Railway interlocking is a safety control system that prevents conflicting train movements and reduces the chance of collisions or derailments. In technical terms, it links signals, points, and routes so one action cannot create an unsafe track configuration, using mechanical, electrical, or computer-based logic to enforce movement authority.
How Railway Interlocking Works
Railway interlocking is a fail-safe logic layer, not just a set of signals. Its purpose is to make sure that a route, switch position, and signal aspect all agree before a train is allowed to move, so the system can prevent conflicting movements by design rather than by human memory or speed alone.
The core idea is dependency control. If one route is set, the interlocking blocks incompatible routes, locks the relevant points, and holds signals at danger until the protected path is safe. That means a single unsafe command cannot freely propagate into the track layout.
Why It Matters for Railway Safety
Interlocking exists because rail systems are highly coupled: a change in one part of the network can create a collision path somewhere else. By enforcing mutually exclusive movement authority, it reduces the chance that a signaller, operator, or automated system can accidentally create a dangerous alignment.
This makes railway interlocking one of the most important barrier systems in rail operations. It is especially valuable where trains, points, level crossings, and route-setting logic all share the same operational environment and errors can have immediate physical consequences.
Mechanical, Electrical, and Computer-Based Interlocking
Interlocking has evolved from mechanical devices to relay-based and computer-based systems, but the safety objective stays the same. Mechanical interlocking used physical linkages, electrical relay interlocking used hardwired logic, and modern computer-based interlocking uses software and safety-certified control logic to apply the same constraints.
The engineering difference is implementation, not intent. Older systems expressed safety through physical impossibility, while newer systems express it through verified logic, redundancy, and assured failure behaviour. In both cases, the design goal is that unsafe combinations should be blocked or forced into a safe state.
Operational Failure Modes and Safety Dependencies
Interlocking is effective only when it has an accurate view of track occupancy, switch position, and route status. If sensors fail, configurations drift, maintenance is incomplete, or the logic model no longer matches the track layout, the system can either become unavailable or, more seriously, lose the ability to enforce safe separation.
It also depends on disciplined change control. Track modifications, signal changes, and software updates must preserve the safety case, because a mismatch between the installed environment and the interlocking logic can create hidden hazards even when the control system appears to be functioning normally.
Risk and Threat Considerations
Railway interlocking is a safety control with direct operational risk: if its logic is bypassed, misconfigured, or compromised, conflicting movements can be authorised and the consequences can include collision, derailment, or a broad loss of service. The same centralised logic that improves safety also creates a high-value failure point.
Failure mechanism: Unsafe states emerge when the interlocking receives false occupancy data, incorrect route information, stale configuration, or unauthorised control inputs, causing it to trust an unsafe track combination or fail open in a way that weakens protection.
Impact: The result can be passenger and staff injury, infrastructure damage, operational shutdown, and expensive recovery work, especially when the fault affects a busy corridor or a centrally managed signalling area.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Interlocking enforces safety boundaries between incompatible movements. |
| SI-7 — Software, Firmware, and Information Integrity | Computer-based interlocking depends on trustworthy logic and controlled change. | |
| Recommendation — Apply SC-7 principles to isolate conflicting control paths and prevent unsafe cross-route actions. Use SI-7 to detect integrity problems in signalling logic and control software. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Interlocking safety depends on correct configuration of route, signal, and point logic. |
| Recommendation — Maintain secure configuration baselines for signalling assets and interlocking logic. | ||
Practitioner Guidance
What to watch for: Treat interlocking as a safety-critical change domain, not a routine control system. Engineers and operators should verify that every layout, signal, and points change is reflected in the safety logic and that fallback states remain conservative after maintenance or software updates.
Practitioner takeaway: The safest interlocking is the one that assumes components will fail and still prevents conflicting movement authority.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org