputs and outputs between the two
than in relay the particular track and signalling layout. This is channels in order to detect faults.
logic.” known as a ‘two out of two’ (2oo2) configuration. • more than one mechanism by which a
In the event of a difference in the outputs from shutdown can be enforced (and employing
the channels (indicating an error has occurred), special hardware for the purpose).
the system shuts itself down and a safe state is These mechanisms are not without their
enforced. In most systems lineside signals return difficulties. For instance, a lack of synchronisation
to danger (stop) and points cannot be moved. (differences in timing) of processing in the two
In practice, achieving a safe shutdown is not channels can cause the two channel outputs
quite as simple as it might at first appear. Firstly, to be different for short periods of time, even
the part of the system that compares the outputs though each channel is behaving correctly. These
of the two channels and shuts the interlocking short-term differences may be interpreted by any
down in the event of a difference must be highly cross-checking as an error and cause a shutdown,
creating a serious threat to reliability.

21
IRSE News | Issue 265 | April 2020

Figure 7 – Most
computer-based Project specific signalling logic
interlockings split configuring system to a specific
their software and scheme plan and layout
configuration into a
number of layers, enabling
Specific application logic
Signalling logic and rules, typically
the same basic hardware
to be used in many entered once per railway, common
different applications. across all applications on that railway
Generic application software
Operating system, created as part
of product development, common
Generic product software across all railways where product used

Reliability of CBIs Configuring CBIs

The reliability of computer-based interlockings All interlockings must be configured for the
is almost as important as their intrinsic safety. A particular track and signalling layout required
fault in a relay interlocking (such as a failure of – a task generally performed by a signal
a relay) may cause a small number of routes to design engineer. In the case of computer-
be inoperable, but it is very unlikely to render the based interlockings, he or she has to produce
whole interlocking unusable and thus stop all configuration logic (program code and/or data) –
trains. But a computer-based interlocking that a process commonly known as ‘data preparation’.
detects a processing fault may shut itself down
The concepts of ‘free-wired’ and ‘geographical’
completely, stopping all trains in the area of
relay interlockings have their equivalents in
control. Most modern CBIs therefore have built-in
computer-based interlockings, each with their
redundancy to improve reliability.
advantages and disadvantages. Both make use
One approach is to have three processing of the duplication and redundancy techniques
channels in the interlocking, instead of two. If described above to achieve required levels of
one channel disagrees with the other two, a safety and reliability.
majority voting system shuts it down and the
The free-wired equivalent typically uses general
interlocking continues operating with the two
“The safety remaining channels. This configuration is known
purpose safety PLCs which are configured for
of the railway each specific railway layout. A notation known
as ‘Two out of Three’ (‘2oo3’) and was popular
as ‘Ladder Logic’ is frequently used to configure
is critically in early CBIs when computers were expensive,
the system, although it is also possible to use
because it used less hardware than the alternative
dependent not arrangement described below. There is a marginal
fundamental Boolean logic or more sophisticated
only upon the PLC programming languages. Ladder logic
safety disbenefit in this arrangement, because
resembles a conventional circuit diagram that
core interlocking very rarely it could be that one channel is correct
has switches, relay coils and contacts, and other
product but and the other two are in error. In addition, if
electrical elements such as counters, latches and
the same software is used in all three channels
also upon the then common mode failure remains a risk and
timers. It is therefore intuitively easy to produce by
someone familiar with relay circuits.
correctness producing three diverse sets of code and/or
of the specific hardware to avoid such failures would be very The equivalent of a geographical relay
expensive and create an even greater risk of interlocking uses a more conventional form
application data/ timing issues. However, the other safeguards built of microprocessor-based computer. The core
logic” into the systems makes these issues extremely system (the ‘generic product’) is customised by
unlikely in practice. incorporating standard software modules which
define how basic track and signalling elements
Alternatively, some interlockings have a complete
operate in accordance with the signalling
duplication of the two channels (i.e., two sets,
principles for the railway on which it is to be
each comprising two channels) – a configuration
used. This hardware and software package is the
known as ‘Duplicated Two out of Two’ (2X2oo2).
signalling manufacturer’s interlocking country/
If one set identifies a disagreement between its
client-specific product (known as the ‘generic
channels, it is shut down and the other set (which
application’). The signal design engineer then
is in effect a ‘hot standby’) continues to operate
produces application data which defines how
the railway. This tends to be a more popular
the country/client-specific software modules
arrangement in modern interlockings, as it is
are configured to represent the particular track
easier to implement than 2oo3 and the cost of the
and signalling layout (known as the ‘specific
additional hardware is not such a big issue as it
application’). The data format is usually proprietary
used to be. The set of hardware and software that
to each manufacturer’s system.
is acting as the hot standby must have all the same
inputs and be kept in complete synchronism with In both types of interlocking, the safety of the
the controlling set otherwise the changeover will railway is critically dependent not only upon
not be seamless and some form of initialisation the core interlocking product but also upon the
process will be required. correctness of the specific application data/logic,
which is why so much effort goes into checking
and testing it.

