Evaluating the Safety Control Scheme of Railway Centralized Traffic Control (CTC) System with Coloured Petri Nets

Abstract

The Centralized Traffic Control (CTC) system plays an important role in ensuring safe and efficient rail transportation operations. It is mainly responsible for the implementation and adjustment of the train operation schedule through the automatic control of the station signalling equipment. The major task of the CTC system is to achieve a high rail transportation operation efficiency under the precondition of safety. For this purpose, it is necessary to select appropriate safety control schemes for the CTC system. In this paper, a formal approach is proposed to quantitatively evaluate the operation efficiencies of the CTC system with respect to different safety control schemes. The proposed approach adopts stochastic coloured Petri nets as the means of description for the system model, and evaluates the operation efficiency of the CTC system based on the data collected during the simulation of the system model. To exemplify the proposed approach, the safety control scheme of prohibiting a passenger train from passing a freight train through adjacent rail tracks between two adjacent stations is studied. The results of the case study show the feasibility of the proposed approach.

1. Introduction

In the railway field, the technology of Centralized Traffic Control (CTC) has been widely used around the world. A CTC system is an automatic command system which integrates computer technology, network communication technology and modern control technology to accomplish the remote control of train operations [1]. It is mainly responsible for the implementation and adjustment of the train operation schedule through the automatic control of the station signalling equipment [2]. In regard to the train scheduling problem or traffic scheduling/rescheduling problem, numerous works are available, e.g., [3,4,5,6,7,8]. The CTC system plays an essential role in ensuring safe train operations and achieving a high operation efficiency of rail transportation.

In Ref. [9], based on the practical application of the CTC system in Beijing-Shanghai high-speed railway, the line conditions and the user requirements, the authors proposed to optimize the system in terms of the polling frequency of route self-triggering, self-triggering timing of receiving route, section processing of departure route, route self-triggering between yards, wireless route forecasting and automatic train number changing. The optimization practice improves the efficiency of automatic route setting of the CTC system. In Ref. [10], in order to make the CTC system more suitable to the ordinary-speed railway and overcome the shortcoming of handling shunting routes via manual button presses in the CTC system, a solution in which the interface between the CTC system and the Station Management Information System (SMIS) is added to obtain the station shunting operation schedule was proposed. With the proposed solution, the probability of the incorrect handling of station shunting routes could be reduced by checking the conditions of shunting route handling and safety control.

Both papers [9,10] have proposed approaches to improve the operation efficiency of the CTC system, but they only provided with basic principles of the approaches with textual descriptions, lacking of rigorous theoretic analysis or model-based evaluation. Considering this issue, we propose a formal model-based approach to evaluate the operation efficiencies of the CTC system with respect to different safety control schemes.

In China, many rail lines are passenger-freight lines, i.e., both passenger trains and freight trains can run on these lines. However, to ensure the safety of passengers, a passenger train and a freight train are normally prohibited from passing each other through adjacent rail tracks between two adjacent stations. Literature related to this issue usually focuses on the pressure waves generated when two running trains on adjacent tracks encounter, e.g., [11,12]. Unlike this literature, we intend to evaluate the operation efficiency of the CTC system under the precondition that a passenger train and a freight train are not allowed to pass each other through adjacent rail tracks between two adjacent stations. For the enforcement of this precondition, safety control schemes must be implemented by the CTC system. For different safety control schemes, the operation efficiency/rail-line capacity of the CTC system could be varied. For the calculation of rail-line capacity, many approaches have been studied, e.g., [13,14].

The traditional methods for rail-line capacity calculation mainly include graphic methods [14], analytic methods based on the deduction coefficient [15], etc. For these methods, challenges might be raised when it comes to systems with stochastic behaviours, e.g., the number of arriving trains at a station during a period of time. To this end, we propose a simulation-based approach to evaluate the operation efficiency of the CTC system with formal models, and we select timed/stochastic Coloured Petri Nets (CPNs or CP-nets) [16] as the means of description for the system model. Petri nets [17,18] are formal modelling languages that are well-known for systems that characterised as concurrent, synchronous, distributed, etc. Some application examples that adopt Petri nets as the means of descriptions for railway signalling systems can be found in the literature, e.g., [19,20,21,22,23,24,25,26]. In addition, Petri net models are widely used for transportation systems [27] and railway networks [28]. The proposed method in this paper is a Petri-net-based approach, which makes formal analysis and quantitative evaluation possible.

