The Lesser of Two Evils: Catch Points & Trap Points Explained

Catch Points and Trap Points act as the ultimate sacrifice in railway safety. Learn why intentionally derailing a train is sometimes necessary to protect the main line from collision.

December 9, 2025 11:59 am | Last Update: March 21, 2026 8:24 am

⚡ In Brief

Catch points and trap points are safety switch devices installed in railway track that are set by default to derail any vehicle that passes them without authority — deliberately causing a controlled low-speed derailment into a sand drag or open ballast to prevent the vehicle from fouling or colliding with an occupied main line.
The core safety logic is “the lesser of two evils”: a controlled derailment at low speed at a catch or trap point, where the vehicle slides to a halt in the cess or sand drag, is infinitely preferable to the uncontrolled collision that would result if the same vehicle entered a main running line where an express passenger train is approaching at line speed.
Trap points protect against unauthorised exits from sidings, yards, and depots — preventing a train that has passed a signal at danger or a shunting movement that has exceeded its authorised limit from entering the main line. They are controlled by the signalling interlocking, set to the derailing position as the default, and cleared only when the interlocking confirms it is safe for movement to the main line.
Catch points protect against runaway vehicles on falling gradients — a wagon or train that has become detached or whose brakes have failed and is rolling backwards or forwards under gravity on an incline. They are typically spring-loaded or gravity-set to the derailing position and act without any signaller intervention, triggering automatically when an unauthorised movement passes over them.
The widespread adoption of ATP systems — TPWS and ETCS in Europe, PTC in North America — has progressively reduced the safety case for trap points at ETCS-controlled locations, since ATP enforcement prevents trains from passing signals at danger. However, catch points on gradients and trap points in freight yards and on non-ATP-equipped lines remain essential last-resort protections where technology-based prevention cannot be guaranteed.

On 11 June 1983, a freight train at Polmont, Scotland — the Stoke Summit runaway — demonstrated with tragic precision why the railway engineering principle of “the lesser of two evils” exists. A Class 47 locomotive and loaded wagons had stalled on a rising gradient and began to roll back uncontrolled. The runaway reached approximately 60 mph before striking a passenger train in the opposite direction. Thirty-one people died. The subsequent investigation found that catch points, which had been present at the location in an earlier track layout, had been removed as part of a signalling modernisation without adequate replacement protection.

The Polmont accident is not the only example of a runaway reaching a main line without interception, but it is among the most consequential in British railway history. The catch point exists precisely to intercept this scenario: to derail the runaway in a controlled, low-speed event before it can reach occupied track. The derailment is the intended outcome. The engineering decision embedded in the design of every catch and trap point on the railway network is explicit: a derailment here, now, at this speed, in this location, is better than the alternative.

The Core Safety Principle: Flank Protection

Flank protection is the safety concept of protecting the side of a train movement — ensuring that no other vehicle can enter the route on which a train is authorised to move and collide with it from the side or head-on. The three primary mechanisms for providing flank protection in modern signalling are:

Route locking: The signalling interlocking prevents any conflicting route from being set while an authorised train movement is in progress.
Overlap and approach locking: The interlocking maintains locking on adjacent routes for a defined period after a train has passed, preventing premature clearance of signals that could allow a following movement to encroach.
Physical derailment devices: Trap points and catch points provide physical, mechanical flank protection that operates independently of the signalling system — if the interlocking fails, if a driver passes a signal at danger despite ATP, or if a vehicle becomes detached and rolls without any driver, the derailment device provides the last line of defence.

The value of physical flank protection is precisely its independence from all other systems. It requires no power supply, no signaller action, no driver response, no ATP intervention. It is set by spring force or gravity to its safe (derailing) position, and it only moves to its permissive (non-derailing) position when the interlocking explicitly confirms safe conditions. If everything else fails, the trap point still works.

Trap Points: Protecting Main Line Exits from Sidings

A trap point is a switch device installed at the exit of a siding, yard, depot, or loop, set by default to deflect any vehicle attempting to exit into the main line track — onto the ballast cess beside the track. It is integrated with the signalling interlocking: the trap point is in the derailing position whenever the exit signal is at danger, and moves to the non-derailing (through) position only when the interlocking clears the exit signal for a controlled movement.

The derailment a trap point causes is deliberately designed to be low-consequence: the trap point is positioned far enough from the main line that the derailed vehicle comes to rest in the siding cess area before reaching the main running rail, and the speed at which a vehicle can reach the trap point from the normal siding position is typically low (5–15 km/h) because of the short distance available. The derailed vehicle is stopped in a controlled location where it does not foul the main line.