22
 IRSE News | Issue 265 | April 2020

Control Centre
(Control Panel or
Computer Workstation)

Indications
Requests
High integrity Multicore cable,
multicore cable, datalink or
datalink or transmission
transmission system
system

Requests
Neighbouring
Interlocking
interlockings

High integrity
multicore cable,

Status
datalink or
transmission
system

Trackside cabinet Trackside cabinet Trackside cabinet

containing interface containing interface containing interface
equipment/object equipment/object equipment/object
controllers controllers controllers
Commands

Commands

Commands
High integrity High integrity High integrity
cables cables cables

Points Train detection Signals Points Train detection Signals Points Train detection Signals

Figure 8 – The Nowadays a large proportion of the data and Interlocking to control panel/desk
interlocking forms the logic for computer-based interlockings can be interface
‘safety layer’ of a railway generated automatically from the signalling
signalling system, The signaller controls the movement of trains
scheme specifications. Signal design engineers
receiving information either by use of a control panel or by using a
from and relaying status can therefore concentrate their skills on the
control desk and workstation. A panel is equipped
to a control centre, special or unusual interlocking elements of a
with a representation of the track layout, on which
communicating with signalling scheme which cannot be designed
are buttons and switches for setting routes etc,
adjacent interlockings, automatically. Simulation and automated testing
and controlling trackside
and indications to show him or her information
can also reduce the amount of manual verification
objects. including what routes are set, the positions of
and validation required. Because interlockings
trains and the aspects of signals. In the case of
primarily implement a set of logical rules they are
a control desk and workstation, the signaller
particularly well suited to testing and validation
has the same information presented to him/
using formal methods and automation. Most
her on screen and sets routes etc by use of a
of the major interlocking suppliers have now
keyboard and mouse.
adopted these methods in some form and as
a result the number of errors found by more The interface with the interlocking is therefore
conventional testing, particularly in the field, has two-way, with route requests being sent from
reduced very significantly. the control panel/desk to the interlocking and
information from the interlocking being sent to
The interfaces between an the control panel/workstation. There is usually
interlocking and other sub-systems some sort of interface sub-system (either relays or
In a modern signalling system, an interlocking software-based) between the two.
interfaces with a number of other sub-systems. A typical control panel/desk will communicate
The three most important interfaces are with with several interlockings, as the geographical
the trackside equipment, with the control panel area covered by the control panel/desk is often
(or computer workstation), and with other larger than that covered by a single interlocking.
neighbouring interlockings. There are of course Where all the interlockings are housed in
other interfaces, but we are not attempting the same building as the control panel/desk,
here to describe the architecture of a complete the communication with the interlockings is
signalling system, so they are not explored achieved either by multi-core cables or by a data
in this article.

