Railway Interlocking Systems — Relay, SSI, Electronic, and ETCS Explained
A comprehensive guide to railway interlocking systems — from traditional relay interlocking to Solid State Interlocking (SSI), Electronic Interlocking (EI), and ETCS/Kavach. How they keep trains safe.
What is Interlocking?
Interlocking is the fundamental safety system in railway signalling. It prevents conflicting train movements by enforcing rules about which signals can show "clear" and which points can be set, based on the current state of all routes.
Simply put: interlocking makes it impossible to set up a dangerous route.
┌─────────────────────────────────────────────────────────────┐
│ WHY INTERLOCKING EXISTS │
│ │
│ Without interlocking: │
│ │
│ Train A →→→→→→ │
│ ╲ CRASH! 💥 │
│ Train B →→→→→→→→╲→→→→ │
│ │
│ Two trains could be routed onto the same track │
│ │
│ With interlocking: │
│ │
│ Train A →→→→→→→→→→→→ (Signal GREEN — route locked) │
│ ╲ │
│ Train B ████████ 🔴 (Signal RED — conflicting route) │
│ │
│ The system PREVENTS the conflicting signal from clearing │
└─────────────────────────────────────────────────────────────┘
Core Interlocking Rules
Every interlocking system, regardless of technology, enforces these fundamental rules:
┌─────────────────────────────────────────────────────────────┐
│ THE THREE FUNDAMENTAL RULES │
│ │
│ Rule 1: CONFLICTING ROUTES │
│ ───────────────────────────────────────── │
│ If Route A is set, any conflicting Route B CANNOT be set. │
│ Signals protecting Route B remain at RED. │
│ │
│ Rule 2: POINTS LOCKED │
│ ───────────────────────────────────────── │
│ Once a route is set, all points in that route are LOCKED. │
│ They cannot be moved until the route is released. │
│ │
│ Rule 3: TRACK OCCUPANCY │
│ ───────────────────────────────────────── │
│ A signal cannot clear if any track circuit in the route │
│ ahead shows OCCUPIED (train detected). │
│ │
│ Additional rules: │
│ • Approach locking: Route can't be cancelled if train │
│ has passed the approach track circuit │
│ • Overlap: Protection beyond the signal (overrun space) │
│ • Flank protection: Points set to prevent side collision │
└─────────────────────────────────────────────────────────────┘
Types of Interlocking Systems
1. Mechanical Interlocking (Historical)
┌────────────────────────────────────────────────────────┐
│ MECHANICAL INTERLOCKING │
├────────────────────────────────────────────────────────┤
│ │
│ Technology: Lever frame with mechanical locking bars │
│ Era: 1850s – 1960s (still in use at some │
│ stations in India) │
│ │
│ How it works: │
│ Lever A ═══╗ │
│ ╠═══ Locking bar ═══ Prevents Lever B │
│ Lever B ═══╝ │
│ │
│ Physical bars between levers prevent conflicting │
│ combinations from being pulled. │
│ │
│ Pros: Simple, no electronics, proven for 170+ years │
│ Cons: Limited capacity, one operator per station, │
│ high maintenance, not remotely controllable │
└────────────────────────────────────────────────────────┘
2. Relay Interlocking (Route Relay Interlocking — RRI)
The workhorse of Indian Railways signalling for decades.
┌────────────────────────────────────────────────────────┐
│ ROUTE RELAY INTERLOCKING (RRI) │
├────────────────────────────────────────────────────────┤
│ │
│ Technology: Safety relays (vital circuits) │
│ Era: 1950s – present (still widely deployed) │
│ │
│ How it works: │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ Route │───▶│ Point │───▶│ Signal │ │
│ │ Request │ │ Setting │ │ Clear │ │
│ │ Relay │ │ Relays │ │ Relay │ │
│ └─────────┘ └─────────┘ └─────────┘ │
│ │ │ │ │
│ └──────── All relay contacts in SERIES ──────── │
│ │
│ Signal can ONLY clear if ALL safety relays in the │
│ chain are in the correct state. │
│ │
│ Relay count: 500–3000 relays per station │
│ Room size: Full relay room with rows of racks │
│ │
│ Safety principle: Vital relays are FAIL-SAFE — │
│ contacts are gravity-dependent (drop to safe state) │
│ │
│ Pros: Proven safety record, well-understood │
│ Cons: Huge relay rooms, high maintenance, inflexible │
│ No remote monitoring, hard to modify │
└────────────────────────────────────────────────────────┘
3. Solid State Interlocking (SSI)
┌────────────────────────────────────────────────────────┐
│ SOLID STATE INTERLOCKING (SSI) │
├────────────────────────────────────────────────────────┤
│ │
│ Technology: Microprocessor-based with 2oo3 voting │
│ Era: 1985 – present │
│ │
│ Architecture: │
│ ┌───────────────────────────────────────────┐ │
│ │ SSI PROCESSOR │ │
│ │ │ │
│ │ CPU A ──┐ │ │
│ │ ├──▶ VOTER ──▶ Output ──▶ Field │ │
│ │ CPU B ──┤ (2oo3) │ │
│ │ │ │ │
│ │ CPU C ──┘ │ │
│ │ │ │
│ │ All 3 CPUs run same interlocking logic │ │
│ │ Output only if 2 out of 3 agree │ │
│ └───────────────────────────────────────────┘ │
│ │
│ Field interface: Trackside Function Modules (TFMs) │
│ control signals, points, track circuits via serial │
│ data link to the central processor. │
│ │
│ Pros: Smaller footprint, software-configurable, │
│ remote monitoring possible │
│ Cons: High initial cost, specialized maintenance │
└────────────────────────────────────────────────────────┘
4. Electronic Interlocking (EI / CBI)
The current generation of interlocking, also called Computer-Based Interlocking (CBI).
