Can high-security industrial relays be used in interlocking systems? Or are only component-level certified SIL 4 relays permitted? This question points to a widespread conceptual confusion in the sector. The answer is not simply yes or no: Utilization is subject to specific architectural conditions.

Theoretical Background

The Two Worlds of Safety Relays

The selection of relays in railway safety depends on the design philosophy and certification approach. There are two primary categories:

Vital Relays

These relays represent the long-established design approach of railway signaling, rooted in a century of engineering heritage.

Gravity Fail-Safe (e.g., Mors Smitt N.S1):

• When the coil energy is removed, the opening of the contacts is entrusted not to a friction-prone spring force, but directly to gravity.
• A spring can fatigue or snap, but gravity never disappears.
• Therefore, these relays must always be mounted in a specific vertical orientation defined by their design parameters.

Carbon-Silver Contact Technology (e.g., Clearsy RS4):

• One of the contact tips is made of silver, and the mating tip is made of a carbon (graphite) alloy.
• By its metallurgical nature, carbon does not weld to silver; this physically prevents the contacts from fusing.
• Contact welding is rendered physically near-impossible.

Industrial Safety Relays: Forcibly Guided Contacts

Manufactured according to the EN 61810-3 (formerly EN 50205) standard, these relays pursue an entirely different safety strategy. Companies like Dold, Finder, and Arteche have established industry-standard products in this class.

Mechanical Linkage Principle:

• Normally Open (NO) and Normally Closed (NC) contacts are mechanically interlocked via a guiding rod (comb).
• If an NO contact welds due to excessive current or a short circuit, the mechanical rod physically prevents the NC contact from closing and the system from transitioning to an unsafe state.
• As mandated by the standard, a minimum functional gap of 0.5 mm is guaranteed between contacts.

The Critical Difference:

These relays do not prevent the metallurgical occurrence of welding; they merely report the condition to the controller once it happens.

Coil De-energized Contact Pushed by SPRING Force

Contact Welded?

Contact OPENS
(Normal State)

NC Contact Stays OPEN(Mechanical Failure) PLC Detects andLOCKS the SystemNOYES!

VITAL RELAY

Coil De-energized Armature Drops by GRAVITY Carbon-Silver Contact Opens

SAFE STATE

Research Details: Root Cause Analysis

Field Scenario: Relay Selection in Interlocking Panels

An EPC (Engineering, Procurement, and Construction) contractor is selecting relays for an electronic interlocking project. There are two options on the table:

Prices are indicative list-level figures for illustration and vary by volume, region and date.

Cost Discrepancy: The per-unit cost difference in the field is approximately tenfold. The Critical Question: Can Option B be used in the design?

Why Aren’t Industrial Relays SIL 4 Standalone?

Deduction: Industrial safety relays do not possess a SIL rating on their own. They can form part of a system targeting SIL 4 only where the complete architecture — redundancy, readback-based diagnostics, failure assumptions and the resulting safety case — has been assessed against the applicable CENELEC lifecycle and accepted by the independent safety assessor. The 1oo2 plus readback pattern described below is the usual starting point for that architecture, not a substitute for the assessment.

Architectural Solution and Operational Logic

There are two distinct safety architectures in the market. One is predicated on purchasing safety, while the other revolves around constructing it holistically.

Approach A: Component-Level Architecture

Representative: Clearsy RS4 Series

This approach positions the product itself as a certified black box. The relay is a sealed unit designed according to SIL 4 requirements during the hardware design and manufacturing phases, possessing internal redundancy and inherent fail-safe capabilities.

• Operational Principle: The integrator drives the relay using standard industrial relay logic. The product’s safety case documentation is provided directly by the manufacturer.
• Wiring: Only the driving coil and transmission contact terminals are connected. It does not require an external control cable or specialized monitoring software on the safety PLC side.
• Internal Mechanism: The configuration of the mechanism and gravity within the relay inherently eliminates the risk of contact welding.

Commercial Equation:

•  Plug-and-Play: The engineering burden and Independent Safety Assessor (ISA) approval process for the integrator are minimized.
•  Cost: The standalone unit cost is high (~€500).
•  Supply Chain: Creates dependence on a small number of qualified suppliers.

