Automatic Train Control


The automation of train movements originated with the need to enforce signal commands so that drivers would not allow trains to pass beyond their limit of movement authority (LMA). We discuss this further in our enforcement page. The automation of train control was developed from there, using advances in traction control, which allowed automatic acceleration and in braking and allowed electrical control and automatic load compensation.

Originally, in Britain, the letters ATC referred to "Automatic Train Control", which was the title given to the warning system tried on some UK lines before the general introduction of the AWS (Automatic Warning System) in the 1960s. In the US it also refers to Automatic Train Control but it refers to a more modern concept where the system includes ATP (Automatic Train Protection), ATO (Automatic Train Operation) and ATS (Automatic Train Supervision). It has been adopted around the world to describe the architecture of the automatically operated railway. It is usually applied to metros. This article looks at the relationship between the four different automatic train concepts.

As a definition, ATC refers to the whole system which includes all the other automatic functions and, for some of these functions at least, also includes a degree of manual intervention. ATC therefore, is the package which includes ATP, ATO and ATS.

The ATC Package

There are a number of ways to assemble the parts of an ATC package but a common format appears as in Figure 1.

Figure 1: A schematic showing the basic architecture of a fixed block automatic train control (ATC) system with its three main components - ATP (Automatic Train Protection), ATO (Automatic Train Operation) and ATS (Automatic Train Supervision).  

The basic safety requirement, to keep trains a safe distance apart, is performed by the ATP, which has a control unit known as an ‘interlocking’ for each block. This control unit receives data from the blocks ahead on their occupational status, converts that into a speed limit for the block it controls and sends the speed limit data to the track. The train picks up the data using the codes transmitted along the track. The transmission system can be track circuits, loops or beacons (balises) located along the track.  

The data received by the ATP control unit is usually limited to indicating that a train is in the block or the speed limit currently imposed in the block.  This data is sent to the ATS computer where it is compared with the timetable to determine if the train is running according to schedule or is late or early.  To adjust the train's timing, the ATS can send commands to the ATO spots located along the track.

The ATO spots, which can be short transmission loops or small boxes called beacons or "balises", give the train its station stop commands. The spots usually contain fixed data but some, usually the last one in a station stop sequence, transmit data about the time the train should stop (the dwell time) at the station and may tell it how fast to go to the next station (ATP permitting). 

Some systems leave the ATO spots alone - i.e their data is always fixed - but use the ATP system to prevent the train from starting or restrict its speed.  The ATS computer tells the ATP control unit to transmit a restricted speed or zero speed to the track.

Both ATP and ATO commands are picked up by receivers on the train and translated into motoring, braking or coasting commands.  Where a train can be manually driven, the ATP will still ensure the safety requirement but the ATO is overridden, the driver stopping the train in the stations by use of the cab controls.

There are lots of variations of ATC around the world but all contain the basic principle that ATP provides safety and is the basis upon which the train is allowed to run.  ATO provides controls to replace the driver, while ATS checks the running times and adjusts train running accordingly.

Moving Block

There is little difference between fixed block and moving block as far as ATC is concerned but the architecture will look something like this:

The transmission of data to the rails is gone and is replaced by radio transmission. Also, there are no blocks. The train's location is determined by the on-board route map, which is reset when the train starts its trip and is verified by "checking balises" spaced along the route. The balises can be used to send ATS instructions to the train but, like the ATO spots used in fixed block systems, they contain static data about location and route profile.

In a moving block system, the ATP control unit differs from that used in a fixed block system.  It now covers a larger area and it gets its data from the radio transmissions.  It sends data by radio as well.  If the radio transmission fails to reach a train, this train assumes that the train in front has stopped at its last known position and will stop a safe distance behind it.

ATS covers the same functions as for fixed block systems.  Train location data is received and train running adjusted as necessary.  In all ATS systems nowadays, there is lots of data logging to provide management information and statistics and some ATS systems allow replays of sections of the day's train movements to assist in formulating future recovery management strategies.

There are some variations on the general principles mentioned above and these are noted in the article on Moving Block signalling. Signalling used on high density metro (or subway) routes is based on the same principles as main line signalling. The line is divided into blocks and each block is protected by a signal but, for metros, the blocks are shorter so that the number of trains using the line can be increased. They are also usually provided with some sort of automatic supervision to prevent a train passing a stop signal.