23
IRSE News | Issue 265 | April 2020

Figure 9 – The use communications bus. If some of the interlockings circuits for operating the signals, moving points,
of computer-based are in buildings some distance from the control indicating the occupancy or otherwise of a track
interlocking, and centre, then some form of remote control and circuit to the interlocking etc. The interlocking
increasingly the
indication system (using, for instance, time- depends upon the integrity of these circuits in
use of network
communications, division multiplexing) is often used to connect order to function safely.
allows modern interlockings to the control centre to reduce the
In the case of computer-based interlockings, the
control systems to amount of cabling required.
be implemented, as
items of trackside equipment are normally (but not
in this example from It is important to note that all these always) connected to nearby object controllers
Hong Kong MTR. communication links are not safety-critical (i.e. which provide the power for the equipment, pass
The interlocking they do not have to be SIL 4). The interlocking the interlocking commands to the equipment and
continues to ensure ensures the safety of train movements even if receive equipment status information for sending
that the signalling there is a fault or failure in the communications back to the interlocking. The object controllers
rules are enforced links or interface sub-systems. That said, the are connected to the trackside equipment by high
to assure safety, but
the non-vital control
interfaces and communications links must be as integrity cables as described above, and to the
system above allows reliable as possible, both for normal working and interlocking via a communications datalink. Just
the railway to be in degraded mode situations. In both cases, the as with relay interlockings, the integrity of the
operated optimally. control panel or workstation is presenting the communication link is vital for the safe operation
Photo Francis How. signaller with information about the railway, upon of the interlocking. The object controllers
which he or she makes decisions regarding the therefore generally have a 2oo2 configuration
movement of trains. to ensure safety, and the datalink uses highly
secure coding techniques to prevent (or detect)
Many modern signalling systems include
corruption of the transmitted data. In some
Automatic Route Setting (ARS), a sub-system
manufacturers’ systems the communications
which automatically sets routes ahead of each
protocol is proprietary to their product, but
train based on the timetable and, where conflicts
increasing use is now being made of IP addressing
arise (eg because of late running), on a set of rules
techniques. Manufacturers still use their own
“Just as for prioritisation of train movements. This relieves
safety and applications protocols, although the
the signallers of much of their routine work. So
with relay far as the interlocking is concerned, however, it
European EULYNX project is promoting open
standards for interfaces, to reduce signalling
interlockings, receives and acts on ARS route-setting requests
life cycle costs.
the integrity in the same way as if the requests had come from
the signaller and the control panel/workstation. Interlocking to interlocking interface
of the
Interlocking to trackside equipment Interlockings must be able to interface with
communication neighbouring interlockings, because almost
interface
link is vital for inevitably at the geographical boundaries there
In the case of a relay interlocking, in most
safe operation” systems the items of trackside equipment (signals,
will be routes that have their entrance signal in
the area controlled by one interlocking and their
points, track circuits etc) are connected to the exit signal in the area controlled by another.
interlocking by multi-core cables, with a dedicated The route setting process is initiated by the
pair of cores for each circuit. The cables are interlocking responsible for the entrance signal,
generally specified and constructed to meet but requires action by, and information from, the
railway requirements, both in terms of resilience other interlocking in order for the complete route
to the trackside environment, and in terms of to be declared ‘set’, before the entrance signal is
the integrity and separation of each core. This is allowed to clear.
necessary because they are carrying safety critical

24
 IRSE News | Issue 265 | April 2020

It is common practice, so far as possible, metros, a number of systems already combine