Approach B: System-Level Architecture

Representatives: Arteche, Finder, Dold (Forcibly Guided Relays)

This approach aims to achieve the firm SIL 4 target by combining standard safety relays through an intelligent system architecture. Safety is not embedded in the off-the-shelf product; it is concealed within the entirety of the designed circuit.

• Operational Principle: Instead of using a single relay, at least two relays with forcibly guided contacts are used, electrically wired in series (1oo2 Architecture).
• Wiring and Monitoring:
  • Series Safety: The NO contacts of the dual relay set are wired in series to the field load. Even if one relay effectively welds, the other interrupts the circuit, mitigating the fault efficiently.
  • Readback Process: The closed (NC) contacts of the relays are wired to the digital input (DI) card of the safety PLC, enabling instantaneous monitoring of the relays’ mechanical states.
• Audit Logic: The safety PLC verifies the state of the NC contacts before dispatching a drive command to the field. If a contact appears open while no energy is supplied to the field (indicating a welding syndrome), the system refuses the drive command and locks into a safe state.

Commercial Equation:

•  Cost-Effective: Unit cost is roughly an order of magnitude lower. Project-level savings are smaller, because circuit design, wiring, verification, documentation and assessment effort shift to the integrator.
•  Flexibility: Any EN 61810-3 (EN 50205) compliant standard product can be used.
•  Engineering Burden: Circuit design, wiring complexity, and the ultimate safety proof responsibilities of the final system lie squarely on the shoulders of the integrator architect.

Conclusion

Decision Matrix

Summary Deductions:

• The concept of a “SIL 4 Relay” does not equate to a “SIL 4 System”: A single component may possess a SIL 4 hardware label, but system engineering is a comprehensive, end-to-end endeavor.
• Gravity vs. Spring Force: The safety of vital relays relies on immutable physical laws of nature, whereas industrial safety relays necessitate external diagnostic intelligence to effectively detect latent flaws.
• Cost vs. Responsibility Trade-off: Choosing inexpensive components incurs a high engineering burden and continuous ISA auditing, whereas expensive components yield a comfortable, stress-free integration. The supply chain strategy is directly proportional to a firm’s internal engineering confidence.

References

• EN 61810-3: Electromechanical elementary relays – Relays with forcibly guided contacts
• EN 50129: Railway applications – Communication, signalling and processing systems
• Mors Smitt N.S1 Technical Documentation
• Clearsy RS4 Functional Safety Guidelines
• HIMA SILworX Application Notes

Related Links

 Related Article: → Strategic Analysis: CENELEC SIL 4 Relay Procurement Strategies and Market Dynamics in Railway Signaling

Last update: March 2026 | Version: 1.1

Global railway networks are exposed to multidimensional physical threats, ranging from economically motivated theft correlated with commodity price fluctuations to asymmetric sabotage risks triggered by geopolitical tensions. This study examines the statistical distribution of security threats, material-based attack vectors, and the methodology of deducing perpetrator motivation from field evidence, using Open Source Intelligence (OSINT) data, UIC (International Union of Railways) incident analyses, and LME copper price movements. The acquired data indicates that railway security is transitioning from a mere public order issue to a national critical infrastructure security framework.

Key Findings

• The Security Paradox of Material Transition: The technological transformation of infrastructures (the shift from conventional copper architecture to a fiber-optic communication backbone) alters the current threat profile.
• Motivational Distinction: Across reported incidents, the overwhelming majority are theft driven by scrap-metal value. Deliberate sabotage is a small minority, and terrorism-classified incidents are rarer still. This distribution matters operationally: countermeasures optimised for sabotage are poorly matched to the threat that actually dominates the incident log. Fiber-optic sabotage, though less frequent, is a strategic intervention aimed at creating system blindness and operational disruption.
• The Role of Forensic Field Analysis: Accurate interpretation of physical signs left at the crime scene (e.g., missing hardware vs. targeted incision) is the most critical parameter in determining the nature of the action (economic crime or asymmetric sabotage).
• Hybrid Processes: Recent incidents, particularly reported in the European region, indicate that the boundaries between organized economic crime events and sabotage elements considered to be state-sponsored occasionally blur.

