Wednesday Reality: The Permission to Proceed

Through the windows of a traditional railway signal box, a signaller could watch trains approach beside a row of substantial metal levers. Some moved points, directing wheels towards one track rather than another. Others operated signals, communicating permission to advance. Each handle connected an intention inside the building to a movement outside it. Yet beneath the operating floor, another mechanism determined which intentions could coexist. A signaller could grasp a lever and discover that the railway would refuse the requested arrangement.

That refusal had a history. In 1856, John Saxby brought together and interlocked the levers controlling points and signals at Bricklayers' Arms Junction in London. George Findlay's nineteenth-century account of railway operation describes the development from earlier locking proposals towards a practical arrangement. By 1873, the London and North Western Railway reportedly operated 13,000 interlocked levers. The significance lay beyond concentrating controls in one place. Relationships previously dependent on correct human action could now constrain the action itself. [1]

What the machinery refused

An interlocking prevents the establishment of conflicting routes by constraining the operation of points and signals. Its value does not depend on an operator becoming careless. An attentive person can still hold an incomplete picture, misunderstand a movement or act at an unfortunate moment. The locking mechanism gives certain incompatible arrangements a physical consequence: the lever cannot simply follow the hand. Instructions describe how somebody should operate the railway. Interlocking changes which operations the equipment will permit. [2]

The visible signal nevertheless depends on more than the arrangement of levers. Points must provide the intended route, and the signalling system needs information about trains ahead. A departure time establishes neither condition. When points fail, their interlocking with signals prevents a proceed indication over the affected route. A timetable can organise movements across an entire network while remaining unable to establish whether one particular movement can safely begin. [3]

A conventional track circuit connects that decision to the track. A supply feeds current through the rails towards a relay. A train's wheels and axles create a path between the rails that diverts current away from the relay, indicating occupation. Many electrical failures also deprive the relay of current, producing a restrictive condition. The arrangement normally withdraws permission when the evidence needed to support it disappears. A delayed passenger experiences the absence of movement. The equipment may have successfully refused to claim that the line is clear. [4]

This does not make every failure safe. At Clapham Junction in December 1988, faulty wiring created a false electrical feed that prevented a signal from returning to danger when it should have done. A redundant wire remained connected at one end and made unintended contact at the other. Thirty-five people died in the resulting collision. The driver received an intelligible permission from machinery whose relationship with the occupied track had failed. The inquiry examined both the wiring errors and the circumstances surrounding the work. The danger lay beneath a signal that still appeared capable of doing its job. [5]

Two correct systems

A quieter version of that separation can develop around a project table. A customer requirement receives approval, an architecture acquires a signature and a delivery plan gains a committed date. These actions establish real things: agreement, authority to spend, permission to allocate people. Their significance becomes harder to interpret when the organisation treats them as evidence about the behaviour of the operation being built.

Consider a hypothetical integration between a customer ordering system and a warehouse. The specification defines an acknowledgement message. The customer interprets it as acceptance of responsibility for fulfilling the order. The warehouse sends it when the message enters an incoming queue, before checking stock or validating the order. Both teams implement their understanding correctly. Each can demonstrate that the interface sends and receives the required fields. The customer's system now records an accepted order while the warehouse has yet to decide whether it can accept one.

The contradiction becomes operational when validation fails. The warehouse expects the customer to inspect a later rejection message. The customer, having transferred responsibility at acknowledgement, expects the warehouse to manage exceptions. The message has crossed the interface. Responsibility has fallen between its two meanings. No amount of inspecting the acknowledgement's format will reveal that gap. The combined behaviour depends on a relationship that neither component's local correctness establishes.

The railway's locking frame makes that relationship unusually tangible. Its concern includes combinations of actions, rather than merely whether individual levers move properly. A project can inspect every lever in isolation and still leave conflicting movements available. When testing eventually exposes the conflict, its identity depends on who encounters it. Engineering sees an unspecified rule, the customer sees a broken commitment, and project management sees a change threatening an approved scope. The same gap enters three records as three different problems.

Why the signature matters

Approval persists partly because it answers questions that organisations genuinely need answered. Can procurement release the purchase order? Can a manager reserve the team? Has the customer accepted the contractual description? Who agreed to this expenditure? A signature provides a durable answer that can travel through budgets, staffing plans and audit records. Operational understanding travels less easily, especially when it consists of unanswered questions about exceptional behaviour.

This difference can make premature closure rational for the people involved. A participant may recognise that the specification leaves room for interpretation while also knowing that withholding approval blocks several other activities. Another may approve the architecture within a limited remit, assuming somebody else owns the business behaviour. Nobody needs to believe that every uncertainty has disappeared. The organisation can nevertheless combine their bounded approvals into an unbounded declaration of readiness.