This work is a revision and extension of our previous work [29] submitted to the ITSC conference 2022 and yet to be published. The main contributions of the work are: (1) a modelling approach for the safety control schemes of the CTC system is proposed; (2) an evaluation method of calculating the operation efficiency of the CTC system is presented, i.e., the operation efficiencies of the CTC system with respect to different safety control schemes are evaluated by using the data collected during the simulation of the system model. The paper is organized as follows. Firstly, the safety control schemes of the CTC system considering that passenger trains and freight trains are prohibited from passing each other by adjacent rail tracks between two adjacent stations are introduced. Secondly, the safety control schemes of the CTC system are modelled with timed CPNs and the model is verified. Thirdly, the operation efficiencies of the CTC system with respect to different safety control schemes are evaluated based on the data collected during the simulation of the CPN model. Finally, the conclusions are given.

2. Safety Control Scheme of the CTC

One of the main functions of the CTC system is to implement and adjust the train operation schedule through the automatic control of the station signalling equipment. Based on the train operation adjustment schedule issued by the CTC control centre located in the railway bureau, the station autonomous computers automatically generate train route sequences. These train route sequences are then sent to the interlocking system for implementation. The generation of train route sequences by station autonomous computers is strictly guided by the safety control schemes (safety constrains). For the scenario studied in this work, i.e., a passenger train and a freight train are prohibited from passing each other through adjacent rail tracks between two adjacent stations, different safety control schemes can be implemented by the CTC system.

We assume that: (1) there are two adjacent stations A and B with a double-track rail line in between, and the rail track from  station A (station B) to  station B (station A) is called down-line (up-line); (2) at  station A, a passenger train TRAIN-P (may have not arrived yet) has been scheduled as the next train to depart for  station B by the down-line, and the scheduled departure time of TRAIN-P is $t_{{TRAIN-P}_{sdp}}$; (3) at  station B, a freight train TRAIN-F (may have not arrived yet) has been scheduled as the next train to depart for  station A by the up-line, and the scheduled departure time of TRAIN-F is $t_{{TRAIN-F}_{sdp}}$; (4) the time needed for TRAIN-P to run from  station A to  station B is $t_{TRAIN-P}$; (5) the time needed for TRAIN-F to run from  station B to  station A is $t_{TRAIN-F}$. Then TRAIN-P and TRAIN-F will pass each other through in the section between the stations if one of the following conditions is satisfied: (a) $t_{{TRAIN-P}_{sdp}}<=t_{{TRAIN-F}_{sdp}}$ and $t_{{TRAIN-P}_{sdp}}+t_{TRAIN-P}>=t_{{TRAIN-F}_{sdp}}$; (b) $t_{{TRAIN-P}_{sdp}}>=t_{{TRAIN-F}_{sdp}}$ and $t_{{TRAIN-F}_{sdp}}+t_{TRAIN-F}>=t_{{TRAIN-P}_{sdp}}$. In order to avoid the encounter of TRAIN-P and TRAIN-F, a number of safety control schemes (SCS) are available as follows.

(1)

SCS-1: “Passenger Train First” principle, namely, TRAIN-P departs first and TRAIN-F departs after TRAIN-P has arrived at  station B;

(2)

SCS-2: “Freight Train First” principle, namely, TRAIN-F departs first and TRAIN-P departs after TRAIN-F has arrived at  station A;

(3)

SCS-3: “Highest Section Occupancy Rate” principle, namely, if $t_{{TRAIN-P}_{sdp}}<=t_{{TRAIN-F}_{sdp}}$, TRAIN-P departs first and TRAIN-F departs after TRAIN-P has arrived at  station B. Otherwise, TRAIN-F departs first.

