How secure is ERTMS?

This paper reports on the results of a security analysis of the European Railway Traffic Management System (ERTMS) specifications. ERTMS is designed to be fail-safe and the general philosophy of ‘if in doubt, stop the train’ makes it difficult to engineer a train accident. However, it is possible to exploit the fail-safe behaviour of ERTMS and create a situation that causes a train to halt. Thus, denial of service attacks are possible, and could be launched at a time and place of the attacker’s choosing, perhaps designed to cause maximum disruption or passenger discomfort. Causing an accident is more difficult but not impossible

In loco intellegentia: Human factors for the future European train driver

The European Rail Traffic Management System (ERTMS) represents a step change in technology for rail operations in Europe. It comprises track-to-train communications and intelligent on-board systems providing an unprecedented degree of support to the train driver. ERTMS is designed to improve safety, capacity and performance, as well as facilitating interoperability across the European rail network. In many ways, particularly from the human factors perspective, ERTMS has parallels with automation concepts in the aviation and automotive industries. Lessons learned from both these industries are that such a technology raises a number of human factors issues associated with train driving and operations. The interaction amongst intelligent agents throughout the system must be effectively coordinated to ensure that the strategic benefits of ERTMS are realised. This paper discusses the psychology behind some of these key issues, such as Mental Workload (MWL), interface design, user information requirements, transitions and migration and communications. Relevant experience in aviation and vehicle automation is drawn upon to give an overview of the human factors challenges facing the UK rail industry in implementing ERTMS technology. By anticipating and defining these challenges before the technology is implemented, it is hoped that a proactive and structured programme of research can be planned to meet them

Technology transfer: Transportation

The application of NASA derived technology in solving problems related to highways, railroads, and other rapid systems is described. Additional areas/are identified where space technology may be utilized to meet requirements related to waterways, law enforcement agencies, and the trucking and recreational vehicle industries

Passenger Flows in Underground Railway Stations and Platforms, MTI Report 12-43

Urban rail systems are designed to carry large volumes of people into and out of major activity centers. As a result, the stations at these major activity centers are often crowded with boarding and alighting passengers, resulting in passenger inconvenience, delays, and at times danger. This study examines the planning and analysis of station passenger queuing and flows to offer rail transit station designers and transit system operators guidance on how to best accommodate and manage their rail passengers. The objectives of the study are to: 1) Understand the particular infrastructural, operational, behavioral, and spatial factors that affect and may constrain passenger queuing and flows in different types of rail transit stations; 2) Identify, compare, and evaluate practices for efficient, expedient, and safe passenger flows in different types of station environments and during typical (rush hour) and atypical (evacuations, station maintenance/ refurbishment) situations; and 3) Compile short-, medium-, and long-term recommendations for optimizing passenger flows in different station environments

Maximum risk reduction with a fixed budget in the railway industry

Decision-makers in safety-critical industries such as the railways are frequently faced with the complexity of selecting technological, procedural and operational solutions to minimise staff, passengers and third parties’ safety risks. In reality, the options for maximising risk reduction are limited by time and budget constraints as well as performance objectives. Maximising risk reduction is particularly necessary in the times of economic recession where critical services such as those on the UK rail network are not immune to budget cuts. This dilemma is further complicated by statutory frameworks stipulating ‘suitable and sufficient’ risk assessments and constraints such as ‘as low as reasonably practicable’. These significantly influence risk reduction option selection and influence their effective implementation. This thesis provides extensive research in this area and highlights the limitations of widely applied practices. These practices have limited significance on fundamental engineering principles and become impracticable when a constraint such as a fixed budget is applied – this is the current reality of UK rail network operations and risk management. This thesis identifies three main areas of weaknesses to achieving the desired objectives with current risk reduction methods as: Inaccurate, and unclear problem definition; Option evaluation and selection removed from implementation subsequently resulting in misrepresentation of risks and costs; Use of concepts and methods that are not based on fundamental engineering principles, not verifiable and with resultant sub-optimal solutions. Although not solely intended for a single industrial sector, this thesis focuses on guiding the railway risk decision-maker by providing clear categorisation of measures used on railways for risk reduction. This thesis establishes a novel understanding of risk reduction measures’ application limitations and respective strengths. This is achieved by applying ‘key generic engineering principles’ to measures employed for risk reduction. A comprehensive study of their preventive and protective capability in different configurations is presented. Subsequently, the fundamental understanding of risk reduction measures and their railway applications, the ‘cost-of-failure’ (CoF), ‘risk reduction readiness’ (RRR), ‘design-operationalprocedural-technical’ (DOPT) concepts are developed for rational and cost-effective risk reduction. These concepts are shown to be particularly relevant to cases where blind applications of economic and mathematical theories are misleading and detrimental to engineering risk management. The case for successfully implementing this framework for maximum risk reduction within a fixed budget is further strengthened by applying, for the first time in railway risk reduction applications, the dynamic programming technique based on practical railway examples