to arrange the geographical boundaries of the functions of interlocking and track-train
interlockings to occur on sections of plain line, messaging within the same system.
where the interlocking arrangements for each
A second possibility, and one that is already
cross-boundary route are very straightforward.
being explored, is to use cloud technology
However, this is not always possible, particularly
for interlocking. This has various advantages,
in places such as complex station areas where
including cost, flexibility and, potentially,
more than one interlocking is required. In
resilience. It also comes with challenges, not the
the case of relay interlockings, the interface
least of which is maintaining cyber-security (and
generally takes the form of high integrity multi-
therefore safety as well as reliability).
core cables to link circuits in the two equipment
buildings – the same sort of cables as are used to Thirdly, we may see a move towards distributed
connect the relay interlockings with their items of interlocking functionality. In recent years the trend
trackside equipment. has been to place computer-based interlockings
together in a single location (often co-located
In the case of computer-based interlockings, a
with the control centre). In time this may change,
high integrity datalink is used for the interface
with some interlocking functions shared between
(bearing in mind that the two interlockings may
the train-borne and trackside systems. Indeed, it
well be in physically adjacent cabinets in an
could be argued that this is already happening to a
equipment room rather than in separate buildings).
limited extent with CBTC and ERTMS.
However, the interfacing arrangements tend
to be more complex than in the case of relay Even more radically, the train may play a key role
interlockings. The two sets of software have to in initiating the setting of the route ahead and in
act together and perform ‘handshakes’ with each determining its own safe movement authority,
other in order to set, lock and release routes. making use of train-to-train communications
to do so. A more train-centric architecture will
The future of interlocking be adopted, with the trains being ‘smart’ rather
At the beginning of this article we said that than simply responding to movement authorities
‘interlocking’ is the mutual dependency between issued by trackside infrastructure systems. Again,
signalling functions (moving points, clearing suppliers are already starting to make some of
“The concept signals etc). We have seen how these interlocked this a reality. This may well lead in time to some
of a physically functions are made real by use of some sort of of the traditional principles of signalling being
discrete ‘logic machine’, whether mechanical, electrical challenged, such as making the distance between
or computerised, which signal engineers call following trains dependent upon their relative
interlocking an interlocking. In a modern signalling system speeds rather than always assuming the train
is starting to we might expect to see a relay interlocking or ahead is stationary.
change” a suite of computer interlockings housed in a
building or in a cabinet trackside, connected Closing remarks
to trackside equipment, the control panel/ This article has provided an introduction to
desk and screen, and to other interlockings by the technologies used for railway interlocking.
cables and data transmission systems. But the Next month we will look at the functionality of
concept of a physically discrete interlocking is an interlocking.
starting to change.
If you want to know more, some of the IRSE
Various examples come to mind. Firstly, in the textbooks cover the subject in greater detail. For
case of ERTMS Levels 2 and 3, there is a second many signal engineers the specification and design
vital element in the system, namely the Radio of interlockings is at the heart of their careers. It
Block Centre (RBC), which links trains with requires knowledge, experience and expertise –
the interlocking, sending information about and it is vital to the safety of the railway. But if you
movement authorities, permissible speeds etc and are new to the industry, don’t let that deter you.
receiving information about the train speed and Instead, take every opportunity to learn from those
location. Like the interlocking, the RBC must be who have the experience and knowledge.
of the highest safety integrity. System suppliers
are starting to combine these two functions on
the same computer platform, and in the world of

About the author ...

Francis has been a long-time member of the technical knowledge and played a vital role in
IRSE. First with British Rail/Railtrack, Atkins, as drawing younger members into the running
the technical director of the Railway Industry of the Institution and has encouraged and
Association and chief executive of the IRSE. helped them develop their capabilities in both
He was an IRSE exam Thorrowgood scholar their professional and IRSE roles. He has given
and served on Council for many years and was quiet encouragement and encouraged self-
president of the Institution 2012-2013. He is confidence in many of the rising engineers in
widely respected for his professionalism and the control and communications industry.

25
Back to basics: Interlocking
Part 2

Francis How

Last month in IRSE News there was the Checking route availability
third in a series of articles on ‘back to When a request to set a route is sent from the
basics’ themes, looking at the essentials of control panel/desk/VDU (or from the Automatic
‘interlocking’, focused on the technology Route Setting system, where one is provided),
used. This month we are going to look the interlocking first checks that the route can be
at the functions that an interlocking set in its entirety, and that the request does not
performs, and how these ensure the safe conflict with any other routes that have already
movement of trains. been set or are in the process of being set.
This article is no more than an introduction Without this check, the interlocking might start
to the subject, intended for IRSE members moving points to set the route but fail to complete
new to the industry rather than those who are the process because one or more points are
experienced in specifying, designing and testing locked in the wrong position by routes that are set
signalling systems. for other train movements. The check is also vitally
important for ‘directly opposing’ routes, for trains
The functions of a modern travelling in the opposite direction to the route
interlocking whose availability is being checked, and for which
the point settings are identical.
We saw in last month’s article that interlockings
have used a variety of mechanical, electrical, If the whole of the route is not available for
electronic and software-based technologies over setting at the time the request is received by the
the years. But regardless of what technology is interlocking, it is rejected or ignored, rather than
“Signalling used, a route-setting interlocking must perform being stored until the route can be set. This is
principles vary essentially the same functions in order to ensure a feature known as ‘anti-preselection’. Not all
from country the safe movement of trains. These functions, railways include it, but it is often regarded as
which are defined in the railways’ signalling good practice to prevent a route request from
to country principles and application rules, must be continuously trying to make the interlocking set a
but are similar compatible with the operational rules/regulations route that cannot (yet) be set.
in their basic for the movement of trains, under both normal
Route setting and locking
and failure conditions.
requirements” When the route availability check is successfully
The signalling principles and application rules for
completed, the interlocking starts moving the
the interlocking functions vary somewhat from
points in the route to their required positions. It
country to country but are similar in their basic
may also be necessary to move other points that
requirements. The descriptions of the principal
are not in the route itself, to protect the route
functions in this article are based on the current
from other trains in the event that they pass a
signalling principles used for colour light lineside
signal that is displaying a stop aspect.
signalling of passenger railways on the mainline
railway in Great Britain and in some other When the points are correctly positioned, route
countries (they are relaxed somewhat for shunting, locking is applied to all the track detection
permissive and freight movements, but these are sections that form the route, thereby reserving
not covered in this article). Where some railways each section for the route being set, preventing
adopt significantly different practices, these are the points from being moved and ensuring that no
noted but are not described in any detail. conflicting routes can be set.

