6060COMP Real Time Systems

An In-Cab Railway Signalling System:

Analysis, Specification and Design with the Unified Modelling Language

Outline of Problem

Overview: you are required to specify behaviour for a new system of in-cab railway signalling. From a driver’s perspective, rather than receiving signal instructions from lineside semaphore or lamp/LED signals, they will now receive them directly to a panel in their cab. It will also report the maximum permissible speed for current line conditions and the train they are driving. A subsystem, known as a Train Controller, is to be installed in every train. It must broadcast certain details about the train in which it is installed, receive information from other devices (including other train controllers), and report some of this information to the driver. Indications available to the driver will be:

Clear – the train can proceed at maximum linespeed (indicated)

Caution – the driver should slow the train to the speed indicated  Stop – the driver should stop the train immediately

In-Cab / Driver Indications: Ordinarily, the driver receives a Clear signal indication. Linespeed is adjusted in accordance with safety concerns, and to manage congestion with other trains on the same route. Reductions in linespeed to manage congestion will be indicated by a Caution signal, and a new lower linespeed being displayed to the driver. In times of severe congestion, such as entering a busy station or goods yard, the driver will be instructed to bring the train to a complete halt by a Stop signal, usually following a period of caution signals with gradually reducing linespeed. Additionally, engineering and maintenance works may require lower linespeeds, or trains to stop entirely, which will be indicated to the drivers using these same in-cab signals.

In emergency situations, all trains in a particular area can be instructed to come to a complete halt (e.g. a car stuck on a level crossing). In these emergency situations, the driver’s in cab signalling will change directly to Stop (i.e. without transitioning through Caution and speed reductions) and sound an alarm.

In-Cab Alerts, Acknowledgements and Lock-out: The system is expected to automate a degree of safety-related functionality. It should sound an audible alarm under the following circumstances:

• Every 30s, the system should sound a short bell tone; to which the driver is expected to acknowledge. If the driver does not acknowledge it within 5s, the alarm should escalate to a continuous horn tone. If the driver still does not acknowledge within a further 5s, the system should enter lock-out
• If the train’s speed is above the specified linespeed, it should sound an intermittent horn tone, which continues until the train is brought to, or below, the indicated linespeed. If the train’s speed remains above linespeed for more than 10s without a brake application, the alarm tone should become continuous. If the train’s speed remains above linespeed for a further 10s, the system should enter lock-out
• If the train is instructed to stop immediately in an emergency, an audible klaxon-type signal should sound. If the driver does not apply the emergency brake within 2s, the system should then enter lock-out

In lock-out mode, the train should sound a two-tone audible alarm in the cabs, automatically apply its emergency brake, and lock-out the driver’s controls to prevent the train from being restarted. The controls can only be reactivated by a reset control in the opposite end driving cab.

Routes: a train’s assigned route across points/junctions and into specific sidings or platforms is controlled by Network Control. The assigned route is communicated to the train, but cannot be altered by it. Different sections of the route may have different associated maximum linespeeds, depending on the condition of the track, or whether the route goes ahead or diverges at points/junctions. Ordinarily, a train’s route will be set at the start of its journey, but may be varied during the journey if the planned route is obstructed. Changes occurring in a planned route requires immediate notification; a changed linespeed or trains further ahead on the new route may require a driver alert.

Normal operation and communication with other systems is to be managed as follows:

1. The train receives linespeed information from trackside transponders, which gives a maximum safe speed for the current track section. At junctions in the railway, one transponder will provide a safe speed for the straight route, and another, usually lower speed, for the diverging route.
2. This information is filtered by the train controller to include only those transponders relevant to the train’s specified route, then further adjusted by a train-specific coefficient (i.e. based on its hauled weight and stopping ability), and is reported to the driver with no further adjustments when the route is clear ahead.
3. Each train should constantly broadcast a unique identifier, along with: its current linespeed, length, specified route, current position, and whether it is maintaining its speed, or accelerating/decelerating.
4. These broadcasts are received by all other trains in the vicinity. This is factored into calculations for safety and managing congestion, as follows. In each of these scenarios, train A is following another train, called train B, both of which are presently on the same route. It is the operation of train A's control system that is being described:
5. Train A’s linespeed is used to calculate a distance equivalent to 30s forward travel (this is the train’s “safety zone”), and 240s forward travel (the train’s “interface zone”).
6. When the interface zone is clear, the driver should receive a Clear signal, and appropriate linespeed, as in Steps 1/2.
7. When train A’s interface zone is occupied by any portion of train B, the driver should receive a Caution signal. If both trains are travelling at the same speed, this is all that is required.
8. If train B speeds up and exits train A’s interface zone, the train A’s signal should return to Clear. Similarly, if train B diverges onto a different route to train A, train A’s signal should return to Clear.
9. If train B is travelling slower than the following train, train A should indicate a revised lower linespeed to the driver that will enable the current separation to be maintained (i.e. usually the linespeed of train B).
10. If train B alters speed, then train A’s linespeed indicator should adjust to maintain the current separation.
11. If train B slows to a halt, train A’s linespeed indicator should indicate it should gradually slow until it reaches 50km/h, compressing the interface zone. Train A can continue to move forward at this speed until train B is in train A’s safety zone.
12. At the point the safety zone is breached, train A should slow to 30km/h, and is allowed to travel towards the stopped train B. It should receive a stop signal in time to halt the train with a minimum of 5m separation.
13. From stopped, train A should continue to receive a stop signal until the route is clear for 1km ahead. It is then allowed to proceed, in accordance with the safety and congestion management rules outlined above.

Special instructions:

in addition to information from other train controllers, each train can receive special “do not proceed” or “emergency stop” information from a variety of other sources on the railway; including:

• evel crossings (which will send this signal unless their road barriers are down and warning lights are flashing),
• Engineering crews (who carry their own transponders to ensure their safety), and
• stations and goods yards (which send this signal if the train’s destination platform or siding is occupied).

The precise behaviour of these external systems is outside of the scope of this work, but it should be assumed that the information transmitted can be directed to specific trains (i.e. only trains to which the message is relevant will receive it) and will include at a minimum: the location of the source and the type of source, and whether the instruction has been issued as an emergency.

The sources should be treated as if they are a stopped train as described above if the instruction is “do not proceed”, or in accordance with the emergency scenario, if the instruction is “emergency stop”

Detail of Questions

Perform analysis and design of the Train Controller from the In-Cab Signalling System using UML, and document all results obtained from each of the following tasks:

1. Requirements analysis including:

1. A clear statement of assumptions made, along with justifications. You should include requirements you’ve omitted because they conflicted or weren’t consistent.
2. A full use case diagram, and formal descriptions of all use cases on the diagram.
3. A list of candidate objects, classes and their responsibilities.
4. An object sequence diagram (OSD) for the normal scenario of each use case identified in 1(b).
5. A class diagram, including operations / methods where relevant.
6. State machine diagrams for all identified classes with operations.

2. System design including:

1. A system wide communication diagram
2. Activity diagram(s) for the normal operation of the Train Controller
3. Timing Diagram for the in-cab alerts / acknowledgement scenarios
4. Component Diagram for the system software architecture