Mixed relay-CBI migration lacks a quantitative safety method, study finds

No widely adopted quantitative method exists for demonstrating equivalent safety integrity while relay interlockings and computer-based interlockings share control during migration, according to a technical study by signalling engineer Kevin Chivers. The finding has direct consequences for staged renewals across the UK network, where hybrid configurations routinely control movement authority for months or years.

Why 'big bang' is not always available

Where scope and access permit, a relay interlocking can be replaced in a single major commissioning — a 'big bang' changeover that may transfer the areas of several mechanical or relay signal boxes to a Rail Operating Centre at once, avoiding prolonged mixed control.

Staged migration is nevertheless required where the geographical scope is too large for one commissioning, where renewals arrive in successive phases, where adjoining interlockings must stay operational, or where relay rooms and their interfaces are altered incrementally. Even projects planning a single final cutover can create temporary hybrids through enabling works, fringe alterations and testing.

The critical question, Chivers argues, is not simply whether the new CBI meets Safety Integrity Level 4. It is whether the complete configuration at every stage — temporary or permanent — continues to provide the required integrity while responsibility is divided between old and new equipment.

What relay interlockings actually prove

Since the 1950s, relay-based designs such as BR's SW67 and the E10K have underpinned UK signalling. They take very different routes to safety.

SW67 implements route setting and aspect control using BR930-series safety relays. A route is established only when each prerequisite — track circuits, point detection, point locking, approach locking, route locking — is positively proved in sequence. Loss of power or a broken conductor drives the system toward the restrictive state; a single abnormal condition cannot create a permissive aspect.

E10K adopts a 'vital core, non-vital shell' architecture. Non-vital Post Office-type relays handle route availability and control processing, while BR930-style safety relays are reserved for locking, holding and final signal aspect output. Lamp-proving circuits ensure that loss of feed, a control error or an upstream malfunction reverts signals to red. Despite their differences, both architectures have been historically accepted in UK safety cases as achieving SIL 4 for vital interlocking functions.

The lesson: safety arises from how the complete proving chain responds to faults, not from component labels. Replacing one apparently simple function with software can remove more of the original safety argument than a project expects, because relay protection is distributed across thousands of contacts and dependencies.

A different failure landscape

CBIs offer richer diagnostics, programmable logic and modular hardware for large layouts. Random hardware failures are addressed through fault-tolerant architectures: two-out-of-two (2oo2) voting requires channel agreement before an action, two-out-of-three (2oo3) improves availability, and dual 2oo2 systems add further redundancy.

Voting does not remove systematic risk. Identical channels sharing the same design error or software defect may produce the same wrong result. The study therefore treats diversity — independent software, different tools and processor families, separated development and verification teams — as essential where common-mode failure must be controlled.

How proportional allocation works

The proposed Proportional SIL-Allocation Method treats the interlocking as a collection of safety functions rather than one indivisible box, in four stages:

• decompose the interlocking into discrete safety functions;
• determine the protection the relay architecture historically provided for each;
• assign a minimum SIL to the CBI subsystem performing that function;
• identify mitigations allowing relay and computer equipment to coexist safely.

Route selection and conflict checking, with high exposure on busy railways, retain a SIL 4 requirement with diverse software and relay final proving as a migration mitigation. Final aspect proving and lamp drive — the output circuitry energising signal lamps or LEDs — are assigned SIL 4, with existing BR930 vital output relays retained and driven from the CBI through a dynamic interface. Point detection and locking remain SIL 4, with relay detection presentable to the CBI as a SIL 4 channel. Approach locking sits in the SIL 3–4 range.

The method also ties integrity to consequence and exposure rather than technological sophistication: a lightly used rural single line can justify a lower allocation to the token or movement-authority release output, backed by cyclic testing of the output relay — a component-level judgement within a system that still relies on the token principle, interlocking and operating rules.

Keeping the argument visible

Evidence must follow each function across the technology boundary through traceable requirements, fault testing, simulation and independent verification, with engineering, operations, maintenance and assurance teams agreeing which system is authoritative at each stage. Full diversity is costly; partial diversity offers limited protection. The method prescribes no single architecture but requires claimed protection to be explicit and proportionate to risk. The task, Chivers concludes, is making the invisible protections — the independent proofs and failure defences between a fault and an unsafe movement — visible, and demonstrating each has been retained or equally replaced.