Global Threat Landscape: Proportional Distribution

(Source: General assessment in light of UIC Metal Theft on Railways Report data)

The Industrial Scale of Theft

The frequency of theft incidents tends to track metal prices closely enough that operators treat price spikes as a leading indicator. Particularly between 2010 and 2024, the rise in copper’s index value traded via the LME (London Metal Exchange) has made unprotected railway yard infrastructures potential targets for organized entities.

Reference Case – South Africa Transnet Operation: According to operator (Transnet) statements, approximately 1,121 km of cable theft incidents were recorded in the 2023 operational period. This magnitude requires the rebuilding of a considerable portion of the respective network every year, consuming the maintenance and repair budget. Evidence on the field confirms that dismantling operations are carried out in a mobilized manner by highly organized groups.

Sabotage Dynamics and Asymmetric Actions

According to reports and analyses by critical infrastructure protection agencies across Europe (including ENISA), an “intervention/sabotage” trend targeting logistical arteries has been monitored, especially following the outbreak of conflicts in Eastern Europe. In the 2024-2025 projection, various incidents directed at multiple infrastructures (energy, communication, railways) have been recorded specifically in Europe. These specific interventions are devoid of theft motives and are asymmetric actions designed to slow down strategic shipments, create communication outages, or establish blockades in the supply chain.

Infrastructure Material Analysis: Copper vs. Fiber Optic

Copper Architecture: Legacy Infrastructure

When evaluating the system as a whole, conventional railway lines remain reliant on copper transmission and grounding hardware across a large share of the network.

Critical Usage Points:

• Track Circuits (Impedance Bonds)
• Switch Point Drive Mechanisms
• Field Signal Instruments
• Electrification Catenary Grounding Equipment

Security Vulnerability Profile: The predominant portion of actual theft incidents encountered in the sector consists of lines carrying copper. A broad spectrum is at risk, ranging from catenary overhead line tension weights to thick-section underground grounding cables in substations.

Fiber Optic: The Communication Backbone

Security Vulnerability Profile: Since fiber-optic systems carry glass strands, they possess no financial equivalent in the metal market.

The Paradox Brought by Material Transition

Although technological modernization offers the potential to reduce “Theft” rates; it renders cyber-physical systems more open and vulnerable to “Sabotage” scenarios. While an outage in the copper infrastructure mostly causes regional local security vulnerabilities and singular relay drops; the severing of a single fiber cable running through the main backbone creates a “Single Point of Failure” scenario capable of simultaneously bringing down GSM-R, interlocking communication data, and SCADA telemetry across an axis of hundreds of kilometers.

Physical Attack Typology: Crime Scene Analysis Matrix

Classifying physical damage through an architectural approach provides reference data for Root Cause Analysis:

Type A: Copper Cable Theft

• Target Points: Power transmission lines, catenary masts, substations.
• Forensic Findings:
  • Material Loss: The main conductive parts of the cables have been removed from the facility.
  • Processing Marks: Plastic sheath remnants and burn marks are found in the environment (done to reduce weight).
  • Mobility Evidence: Large-scale tire, track, or dragging marks belonging to heavy transport vehicles are visible.
  • Operation Window: Generally, time boundaries between 01:00 and 04:00, which are low traffic hours, are preferred.

Type B: Targeted Sabotage

• Target Points: Main fiber-optic distribution centers, critical relay/TCC communication cabinets, GSM-R station bases.
• Forensic Findings:
  • Material Presence: All severed cables are abandoned at the scene.
  • Detectable Precision: A surgical cut is made by specifically selecting thin data lines carrying direct communication data instead of grounding or high voltage lines.
  • Simultaneity: Simultaneous actions are executed at different locations to decommission distributed redundancy lines.

Type C: Misidentification-Induced Damage

• Scenario Type: Material identification error by groups acting with theft motivation.
• Forensic Findings: Thick outer protective armored fiber cables are cut, but abandoned in place when the material content (glass strand) is realized. Additional traces of classical copper cutting attempts should undoubtedly be sought in the immediate vicinity.