20
 IRSE News | Issue 266 | May 2020

Interlocking has been an Overlaps feature known as ‘swinging overlaps’) by moving

underpinning concept the position of the facing points to create a new
for railway safety since Many countries and railway administrations also
lock and protect a short section of track beyond overlap. This provides signallers with greater
the 1850s, although
the exit signal as part of the route-setting process. operational flexibility. The facility to swing an
the technology upon it
depends has changed This is called the ‘overlap’, and it is typically overlap is inhibited by the interlocking as the
phenomenally during between 50m and 200m in length. The provision train approaches the exit signal so that a safe
that period. Areas of of overlaps is not a universal practice, however. (locked) overlap exists in case the train passes the
points and crossings are signal at danger. Designing the circuits or data
Some railways do not use overlaps at all and, at
the most complex part of for swinging overlaps can become very complex
any interlocking design. the other extreme, some have overlaps which
comprise, in effect, all the track from the exit indeed, however, and their provision should be
Photo Paul Darlington.
signal to the next signal beyond that. Even on limited to that which is considered necessary for
railways that use overlaps, they are not necessarily operational purposes.
required for all types of routes. Where railways do The setting of an overlap happens only if the exit
use overlaps the rules for setting and locking them signal is at danger (stop), of course. If a further
vary from one railway administration to another, onward route is set for the train, from the exit
so it is worth emphasising that this description signal to the next signal beyond, then that route
“Some railways applies to main line railways in Great Britain and is is itself set and locked in the same manner as
not necessarily true of other railways. described above.
don’t use
overlaps at all” The purpose of an overlap is that if the exit signal Clearing the entrance signal
is at danger (stop) and the train fails to come
When the route has been set (as described
to a stand at the signal because of inadequate
above), all relevant train detection sections
deceleration, it is likely to stop within the overlap
must be proved ‘clear’ (i.e. no train or vehicles
distance and so avoid risk of collision with other
present) before the entrance signal is permitted
legitimate train movements. Of course, it is
by the interlocking to show a proceed
not guaranteed that the train will stop within
aspect. This includes:
the overlap, and an overlap is of no help at all
if the train brakes have not been applied or the • All the track that forms the route between the
adhesion conditions are very poor. It should also entrance and exit signals.
be noted that with cab signalling, overlaps have an • All the track that forms the overlap ahead of
additional purpose, to do with the accuracy with the exit signal (if an overlap is provided).
which the train location is known.
• Any other sections of track on which a train or
Trailing points in an overlap are set to the correct individual rail vehicle could stand and be ‘foul’
position and locked when a route is set. Where of the route (i.e. with which the authorised
there are facing points ahead of the exit signal train could collide).
there may be more than one overlap that can • Any ‘flank’ sections of track, which are
be used. These facing points must be set to the included to provide early detection of another
position required for the selected overlap, and train passing its own exit signal at danger
they may also be locked. The reason for not (SPAD) and thereby intruding onto the route of
locking the facing points in all circumstances the authorised train.
is that in complex areas such as stations, the
In the case of lineside signalling, other checks may
interlocking may permit the overlap to be changed
also be required before the signal is permitted
after the entrance signal has been cleared (a

