Abstract: A pair of on-board processing units, operating in parallel, are supplied with input signals representing actual train speed, advance traffic conditions, and selected train parameters. Each unit continuously calculates a maximum train speed from which emergency braking will stop the train within the indicated clear track distance ahead. Each unit also compares the calculated maximum speed with actual train speed and emits a preselected distinctive frequency signal or a d.c. signal as actual speed is less than, or equals, or exceeds maximum speed, respectively. A logic network with parallel filter-rectifier circuit paths passes the unit outputs, if of the preselected frequencies, to a two-input AND gate whose output holds emergency braking released. If a preselected frequency output is absent from either or both units, due to actual speed equaling or exceeding maximum speed or to a fault condition in the apparatus, the corresponding lack of an AND gate output actuates emergency braking.