Once a safety control scheme is selected, the CTC system will implement or adjust the train operation schedule accordingly.

3. Modelling of the CTC Safety Control Scheme

In this section, we present the modelling of CTC safety control schemes with timed CPNs. The established model is a hierarchically structured model, which is good for reading and  effectively describes the CTC system, which is characterized as concurrent, distributed and synchronous. To make the modelling approach more comprehensible, a brief introduction of CPNs is firstly presented in the section.

3.1. Coloured Petri Nets

Coloured Petri Nets (CPNs or CP-nets) [16] are high-level Petri nets containing two types of nodes: places (ellipses or circles) and transitions (rectangular boxes), where edges that connect only nodes of different types are denoted as arcs. Each place is assigned a type called colour set which determines the set of token colours (data values) that the tokens on that place are allowed to have. With the CPN modelling language, it is possible to work with different levels of detail and abstraction because of the capability of specifying hierarchically structured models of CPNs. These hierarchical models allow a module to have submodules, a set of modules to form a new module, and the reuse of submodules in different parts of the model. In CPN models, a module is usually represented by a substitution transition in its superior hierarchical level. A substitution transition has a rectangular substitution tag positioned next to it. The substitution tag contains the name of a submodule related to the substitution transition. In timed CPN models, in addition to token colour, tokens can carry a second value called timestamp. The timestamps of tokens are written after the symbol “@”. The timestamp of a token specifies the time at which the token is available for use, i.e., the time at which it can be removed by an occurring transition. A timed CPN model has a global clock representing the model time. In a hierarchically timed CPN model, there is a single global clock shared by all the modules.

3.2. Top-Level of the CPN Model

The top-level of the CPN model is shown in Figure 1. The substitution transitions StationA and StationB represent the station A and station B, respectively. The substitution transition Plan Implementation represents the implementation and adjustment of the train operation schedule by the CTC system. The tokens on the places PLAN_A and PLAN_B represent the trains (with schedule information) running from  station A to  station B and from  station B to  station A, respectively.

The declarations of the CPN model are shown in the following:

colset BOOL=bool;

var b,b’,b1,b1’,b2,b2’: BOOL;

colset INT = int timed;

var n,n’,proctime: INT;

colset TrainType = with P | F;

colset SECTION = with UP_LINE|DOWN_LINE timed;

var sec:SECTION;

colset PLAN = record trainType: TrainType * AT: INT * DT: INT;

var plan,plan’: PLAN;

colset PLAN_LIST = list PLAN;

var plans,plans’: PLAN_LIST;

colset N_PLAN = record originalPlan: PLAN * CompT: INT;

var nPlan: N_PLAN;

colset SECTIONxPLAN= product SECTION * PLAN timed;

fun adjustPlan(plan: PLAN, n: INT) = {trainType = #trainType plan,

    AT = #AT plan, DT = max(n,(#DT plan))}

fun intTime() = IntInf.toInt (time());

fun max(n: INT, m: INT)=

    if~n>=m

    then n

    else m;

colset Ten0 = int with 1..10;

colset Ten1 = int with 1..10;

var t0 : Ten0;

var t1 : Ten1;

fun OK(t0: Ten0, t1: Ten1) = (t0 < t1);

The standard priorities are as in the following:

val P_HIGHEST = 50;

val P_HIGH = 100;

val P_NORMAL = 1000;

val P_LOW = 10000;

