Relays: The Fail-Safe Logic Behind Railroad Interlocking

For many decades the interlocking function has been carried out by relay circuitry. An interlocking might consist of many hundreds, or even thousands, of relays interconnected to build up the safety logic conditions required. Microprocessor-based vital systems have been in service since the mid-1980s, but they never fully displaced the relay: relay circuits are still installed and maintained on many railroads and transit systems, so they remain important in their own right.

And even where microprocessors have taken over, the logic uses the same fundamentals as relay circuits. Vital microprocessor logic is largely a direct translation of the relay logic it replaced. So it is worth understanding relay logic even if the application will ultimately run on a processor. Everything that follows is the mental model the whole discipline is built on.

The Signal Relay

A relay consists of a number of switches, or contacts, and one or more coils. The contacts are all operated simultaneously by applying a voltage to the coil. Each contact consists of two flexible contact arms, one of which may be fitted with a pad of graphite impregnated with silver.

Relay contacts. The pair of arms act as a switch.

The pair of arms act as a switch. If the two are not touching, the contact is open and no current can flow through it. If the two are pushed together so they touch, the contact is closed and current can flow.

The movement of the arms is provided by the action of an electromagnet, formed by a metal core within the coil of the relay. The diagram below shows the principle. Assume there is no current flowing through the coil E/F. At the top are two contacts: A/B are shown open, while C/D are shown closed.

Diagram of a common railroad signal relay.

When current flows through the coil, the core becomes magnetized and pulls the armature up. Every contact that moves with the armature changes state at once: the open pair closes, the closed pair opens. Remove the current and the armature falls back. That single fact, one coil driving many contacts together, is what lets a relay stand in for a Boolean variable with as many copies as the logic needs.

Front and Back Contacts

Signalling has its own names for the two contact states, defined relative to the energized (picked-up) relay:

• A front contact is closed when the relay is energized. It expresses the true, permissive condition of that relay.
• A back contact is closed when the relay is de-energized. It is the logical inverse: it proves the relay is not up.

A single relay carries many of each. That is the whole point: one physical device publishes both a signal and its negation, as many times as the wiring requires, all switching in lockstep.

Gravity, and Why the Relay Is Fail-Safe

The classic signal relay is a neutral, gravity-dropped relay. Energize the coil and the armature is lifted against its own weight; cut the current and gravity, not a spring, returns it to the de-energized position. This is a deliberate design choice with a safety consequence that is hard to overstate.

Because the return force is gravity, there is no spring that can weaken, corrode, or break in a way that leaves the relay falsely energized. Vital signal relays are proportioned and built so that they cannot stick in the picked-up position: defined contact materials, generous spacing, and mechanical arrangements that make a "stuck up" failure effectively impossible. The guiding rule is de-energize to danger: the safe state is the one the system falls into when anything goes wrong.

Vital and Non-Vital

Not every relay in an installation carries safety responsibility. Signalling draws a hard line between the two:

• Vital relays are those whose failure could affect safety, for example proving that points are locked in position or that a track section is clear. They are held to strict standards for construction and for defined-restrictive-state behavior.
• Non-vital relays handle indications, logging, panel lamps, and other functions where a failure is an inconvenience, not a hazard.

Everything about the vital relay, the materials, the gravity drop, the contact geometry, exists so that its failure modes are known and always land on the safe side.

Contacts Become Logic

Here is where relays stop being switches and start being a computer. Wire contacts in series and you have a logical AND: current reaches the end only if every contact in the chain is closed. Wire them in parallel and you have an OR: any one closed path is enough. A back contact gives you NOT. With AND, OR, and NOT you can build any Boolean function, and an interlocking is exactly that: a large Boolean function whose output is "may this signal clear?"

Take one signal's clear condition, drawn as the series contact chain that feeds its relay coil:

Front contacts (the plain gaps) close when their relay is energized; the back contact (with the diagonal slash) closes when its relay is de-energized. Current reaches the signal-clear relay coil only when all of them are made at once.

Every contact must be made for the relay to pick up and the signal to clear. If any one track section is occupied, its track relay drops and its contact in the chain opens, so the signal-clear relay cannot energize and the signal stays at stop. The safety condition is enforced by the physics of the circuit, not by a program that has to remember to check it.

Proving and Stick Circuits

Two patterns turn the basic chain into a real interlocking.

Proving means a relay's state is fed back into the logic to confirm a physical thing actually happened. Points are not merely commanded to a position; a detection contact proves they reached and locked it before any route over them can clear. The logic never trusts a command, only a proof.

Stick (or latch) circuits give the logic memory. A relay wired to hold itself up through one of its own front contacts stays energized after the initial condition that picked it up has passed. This is how route locking works: once a route is set and a train is approaching, the route "sticks" locked so points cannot move under the train, and it only releases when the train has passed and proved the sections clear again.

From Relay Racks to Vital Microprocessors

When vital microprocessor interlockings arrived in the 1980s, they did not throw the relay model away, they encoded it. The safety equations running inside a modern vital processor are, in most cases, direct translations of the contact chains they replaced: the same ANDs, ORs, proving conditions, and stick circuits, now expressed as vital software executing on redundant, self-checking hardware (typically 2-out-of-2 or 2-out-of-3 architectures that compare results and fail to the restrictive state on any disagreement).

The processor buys density, remote diagnostics, and easier reconfiguration. What it inherits unchanged is the philosophy: deterministic logic, proving before acting, and a defined restrictive state that the whole system collapses toward on any fault.

Why Relays Endure

Relays are bulky, they draw power, and their contacts need maintenance. Yet they persist, and not only through inertia. A relay's failure behavior is visible and physical: you can see the armature, meter the coil, and inspect the contacts. The fail-safe property is a consequence of gravity, about as dependable a force as engineering has. For a safety case that must be argued to a regulator, "it falls to danger because it is heavy" is a remarkably strong sentence.

So the relay remains the reference model for the entire field. Learn to read a contact chain and you can read an interlocking, whether it is a room full of shelf after shelf of plug-in relays or a sealed vital processor running the very same logic in software.