01Executive summary
Three milestones producing the clearest example of fail-safe design anywhere in this set: a brake that applies itself when its own control system fails.
Westinghouse patented a straight-air brake in 1869 at the age of twenty-three, having been struck by the use of compressed air to drive the Mont Cenis tunnel. By 1872 he had developed the automatic brake, in which each car carries its own reservoir and a triple valve, and the brakes apply when train-line pressure falls. From 1886 the Burlington trials established brake performance by extensive comparative testing.
02The problem: brakes at the wrong end of the train
As train lengths, speeds and unit loads increased it became obvious that the driver should be able to control braking directly for the whole length of the train. Before that, braking depended on brakemen riding the train and applying handbrakes on individual cars on a whistle signal — slow, uncoordinated, dangerous for the men, and completely inadequate for an emergency.
Westinghouse's route to the answer is a good illustration of transferring a solution across domains. The successful use of compressed air for drilling the Mont Cenis tunnel in the late 1860s impressed him with the possibility of using compressed air to operate brakes. Compressed air was already understood as a way of transmitting power over distance to where it was needed — which is exactly the problem a long train presents.
His first patent, issued in 1869, covered the straight-air type. A main reservoir in the locomotive cab supplies air through a train line to a brake cylinder on each car; admitting air applies the brakes, releasing it lets them off. It works, and it has one serious defect.
03The automatic brake: inverting the logic
In a straight-air brake, the air pressure is the braking force, so anything that interrupts the supply removes the brakes. If the train line ruptures — and a train that has just broken in two has by definition ruptured its train line — the brakes release completely on the runaway portion at precisely the moment they are most needed.
The automatic brake inverts this, and the inversion is the milestone.
| Aspect | Straight air, 1869 | Automatic, 1872 |
|---|---|---|
| Where the energy is stored | Locomotive main reservoir only | An auxiliary reservoir under every car, plus the train line |
| To apply the brakes | Admit air to the train line | Reduce or cut off train-line pressure |
| The controlling device | Driver's valve | A triple valve on each car, responding to train-line pressure change |
| If the train line ruptures | Brakes release — the dangerous outcome | All brakes apply automatically from the individual reservoirs |
| Response along the train | Air must travel the full length to apply | Each car acts on its own stored air as the pressure wave reaches it |
The train line and the auxiliary reservoirs are normally kept charged at about five bar. When the driver reduces train-line pressure, the triple valve on each car connects that car's auxiliary reservoir to its own brake cylinder, applying the brakes partially or fully according to how far the pressure was reduced. The triple valves are the essential feature of the whole arrangement.
Energy for the safe action is stored locally at every point where the action must occur, and the control signal is used only to release that stored energy. Loss of the control medium therefore causes the safe action rather than preventing it. That single sentence is the definition of a fail-safe system, and this brake is one of its earliest and cleanest industrial embodiments.
The same reasoning appears throughout this set: the pacemaker reverting to a defined asynchronous mode rather than ceasing to pace, spring-return valve actuators closing on loss of instrument air, de-energise-to-trip relays, dead-man controls, and the reactor whose physics opposes a power excursion without any action. The question to ask of any protective system is what it does when its own supply is lost — and the answer must not be "nothing".
04Settling performance by measurement
Improvements in air brakes after 1872 were mainly in details. What did change substantially was how brake performance was established. American manufacturers and railroad men conducted many series of extensive tests of every feature of brake equipment and of various brake types, beginning with the Burlington trials carried out with freight trains on the Chicago, Burlington and Quincy Railroad from 1886.
This belongs with the Rainhill trials of the first series and the full-scale fatigue testing that followed the Comet accidents in the second. Competitive, instrumented, published trials on the governing case are how the profession settles questions that argument cannot, and the method is older and more widely applicable than its individual instances suggest.
05Takeaways for current practice
- Store the energy for the safe action locally. Every car carries its own reservoir, so no car depends on a supply that may be severed.
- Use the control signal to release, not to actuate. Loss of the signal then produces the safe outcome by construction.
- Ask what a protective system does when its own supply fails. If the answer is "nothing", it is not a protective system.
- Test the governing case, not the convenient one. Long heavy freight trains, not short passenger ones.
- Look for a solution already working in another domain. Compressed air was transmitting power in tunnels before it stopped trains.
Modern references include AS 7501 and the rail industry standards published under the Rail Industry Safety and Standards Board, and IEC 61508 for functional safety generally. Cited by number for orientation only — verify currency.