Figure 1: Diagram showing simple Metro-style two-aspect signalling.

Originally, metro signalling was based on the simple 2-aspect (red/green) system as shown above. Speeds are not high, so three-aspect signals were not necessary and yellow signals were only put in as repeaters where sighting was restricted.

Many metro routes are in tunnels and it has long been the practice of many metro operators to provide a form of enforcement of signal observation by installing additional equipment. This became known as automatic train protection (ATP). It can be either mechanical or electronic.

The London Underground, for example, uses both types on its lines, depending on the age of the installation. The older, mechanical version is the train stop; the later, electronic version is provided with automation of driving as well. The actual design depends on the manufacturer. 

The trainstop consists of a steel arm mounted alongside the track and which is linked to the signal. If the signal shows a green or proceed aspect, the trainstop is lowered and the train can pass freely. If the signal is red the trainstop is raised and, if the train attempts to pass it, the arm strikes a "tripcock" on the train, applying the brakes and preventing motoring.

Electronic ATP involves track to train transmission of signal aspects and (sometimes) their associated speed limits. On-board equipment will check the train's actual speed against the allowed speed and will slow or stop the train if any section is entered at more than the allowed speed.

The Overlap

If a line is equipped with a simple ATP which automatically stops a train if it passes a red signal, it will not prevent a collision with a train in front if this train is standing immediately beyond the signal.

Figure 2: Diagram showing the need for a safe braking distance beyond a stop signal.

There must be room for the train to brake to a stop - see the diagram above. This is known as a "safe braking distance" and space is provided beyond each signal to accommodate it. In reality, the signal is placed in rear of the entrance to the block and the distance between it and the block is called the "overlap". Signal overlaps are calculated to allow for the safe braking distance of the trains using this route. Of course, lengths vary according to the site; gradient, maximum train speed and train brake capacity are all used in the calculation.

Figure 3: Diagram showing a signal provided with an overlap. The overlap in this example is calculated from the emergency braking distance required by the train at that location.

This diagram (Figure 3) shows the arrangement of signals on a metro where signals are equipped with trainstops (a form of mechanical ATP) and each signal has an overlap whose length is calculated on the safe braking distance for that location. Signals are placed a safe braking distance in rear of the entrances to blocks. Signal A2 shows the condition of Block A2, which is occupied by Train 1. If Train 2 was to overrun Signal A2, the raised trainstop (shown here as a "T" at the base of the signal) would trip its emergency brake and bring it to a stand within the overlap of Signal A2.

Overlaps are often provided on main line railways too. In the UK, it is the practice to provide a 200 yard (185 m) overlap beyond each main line signal in a colour light installation. Back in 1972 when it was decided upon, it was, after a review of many instances where trains had overrun stop signals, considered the maximum normally required. It was a rather crude risk analysis but it was the best they could afford.

In the US, the overlap is considered so important that a whole block is provided as the overlap. It is referred to as "absolute block". This means that there is always a full, vacant block between trains. It's rather wasteful of space and it reduces capacity but it saves the need to calculate and then build in overlaps for each signal, so it's cheaper. Like a lot of things in life, you get what you pay for. We will see more about this in Automatic Train Protection below.

Track-Circuited Overlaps

Figure 4: Diagram showing a train standing in the signal overlap.

Nothing in the railway business is as simple as it seems and so it is with overlaps. A line which uses overlaps and has close headways could have a situation as shown above where the train in the overlap of Signal A121 has a green signal showing behind it. Although it is protected by Signal A123 showing red, the driver of Train 2 may see the green signal A121 behind Train 1 and could "read through" or be confused under the "stop and proceed" rule.

Figure 5: Diagram of the track circuited overlap, sometimes known as a "replacing track circuit".

So, where there is a possibility of a green signal being visible behind a train, overlaps are track circuited as shown in Fig. 5. Although there is no train occupying the block protected by Signal A121, the signal is showing a red aspect because the train is occupying the overlap track circuit or "replacing" track circuit, as it is sometimes called. This will give rise to two red signals showing behind a train whilst the train is in the overlap. The block now has two track circuits, the "Berth" track and the "replacing" track.