Comparative Attack Analysis Matrix

Sample Field Findings Analysis

Case A: Germany GSM-R Outage (Sample – October 2022)

In the incident that paralyzed the main train traffic in Germany’s northern corridor during the specified timeframe, the main and redundant lines at two critical GSM-R fiber-optic communication points averaging 500 km apart were reduced in a coordinated manner. Verdict Outcome: The ability to bypass distributed redundancy with such precision led investigating authorities to treat the incident as deliberate sabotage by an actor with detailed knowledge of the system design, acting in a planned manner.

Case B: France HSR Process (Sample – 2024 Event Period)

On the eve of a large-scale international event, arson-based actions were carried out on three critical arteries feeding the TGV main lines. Verdict Outcome: No evidence of theft was observed at the focal points feeding the signaling centers. The style of the action; aligned with the methodology of organized public order threats in terms of its direct aim to simulate asymmetric impact, psychological pressure, and Denial of Service (DoS) on a physical dimension.

Architectural Solutions and Mitigation Strategies

Engineering-based risk mitigation approaches that can be developed against the aforementioned threats:

Distributed Acoustic Sensing (DAS) Integration

It is an intelligent topology where the existing unused or dark fiber internal structure is evaluated as an acoustic analysis sensor.

• Core Principle: The Rayleigh backscatter of laser pulses assigned into the line is continuously analyzed, deriving distance and vibration threshold values.
• Assessment: Offers the possibility of detecting a potential threat via soil excavation vibrations before the wire fence is breached. However, since DAS investments will generate a significant amount of environmental “noise” (animal passage, train vibration, weather conditions); it is imperative that the raw data is integrated into advanced Artificial Intelligence (Edge AI) based signal processing systems so as not to fatigue the alarm system. Given the high CapEx budget requirement, it presents feasibility only in strategic corridors.

Forensic DNA Marking

Provides the transformation of facility traceability into legal evidence to deter industrial metal thefts.

• Core Principle: It is the application of a synthetic and unique polymer-based liquid, detected under ultraviolet light, to line components.
• Assessment: It aims to form technical evidence against the criminal network subject to the offense by analyzing the scrap that falls into the black market following the theft. It ensures deterrence by making the salability of metal in recovery or secondary markets sectorally risky.

Design and Material Revisions

• Designing the transition from copper to aluminum-based (CCS – Copper Clad Steel) bimetallic cables in grounding areas within the context of its very low liquidity in the scrap market.
• Confining aerial cables entirely to underground passages through architecturally reinforced precast concrete culverts.

Conclusion

The era of traditional wire fences and passive protection in critical railway structures is coming to an end. Evaluated from the lens of systems engineering:

1. The Dual Challenge: Railway infrastructures are caught between a heavy OPEX burden (90%) arising from theft and extremely low-probability but high-risk destruction scenarios originating from sabotage.
2. Root Cause Verification: There is a need for “Telemetric TDR” or “DAS” architectures capable of detecting whether a dropped signal or reduced voltage at the system center is a technical corrosion, a cable break, or a deliberate severing without having to visit the field.
3. The Necessity of an Analytical Approach: Instead of directly encoding an anomaly encountered at the scene with the banality of a theft attempt or a coordinated sabotage conspiracy theory; a rational methodology should be applied by considering the damage typology, material preferences, timing, and interventions on redundancy.

When examining the risk matrix in infrastructures; the finding is obtained that technological evolution not only facilitates communication but simultaneously promotes physical threats to cyber-physical scenarios. It should be expected that the railway security standards of the future will step out of the isolated silo of operational technology (OT) and physical breach alarm (CCTV, DAS, Access Control) systems and become integrated within a single SOC (Security Operations Center) pool.

References

Data Compilation and Analysis Base: The current review is based on a methodological synthesis pertaining to Open Source Intelligence (OSINT) examinations, independent security and breach frequency analyses published by institutions, and market commodity correlations.

• UIC (International Union of Railways): Security committee databases
• ENISA (EU Cybersecurity Agency): Railway critical infrastructure threat landscape studies
• LME (London Metal Exchange): Ten-year global commodity and scrap-based supply-demand price charts
• Global Initiative Against Transnational Organized Crime: Metal-based criminal organizations case reports

Documents

 Download Document: Railway Security Threat Analysis Report Turkish (PDF)

Last updated: March 2026 | Version: 2.0