Moving - block Train Control ( HSCC 2011 ) AVACS H 4 Phase 2 July 28 , 2011

1 Description of the Model We present a model of headway control in the railway domain, as depicted in Figure 1. In this case study, continuous distributions are used. The abstraction of a guarded command with a continuous probability distribution into one with a discrete probability distribution is described in a recent publication [1]. A more extensive description of the setting plus a closely related case study containing a sampling-related bug not present in the current model appeared in a different publication [4]. In contrast to fully automated transport, which is in general simpler to analyse (as the system is completly under control of the embedded systems) our sample system implements safeguarding technology that leaves trains under full human control provided safety is not a risk. It is thus an open system, giving rise to the aforementioned analysis problems. Our model implements safe interlocking of railway track segments by means of " moving block " principle operation. While conventional interlocking schemes in the railway domain fully lock a number of static track segments, the moving block principle enhances traffic density by reserving a smoothly moving " moving block " ahead of the train. This block is large enough to guarantee safety even in cases requiring emergency stops, i.e. has a dynamically changing block-length depending on current speed and braking capabilities. There are two variants of this principle, namely train separation in relative braking distance, where the spacing of two successive trains depends on the current speeds of both trains, and train separation in absolute breaking distance, where the distance between two trains equals the braking distance of the second train plus an additional safety distance (here given as sd = 400m). We use the second variant, as also employed in the European Train Control System (ETCS) Level 3. Our simplified model consists of a leader train, a follower train and a moving-block control regularly measuring the leader train position and communicating a related movement authority to the follower. The leader train is freely controlled by its operator within the physical limits of the train, while the follower train may be forced to controlled braking if coming close to the leader. The control principle is as follows: 1. 8 seconds after communicating the last movement authority, the moving-block control takes a fresh measurement m of the leader train position s l. This measurement 1