New Simulation and Evaluation Technologies for Safety-Critical Railway Applications and Interfaces

OBJECTIVE Train control command and signaling can be described as a safety-critical system. Developing safety-critical software is a time-consuming and complex task with a focus particularly on system design, security and... [ view full abstract ]

OBJECTIVE
Train control command and signaling can be described as a safety-critical system. Developing safety-critical software is a time-consuming and complex task with a focus particularly on system design, security and verification. Moreover, in the last years, integrating the user’s perspective, his working environment and especially usability became increasingly important.
Since it is not possible to field test railway software in an early development phase a simulation environment for railway operations is needed. In Darmstadt, the Eisenbahnbetriebsfeld Darmstadt, a research facility for simulating railway operations, offers such an opportunity. It comprises actual interlocking technology and dispatching software, true to original, which controls a realistically designed infrastructure largely constructed from model railway components. This allows for testing under such conditions that the complexity inherent to railway operations is properly represented. Unfortunately, testing in a simulation environment is costly since developing and programming prototypes is expensive and time consuming, but testing with paper mock-ups is only possible on a limited basis because they cannot display any dynamic process due to their static nature.
METHOD
Since it is recommended to integrate users into the design process and to test iteratively to guarantee quality in design, we started six software engineering projects to support and simplify the process of developing interfaces and designing of testing scenarios. These six programs cover the following areas:
1. Designing infrastructure representations for electronic interlocking user interfaces
2. Designing new user interfaces
3. An interface that enables to connect user interfaces completely different from the existing electronic interlocking system
4. Creating timetables
5. Choosing suitable evaluation methods and reasonable combinations thereof in the right order in time
6. Creating disturbances and malfunctions
In this paper, we will concentrate on the first two programs. All others will be described briefly.
DISCUSSION
These six programs facilitate the design of an evaluation for the test leader. At this point the question arises whether it is of value and reasonable to design a dedicated scenario for each study. It should be investigated if a suitable ruleset can be defined that facilitates objective comparison of study settings, and offers a meter to assess if a study’s scenario can be reasonably transferred to a different one. This challenge is closely related to the question if and how often it makes sense to vary scenarios between evaluations. In favor of scenario variation speaks the fact that it allows for more and different testing situations; constancy however allows the user to become acquainted with the scenario and to develop a sort of routine. Moreover, the train traffic controllers can acquire route knowledge which is mandatory for their work in reality. Currently it seems reasonable to develop a standard EBD scenario comprising a fixed infrastructure and timetable while varying disruptions and malfunctions (and, where necessary, also the evaluation methods).
Moreover, it is vital to ensure that not only infrastructure and timetable, but also disruptions and malfunctions are as realistically modeled as possible, concerning, e.g., type of malfunction and frequency, for instance by establishing an expert committee.
noindustrialapplication
pleaseconsidermypaperforinclusioninaspecialeditionoftheJournalofRapidRailandTransit,inadditiontobeingpublishedintheelectronicbookofconferenceproceedings