Runtime verification of train control systems with parameterized modal live sequence charts

The CTCS-2 train control system of high speed railway is a typical safety-critical system.In term of the characteristic of safety-critical system and with analyzing the requirements of safety test and evaluation of the CTCS-2 train control system of high speed railway the test script language-SED_TSL was designed which driven by scenarios and events.Then the functions system architecture and test strategy of the test environment for the CTCS-2 train control system of high speed railway were proposed the automatic test environment of CTCS-2 train control system based on the SED_TSL was implemented.The automatic test environment was used for standard testing of the product in the train control system and implementing effectively the functional and safety test of the product of train control system.

Requirements-based testing is one of the most commonly used ways to ensure the correctness of software, especially for embedded control software in safety-critical domains such as spacecraft and railway systems. Many industrial standards such as the DO-333 and EN50128 also request rigorous requirements-based software testing. To test embedded control software effectively and efficiently, generating high-quality test cases automatically is extremely important. However, existing methods for generating test cases from requirements require intensive manual efforts and expertise. To address this problem, we proposed an automatic requirements-based software testing method for embedded control software. To obtain automatic test case generation and precise test oracles derivation, requirements specification should be precise and readable for the industrial practitioners. Therefore, we use the light-weight domain-specific formal description language, CASDL (Casco Accurate Specification Description Language) for the industrial practitioners to define software requirements into formal specifications at the first step. Based on the formal specification, we propose an algorithm to automatically generate test inputs that satisfy the MC/DC criteria suggested by typical industrial standards and precise test oracles can be derived by "running" the specification with such test inputs. To this end, we proposed an algorithm for simulating the formal specification to generate the test oracles, i.e., the expected outputs corresponding to the test inputs. To facilitate the application of this method in the industry, we have built a tool that can automatically perform the overall testing process. To validate and evaluate its effectiveness in real industrial projects, we have applied it in testing a real Automatic Train Protection (ATP) system provided by our industrial partner, the Casco Signal Co., Ltd (one of the largest railway control system companies in China). In the case study on ATP requirements, our approach generated test cases for 129 requirement items following MC/DC criteria and caught 40 inconsistencies between Casco's requirements and implementation.

Dependability in open proof software with hardware virtualization—The railway control systems perspective

The nuclear heating reactor (NHR) is a typical integral pressurized water reactor (iPWR) developed by the institute of nuclear and new energy technology (INET) of Tsinghua University, which has the safety advanced features such as the primary circuit integral arrangement, full-range natural circulation, self-pressurization. Power-level control is crucial for the operational stability and efficiency of the NHR, and the dynamic modeling is a basis for control system design and verification. From the conservation laws of mass, energy and momentum, a lumped-parameter dynamical model is proposed for the nuclear steam supply system (NSSS) based on the 200MWth nuclear heating reactor II (NHR200-II). The steady-state model validation is given by the comparing the parameter values of this model and that for plant design. Then, both the open-loop responses under the disturbances of reactivity and coolant flowrates as well as the closed-loop responses under the case of power ramp are given, where the rationality of the responses are analyzed from the viewpoint of plant physics and thermal-hydraulics. This model can be utilized for not only the control system design but also the development of a real-time simulator for the hardware-in-loop control system verification.

At present, the EN50121 standards are the main reference for electromagnetic compatibility in European railway systems. These standards should improve as technology and testing develops. Therefore, major sources of EMI in a railway environment need to be better understood. This study is complex because many different railway power systems exist in Europe (1.5 kV DC, 3 kV DC, 15 kV 16.7 Hz, 25 kV 50 Hz). European railways are using new control and communication systems, and electromagnetic compatibility problems should be carefully studied and solved.