Absolute Block

Figure 6: Schematic showing the principle of the Absolute Block system. Signal A127 is clear because two blocks in advance of it are clear. A125 shows a danger aspect because one of the blocks ahead of it is occupied by a train.

Many railways use an "Absolute Block" system, where a vacant block is always maintained behind a train in order to ensure there is enough room for the following train to be stopped if it passes the first stop (red) signal. In Figure 6, in order for Signal A125 to show a proceed aspect (green), the two blocks ahead of it must be clear, with Train 1 completely inside the block protected by Signal A121.

Automatic Train Protection

To adapt metro signalling to modern, electronic ATP, the overlaps are incorporated into the block system. This is done by counting the block behind an occupied block as the overlap. Thus, in a full, fixed block ATP system, there will be two red signals and an unoccupied, or overlap block between trains to provide the full safe braking distance, as shown here (click for full size view). As an aside, remember that, although I have shown signals here, many ATP equipped systems do not have visible lineside signals because the signal indications are transmitted directly to the driver's cab console (cab signalling).

On a line equipped with ATP as shown above, each block carries an electronic speed code on top of its track circuit. If the train tries to enter a zero speed block or an occupied block, or if it enters a section at a speed higher than that authorised by the code, the on-board electronics will cause an emergency brake application. This is the system used by London Underground for the Victoria Line from 1968 - the first fully automatic, passenger carrying railway (more information here). It was a simple system with only three speed codes - normal, caution and stop. Many systems built since are based on it but improvements have been added.

ATP Code Transmission

We have seen in the previous articles that the ATP signalling codes contained in the track circuits are transmitted to the train. They are detected by pick-up antennae (usually two) mounted on the leading end of the train under the driving cab.  This data is passed to an on-board decoding and safety processor. The permitted speed is checked against the actual speed and, if the permitted speed is exceeded, a brake application is initiated. In the more modern systems, distance-to-go data will be transmitted to the train as well. The data is also sent to a display in the cab which allows the driver of a manually driven train to respond and drive the train within the permitted speed range.

At the trackside, the signal aspects of the sections ahead are monitored and passed to the code generator for each block. The code generator sends the appropriate codes to the track circuit. The code is detected by the antennae on the train and passed to the on-board computer. As we have seen, the computer will check the actual speed of the train with the speed required by the code and will cause a brake application if the train speed is too high.

Beacon Transmission

In the examples so far, the ATP data from the track to the train is transmitted by using coded track circuits passing through the running rails. It is known as the "continuous" transmission system because data is passing to the train all the time. However, it does have its limitations. There are transmission losses over longer blocks and this reduces the effective length of a track circuit to about 350 metres. The equipment is also expensive and vulnerable to bad weather, electronic interference, damage, vandalism and theft. To overcome some of these drawbacks, a solution using intermittent transmission of data has been introduced. It uses electronic beacons placed at intervals along the track.

In the best known system, originally developed by Ericsson in Sweden and formerly marketed by Adtranz (now Bombardier), there are usually two beacons, a location beacon to tell the train where it is and a signalling beacon to give the status of the sections ahead. The beacons are sometimes referred to as "balises" after the French. Data processing and the other ATP functions are similar to the continuous transmission system.

Operation With Beacons

The beacon system operates as shown in the simplified diagrams below. In the diagram (left), the beacon for red Signal A2 is located before Signal A1 to give the approaching train (2) room to stop. Train 2 will get its stopping command here so that it stops before it reaches the beacon for signal A3.  

In the diagram on the left, the train has stopped in front of Signal A2 and will wait until Train 2 clears Block A2 and the signal changes to green. In reality, it will not move even then, since it requires the driver to reset the system to allow the train to be restarted. For this reason, this type of ATP is normally used on manually driven systems.

Intermittent Updates

A disadvantage of the beacon system is that once a train has received a message indicating a reduced speed or stop, it will retain that message until it has passed another beacon or has stopped. This means that if the block ahead is cleared before Train 2 reaches its stopping point and the signal changes to green, the train will still have the stop message and will stop, even though it doesn't have to. Why, might you ask, can't the driver cancel the stop message like he does when the train has stopped and the signal changes to green? If he could cancel the stop message while the train was moving, the system would be no better than the AWS with its cancel button. ATP is "vital" or "fail-safe" and must not allow human intervention to reduce its effectiveness.