┌────────────────────────────────────────────────────────┐
│ ELECTRONIC INTERLOCKING (EI) / CBI │
├────────────────────────────────────────────────────────┤
│ │
│ Technology: Commercial-off-the-shelf hardware + │
│ certified safety software (SIL-4) │
│ Era: 2000s – present (actively deploying) │
│ │
│ Architecture: │
│ ┌──────────────────────────────────────────────┐ │
│ │ OPERATOR WORKSTATION (Control Centre) │ │
│ │ ┌─────────────────────────────────────┐ │ │
│ │ │ Graphical route setting interface │ │ │
│ │ │ Train movement display │ │ │
│ │ │ Alarm management │ │ │
│ │ └──────────────────┬──────────────────┘ │ │
│ │ │ Secure LAN │ │
│ │ ┌──────────────────┴──────────────────┐ │ │
│ │ │ INTERLOCKING PROCESSOR │ │ │
│ │ │ (Redundant: 2oo2D or 2oo3) │ │ │
│ │ │ Runs interlocking logic (SIL-4) │ │ │
│ │ └──────────────────┬──────────────────┘ │ │
│ │ │ Serial/Ethernet │ │
│ │ ┌──────────────────┴──────────────────┐ │ │
│ │ │ OBJECT CONTROLLERS (OC) │ │ │
│ │ │ Interface to field equipment: │ │ │
│ │ │ Signals, Points, Track Circuits │ │ │
│ │ └─────────────────────────────────────┘ │ │
│ └──────────────────────────────────────────────┘ │
│ │
│ Vendors: Siemens (Trackguard Westrace), Alstom │
│ (Smartlock), Hitachi, Bombardier │
│ │
│ Pros: Full diagnostics, remote monitoring (SNMP!), │
│ software updates, centralized control │
│ Cons: Cybersecurity requirements, certification cost │
└────────────────────────────────────────────────────────┘
Comparison of All Types
┌───────────────────┬────────────┬────────────┬────────────┬────────────┐
│ Feature │ Mechanical │ Relay (RRI)│ SSI │ EI / CBI │
├───────────────────┼────────────┼────────────┼────────────┼────────────┤
│ Technology │ Lever/bar │ Relays │ Processor │ Computer │
│ Safety level │ Proven │ SIL-4 │ SIL-4 │ SIL-4 │
│ Room size │ Large │ Very Large │ Small │ Very Small │
│ Relay count │ None │ 500–3000 │ ~50 │ ~20 │
│ Remote control │ No │ Limited │ Yes │ Yes │
│ Diagnostics │ None │ Manual │ Built-in │ Full SNMP │
│ Modification │ Physical │ Rewiring │ Software │ Software │
│ Maintenance │ High │ High │ Medium │ Low │
│ Centralized ctrl │ No │ No │ Yes │ Yes │
│ Cyber risk │ None │ None │ Low │ Medium │
│ Cost per station │ Low │ Medium │ High │ High │
│ Indian Railways │ Legacy │ Widespread │ Limited │ Expanding │
└───────────────────┴────────────┴────────────┴────────────┴────────────┘
ETCS — European Train Control System
ETCS adds a layer on top of interlocking for continuous train supervision. It's being adopted worldwide (including Indian Railways as part of Kavach).