Trap Point Mechanism

A trap point is mechanically a simple switch — it moves a short section of rail (the switch blade) from the normal (derailing) position to the reversed (through) position when power is applied by the signalling interlocking. In the normal position, the switch blade is positioned such that a vehicle’s wheel flange hits the open end of the blade and climbs over the rail — the vehicle is deflected off the track. In the reversed position, the blade is closed against the stock rail, providing a continuous running surface for authorised movements.

Key design requirements for trap points:

Fail-safe normal position: The trap point must return to the derailing position if power is lost, if the point machine fails, or if the blade is not fully detected in the reversed position. The default is always derailment, never through movement.
Detection: The interlocking must detect that the blade is fully in the correct position before a movement over it is permitted — an incompletely reversed trap point is treated as danger.
Sand drag provision: Many trap points are followed by a sand drag — a shallow trough of sand into which the derailed vehicle’s wheels sink, providing a friction-based stopping mechanism that limits how far the derailed vehicle travels after the derailment point.

Catch Points: Intercepting Runaways on Gradients

Catch points address a different hazard from trap points: not an unauthorised exit from a siding, but a vehicle that is moving without control in the wrong direction on a gradient — either rolling backwards on an incline after a brake failure, or a detached wagon rolling forward on a descending grade.

Catch points on gradients are typically spring-loaded or gravity-operated to be in the derailing position at all times, except when a train is specifically authorised to pass over them. They require no power supply and no signaller action — they activate automatically when any vehicle passes over them in the runaway direction. A train approaching in the correct direction typically passes over them without derailment because the trailing geometry of the switch blade is configured to allow the flanges of correctly-directed wheels to pass without derailment (a “trailing” catch point); the same blade catches wheels moving in the wrong direction.

Trailing vs. Facing Catch Points

Type	Orientation	How It Catches	Effect on Correct-Direction Train	Primary Use
Trailing catch point	Open blade faces away from the direction of authorised traffic	Runaway wheels hit the open blade toe when moving against the authorised direction — flange rides over blade and derails	None — wheels pass through the blade in the trailing direction without derailment risk	Protecting against backward runaways on inclines (most common type)
Facing catch point	Blade set against the direction of runaway movement	Runaway wheel hits blade in facing direction — diverted off the main line onto catch track or cess	Train must pass over facing catch point — point must be reversed for all authorised movements; adds operational complexity	Diverting runaways off main line onto a separate catch siding or bank

Catch Points vs Trap Points: Complete Comparison

Parameter	Catch Points	Trap Points
Primary hazard	Runaway vehicle on gradient (backward or forward, no driver)	Unauthorised exit from siding, yard, or loop onto main line (SPAD or shunting overrun)
Typical location	On the incline, between the summit/base and the main line junction	At the exit of sidings, depots, loops, and goods yards where the siding connects to the main line
Normal position	Derailing — spring or gravity returns to catch position automatically	Derailing — electrically held in derailing position; only reversed on signalling authority
Activation	Passive/automatic — no power or signaller action required to catch a runaway	Active — interlocking-controlled; moves only on explicit authority
Effect on authorised trains	Trailing catch points: no effect. Facing: must be reversed for train passage	Must be reversed for all authorised exit movements; automatically returns to derailing after movement
Signalling integration	May be monitored by interlocking; facing type requires interlocking control	Fully integrated with interlocking — trap point position is a condition for signal clearance
Power dependency	None (trailing type) — spring/gravity action is power-independent	Power loss → trap remains in derailing position (fail-safe)
Relationship to ATP	Complementary — ATP cannot stop a detached runaway wagon; catch point is the only defence	Partially redundant with ATP/TPWS on SPAD scenarios, but retained as last resort at critical locations

Sand Drags: Where the Derailed Vehicle Stops

A sand drag (or sand bed) is a length of track beyond a catch or trap point filled with a deep layer of coarse sand. When a vehicle derails at the catch/trap point, its wheels (no longer on the rail) drop into the sand drag, which provides a high-friction braking medium. The vehicle sinks progressively into the sand as it decelerates, coming to rest within the drag length.