To avoid the situation of an unnecessary stop, an intermediate beacon is provided. This updates the train as it approaches the stopping point and will revoke the stop command if the signal has cleared. More than one intermediate beacon can be provided if necessary.

Moving Block - The Theory

As signalling technology has developed, there have been many refinements to the block system but, in recent years, the emphasis has been on attempts to get rid of fixed blocks altogether. Getting rid of fixed blocks has the advantage that you can vary the distances between trains according to their actual speed and according their speeds in relation to each other. It’s rather like applying the freeway rules for speed separation - you don’t need to be a full speed braking distance from the car in front because he won’t stop dead. If you are moving at the same speed as he is, you could, in theory, travel immediately behind him and, when he brakes, you do. If you allow a few metres for reaction time to his brake lights and variations in braking performance, it works well. Although it only needs a few spectacular collisions on the freeways to disprove the theory for road traffic, in the more regulated world of the railway, although it could  not be applied without a full safe braking distance between trains, it has possibilities.

In the diagram (left), as long as each train is travelling at the same speed as the one in front and they all have the same braking capabilities, they can, in theory, run as close together as a few metres. Just allow some room for reaction time and small errors and trains could run as close together as 50 metres at 50 km/h. Well, that’s OK in theory but, in practice, it’s a different matter and, as yet, no one has taken moving block design this far and they are unlikely to do so in the near future. The recent ICE high speed accident in Germany where a train derailed, struck a bridge and stopped very quickly, effectively negates the safety value of the theoretical moving block system described above. This means that it is essential to maintain a safe braking distance between trains at all times.

What is worth doing, is making the the block locations and lengths consistent with train location and speed, i.e. making them movable rather than fixed. This flexibility requires radio transmission, sometimes called Communications Based Train Control (CBTC) or Transmission Based Signalling (TBS) rather than track circuit transmission, to detect the location, speed and direction of trains and to tell trains their permitted operating speed.

Moving Block and Radio Transmission

On a moving block equipped railway, the line is usually divided into areas or regions, each area under the control of a computer and each with its own radio transmission system. Each train transmits its identity, location, direction and speed to the area computer which makes the necessary calculations for safe train separation and transmits this to the following train as shown here (left).

The radio link between each train and the area computer is continuous so the computer knows the location of all the trains in its area all the time. It transmits to each train the location of the train in front and gives it a braking curve to enable it to stop before it reaches that train. In effect, it is a dynamic distance-to-go system. This is Communications Based Train Control (CBTC).

One fixed block feature has been retained - the requirement for a full speed braking distance between trains. This ensures that, if the radio link is lost, the latest data retained on board the following train will cause it to stop before it reaches the preceding train. The freeway style vision of two trains moving at 50 km/h with 50 metres between them is a step too far into virtual reality for most operators.

Moving Block - Location Updates

As we have seen, trains in a moving block system report their position continuously to the area computer by means of the train to wayside radio. Each train also confirms its own position on the ground from beacons, located at intervals along the track, which recalibrate the train’s position compared with the on-board, computerised line map.

Transferring a train from one area to another is also carried out by using the radio links and, additionally by a link between the two adjacent area computers. The areas overlap each other so, when a train first reaches the boundary of a new area, the computer of the first area contacts the computer of the second area and alerts it to listen for the new train’s signal.  It also tells the train to change its radio codes to match the new area. When the new area picks up the ID of the train it acknowledges the handover from the first area and the transfer is complete.

Another version of the moving block system has the location computers on the trains. Each train knows where it is in relation to all the other trains and sets its safe speeds using this data. It has the advantage that there is less wayside equipment required than with the off-train system but the amount of transmissions is much greater.

An Early Moving Block System

One system which claims the distinction of being the first moving block system is that marketed under the name Seltrac by Alcatel. It is used in Canada and on the Docklands Light Railway in London. It has the ingredients of moving transmission of data, but the transmission medium is the track-mounted induction loops which are laid between the rails and which cross every 25 metres to allow trains to verify their position. Data is passed between the vehicle on-board computer (VOBC) and the vehicle control centre (VCC) through the loops. The VCC controls the speed of Train 2 by checking the position of Train 1 and calculating its safe braking curve. More detail on this system is here

The Seltrac system requires no driver, as it is fully automatic. In case of a system failure where a train has to be manually driven, it has axle counters¹ to verify the position of a train not under the control of the loops. Perhaps its biggest drawback is the need for continuous cables to be laid within the tracks, expensive to install and open to damage during track maintenance.  