ETCS Levels
┌─────────────────────────────────────────────────────────────┐
│ ETCS LEVELS │
├─────────────────────────────────────────────────────────────┤
│ │
│ LEVEL 1: Spot transmission │
│ ────────────────────────────── │
│ Lineside signals + Eurobalise (spot data) │
│ Train gets Movement Authority at each balise point │
│ │
│ 🚂──────▶ [Balise] ──────▶ [Balise] ──────▶ [Signal] │
│ │
│ │
│ LEVEL 2: Continuous radio │
│ ────────────────────────────── │
│ Radio Block Centre (RBC) sends Movement Authority via │
│ GSM-R/LTE-R. Lineside signals optional. │
│ │
│ 🚂 ◄════ GSM-R radio ════► [RBC] ◄══► [Interlocking] │
│ │
│ │
│ LEVEL 3: Moving block (Future) │
│ ────────────────────────────── │
│ No fixed block sections. Train reports position via radio. │
│ Minimum headway = braking distance between trains. │
│ │
│ 🚂₁ ←──braking dist──→ 🚂₂ ←──braking dist──→ 🚂₃ │
│ Train integrity checked onboard. No track circuits needed! │
│ │
│ Capacity increase: Level 1 (+20%) → Level 2 (+30%) │
│ → Level 3 (+50% or more) │
└─────────────────────────────────────────────────────────────┘
ETCS vs Kavach
┌──────────────────┬────────────────────┬──────────────────┐
│ Feature │ ETCS │ Kavach │
├──────────────────┼────────────────────┼──────────────────┤
│ Origin │ European (ERA) │ Indian (RDSO) │
│ Standard │ ERTMS/ETCS │ Indian standard │
│ Communication │ GSM-R → LTE-R │ LTE-R │
│ Track detection │ Track circuit │ Track circuit + │
│ │ │ RFID │
│ Moving block │ Level 3 (future) │ Planned │
│ SIL level │ SIL-4 │ SIL-4 │
│ Speed │ Up to 350 km/h │ Up to 160 km/h │
│ Cost │ Very high │ Lower than ETCS │
│ Auto braking │ Yes │ Yes │
│ Anti-collision │ Yes │ Yes (primary) │
│ Deployment │ Europe-wide │ Indian Railways │
└──────────────────┴────────────────────┴──────────────────┘
Monitoring Modern Interlocking Systems
Electronic interlocking systems expose monitoring data via SNMP and proprietary protocols. Here's what you can monitor:
┌─────────────────────────────────────────────────────────────┐
│ EI MONITORING DASHBOARD │
├─────────────────────────────────────────────────────────────┤
│ │
│ System Health: │
│ • Processor A: 🟢 Active CPU: 23% Memory: 45% │
│ • Processor B: 🟢 Standby CPU: 12% Memory: 44% │
│ • Object Controller 1: 🟢 Online │
│ • Object Controller 2: 🟢 Online │
│ • Communication link: 🟢 Active (2ms latency) │
│ │
│ Route Statistics (24h): │
│ • Routes set: 342 │
│ • Routes cancelled: 5 │
│ • Point operations: 1,240 │
│ • Point failures: 0 │
│ • Track circuit failures: 2 (false occ., auto-recovered) │
│ │
│ Alarms: │
│ • Critical: 0 │
│ • Major: 1 (Point 23A operating time above threshold) │
│ • Minor: 3 (Track circuit voltage marginal at relay end) │
└─────────────────────────────────────────────────────────────┘
For tools to set up this monitoring, see our guide on Railway Telecom and SNMP Monitoring.
Frequently Asked Questions
What is interlocking in railway signalling?
Interlocking is a safety system that prevents conflicting train movements by controlling the relationship between signals, points (switches), and track sections. It ensures that a signal can only show "clear" if the route ahead is safe — all points are correctly set and locked, all track circuits show clear, and no conflicting routes are active. Interlocking is the foundation of railway safety and has been mandatory since the late 19th century.
What is the difference between relay interlocking and electronic interlocking?
Relay interlocking uses hundreds to thousands of safety-rated electromagnetic relays wired in specific circuits to enforce interlocking rules. Electronic interlocking (EI/CBI) uses redundant computer processors running certified safety software (SIL-4) to achieve the same function. EI systems are much smaller, support remote monitoring via SNMP, can be reconfigured through software changes instead of physical rewiring, and provide full diagnostic data. However, they introduce cybersecurity considerations that relay systems don't have.
What is ETCS and how does it relate to interlocking?
ETCS (European Train Control System) is a train protection layer that sits on top of interlocking. While interlocking controls signals and points at a station or junction, ETCS provides continuous speed supervision of trains between stations. ETCS Level 2 uses a Radio Block Centre (RBC) to send Movement Authority to trains via GSM-R radio, enabling higher speeds and closer headways. The interlocking still controls the infrastructure, but ETCS ensures trains obey the limits. In India, the equivalent system is Kavach.
What does SIL-4 mean in railway signalling?
SIL-4 (Safety Integrity Level 4) is the highest level of safety certification for electronic systems, as defined by the CENELEC EN 50129 standard. It means the probability of a dangerous failure is less than 10^-9 per hour (one in a billion hours). Railway interlocking, both SSI and EI, must achieve SIL-4 certification. This is accomplished through redundant processors (2oo3 voting), diverse software, extensive testing, and formal safety proofs. SIL-4 is the same level required for nuclear power plant safety systems.
What is Kavach and how does it work?
Kavach is India's indigenous Automatic Train Protection (ATP) system developed by RDSO (Research Designs and Standards Organisation). It uses LTE-R radio communication, RFID tags on the track, and onboard equipment to continuously monitor train speed and position. If a train exceeds the permitted speed or approaches a danger signal, Kavach automatically applies the brakes. It also prevents collisions between two Kavach-equipped trains by exchanging position data via radio. Kavach is being deployed across Indian Railways and is significantly cheaper than ETCS.
For related topics, read our guides on Track Circuits, Point Machines, and Railway Telecom Systems.