Skip to content
Nuno Macedo edited this page Jun 17, 2021 · 54 revisions

Hybrid ERTMS/ETCS Level 3 Concept

The European Rail Traffic Management System (ERTMS) is a system of standards for management and interoperation of signalling for railways by the EU, that aims to replace the various national systems with a seamless European railway system. The European Train Control System (ETCS), the ERTMS control command part, defines 3 levels of signalling that a system can operate on, depending on on the trackside equipment used, how the on-board systems communicate with the trackside, and on which functions are processed on-board or by the trackside.

In Level 3, positive train detection (PTD) information is detected and reported by the on-board system directly to the trackside, which, based on logical rather than physical track block sections, decides whether it is safe to issue movement authorities (MA), reporting them back to the on-board system via radio. For this to be feasible, PTD information must be reliable and the communication between the on-board and the trackside systems guaranteed at all times. These pre-conditions are not easily met, which has led to the proposal of a Hybrid Level 3 concept, that combines PTD information with limited trackside detection. These trackside train detection sections (TTD) are then broken into smaller virtual subsections (VSS). This allows for trains with non-ideal equipment or with communication problems to still use the line, albeit below full capacity.

This page presents the modelling and subsequent validation and verification of the Hybrid ERTMS/ETCS Level 3 (HL3) concept in Electrum, and was developed as an answer to the ABZ 2018 call for case study contributions, mainly based on the detailed HL3 principles document.

Model for the HL3 Concept

The Electrum model for the HL3 concept is present in detail in the ABZ 2018 publication. The model at the time of the conference, for version 1A of the reference document, is available here (with the respective theme here). A version of the model in plain Alloy was also developed, available here (with the respective theme here). A new version of the reference document was released for publication of the conference. The model for this 1C version is also available here (with the respective theme here), and is described in the extended version of the paper at STTT.

Note: While these models were initially developed for Electrum 1.1, they have been updated for Electrum 2.1 in order to be analysable by the latest version of the tool.

The 9 operational scenarios provided by the HL3 principles document, generated by the Electrum Analyzer for this model, are presented below.

Operational Scenarios

Disconnected train Connected train not reporting Connected train not reporting rear info Connected train fully reporting
Train with expired mute timer Train with expired integrity timer Actual train front position Actual train rear position
Free VSS Occupied VSS Ambiguous VSS Unknown VSS
VSS with expired disconnected propagation timer VSS with expired integrity loss propagation timer MA assigned to a train Jumping train info
Free TTD Occupied TTD TTD with expired shadow timer A TTD with expired shadow timer B
TTD with expired ghost propagation timer VSSs comprising a TTD

Scenario 1 - Normal running of a single train with integrity confirmed by external device

S1_0

S1_1

S1_2

S1_3

S1_4

S1_5

S1_6

S1_7

Scenario 2 - Splitting of a composite train with integrity confirmed by external device

S2_0

S2_1

S2_2

S2_3

S2_4

S2_5

S2_6

S2_7

Scenario 3 - Shadow train

S3_0

S3_1

S3_2

S3_3

S3_4

S3_5

S3_6

S3_7

S3_8

Scenario 4 - Start of Mission / End of Mission

S4_0

S4_1

S4_2

S4_3

S4_4

S4_5

S4_6

S4_7

S4_8

Scenario 5 - Integrity lost

S5_0

S5_1

S5_2

S5_3

S5_4

S5_5

S5_6

S5_7

Scenario 6 - Connection lost and reconnect within session

S6_0

S6_1

S6_2

S6_3

S6_4

S6_5

S6_6

S6_7

S6_8

Scenario 7 - Connection lost and reconnect within session with release of VSS

S7_0

S7_1

S7_2

S7_3

S7_4

S7_5

S7_6

S7_7

S7_8

Scenario 8 - Sweeping, jumping and two trains in a VSS

S8_0

S8_1

S8_2

S8_3

S8_4

S8_5

S8_6

S8_7

S8_8

S8_9

S8_10

Scenario 9 – Ghost train

S9_0

S9_1

S9_2

S9_3

S9_4

S9_5

S9_6

S9_7

S9_8

S9_9

S9_10

S9_11

Clone this wiki locally