3.3. The Second Level of the CPN Model

3.3.1. Module StationA/StationB

The module StationA is shown in Figure 2. This module is deployed to generate a train operation schedule which includes a list of trains with the timing information of departing from  station A. The operation schedule of a train is described by the record colour set PLAN which contains three fields: trainType refers to the type of the train (P means “passenger train” and F represents “freight train”); AT represents the scheduled departure time of the train and DT represents the actual departure time of the train. The list token on the place PLAN_A represents the list of trains to be depart from  station A. We assume that the scheduled departure time intervals between the trains are subjected to a Poisson distribution with a parameter of $\lambda$ (in Figure 2, $\lambda =15.0$). This is realised by the arc descriptions “poisson(15.0)” from the transition Init to the place Next and “n+poisson(15.0)” from the transition Arrive to the place Next. The boolean expression “OK(t0,t1)” in the code segment of the transition Arrive determines the type of  train. The variable $t0$/$t1$ will be bound to an arbitrary value in its colour set (i.e., to an integer between 1 and 10). The ratio of passenger trains to the freight trains can be revised by changing the colour sets Ten0 and Ten1 in the declarations. For example, for the declarations shown above (both colour sets Ten0 and Ten1 are defined by the integer between 1 and 10), the ratio of passenger trains to freight trains is set to be one to one, for simplicity. The module StationB is similar to the module StationA, and thus the detailed model of the module StationB is not presented in the paper.

3.3.2. Module PlanImplementation

Before the detailed introduction of the module, some assumptions are given as in the following:

(1)

Only one train is allowed to enter the section between two adjacent stations;

(2)

The duration time of a passenger train running from  station A (station B) to  station B (station A) by the down-line (up-line) is $t_P$;

(3)

The duration time of a freight train running from  station A (station B) to  station B (station A) by the down-line (up-line) is $t_F$;

(4)

$t_F>t_P$.

The module PlanImplementation is shown in Figure 3. The upper part of the model refers to the process of a train running from  station A to  station B, while the lower part of the model describes the process of a train running from  station B to  station A. Since these two parts are very much similar, we only provide with the introduction of the upper part. The places DownLine_Idle and DownLine_Occupied represent the states of the down-line (on which trains run from  station A to  station B) are “free” and “occupied”, respectively. Similarly, the places UpLine_Idle and UpLine_Occupied represent the states of the up-line (on which trains run from  station B to  station A) are “free” and “occupied”, respectively. When a train leaves  station A for  station B, the token colour “DOWN_LINE” on the place DownLine_Idle will be removed and added to the place DownLine_Occupied by firing the transition Run_A. Meanwhile, the time that the down-line will be free again is sent to the place FreeTime_A. If the train arrives at  station B, the state of down-line will be turned into free again by firing the transition ArriveB, and a token colour with the information of the original schedule of the train and the actual arriving time will be added to the place Completed. Subsequently, the transition Passenger Train will be fired if this train is a passenger train. Otherwise, the transition Freight Train will be fired.

When the input place PLAN_A is marked by a list token of train operation schedule for  station A, the transition Start1 will be fired. In the code segment of the transition Start1, the function adjustPlan(plan,n) (see its definition in the declarations presented above) adjusts the train operation schedule if the time when the down-line begins to be free (represented by the token value of the place FreeTime_A) is greater than the original scheduled departure time. After the firing of the transition Start1, the actual train operation schedule to be executed is added to the place Next_A. The same for the transition Start2. When the operation schedule of the train (say train A), which is the next one to depart from  station A is obtained (i.e., the place Next_A is marked), and the operation schedule of the train (say train B) which is the next to depart from  station B is also obtained (i.e., the place Next_B is marked), the safety control scheme of the CTC system will be implemented by firing the transition Safety Control to determine which train to depart first. The safety control scheme is defined by the code segment of the transition Safety Control. As shown in Figure 3, the code segment of the transition Safety Control (codes in red colour) defines the safety control scheme SCS-3 presented in  Section 2 (i.e., a highest occupancy rate of the section between the stations A and B). To be specific, if train A is a passenger train, train B is a freight train and the scheduled departure time of train A is not greater than that of train B, then train A departs first; if train A is a passenger train, train B is a freight train and the scheduled departure time of train A is not greater than that of train B plus $(t_F-t_P)$, then train A departs first; if train A is a freight train, train B is a passenger train and the scheduled departure time of train A plus $(t_F-t_P)$ is not greater than that of train B, then train A departs first; if both train A and train B are passenger trains, and the scheduled departure time of train A is not greater than that of train B, then train A departs first; if both train A ans train B are freight trains, and the scheduled departure time of train A is not greater than that of train B, then train A departs first. If the train A departs first, the place Flag_A will be marked by a boolean token “true”. Otherwise, it is marked by a boolean token “false”. The places P1 and P2, and the transitions T1 and T2 constitute a timer [20]. The value of the token colour on the place P2 is always equal to timestamp of the token colour. Thus we can take the value of the token colour on the place P2 as the global time of the system model. When the actual departure time of train A is met with the global time, and the place Flag_A is marked by a boolean token “true”, it will depart by firing the transition Run_A. When the actual departure time of train A is met with the global time, but the places Flag_A is marked by a boolean token “false”, it will wait at  station A by firing the transition Wait_A.

