Formal Assurance of Signaling Safety: A Railways Perspective

Introduction

Railway signaling has been one of the most well studied safety critical systems for nearly two centuries. During this period, the notion of railway signaling has evolved in various ways, including the protocol for signaling, the technology used for implementing the signaling system, and most importantly the way in which safety guarantees are assured. The very early form of signaling relied on temporal separation of trains, which was primarily implemented by setting up time tables that ensured that two trains never shared a track at the same time. With the increase in railway traffic, it became necessary to divide the tracks into segments (or blocks), thereby giving birth to the notion of block signaling, where one or more trains can be on the same track, but on different blocks – which effectively means that the trains are spatially separated. Signals guard the entry of the block and implement the spatial separation.

Railway yards also have points where two tracks intersect. The point setting determines whether the train will continue to move on the same track or whether it will move into the intersecting track. A complex yard may contain many points, with the tracks crisscrossing each other, which significantly increases the complexity of ensuring that a train can safely move from one track to another possibly passing through several intermediate tracks. In signaling parlance such complex passages are called routes. A railway yard can have hundreds of routes, and the signaling system must ensure that conflicting routes are kept free when a train is passing through a route. This is achieved by a mechanism called interlocking.

In the past railway interlocking was primarily manual. The hand-operated point levers shown in Figure 1 are reminiscent of the times when point positions were changed manually using such levers. The interlocking system, implemented using electrical relays, would ensure that signal aspects change only when points are in proper position.

Figure 1.

A point (left) and hand-operated point lever (right)

In recent times, railways use electronic interlocking, where the signals and point positions are controlled by software running on an electronic interlocking (EI) system. Such computer controlled systems are designed to adhere to the signaling standards. Once configured properly with respect to a specific railway yard, they continue to work reliably over time and are not subject to human errors.

The primary concern with EI equipment is in determining with absolute certainty that the system configuration is correct, and that given a correct system configuration, the software is guaranteed to never err in signaling decisions. In current practice this verification task is performed using a high level of certification of the software and through rigorous testing of the configured equipment.

In spite of the best practices followed in configuring and testing of EI equipment, there are known instances of failures resulting out of human errors in the design of the logic for the EI equipment. The following two incidents may be highlighted: