1 Satisfiability Testing in the Railway Industry Simon Chadwick Head of Research Westinghouse Rail Systems Limited, Chippenham, UK SAT2009 Twelfth International Conference on Theory and Applications of Satisfiability Testing

2 Contents Introduction Railways and Safety The Story of Signalling Where Signalling meets SAT Some final thoughts

3 Introduction WRSL Westinghouse Rail Systems Limited Part of Invensys Rail Group Part of Invensys plc

4 Introduction

5

6 Railways and Safety First railway? Stockton & Darlington Railway Opened 27 th September 1825

7 Railways and Safety First railway accident? William Huskisson ( ) Killed during the opening of the Liverpool and Manchester Railway, 15 th September 1830.

8 Railways and Safety Incremental rule building Accident Investigation Changes Improvement Apply for 150 years:

9 Railways and Safety Causes of Accidents Many causes: –Civil engineering failure –Failure of train –Failure of operators –Failure of signalling system

10 Railways and Safety Railway Signalling assumes… Rails intact Civil engineering intact Trains intact

11 Contents Introduction Railways and Safety The Story of Signalling Where Signalling meets SAT Some final thoughts

12 To maintain the safety of trains by: 1.Maintaining a safe distance between following trains on the same track 2.Safeguarding the movement of train at junctions and crossings 3.Regulating the passage of trains according to service density and speed required 4.Ensuring safety of trains in the event of equipment failure The Story of Signalling What is signalling for?

13 STOP PROCEED The Story of Signalling Early Signalling

14 Regulation of train by time Controlled by Policemen No standard time Electrical Telegraph Block Instrument Absolute Block Working The Story of Signalling Time Interval Working

15 The Story of Signalling Semaphore Signals

16 Block Section Station Limits Signal Box Distant Signal Home SignalStarter Signal Direction of travel Station Block Section The Story of Signalling Basic Signalling

17 Block Section Station Limits Signal Box Distant Signal Home Signal Starter Signal Direction of travel Station Block Section Outer Home Signal Overlap The Story of Signalling Outer Home Signal

18 The Story of Signalling Four Aspect Signalling

19 The Story of Signalling Four Aspect Signalling

20 The Story of Signalling Four Aspect Signalling

21 The Story of Signalling Four Aspect Signalling

22 The Story of Signalling Four Aspect Signalling

23 The Story of Signalling Four Aspect Signalling

24 The Story of Signalling Four Aspect Signalling

25 The Story of Signalling Four Aspect Signalling

26 The Story of Signalling Four Aspect Signalling

27 The Story of Signalling Four Aspect Signalling

28 The Story of Signalling Four Aspect Signalling

29 The Story of Signalling Four Aspect Signalling

30 The Story of Signalling Four Aspect Signalling

31 The Story of Signalling Four Aspect Signalling

32 The Story of Signalling Four Aspect Signalling

33 The Story of Signalling Four Aspect Signalling

34 The Story of Signalling Four Aspect Signalling

35 The Story of Signalling Four Aspect Signalling

36 The Story of Signalling Interlocking and Control Centre Interlocking Control System Train detection inputs Point control outputs Point detection inputs Signal lamp outputs Lamp proving inputs

37 The interlocking is the safety device for the signalling equipment. It will not allow an unsafe condition to occur It ensures that all train movements are protected The design of the interlocking is the responsibility of principle design Engineers who must incorporate very strict rules. The design is independently checked and tested. The Story of Signalling Interlocking Principles

38 The Story of Signalling Mechanical Interlocking

39 The Story of Signalling Relay Interlocking

40 The Story of Signalling Solid State Interlocking (SSI)

41 Put WESTLOCK photo here The Story of Signalling Solid State Interlocking WESTLOCK

42 The Story of Signalling Lever Frame Control System

43 Cowlairs The Story of Signalling Control Panel

44 The Story of Signalling Large Control Panel

45 The Story of Signalling Electronic Control Centres

46 Contents Introduction Railways and Safety The Story of Signalling Where Signalling meets SAT Some final thoughts

47 Where Signalling Meets SAT Signalling meets SAT at the interlocking The interlocking can be seen as a logic engine

48 Interlocking Control System Train detection inputs Point control outputs Point detection inputs Signal lamp outputs Lamp proving inputs Where Signalling Meets SAT At the Interlocking

49 Where Signalling Meets SAT If N = number inputs Then 2 N combinations of inputs are possible BUT… can have internal stored states So, order of combinations of inputs matters BUT… can have timers So, duration of combinations of inputs matter

50 Where Signalling Meets SAT I can express the behaviour of an interlocking as a set of Boolean equations One of the interlocking products used by WRSL uses Ladder Logic I can express safety rules about my interlocking as generic rules I can use SAT theory to demonstrate that my interlocking logic meets the safety rules

51 Where Signalling Meets SAT WESTRACE Ladder Logic

52 Where Signalling Meets SAT At the Interlocking P123TATBTCTDTE TGTH S1S2 S3 Example rules - general 1.Points should not be moved if the track is occupied 2.Signals can only show proceed aspect if the track is clear for route set Example rules - specific 1.Points P123 should not be moved if track TC is occupied 2.If route is set S1 to S3, signal can only show proceed if tracks TC, TG are clear, plus TH if overlap

53 Where Signalling Meets SAT Specific Interlocking Logic Signalling Designer Generic Safety Rules Specific Safety Requirements Instancing Specific Railway Layout Satisfiable? This is the hard bit! Are the safety properties complete?

54 Where Signalling Meets SAT WRSL and IRG research P123TATBTCTDTE TGTH S1S2 S3 WRSL is working with Swansea University to enhance our understanding of satisifiability testing, and understand how it can be applied to railway interlocking systems. WRSL is also working with Prover Technology to evaluate use of their proof technology with Invensys Rail WESTRACE interlockings.

55 Contents Introduction Railways and Safety The Story of Signalling Where Signalling meets SAT Some final thoughts

56 Final thoughts High Speed Trains European Rail Traffic Management System (ERTMS)

57 Final thoughts High speed trains If you are driving one of these… you need cab signalling!

58 Final thoughts ERTMS ERTMS = European Rail Traffic Management System Interoperability across Europe Signalling and Automatic Train Protection on the train Interlocking is still required – but…

59 Final thoughts Size and Complexity Over time: Signalling systems have got more complex Scope of individual system components has got larger We have reached the limits of traditional approaches Question: Has size/complexity of modern safety systems exceeded ability of human understanding? If the answer is “Yes” then we need practical applications of technologies such as SAT!

60 Thankyou! Thankyou