Sand drag design parameters:

Length: Calculated from the kinetic energy of the worst-case runaway at the trap/catch point location — a fully loaded wagon rolling at 15 km/h onto a sand drag requires a different length than one at 5 km/h. Typical lengths range from 20–100 metres depending on the site risk.
Sand specification: Coarse, clean sand with adequate depth (typically 300–600 mm in the running surface) to provide consistent friction without the vehicle bouncing or skipping. Sand must be kept free of vegetation, ice, and debris that would reduce its effectiveness.
Maintenance: Sand drags require regular inspection and raking to maintain the sand surface profile — a sand drag that has been compacted by a previous derailment, or frozen in winter, may not provide adequate deceleration. Regular maintenance of sand drags is a specific inspection requirement in track maintenance standards.

Historical Accidents: When Catch and Trap Points Were Absent or Failed

Incident	Year	Deaths	Catch/Trap Point Issue
Polmont, Scotland	1983	13	Catch points previously present at the location had been removed during resignalling without adequate runaway protection replacement; runaway reached main line and collided with passenger train
Tauern Express, Liezen, Austria	2000	6	Freight wagon runaway on a gradient; catch point triggered but derailed wagon’s inertia was sufficient to foul the main line despite derailment; subsequent express train struck the derailed wagon
Buizingen, Belgium	2010	19	SPAD on approach to station; ATP (TBL1) was present but had been switched off by driver; no trap point protection at the junction; train entered the main line and collided head-on with oncoming service
Quintinshill, Scotland	1915	226	Britain’s worst railway disaster; troop train stalled on main line while signaller forgot it was there and cleared express; no catch point on the siding loop exit where a second stalled train sat — the collision cascaded into five-train disaster with subsequent fire

ATP and Trap Points: Complementary, Not Competing

The widespread adoption of ATP — TPWS in the UK, ETCS across Europe, PTC in North America — has changed the risk picture that trap points were designed to address. ATP prevents trains from passing signals at danger (the SPAD scenario) by applying brakes automatically before the signal is passed. At locations with full ETCS Level 2 coverage, the probability of a train reaching a trap point in an unauthorised movement is vastly lower than on a non-ATP-equipped route.

However, ATP and trap points address the same hazard through different mechanisms, and neither renders the other fully redundant:

ATP failure modes: ATP can fail (equipment fault), be isolated (driver’s degraded mode), or be circumvented (in non-equipped areas). At these moments, the trap point — which requires no power, no software, and no driver action — remains the last line of defence.
Freight shunting: In freight yards and depots, shunting movements are typically not under full ATP supervision. The risk of an unsupervised shunting movement overrunning its limits and reaching the main line is not fully mitigated by ATP on a shunting locomotive. Trap points at yard exits continue to provide physical protection that ATP alone cannot guarantee in this context.
Detached vehicles: Catch points address a hazard that ATP cannot address at all — a detached wagon or loose vehicle rolling under gravity with no driver and no ATP-equipped locomotive. No amount of ATP deployment removes the need for catch points on gradients where this hazard exists.

Editor’s Analysis

Catch and trap points represent one of the clearest expressions of fail-safe engineering philosophy in the entire railway system. The logic is deliberately and explicitly pessimistic: assume that every other safety measure has failed, and design a physical mechanism that prevents the worst outcome under that assumption. The result is a device that trades a certain smaller bad outcome (derailment at low speed in a controlled location) for avoiding a probabilistic much worse outcome (main-line collision at full speed). This trade is correct and has been validated repeatedly in the historical accident record — both through accidents where the devices successfully performed their function, limiting damage to a manageable derailment, and through accidents where they were absent or had been removed, allowing the hazard to reach the main line with catastrophic consequences. The Polmont accident is the clearest UK example of the cost of removing catch points without adequate compensating protection. The post-Polmont investigation’s finding — that the removal of catch points during a signalling modernisation had not been properly assessed for the residual risk it created — led directly to tighter requirements for risk assessment when safety measures are removed or modified. This lesson has been learned across European and North American safety management systems: the removal of a physical safety device requires explicit demonstration that the residual risk is tolerable, not merely an assumption that modern technology makes it unnecessary. The technology may fail. The spring in the catch point does not. — Railway News Editorial