21
IRSE News | Issue 266 | May 2020

Interlocking design is to clear, including the following. Not all railways Route holding and release
based on the avoidance apply these checks, and the specific rules for
of conflicting routes, When the train passes the entrance signal
applying them vary from one railway to another: (showing a proceed aspect), the interlocking
allowing for a wide
range of combinations of • The exit signal must be alight (i.e. displaying returns the entrance signal to danger (stop) but
possible events. a visible aspect), to avoid the risk of the driver maintains the locking ahead of the train to prevent
Photo Paul Darlington. failing to see it. points from being moved and conflicting routes
• If the entrance signal is required to display from being set. In order to maximise capacity and
a route indication for the route set, that flexibility it is, however, desirable for the locking
indication must be proved alight before the to be removed as soon as it is safe to do so after
entrance signal is permitted to display a the passage of the train, in order that other routes
proceed aspect. may be set which make use of the same track
• If the train is being routed over a diverging (or some of it).
junction ahead of the entrance signal, that Before the locking can be released after the
signal may be held at a restrictive aspect (stop passage of the train, the route request must first
or caution) by the interlocking until the train be cancelled. Traditionally this would be done
has slowed down sufficiently for the diverging by the signaller using the control panel/desk.
points and the route beyond.
However, to ease the signaller’s workload and
There may be other requirements that have to to enable the locking to be released as soon as
“There may be satisfied before the interlocking will permit possible, many modern interlockings include
be other the entrance signal to clear, for instance for level a function called ‘train operated route release’
crossings or train protection systems (the latter to
requirements stop, or mitigate the risk of, the train passing its
(TORR), which cancels the route request from
the control panel/desk when the train has passed
that have to be exit signal at danger). the entrance signal, without any action by the
satisfied before The actual aspect displayed by the entrance signaller. The interlocking normally does this by
the interlocking signal when it clears, including any speed or route checking that the first two or three train detection
indications, depends not only upon the route sections beyond the signal show ‘occupied’ and
will permit the
immediately ahead, but also on whether a further then ‘clear’ in the correct sequence with the
entrance signal route has been set for the train beyond the exit passage of the train (this minimises the risk of a
to clear” signal. The sequence of aspects seen by a driver train detection failure leading to the premature
at successive signals as he or she approaches a release of the route). Although the route request
signal at danger (stop) varies from one railway to is cancelled by this process, the route locking is
another and is not dealt with in this article. maintained to ensure the safe passage of the train.
On most railways that use colour light signalling, The interlocking may also have a function which
the entrance signal will revert to danger (stop) permits individual portions of the route to be
if the conditions that permitted it to clear are unlocked as soon as possible after the train has
no longer fulfilled. So, for instance, if a track passed, rather than having to wait until the train
circuit in the route fails, or there is a loss of has passed through the whole route. This is
detection on a set of points, the entrance signal known as ‘sectional route release’. As the train
will automatically revert to danger. This is a safe
passes clear of each train detection section
arrangement but can be worrying for a driver who
in the route, the locking on that section is
unexpectedly encounters a signal at danger (stop).
released, provided that:
Some railways do not include reversion – and
of course, with mechanical signals there was no • The entrance signal has returned to
possibility of doing so! ‘stop’ (danger).

22
 IRSE News | Issue 266 | May 2020

• The route request has been cancelled (either the sighting point of the first signal displaying a
by the signaller or by TORR). caution aspect and the entrance signal displaying
• All the route locking from the entrance stop. With cab signalling, the speed and location
signal up to the start of the section has of the train are usually known and can be used
already been released. to check the two conditions, which is a more
Route locking ahead of the train continues to accurate method of checking whether the
be maintained. conditions are fulfilled.

