> In the late 70s, I worked with a former Assistant Professor of Economics from Hayward.
> He told me a remarkable story (perhaps apocryphal) that the when first installed, the
> "fail-safe" mode for the BART signal system was "all green." Can anyone confirm or
> refute that story?

I did have much involvement with BART back in those days. But I am unclear as to what would be meant by a failsafe "Mode", as "Failsafe" is not an optional feature to be turned on or off, but a absolute full time requirement. I will do my best to answer, however.

Also, in those days, BART did not use wayside signals at all on the main track, relying instead solely upon automated controls with no cab signals either. They seem to have since wised up somewhat, now providing the cab signal indication in the form of a maximum speed limit (pure speed signalling); while new interlocking installations are now provided with wayside signals. As was once the case on some eastern railroads, intermediate signals are not used, being supplanted entirely with cab signals.

The word "Failsafe" symbolizes one of those problematic concepts that cannot be understood without a well structured frame of reference. If you ask most aerospace engineers what it means, they will deny it exists. They rely solely on calculated probabilities instead. If you ask most industrial control engineers, they accept merely "robust design" to be sufficient. The concept of "Failsafe" is accepted fully, only by railroad signal and train control engineers. And since nothing man does can ever become absolute, it could be considered a bit of a stretch even there.

For the "Failsafe" concept to exist in the practical world, there must be an inherently safe position to retreat towards whenever a failure occurs. In the case of the aerospace industry, their position is fully justified within that industry, as no such safe default exists for an airliner already in flight. Probability is all they have.

But in the railroad industry, the train can always be stopped, the switch can always be NOT moved, the drawbridge simply stays put, the signal stays red, or falls to the red, due a sudden failure to continuously prove the safety of a less restrictive aspect.

Fail-safety comes then, from understanding all the ways an electrical or mechanical apparatus might fail, and designing accordingly, so that each possible failure represents a more restrictive indication, rather than a less restrictive one. Thus a less restrictive indication can happen only when no inhibiting failures are present.

From its inception (after the Diablo Test Track days), BART used a definition of "Failsafe" similar to the railroad industry in general, that being that no failure shall result in a less restrictive aspect than is safe.

In BART's early application, it meant that no single point of failure could be allowed to result in a hazard. But in practice, that proved to be not good enough, nor was it up to snuff with the rest of the rail industry; which required that "No annunciated failure, alone or in combination with any number of latent failures, nor any latent failure in combination with any other latent failures, shall result in a less restrictive indication than is safe". BART now uses this very tough standard as well. (an annunciated failure is one where a symptom is obvious and noticeable - a latent failure presents no apparent symptoms whatsoever, but is nevertheless a subtle circuit fault)

As to your question:

From the beginning, BART operated its interlockings the same as the rest of the American rail industry. Signals / cab aspect remain at stop unless specifically actuated to the proceed position. Standard relay interlocking designs were used, complete with standard APBS traffic controls between successive control points.

Though the hardware is rather unique and in many ways poorly designed by the vendor, between interlockings, BART uses a series of audio frequency track circuits from one CP to the next, arranged functionally as a multi-aspect automatic block signal system. As such, signals will automatically clear in the set direction as each train clears the blocks ahead. No intermediate wayside signals are present, as cab signal aspects in the form of maximum speed indications are continuously picked up off the rails, displayed in the cab, and automatically enforced to the letter. Overspeed protection and civil speed limit (curve restrictions) enforcement is also provided.

I know of no case where the default ever was "Green", or any other non-zero cab aspect. In all cases, a less restrictive aspect, requires continuous electrical and mechanical proof that it is safe to display it in order to physically maintain it.

Due to inadequate braking distances allowed in the original vendor design at BART's beginning, BART had to redesign and "re-space" the signaling. During the time it took to accomplish this, BART used an old fashioned manual block system as an overlay, complete with manned block stations, station to station phones, manual block lights, train sheets, and exacting procedures. But even these signals only lit green while the buttons were held down. They returned to red as soon the button was released. Manual blocks were dropped as soon as BART's own forces completed the re-signalling.

I hope this properly answers the question.

OPB