A train running at 300 km/h covers 83 metres every second. Its service braking distance, with a typical deceleration of 0.6 to 1 m/s², falls somewhere between three and five kilometres. No matter how good the driver’s eyesight is, that is beyond seeing: the track curves, there is fog, there is a hill, there is pitch darkness. And yet high-speed trains run every three or four minutes without touching each other. The answer is not in anyone’s eyes but in a system that has spent more than a century certifying, metre by metre, that the stretch of track coming up is clear.
The rail as part of an electrical circuit
The oldest piece is still the most elegant: the track circuit. A section of rail is electrically isolated with insulating joints and a current is injected at one end; at the other, a relay detects it. While the section is empty, the current arrives and the relay stays energised: clear track. When a train enters, its steel axles short-circuit the two rails, the current takes the path of least resistance, the relay drops out and the section declares itself occupied. The important detail is the design: the safe state — the one that turns the signal red — is precisely the de-energised relay, meaning the state produced if a cable is cut, the power fails or someone tampers with the circuit. That is what railway engineering calls fail-safe: failure leads to the protective position, not the permissive one.
Track circuits have a known limit: insulating joints degrade, dirt and oxidation on the railhead raise contact resistance, and a light train can slip past unnoticed. That is why many modern routes use axle counters: inductive pedals at the ends of the block that count wheels coming in minus wheels going out. If the balance is not zero, the section is occupied. They do not depend on rail conductivity and tolerate weather better, although they require duplicated electronics and a reset procedure after a power cut.
Blocks: dividing the line into rooms
With detection solved, the route is split into blocks, each protected by a signal. The classic rule is that two trains may never share a block. The signal displays an aspect — green, yellow, red — encoding how many clear blocks lie ahead, and the driver adjusts speed so as to stop before the red. It is a safe system proven over decades, but inefficient: block length is sized for the slowest train and the worst braking distance, so between two fast trains there is always a cushion of track nobody uses. On urban lines that translates into frequencies that cannot be squeezed any further.
ETCS: the track talks to the train
The leap came with ERTMS/ETCS, the European train control system. At level 1, electromagnetic beacons (Eurobalises) placed between the rails transmit spot data as the train passes over them: speed limit, line profile, reference position. The train computes its braking curve and supervises itself. At level 2, lineside signals disappear: information travels continuously by GSM-R radio from an RBC (Radio Block Centre), a control centre that knows every train’s position and authorises how far each may advance. The train still locates itself with its own sensors, but the RBC is the one granting the movement authority.
Level 3, and its urban cousin CBTC, does away with the fixed block: here the block moves. Each train reports its position and integrity, and the system computes a protection bubble around it that travels with the train. The nose of the following train can close to a few hundred metres from the tail of the one ahead instead of waiting for it to leave a one-kilometre block. That is what allows a metro to run at 90-second headways and what makes automated lines (GoA 4, no staff on board) possible.
How the train knows where it is
The critical piece is odometry. The train counts wheel revolutions with optical tachometers, corrects the worn wheel profile with Doppler radar and recalibrates absolute position every time it passes a reference balise. The problem is slip: braking hard, pulling away on wet rail or crossing a patch of leaves makes the wheel turn without advancing, and the count drifts. Modern systems fuse several sources and estimate the uncertainty; when that uncertainty exceeds a threshold, the train slows or stops, because it can no longer guarantee that its position is what it thinks it is. This is a key idea: the system does not need to know exactly where it is, it needs to know how wrong it might be.
The braking curve nobody can skip
With position and a braking model — mass, gradient, adhesion coefficient, application delay — the onboard equipment builds a curve that guarantees a stop before the authorised point. It is computed for the worst case: brakes at 70 % of nominal performance, degraded adhesion, system reaction time. If the train approaches that curve, it warns first; if it crosses it, it applies service braking; if it crosses further, it triggers emergency braking, which is irreversible until the train has come to a complete standstill. There is no button to cancel it while moving.
The interlocking: the referee that cannot be wrong
None of the above would help without an interlocking, the system that decides which routes may be set. Its job is to prevent physically incompatible combinations: two trains on the same track, one route crossing another already set, a switch caught in an intermediate position. Modern interlockings are computers with redundant 2oo2 or 2oo3 architectures — two-out-of-two, or two-out-of-three — channels computing in parallel and comparing results: if they disagree, the system declares itself unavailable and falls back to the safe state. They are certified to SIL 4, the highest integrity level, with dangerous failure rates on the order of one per billion hours of operation.
What comes next: digital radio and thinner margins
GSM-R is living on borrowed time and its replacement is FRMCS, a system built on LTE/5G with latencies of tens of milliseconds and capacity to carry not just movement authorities but telemetry, video and diagnostics. Semi-automatic operation on main lines comes with it: the system drives, the driver supervises. The gain is not in running faster but in shrinking the margin between trains, which is where capacity is won without laying a single new track.
In the end the paradox is a lovely one: the world’s fastest railway works because it refuses to trust what it can see. It measures, computes, certifies and, when in doubt, brakes. The whole system is built around a deeply unromantic question: how wrong can I be before this stops being safe?