Approach Locking Releasing the overlap

There is a further category of route release, If the exit signal is at danger (stop), and the train
applicable only where the route has to be has safely stopped at it, then it is necessary to
cancelled before the train passes the entrance release the locking of any points in the overlap
signal. Clearly this is an unusual set of beyond the signal. The reason for this is that
“There are circumstances – for instance if the signaller needs the points may either not be set correctly for
to change the order of two trains at a junction the train’s onward route, or because another
many other after the route has been set for one of them, or if train needs to use some of the track and points
functions that there is an emergency and it is necessary to try to
in the overlap.
may feature in an stop the train. In such circumstances the signaller
cancels the route on the control panel/desk, With lineside signalling, the interlocking times
interlocking” which has the effect of setting the entrance signal the train’s occupancy of the last train detection
to stop (danger). This action does not necessarily section on the approach to the signal. When
immediately release the route locking ahead of the timer finishes, and provided that the train
the entrance signal, however, in case the train detection section immediately beyond the
cannot brake sufficiently to stop at the signal and signal has not been occupied, the interlocking
consequently enters the route beyond it. will release the points in the overlap. With cab
The interlocking function that determines when signalling, the speed and location of the train are
the route locking ahead of the entrance signal is usually known and can be used directly to check
released in the circumstances described above the train is at a standstill at the signal.
is known as ‘approach locking’. In its more
comprehensive form, it maintains the locking of When the interlocking determines that the train
the route ahead of the entrance signal (which is is stationary at the exit signal, the locking of the
displaying stop/danger) until one of the following overlap is released and the track and points in it
conditions is satisfied: can be used for setting the onward route, or for
routing other trains.
• The train has come to a stand at or
before the signal, or Other interlocking functions
• The train has sufficient braking distance to This article describes only the basic interlocking
come to a stand at or before the signal. functionality of a signalling system. There are,
With lineside signalling the first of these conditions of course, many other functions that may
is usually achieved by using a timer in the feature, including:
interlocking, rather than directly confirming the • The role of the interlocking in displaying
Interlocking design has train is at a standstill. When it has finished timing, speed information via lineside signals.
to consider many factors the train is assumed to either have come to a
including the speed of the
This is of particular importance on ‘speed
stand at the signal or to have passed it, being
trains using the railway signalled’ railways, as distinct from ‘route
unable to stop in time (in the latter case the
and interfaces to other signalled’ railways.
route locking holds the route safe for the train).
equipment such as level
crossings. The second condition consists of a check by the • Interlocking the signalling system
Photo Shutterstock/ interlocking that the train has not yet occupied with protection systems for personnel
VanderWolf images. any of the train detection sections between working on the track.

23
24
/RRS
/RRS


%XQJDORZ


%XQJDORZ 7RIURP
5DPVH\ 7RIURP
5DPVH\
IRSE News | Issue 266 | May 2020

example was used in a recent IRSE examination.

train detection sections, points, overlap etc. This
Figure 1 – Simple Scheme Plan, showing the signals,
Route Information Points Free to Go or Route Opposing Route Locking Points Called, Locked and Tracks Aspect Sequence Approach Approach Locking Special
Release Normal Locked after route set until Detected Locked when Released Controls
Entrance Exit Class Normal Reverse Tracks Clear Tracks Occupied Normal Normal Reverse Proved Clear Proved Aspect Indication Signal Signal Unless First Second or Time
signal / signal for time (sec) or occupied for Ahead Cleared/ tracks Condition Condition (secs)
Route Reverse time Aspect Route set clear
EE#11, ED, EG #12 - B11 B12 - EF occ, EF clr, 180 #15, #16, #17
B12A B11 Main B7, B6 - B3 EE - B7, - -
EC Y Red#13 EE occ EE occ
B6 #10
G - Green
B2 EE #14
[EB, EC, ED
…...or ED for 40]
…..

Assumes Special Notes

• Modern Network Rail practice, including:
 TPWS train protection designed to stop train within overlap length #10 Point set and locked, but not detected
 Route locking incorporates track bob protection #11 Stick track - returns signal to red (danger) when occupied when signal off and berth track also occupied
• Sufficient standage in the loops that the longest trains may pass; #12 Only applies when Temporary Approach Control Facility selected by technician
therefore special controls are not necessary.
#13 Includes proving that associated TPWS loops energised
• No special controls relating to the method of single line working are
necessary (method is unspecified on the plan but would appear not to be #14 AWS electro live when signal at green and alight, AWS suppressor energised after route set from B3 or B4 provided that no
Track Circuit Block, Token Block nor One Train Working- No Staff). Up direction movement from Ramsey is possible.
#15 TPWS energised whilst signal controlled to Red
#16 Route cancelled by triggering of Pre-Defined Overrun Protection Group by a SPAD detected at B2
#17 Route cancelled by activation of Signal Group Replacement Control

F ,56( 1RWWR6FDOH
F ,56( 1RWWR6FDOH

(as shown in Figure 1). Our thanks to Peter Woodbridge for creating this example.
Figure 2 – Example of a signal/route control table for the route from signal B12 to B11
 IRSE News | Issue 266 | May 2020

However functional
and complex the
interlocking is, it’s
important to ensure
that the information
relayed to the driver
is clear and easily
understood, as an
aspect indicating safe
speed (left) or route
based signalling.
Photos Shutterstock/
Miles Schofield and
Paul Darlington.