Once the date becomes a promise, reopening those questions carries a different price. A clarification that would once have altered a design now threatens expenditure, staffing and a customer announcement. The question has not changed technically. Its organisational consequences have. The timetable begins to influence what the organisation will recognise about the track, because acknowledging the condition of the track would require changing the timetable.

The uncertainty that belongs in motion

It would be convenient to conclude that better preparation could settle everything. Software rarely offers that bargain. Real customers produce combinations that workshops never considered. Production reveals timing, volume and behaviour absent from test environments. Some discoveries belong to use itself. An organisation that demanded exhaustive advance knowledge could spend indefinitely refining a representation of an operation it never allowed to exist.

Railway engineering contains its own version of this difficulty. Interlocking verification examines availability alongside safety: trains must eventually move. Modelling research identifies safe deadlocks, in which traffic cannot progress even though no collision occurs. Preventing incompatible movements remains essential, but a system that prevents all movements has failed another part of its purpose. Additional constraints can therefore require examination as carefully as missing ones. [6, 7]

The organisational distinction concerns how uncertainty enters the commitment. A limited launch can deliberately expose an unanswered question while containing its consequences. The scope, observation and recovery effort then form part of the experiment. That differs from declaring a full launch complete and discovering afterwards that its operation depends on intervention nobody budgeted. In both cases people learn through use. In only one does the plan acknowledge what the learning will require.

More signatures cannot resolve that difference automatically. Five approvals may all inherit the same untested assumption, while a sixth adds delay without adding observation. Conversely, a demonstration of one successful order may offer stronger evidence about that order while saying nothing about cancellation or retries. The difficulty concerns the reach of the evidence: which movement it supports, under which conditions, and how far the organisation extends the permission beyond what it has observed.

When rescue becomes evidence

After launch, capable people can bridge the gaps. An engineer finds orders stranded between systems. An operator reconciles records manually. A customer contact explains why an acknowledgement does not yet mean what the customer expected. Their work restores movement, sometimes quickly enough for the project to retain its original completion date. The customer still experiences uncertainty and interruption, while the supplier can classify the concentrated effort as post-launch support.

That classification changes the apparent economics. The project records its delivery expenditure. Maintenance absorbs investigations. Operations carries manual handling. The customer spends time explaining discrepancies. These costs arise from one combined operation, but separate accounts make the original delivery look cheaper than the effort required to make it function. The boundary between project and support becomes a boundary between visible commitment and displaced completion cost.

Successful rescue then influences the next plan. If the organisation remembers that the launch met its date, the preparation budget appears sufficient and the delivery expectation appears achievable. The intervention that made those conclusions possible can disappear into routine support figures. Meanwhile, the people who intervened return to their next commitments with less available capacity. Their adaptability preserves yesterday's assumptions while reducing the resources available to fulfil tomorrow's promises.

The incentives need no villain. Project teams benefit from recorded completion, support teams receive credit for resolving incidents, and experienced engineers gain a reputation for making difficult launches work. Each contribution has value. Together, they can make the organisation unusually effective at recovering from arrangements it consequently becomes less likely to change. The train's arrival supplies evidence for the timetable while concealing the additional work needed along the route.

The record of the journey

Digitisation can strengthen that memory. Modern interlockings depend on application data representing the particular track layout. Faithful execution still requires a correct relationship between the configuration and the railway. Organisational workflows have a comparable dependency. A tool can enforce every prescribed approval while leaving the meaning of readiness untouched. Its history will accurately show who authorised the transition, even when the operation required people to supply missing relationships afterwards. [6]

Evidence also belongs to a particular configuration. An interface tested before an acknowledgement changed meaning does not retain the same authority afterwards. The approval record can survive a change that invalidates what supported it. As systems grow, each team can preserve a defensible local account while the combined operation drifts beyond the conditions anyone actually examined. The panel remains orderly because its records persist more reliably than the relationships they once described.

Imagine the same accounting beside a railway junction. By morning, the train has reached its destination and the departure enters the record as a success. The people who secured the route through the night return to their other work. When the next timetable is drawn up, the journey time remains available to the planners. The hands that made it possible do not appear.

Sources supporting the railway engineering and historical account:

[1] George Findlay, The Working and Management of an English Railway (1889), page 67.

[2] Network Rail, Jargon Buster: Interlocking.

[3] Network Rail, Signals explained.

[4] Network Rail, Track circuits explained.

[5] Anthony Hidden QC, Investigation into the Clapham Junction Railway Accident, 1989.

[6] Cappart et al., Verification of interlocking systems using statistical model checking, 2017.

[7] Vanit-Anunchai, Experience using Coloured Petri Nets to Model Railway Interlocking Tables, 2014.