This paper describes how railway signaling systems are computerized equipment that are vital for the guarantee of the safe running of trains. Because of the computerization of railway signaling systems, the importance of a networking interface between these pieces of equipment is increasing. Thus, it is important to have a reliable and safe communication link between signaling equipment. Recently, network technologies have been applied in a real-time industrial control system, and also there are several studies applying computer network technology in vital control systems such as railway signaling systems. To deploy these computer network related studies in railway signaling systems, implementation costs, transmitted reliability, safety assurance technique and compatibility etc, are considered. The computer network protocol for railway signaling systems has an important advantage over the widely used Ethernet in terms of deterministic characteristics. This paper proposes computer network technology, especially the Ethernet, for railway signaling systems. The computer network characteristics of real-time industrial control systems and vital railway signaling systems are presented in this paper. This algorithm presented is based on switched Ethernet technology with a redundancy scheme. Also the paper demonstrates the experimental results of the proposed network algorithm.

The high speed railway wireless communication system is quite different from public wireless communication system, because the service is train control message, which are closely related to the safety of train transportation. Thus it has much higher requirements for the safety and reliability. In this paper, secrecy capacity and outage probability at the high speed railway scenario with traditional MIMO and beamforming schemes are analyzed. The analytic results show that MIMO scheme can not meet the safety requirements and the beamforming scheme is also helpless while the eavesdropper is close to eNodeB. In order to guarantee the transmission safety of train control messages, a physical layer secure scheme with artificial noise (AN) is proposed for high speed railway communication system. In this proposed scheme, beamforming and AN transmitting directions are adjusted accordingly with the onboard legitimate receiver's channel state information (CSI) and eavesdropper's partial CSI to degrade the eavesdropper while maximize the system secrecy capacity. Simulation results demonstrate the proposed scheme decreases the outage probability under the secrecy capacity constraint, and can meet the safety communication requirements.

Natural language in the maintenance data of high speed railway system is the big challenge for the fault diagnosis due to its unstructual feature and uncertainty semantics. In this paper, a text mining based fault diagnosis method for vehicle on-board equipment (VOBE) of high speed railway has been proposed, in which, the topic model is used to extract the fault feature from the maintenance records with the arbitrary nature. In addition, a Bayesian network (BN) is also used to adapt the uncertainty and complexity of fault diagnosis of VOBE. Furthermore, a method that fully utilizes domain expert knowledge and data is presented to derive an appropriate BN structure for VOBE. At last, the correctness and accuracy of the proposed method has been verified by the real data from Wuhan-Guangzhou high speed railway signaling systems.

The convergence of network, electronic, and control technologies has expanded the attack surface of industrial control systems (ICSs), necessitating the integration of functional safety and cybersecurity. Existing methods often treat safety and security as isolated domains, overlooking their interdependence in modern ICSs. This article proposes a novel methodology, Process-Oriented and Coalescent Analysis (POCA), to bridge this gap through an integrated safety and security analysis. Unlike previous approaches, POCA focuses on the intersection of cyberthreats and functional interactions, offering a new perspective on threat modeling. Applied to a railway signal system, a representative ICS that has received insufficient attention in cybersecurity research, POCA incorporates cyberattack scenarios, system service processes, and safety constraints to identify and assess risks. The analysis results highlight POCA’s effectiveness in uncovering vulnerabilities at the intersection of functional safety and cybersecurity, providing actionable insights for system design and operation.

In rail transport, increasing emphasis has been placed in recent years on improving safety levels. Therefore, more requirements and legal documents require risk analyses to be carried out at various stages of investment implementation. One of the leading legal documents that introduce the obligation to monitor risk is Directive (EU) 2016/798 of the European Parliament and of the Council of 11 May 2016 on railway safety and Commission Implementing Regulation (EU) No 402/2013 of 30 April 2013 on the common safety method for risk evaluation and assessment and re-pealing Regulation (EC) No 352/2009. Additionally, for traffic control systems, the requirements of CENELEC standards are mandatory. These documents present the subject of safety level and show its relation with the safety targets defined in the railway system, including the different ways of measuring them. Methods are also available to analyse the safety level of railway system components in detail, both at the level of individual components, subsystems, and the whole national railway system. However, after conducting an in-depth analysis of the literature, the authors of the article indicate that these methods are not consistent with each other. There is no method defined to present the direct relation of the safety level of the components of the system on the achievement of safety targets for the national railway system. The research and analysis aimed to define an approach, a method that would meet all legal requirements but at the same time would allow to clearly and reliably determine the safety level of the railway system. To define a unified approach, the authors of the article propose to develop a model of a dynamic object - a railway system safety model, which has also been verified on accurate safety data in rail transport in recent years. This model organises the process of safety management on railways and allows to determine values influencing the achievement of safety targets on an assumed level.