Study on a New Train Control System in the IoT Era: From the Viewpoint of Safety2.0

Safety2.0 which advocates cooperative safety is attracting attention. Assuming that Industry4.0 proposed by the German authorities is an IoT-based production revolution, Safety2.0 is a Japanese-originated proposal that seeks to create a more flexible and sophisticated safety by introducing Internet of Things (IoT) into production sites. This chapter introduces the concepts of Safety2.0 and its spread internationally, focusing on the activities of IGSAP, a Safety2.0 promoter. Furthermore, we look back on the conventional train control from the viewpoint of Safetyx.x and look at the appearance of the train control suitable for Safety2.0 using IoT. As a result, in this chapter, we propose a simple and smart train control system unified train control system (UTCS), in which a train control system is realized in a hierarchical structure of a logic layer, a network layer, and a terminal layer, and discuss its processing method

A system architecture for a planetary rover

Each planetary mission requires a complex space vehicle which integrates several functions to accomplish the mission and science objectives. A Mars Rover is one of these vehicles, and extends the normal spacecraft functionality with two additional functions: surface mobility and sample acquisition. All functions are assembled into a hierarchical and structured format to understand the complexities of interactions between functions during different mission times. It can graphically show data flow between functions, and most importantly, the necessary control flow to avoid unambiguous results. Diagrams are presented organizing the functions into a structured, block format where each block represents a major function at the system level. As such, there are six blocks representing telecomm, power, thermal, science, mobility and sampling under a supervisory block called Data Management/Executive. Each block is a simple collection of state machines arranged into a hierarchical order very close to the NASREM model for Telerobotics. Each layer within a block represents a level of control for a set of state machines that do the three primary interface functions: command, telemetry, and fault protection. This latter function is expanded to include automatic reactions to the environment as well as internal faults. Lastly, diagrams are presented that trace the system operations involved in moving from site to site after site selection. The diagrams clearly illustrate both the data and control flows. They also illustrate inter-block data transfers and a hierarchical approach to fault protection. This systems architecture can be used to determine functional requirements, interface specifications and be used as a mechanism for grouping subsystems (i.e., collecting groups of machines, or blocks consistent with good and testable implementations)

Evaluating non-functional qualities in railway by applying the quality triage method - A case study

The railway industry is undergoing modernization and development with increasing use of new technology and digitalisation. In addition to physical security requirements, systems need to be secured against cyberattacks from outsiders. In addition, there are other quality requirements like scalability, reliability, availability, and sustainability that need attention. This paper presents results from testing the quality triage method, which has its origin from software development, on railway projects. The quality triage method aims to balance several quality requirements for decision making in development projects. Cybersecurity is an example of these quality requirements. A discussion of cost elements and benefits from applying the method within the railway domain has been outlined. As a main conclusion, the authors see new opportunities of addressing quality requirements more explicitly in projects by applying the quality triage approach to railway projects.publishedVersio

Electronics in the on-line control of railway movements: quantitative aspects

The present thesis is concerned with a quantitative examination of the on-line control of railway movements and develops a mathematical technique for the evaluation of safety based on the use of Markov processes, illustrated with examples. In addition, the thesis presents a design methodology applicable to electronic safety systems. These systems are shown to be an essential element in the development of fully electronic railway signalling systems, as well as in the increased automation of railway movements. An analysis of the limits of automation of railway movements is described and discussed together with a possible system configuration for the achievement of crewless train operation. The research described herein has been carried out at the British Railways R & D division and the methods described have been successfully applied to real engineering problems. The industrial R & D background of the present thesis is also reflected in the inclusion of a section on the socio-economic consequences of major innovation, particularly in the field of automation and in the consideration of costs and benefits. Section 2 contains an approach evolved jointly with Mr. W.T. Parkman, also at the R & D Division of British Railways, and has been published as Reference 16. Section 5 is a short description or the work carried out by the group under the direct responsibility of the author at the R & D Division of British Railways