Frequently Asked Questions

Q: Do catch and trap points derail every train that hits them, or only unauthorised ones?: It depends on the type. Trailing catch points — the most common type on gradient runaway protection — are configured so that wheels passing in the authorised (correct) direction do not derail. The switch blade geometry allows flanges travelling in the correct direction to ride through without being deflected, while wheels approaching from the wrong (runaway) direction hit the open toe of the blade and are deflected off the rail. This means a train can pass over a trailing catch point in normal service without any effect. Trap points, by contrast, are in the derailing position for all movements and must be positively reversed by the interlocking for any authorised exit movement. If an authorised train exits the siding while the trap point is correctly reversed, it passes through normally. If an unauthorised movement reaches the trap point while it is in the normal (derailing) position, derailment occurs. The design principle is that authorised trains are never exposed to the derailing action — only unauthorised movements trigger it.
Q: What is a “sand drag” and how effective is it at stopping a runaway?: A sand drag is a length of track surface filled with coarse sand, positioned beyond a trap or catch point to arrest a derailed vehicle before it can travel far enough to foul the main line. When a vehicle’s wheels leave the rail at the derailment device, they drop into the sand, which provides a high-friction braking surface. The decelerating force is proportional to the drag the sand exerts on the running wheels and underframe — a fully loaded wagon at 15 km/h may require 40–80 metres of sand drag to stop completely, depending on the wagon weight and sand condition. A lighter, slower vehicle may stop in 10–20 metres. Sand drags are effective under normal conditions but their effectiveness is reduced by frozen sand (winter), compacted sand (following a previous derailment that was not cleaned up), waterlogged sand, or vegetation growth. Regular inspection and maintenance of sand drag condition is a specific maintenance requirement — a sand drag that has not been raked and inspected may not perform as designed when it is needed.
Q: Why would a railway remove catch points during a modernisation, as happened before the Polmont accident?: Catch and trap points are operationally inconvenient: facing catch points must be reversed for every authorised train movement, adding to signaller workload and journey time. Sand drags require maintenance. On a resignalled or upgraded line, removing catch points may appear to be a simplification — the new signalling system presumably prevents trains from being in the wrong place, so the physical protection seems redundant. The problem is that “presumably prevents” is not the same as “guarantees prevention.” Modern safety management frameworks require that the removal of any safety barrier be explicitly assessed: what hazard does this barrier address? What is the residual probability of that hazard occurring without this barrier? Is the residual risk tolerable, and if not, what compensating measure provides equivalent protection? Before Polmont, these questions were not always asked rigorously when physical safety features were removed during modernisation. After Polmont, the requirement for formal risk assessment of safety measure removal was embedded in British railway safety regulation — and subsequently in European rail safety management standards. The answer to “why would a railway remove catch points?” is: because they seemed unnecessary given the new technology, without a rigorous analysis of whether they actually were unnecessary. That analysis is now mandatory.
Q: Can a catch or trap point be defeated — can a vehicle pass through without derailing?: Yes — and this is a known failure mode. A vehicle travelling at very low speed over a catch point may ride over the blade so slowly that the wheel flange does not generate sufficient force to climb the blade — the vehicle may creep over the open blade without derailing, or the blade may be pushed aside rather than derailing the wheel. This is why sand drags are positioned beyond catch points rather than relying on the derailment itself to stop the vehicle: even if a slow-moving vehicle passes the catch point without derailing, the sand drag can still arrest it. Additionally, a very light vehicle (an empty wagon) may fail to derail when a heavier one would, because the lateral force generated by the wheel flange hitting the blade depends partly on the wheel load. Catch and trap point design takes the worst-case and most probable runaway speeds into account, but they are not guaranteed to function perfectly under all possible conditions — they are a final layer of protection, not a perfect barrier. This is part of why the defence-in-depth principle applies: catch points plus sand drags plus buffer stops plus operational speed restrictions on gradients together provide redundant protection that is more reliable than any single measure alone.
Q: What is the difference between a trap point and a buffer stop?: A buffer stop and a trap point address the same general problem — preventing a vehicle from travelling beyond a defined limit — but through entirely different mechanisms and in different operational contexts. A buffer stop is a physical obstruction at the end of a dead-end track (a terminus platform, a siding end, or a headshunt), designed to absorb the kinetic energy of a vehicle that travels beyond the normal stopping point. It does not derail the vehicle; it stops it by direct physical contact with the vehicle’s buffer beam or coupler. Buffer stops are at the ends of tracks — they prevent overruns past the physical end of the track. A trap point is typically at the junction between a secondary track (siding, loop, yard) and a running line, and it derails any vehicle that passes it without authority — diverting the vehicle off the rails before it can reach the main running line. Buffer stops prevent overruns on dead-end tracks; trap points prevent unauthorised exits onto main running lines. They are complementary: a siding may have both a trap point at its main-line exit (preventing unauthorised access to the main line) and buffer stops at its dead end (limiting overrun within the siding itself).