Markets and the technologies have been rapidly changing and advancing. User requirements have been diversified and unpredictable. Under these evolving situations, an autonomous decentralized system (ADS) was proposed for resolving the on-line property to achieve step-by-step expansion, maintenance/test and fault-propagation prevention without stopping the entire system. Research and development has been accelerated in the world not only for control systems but also for wide-area information systems. In China, ADS activities are especially promoted in railway systems. Here as examples, a railway ground-control system and a train on-board-control system, where each of the railway stations and trains has autonomy to regulate the trains through coordinating mutually, are shown to be electively operated.

Preliminary risk analysis (PRA) is a methodology used in critical systems safety studies. It is primarily used at the preliminary stage of the system's design so as to determine the scenarios of potential accidents, to evaluate their probabilities of occurrence (frequency) as well as the severity of the resulting consequences and to propose solutions (preventive and/or mitigative safeguards) in order to reduce the risk level in terms of severity/occurrence (to reduce the frequency of the contributors or reduce the severity of the accident). The preliminary risk analysis was largely used in several industrial fields (aeronautics, weapons systems, chemistry, railway...) in order to study the safety of the systems. From one field to another, from one expert to another, many extremely different approaches and methods are used to carry out this analysis. Moreover, the formats representing the results of the PRA are often varied as well as the terminology and the concepts related to the PRA. The main goal of this paper, completed within the framework of project ANR-PREDIT-SECUGUIDE[1], is to propose a PRA method and to determine standard contents of PRA to be used in the context of the railway systems. [1] ANR-PREDIT-SECUGUIDE is a project financed by the National Agency for Research - France (http://www.agencenationale- recherche.fr) which began in January 2006 per 3 years duration. The project aims to study the impact of introducing the NICT into the railway systems on safety

Railway control systems are based on on-board and trackside subsystems for signaling purposes. Several factors demand for new design and implementation solutions for such railway control systems. These factors are related to the design of interoperable railway networks in Europe, the introduction of new technologies and equipment, and the competition in the market of railway products. The safety of such new design and implementation solutions should still be proved in accordance with the CENELEC recommendations. SFDA, safe message freshness detection algorithm among trackside subsystems, is deeply described. SFDA is included in a new message passing safety protocol stack and it allows the detection of messages and the meeting of real time and safety requirements of trackside railway systems. It is demonstrated that the SFDA can detect all the old messages. Moreover a preliminary analysis of its availability characteristics to check whether it is suitable for railways systems is performed through simulation.

In this paper, the problem of fast time-varying channel prediction is investigated in high-speed railway communication systems. A channel prediction algorithm is proposed based on a support vector machine (SVM) model. In order to further improve the prediction accuracy, the penalty coefficient and Gaussian kernel width of the SVM model are optimized by a genetic algorithm (GA). Simulation results show that the proposed prediction model based on both the SVM and the GA (SVM-GA) has lower prediction error than traditional auto-regressive (AR) and single SVM prediction models. In addition, when the effect of the noise on prediction performance is considered, the SVM-GA prediction model is superior to the AR and the SVM models in terms of normalized mean squared error.

Safety is a concerned point in today’s railway control system. Historical evidence on railway control system failure makes a matter of concern on safe control system. In this paper, we present a use/misuse case based safety framework for a railway control system with integrated safety analysis. The framework comprises of two major processes i.e. use/misuse case based requirements modelling and application of integrated safety analysis techniques. First, the use case and misuse case specification analyze all the system function and identify possible failures. Second, integrated safety analysis techniques evaluate the specification, identify hazards and propose the mitigations. This paper analyses the railway control system reliability using Unified Modeling Language (UML) and followed by integrated safety analysis techniques such as Hazard and Operability Study (HAZOP) and Fault Tree Analysis (FTA). This approach has been systematically applied to study two different domain in system reliability and system control based on human interaction. We demonstrate how an applicability of UML specification is integrated with safety analysis techniques for the development of safe railway control system.