The safety drive circuit, or Sifa for short, is a device that is installed on traction vehicles. It can bring a train to a halt by emergency braking if the driver becomes incapable of acting during the journey, e.g. if he loses consciousness.

Sifa supplements the externally acting train control systems, such as PZB (Point Control System), LZB (Line Control System) or ETCS (European Train Control System). In addition, SIfa can be used to ensure the single-arm control of traction units.

In Switzerland, the Sifa is referred to as safety control system.

General description of the Sifa

As already mentioned, the Sifa is located on traction units, namely in the driver’s cab and consists of one or more operating devices. These devices must be operated continuously or released and re-operated at intervals. If they are not actuated, emergency braking is applied. Different controls shall be provided depending on the railway undertaking and the rolling stock:

» pedal (the most commonly used variant)
» pushbuttons on the side windows (used by the driver when leaving the station)
» Heads of master controllers and brake levers
» Clamping yoke under the rotating master controller (e.g. SNCF)
» Push buttons on the armrests
» Actuation of individual operating elements such as master controller or PZB/Indusi (only as a substitute)

The time-time sifa is the most common form in Germany. With this form the train driver keeps a pedal or button pressed. The pressure must be interrupted briefly every 30 seconds. In this way, the safety drive circuit receives confirmation that the train driver is still capable of reacting. If the driver presses and holds the control element for more than 30 seconds, the system first gives a visual warning. An acoustic warning tone sounds after a further 2.5 seconds. After a further 2.5 seconds, the train is brought to a halt by the safety control circuit. The braking effect is only cancelled after the pedal is released and pressed again. In addition, the master controller must be moved to the neutral position. The release is independent of the distance travelled and is therefore a disadvantage of the time-dependent Sifa.

The time-distance sifa has the advantage that in addition to time, the distance covered since the last actuation is also included in the sequence. This form is used, for example, in most vehicles in Switzerland, as it actively intervenes even when rolling away slowly.

In Austria, again, the way-way-skifa is used for the most part. Here, as with the time-time sifa, the pedal must be pressed and briefly released every 900 meters at the latest. If this is not done, an acoustic warning sounds after another 75 meters. If there is no further reaction, the traction unit initiates a power cut-off or emergency braking. The Taurus and Talent trains already feature a time-time sifa based on the German model. A way-way siphon is normally installed in a City Shuttle reversible train. If a Taurus is preloaded before this train, this train combination will have both the time-time and the way-away siphons, depending on the direction of travel. In order to be able to drive such a train composition, the drivers must be trained for both systems. A special feature was the Austrian class 1012, which automatically switched from the way-trip-syfa to the time-time-syfa at a speed of 160 km/h.

In Sweden, the pedal must be kept in the middle position, i.e. it must not be pressed down completely, otherwise the sifa will also respond. When driving with the train protection switched on, the driver must not release the pedal. MTAB locomotives not only have the Sifa pedal, but also a push button on a spiral telephone cord. It enables the driver to stand up while driving.

In most countries, the Sifa operates at a speed of more than 3 km/h. Only in the Netherlands is the safety drive circuit already active at standstill as soon as a driving direction is selected.

On underground and suburban trains, for example, Sifa has long been associated with the operation of the automatic transmission. This is also known as the dead man’s button. When the button was released, emergency braking was applied.

The function of the Sifa has to be checked at least once a day in each driver’s cab and the functional readiness has to be checked continuously while driving.

Since the introduction of the Railway Construction and Operating Regulations of May 8, 1967, it has been mandatory to equip leading vehicles with Sifa.

Sifa designs in Germany


The RZM-Sifa is a pre-war design and was specified by the Reichsbahn-Zentral-Maschinenamt. It was also used after the Second World War. For example in the pre-series machines of the DB Class V 200.0 .

The RZM safety drive circuit must be constantly actuated during travel. A periodic release is therefore not necessary. It offers no protection in the event of the driver being unable to act.

All operating elements are connected in series. This means that the monitoring circuit must be interrupted if an element is actuated. When the circuit is closed, a solenoid valve is energised, which starts to vent a deceleration air tank. The main air line is kept closed by the pressure in the delay tank. The safety reaction starts when the delay tank is vented. This happens after about 8 – 10 seconds. The air can now escape from the main air line. If the circuit to the solenoid valve is interrupted again and thus the delay tank is filled again, the emergency braking can be cancelled. The RZM-Sifa only becomes effective above 15 km/h, as a speed sensor keeps the monitoring circuit open up to this speed.

Time-Distance-Sifa Type BBC

In the case of the time-way siphon type BBC, a detector lights up after 30 seconds of interrupted operation and a buzzer sounds after a further 75 metres. After another 75 meters the emergency brake is applied. This type of Sifa was very common in the first series of post-war new-build locomotives.

A worm gear driven by the wheelset provides the distance dependence of the Sifa. While the time relay is running, the worm wheel, which is attached to a lever and provided with a return spring, is lifted out of the engagement of the driving worm by an electromagnet. After 30 seconds it falls onto the worm gear and is turned. A contact on the worm wheel feeds the buzzer after 75 meters. After another 75 meters the toothing of the worm wheel ends. The lever then falls out of the discharge valve. The main air line is vented. A pressure switch is opened by the pressure drop. In electric locomotives this causes the motor contactors to drop. In diesel locomotives, the control system is vented electrically, so that the engine runs downwind and the hydraulic transmission is drained.

Sifa 86

The Sifa 86 is a further developed Sifa type that was used by the Deutsche Reichsbahn in the GDR. With this so-called request Sifa, the train driver has to confirm an optical signal by pressing a button. This is done after a randomly selected period of time between 40 and 50 seconds. If more than 400 metres (for vehicles with a top speed of less than 100 km/h) or 800 metres (for vehicles with a top speed of 100 km/h or more) have been travelled since the last actuation, the system also prompts a new actuation, regardless of the time that has elapsed. Previous operations had no effect.

Safety control in Switzerland

For safety control in Switzerland, the driver must keep one pedal constantly depressed. When the pedal is released, an acoustic signal is sounded. This happens after 3 seconds at the latest. Emergency braking is initiated if the pedal is not pressed again. In some vehicles, e.g. SBB Re 420, SBB Re 620, the warning is given after 50 m and the emergency brake after another 50 m. This monitoring mode is also known as overdrive. At speeds of less than 15 km/h, the safety control can be deactivated. This is to improve the overview during racing movements. The safety control is mandatory for all tramways and adhesion tracks.

To drive traction vehicles in one-man operation could only be permitted after the large-scale introduction of electric operation in the 1920s. The safety control system was introduced in the 1920s in order to bring the train to a stop automatically when the locomotive driver was unfit for service. The locomotives used mainly for passenger and freight transport were equipped with the safety control system. Two-man operation was maintained for express trains on longer routes as well as for night trains.

Vigilance check

After several years of testing, the safety control system with vigilance control, also known as slow speed, was introduced in 1950. This is used to monitor the presence and ability to act of the locomotive drivers. For this purpose, the locomotive driver must also confirm his readiness for duty. This must be done at certain time or distance intervals. To do this, he must, for example, briefly release the pedal or actuate the drive or brake control after 500 to 1600 metres or 30 to 60 seconds (depending on the vehicle) at the latest. Otherwise the main switch is automatically switched off after another 200 metres and emergency braking is initiated. All adhesion, cogwheel and tramways must be equipped with the vigilance control. In the past, it was only required in locomotives with seated operators.