The principle difference between this system and the more modern ones being marketed today is that Seltrac uses electro-magnetic transmission of data requiring track cables, whereas radio based systems only require aerials. Seltrac is upgrading their design to use radio based transmission.

Moving Block - Why Do We Need It?

Railway signalling has traditionally required a large amount of expensive hardware to be distributed all along a route which is exposed to variable climatic conditions, wear, vandalism, theft and heavy usage. Because of the widely spaced distribution, maintenance is expensive and often restricted to times when trains are not running. Failures are difficult to locate and difficult to reach. On metros, access is further restricted where there are tunnels and elevated sections.   For these reasons, railway operators have been trying to reduce the wayside signalling equipment and so reduce maintenance costs.  Reduced wayside equipment can also lead to reduced installation costs. Moving block requires less wayside equipment than fixed block systems.

There is another goal much sought after by operators - greater capacity. A norm for most metro lines is 30 trains per hour (tph) or a two-minute headway. It is debatable whether much improvement on this is possible for a high capacity system, since the major losses of line capacity occur because of station stops and terminal operations. Heavily used metro lines, like those in Hong Kong, trying for a greater capacity than 30 trains per hour, will struggle to keep dwell times below 40-50 seconds at peak times. This will push the headway to two minutes or longer, regardless of the signalling system used. Similar problems exist at terminals where crossover clearance times are critical.  Moving block signalling cannot provide much improvement. Shorter headways can, however, be achieved on systems where trains are shorter, speeds lower and the passenger levels smaller. In some places a 95 second headway can be achieved on systems like Docklands and certain sections of the Paris Metro.

Also, for underground lines, modern ventilation and smoke control systems will require train separation of 2-300 metres to allow air circulation at critical times. If moving block signalling allows 50 metre separation, some very expensive additional ventilation arrangements might be necessary. This may reduce the benefits of moving block.

The real prize which could be won by an operator using moving block is reduced wayside equipment and reduced maintenance costs. Better reliability and quicker fault location is also possible with moving block technology. If radio based transmission is included, an all-round improvement can be achieved.

One other factor to be noted is that many operators specifying moving block technology also ask for fixed block track circuits to serve as a back up and for broken rail detection. Track circuits are also still required for junctions.   One might ask, if such equipment is to be installed anyway, why add the expense of radio-based transmission?


1. Axle counters are sometimes used as a way of verifying that a train has completely passed through a block instead of a track circuit. The number of axles on the train are counted as the train enters the block and counted again as it exits.ATP Speed Codes

A train on a line with a modern version of ATP needs two pieces of information about the state of the line ahead - what speed can it do in this block and what speed must it be doing by the time it enters the next block. This speed data is picked up by antennae on the train. The data is coded by the electronic equipment controlling the track circuitry and transmitted from the rails. The code data consists of two parts, the authorised speed code for this block and the target speed code for the next block. The diagram below shows how this works.

In this example (left), a train in Block A5 approaching Signal A4 will receive a 40 over 40 code (40/40) to indicate a permitted speed of 40 km/h in this block and a target speed of 40 km/h for the next. This is the normal speed data. However, when it enters Block A4, the code will change to 40/25 because the target speed must be 25 km/h when the train enters the next Block A3. When the train enters Block A3, the code changes again to 25/0 because the next block (A2) is the overlap block and is forbidden territory, so the speed must be zero by the time train reaches the end of Block A3. If the train attempts to enter Block A2, the on-board equipment will detect the zero speed code (0/0) and will cause an emergency brake application. As mentioned above, Block A2 is acting as the overlap or safe braking distance behind the train occupying Block A1.