3.4. Model Verification

In order to ensure the correctness of the established CPN model, it needs to be verified. State space analysis is one of the main methods for verification in Petri nets. In timed Petri nets, however, this method has a major problem, namely, the state space often becomes infinite. Thus, we analyse the state space of the untimed CPN model (i.e., the timing information of the model is removed). State spaces calculate all reachable states (markings) and state changes (occurring binding elements) of CPN models, and represent these in a directed graph where nodes correspond to the set of reachable markings and arcs correspond to occurring binding elements. A standard state space report generated by the CPN Tools [30] provides some basic information and standard properties including statistics, boundedness properties, home properties, liveness properties and fairness properties [16] of a CPN model.

Since the logic of established model in this work is relatively simple and for the sake of saving space, we only show a part of the standard state space report as in 

Table 1. Part of information of the standard state space report.

Statistics
State Space              SCC Graph
Nodes: 43915               Nodes: 43915
Arcs: 67318                 Arcs: 67318
Secs: 111                    Secs: 9
Status: Full
Home Properties
Home Markings
None
Live Properties
Dead Markings
3978 [43915, 43914, 43913, 43912, 43911, …]
Dead Transition Instances
None
Live Transition Instances
None
Fairness Properties
No infinite occurrence sequences.

and the detailed untimed CPNs are not presented here. Note that an input place is added to the transition Arrive in Figure 2 to limit the number of trains to depart from  station A as one, and the same for  station B. The SCC graph has the same number of markings and arcs as the state space, which means that there are no cycles in the generated state space. The home properties show that there are no home markings. The liveness properties express that there are 3978 dead markings, no transition instances and no live transitions. The fairness properties reveal that there are no infinite occurrence sequences. Because the trains at  stations A and B are finite, the existing of dead markings of the state space is reasonable. As anticipated, the home properties, dead markings, the number of live/dead transitions and the fairness properties are desirable, which proves the correctness of the established model.

4. Simulation and Results

To implement the simulation of the CPN model, some parameters of the model are configured in the first place. In Figure 2, the parameter $\lambda$ of the Poisson distribution is set to be 15.0; the guard of the transition Arrive is set as “n < 10,000” to limit the number of trains that are departing from the station to be finite (while the number of trains is great enough for normal train departures till the termination of the simulation); the possibility of a train to be a passenger/freight train is assumed to be 50% by employing the function OK(t0:Ten0,t1:Ten1). In Figure 3, the duration time of a passenger train running from  station A (station B) to  station B (station A) by the down-line (up-line) is assumed to be 20 min, i.e., $t_P=20$; the duration time of a freight train running from  station A (station B) to  station B (station A) by the down-line (up-line) is assumed to be 40 min, i.e., $t_F=40$; one time unit of the model represents one minute in the real world.

We set up a break point monitor that terminates the simulation when the model time goes beyond 1440 time units (representing 24 h) considering the time needed for the simulation and the acceptable level of accuracy based on our practical experiences. As the model contains random variables (which means that the model simulation contains random behaviour), the simulation output data also exhibit random behaviour; therefore, three simulations are taken when interpreting and analysing the output data. The averages of the observed data are used to illustrate the simulation results.