• The provision of train protection systems (which will be Control Tables

covered in another ‘Back to Basics’ article, soon to be The Control Tables state all the conditions that must be
published in IRSE News). fulfilled for each route before a train can be given a movement
• Interlocking with level crossings or other moveable authority to use it. The route information is derived from
infrastructure (e.g. swing bridges). the Scheme Plan– the position of points, the train detection
sections that must be clear, other routes that must not be set
Specifying interlocking requirements
etc. Approach locking release conditions are also specified, as
The process for specifying the interlocking requirements are requirements for functions such as the delayed clearance
for a particular track layout is strictly governed by railway of signals at diverging junctions, and the aspect sequence
administrations (or in some cases their regulatory bodies), for successive signals. A simple example of a signal/route
because of the safety implications of an error. control table is shown in Figure 2, for a route from signal B12
Ideally, the starting point for the signal engineer is to be to B11 on the Plan in Figure 1. The requirements are based on
provided with details of the proposed track layout and the current British (Network Rail) signalling practice and include
operational requirements. The first of these includes knowledge some features (such as train protection proving and technician
of the location of points and associated critical dimensions. controls) that we have not dealt with in this article.
The operational requirements include the frequency of trains, Control Tables are also prepared for each set of points, stating
their maximum speeds and braking capabilities, the required the conditions that must be fulfilled before a set of points is free
headways and the specific train movements (main line, to move. This includes the routes that require the points to be
shunting, permissive etc). normal or reverse, dead-locking train detection sections and
In practice, this ideal starting point is not always the reality! point-to-point locking.
Signal engineers may, for instance be told to replicate the It is in the preparation of the Control Tables that the signal
existing signalling arrangements in modern form (which is itself engineer’s knowledge of the signalling principles and
an ambiguous statement), without being given any explicit application rules is of vital importance. From the Control
statement of operational requirements. Tables, the circuit diagrams for relay interlockings (based on
The signal engineer also needs to know the signalling principles standard circuits) can be produced, or the data in the case of a
applicable to the railway for which the design is being prepared. computer-based interlocking.
These are the high-level generic rules for ensuring the safe The production of the Control Tables is, therefore, a critical
movement of trains, and they cover all the requirements relating step in the design and configuration of the interlocking.
to route setting, locking and release – and more. Nevertheless, the gradual automation of the design process
The knowledge of the track layout, the operational means that it is possible to go directly from Scheme Plan to
requirements and the signalling principles enables the signal detailed design, with the Control Tables being a by-product
engineer to produce two key sets of documents. The first is the of the process for later use (e.g. for recording tests performed
Scheme Plan, and the second are the Control Tables. on the interlocking), rather than being a key stage in the
design process.
Scheme Plan
The Scheme Plan depicts the layout of the track, showing
Closing remarks
points, signals, train detection sections, level crossings, stations, This article and last month’s have provided an introduction to
permissible speeds etc. Each track is usually shown as a single railway interlocking – and if you want to know more, some of
line, not a pair of lines. Each signalling object is allocated a the IRSE textbooks cover the subject in greater detail. For many
unique identity (numbers and/or letters). The plan also shows signal engineers the specification and design of interlockings is
the routes that each train can take from each signal. Each route at the heart of their careers. It requires knowledge, experience
is given a unique identity. Other relevant information may also and expertise – and it is vital to the safety of the railway. But if
be shown on, or be associated with, the Scheme Plan. A simple you are new to the industry, don’t let that deter you. Instead,
Scheme Plan is shown in Figure 1, for a single line with a passing take every opportunity to learn from those who have the
loop at a station. The symbols shown are used by many railways experience and knowledge.
around the world, but are not universal.

25