Operating with ATP

Trains operating over a line equipped with ATP can be manually or automatically driven. To allow manual driving, the ATP codes are displayed to the driver on a panel in his cab. In our example below, he would begin braking somewhere around the brake initiation point because he would see the 40/25 code on his display and would know, from his knowledge of the line, where he will have to stop. If signals are not provided, the signal positions will normally be indicated by trackside block marker boards to show drivers the entrances to blocks.

If the train is installed with automatic driving (ATO - Automatic Train Operation), brake initiation for the reduced target speed can be by either a track mounted electronic "patch" or "beacon" placed at the brake initiation point or, more simply, by the change in the coded track circuit. Both systems are used by different manufacturers but, in both, the train passes through a series of "speed steps" to the signalled stop.

When the first train clears Block A1, the codes in Blocks A2, A3 and A4 will change to the next speed up and any train passing through them will receive immediately a new permitted speed and a new target speed for the next block. This allows an instant response to changing conditions and helps to keep trains moving.


The next stage of ATP development was an attempt to eliminate the space lost by the empty overlap block behind each train. If this could be eliminated, line capacity could be increased by up to 20%, depending on block lengths and line speed. In this diagram, the train in Block A1 causes a series of speed reduction steps behind it so that, if a following train enters Block A6, it will get a reduced target speed. As it continues towards the zero speed block A2, it gets a further target speed reduction at each new block until it stops at the end of Block A3. It will stop before entering Block A2, the overlap block. The braking curve is shown here in brown as the "standard" braking curve.

To remove the overlap section, it is simply a question of moving the braking curve forward by one block. The train will now be able to proceed a block closer (A5 instead of A6) to the occupied block, before it gets a target speed reduction. However, to get this close to the occupied block requires accurate and constant checking of the braking by the train, so an on-board computer calculates the braking curve required, based on the distance to go to the stopping point and using a line map contained in the computer's memory. The new curve is shown in blue in the diagram. A safety margin of 25 metres or so is allowed for error so that the train will always stop before it reaches the critical boundary between Blocks A2 and A1. Note that the braking curve should reduce (or "flare out") at the final stopping point in order to give the passengers a comfortable stop.

Speed Monitoring

Both the older, speed step method of electronic ATP and "distance-to-go" require the train speed to be monitored. In Fig 8 above, we can see the standard braking curve of the speed step system always remains inside the profile of the speed steps. The train's ATP equipment only monitors the train's speed against the permitted speed limit within that block. If the train goes above that speed, an emergency brake application will be invoked. The standard braking curve made by the train is not monitored.

For the distance-to-go system, the development of modern electronics has allowed the brake curve to be monitored continuously so that the speed steps become unnecessary. When it enters the first block with a speed restriction in the code, the train is also told how far ahead the stopping point is. The on-board computer knows where the train is now, using the line "map" embedded in its memory, and it calculates the required braking curve accordingly. As the train brakes, the computer checks the progress down the curve to check the train never goes outside it. To ensure that the wheel revolutions used to count the train's progression along the line have not drifted due to wear, skidding or sliding, the on-board map of the line is updated regularly during the trip by fixed, track-mounted beacons laid between the rails.

Operation with Distance-to-Go

Distance-to-go ATP has a number of advantages over the speed step system. As we have seen, it can increase line capacity but also it can reduce the number of track circuits required, since you don't need frequent changes of steps to keep adjusting the braking distance. The blocks are now just the spaces to be occupied by trains and are not used as overlaps as well. Distance-to-go can be used for manual driving or automatic operation.

Systems vary but often, several curves are provided for the train braking profile. This example shows three: One is the normal curve within which the train should brake, the second is a warning curve, which provides a warning to the driver (an audio-visual alarm or a service brake application depending on the system) and the third is the emergency curve which will force an emergency brake if the driver does not reduce speed to within the normal curve.

Why doesn't everyone use distance-to-go? Partly because the systems used by many operators were installed before distance-to-go became available. Also, some operators require the safety margin, particularly in the US where they insist on an extra margin, known as the "lurch" factor, to allow for a train which decides to "motor" instead of "brake", as once happened in San Francisco.


Headway: The time interval at a fixed point between the passing of one train and the passing of the next.

Read Through: Where a green signal seen beyond a red signal causes the driver to proceed in error.

Stop and Proceed: Used under special conditions to allow a train to pass a red signal at severely restricted speed.

© The Railway Technical Website 2017