Table 2. Simulation results with respect to different safety control schemes.

Safety Control Scheme	Number of Passenger Trains (Ratio)	Number of Freight Trains (Ratio)	Throughput (Number of Trains in Total)	Average Delay of Passenger Trains	Average Delay of Freight Trains	Occupancy Rate of Down-Line	Occupancy Rate of Up-Line
SCS-1	36.333 (49.099%)	37.667 (50.901%)	74.000	255.879	271.599	78.704%	79.167%
SCS-2	39.000 (46.063%)	45.667 (53.937%)	84.667	338.912	318.760	93.056%	92.593%
SCS-3	37.333 (41.947%)	51.667 (58.053%)	89.000	350.383	365.609	100%	99.537%

shows the average numbers of passenger trains and freight trains, the average delays of passenger trains and freight trains, and average occupancy rates of down-line and up-line with respect to different safety control schemes. For the SCS-1 (“Passenger Train First” principle), the average numbers of passenger trains and freight trains are 36.333 and 37.667, respectively, the number of trains in total is 74.000, and the ratio of passenger train to freight train is 49.099% to 50.901%; the average delays of passenger trains and freight trains are 255.879 time units and 271.599 time units, respectively; the average occupancy rates of down-line and up-line are 78.704% and 79.167%, respectively. For the SCS-2 (“Freight Train First” principle), the average numbers of passenger trains and freight trains are 39.000 and 45.667, respectively, the number of trains in total is 84.667, and the ratio of passenger train to freight train is 46.063% to 53.937%; the average delays of passenger trains and freight trains are 338.912 time units and 318.760 time units, respectively; the average occupancy rates of down-line and up-line are 93.056% and 92.593%, respectively. For the SCS-3 (“Highest Section Occupancy Rate” principle), the average numbers of passenger trains and freight trains are 37.333 and 51.667, respectively, the number of trains in total is 89.000, and the ratio of passenger train to freight train is 41.947% to 58.053%; the average delays of passenger trains and freight trains are 350.383 time units and 365.609 time units, respectively; the average occupancy rates of down-line and up-line are 100% and 99.537%, respectively. It is observed that the SCS-3 has the highest throughput of trains and highest occupancy rates of down-line and up-line; however,  at the same time, it has the highest average delays of passenger trains and freight trains; The SCS-1 has the lowest throughput of trains and lowest occupancy rates of down-line and up-line, but has the lowest average delays of passenger trains and freight trains. We can also observe that the SCS-1 has the highest ratio of passenger trains and the SCS-3 has the lowest ratio of passenger trains.

5. Discussion and Conclusions

5.1. Discussion

Based on the simulation results, we are able to quantitatively evaluate the operation efficiency of the safety control schemes of the CTC system by observing the parameters of the average numbers of passenger trains and freight trains, the average delays of passenger trains and freight trains and average occupancy rates of down-line and up-line. The simulation results show how the operation efficiency parameters are changing along with the changing of the safety control schemes of the CTC system, which is helpful to railway operators in making decisions of selecting CTC safety control schemes. However, the concrete values of these parameters depend on the configuring values of the parameters of the system model, e.g., the parameter of the Poisson distribution function poisson() in Figure 2, the parameter of the function OK(t0:Ten0,t1:Ten1) (see Figure 2) employed to determine the ratio of passenger trains to freight trains that are arriving at  stations A and B, etc. In this work, only the scenario with two stations is considered. Nevertheless, the proposed approach could be extended to handle the scenario with multiple stations by adding more “stationA” and “PlanImplementation” modules. This also is our future work.

5.2. Conclusions

This paper presents a formal approach to evaluate the safety control schemes of railway CTC system based on timed/stochastic CPNs. In this work, three safety control schemes of the CTC system are proposed considering the safety constrain of train operation that a passenger train and a freight train are prohibited from passing each other through adjacent rail tracks between two adjacent stations. The safety control schemes are modelled with timed CPNs and evaluated based on the data collected during the simulation of the CPN model.