1. *Supported by National Research Council of Thailand
Experience using Coloured Petri Nets to Model Railway Interlocking Tables*
Somsak Vanit-Anunchai
School of Telecommunication Engineering
Suranaree University of Technology
Nakhon Ratchasima Thailand
*Supported by National Research Council of Thailand
and the State Railway of Thailand
FSFMA 2014

2. Outline Introduce the railway signalling systems
26/04/62
Introduce the railway signalling systems
What is the interlocking tables? (four functions)
Motivation
Previous work
Two Problems with CPN 2009
Examples: CPN Model of the signalling system
Objectives of Analysis
Concluding Remark

3. Introduction to railway signalling
26/04/62
Railway Signalling System divides rail track into sections.
Only one train is allowed in one section at a time.
A section or route comprises wayside equipment
1) Track Circuits used to indicate the presence of trains
2) Signals to allow the train enter into the route.
3) Points (switches ) to diverge the train to another track.
Each wayside equipment has an Identification number.

4. Route Released  Normal
Signal Operation
26/04/62 1
Route Released  Normal
Route 1-3(2) locked

5. Operation requirement Testing and Commissioning
26/04/62
Interlocking Tables play a central role for
> 100 years
Operation requirement
Traffic Rules
Signalling principle + x = 
Interlocking Tables or Control Tables are the tabular representation specifying how the train moves together with the states and actions of related equipment.
Circuit Design
Implementation
Installation x  x
Accident
Testing and Commissioning

6. 1. Route Setting
26/04/62
201, 202

7. 2. Approach Locked and 3.Route Released
26/04/62

8. 4. What is Flank Protection?
26/04/62
The fail safe means that, in the event of failure, the system shall respond in a no harmful way or no danger to persons.
The equipment within the surrounding area of the reserved route that may cause an accident shall be protected even if no train is expected to pass such a signal or such points. Points should be in such positions that they do not give immediate access to the route. Even though those flank points are not located on the required route, when the route is set, they shall be locked in the safe position until the route is released.

9. 4. Flank Protection
26/04/62
201, 202

10. Motivation
26/04/62
Problems with manual inspection of railway Interlocking table  labour intensive, erorr prone
Labour x No. of Station
= Too long time + errors
Q:Why do not buy software tools from someone?
A:Other software tools usually are designed for a specific railway company but SRT’s Operating rule is unique and can be changed.
Need easy formal methods for signal engineers in order to maintain models themselves
 Coloured Petri Nets Model

11. 26/04/62
Previous Work
CPN 2009
Actually we use Coloured Petri Nets (CPNs) to model Railway Signalling Systems = Interlocking Tables + Signalling layout = Simulates trains movement.

12. 26/04/62
Excel  XML
XSLT script
 ML functions are automatically created from XML control table using XSLT.

13. Generic Model for Interlocking Table
26/04/62
Generic Model for Interlocking Table
require_point_normal(route)
++ require_point_reverse(route)

14. Two problems and suggestions in CPN2009
26/04/62
Two problems and suggestions in CPN2009
1. When the layout is complex  difficult to model using Places and Transitions.
Suggestion: Geographic information (how each wayside equipment connects to each other) is encoded into tokens.
2. Analysis result is not understandable
because of too many terminal marking.
Suggestion: prefers only 1 terminal marking  No train in the terminal marking .

15. MoveT2T Page : (Coordination2010 ) (Generic mode for station layout)
26/04/62
MoveT2T Page : (Coordination2010 ) (Generic mode for station layout)

16. Previous Work: Coordination2010
26/04/62
Previous Work: Coordination2010
1. To answer the first comments  Generic model of Signalling layout in Coordination2010.
2. While the second problem has not been solved, we encountered the third problem: State Exploded. The model in Coor2010 was the double track model but in CPN2009 was the single track model.
3. Even a small double track model we cannot fully analyse. However SRT can use partial analysis and simulation.

17. Previous Work: Coordination2010 (cont)
26/04/62
Previous Work: Coordination2010 (cont)
4. While the second problem has not been solved, the state explosion problem caused the project at halt.
5. Until CPN Tools version Prioritized Transition, Reset Arc, Inhibitor Arc
These features are very helpful so that we revise the CPN model.

18. A safe but undesired deadlock Automatic Route Setting required
26/04/62
Revisting 2nd Problem: why so many Terminal marking Initial Markings Case D
A safe but undesired deadlock Automatic Route Setting required

19. Automatic Route Cancellation (required)
26/04/62
Automatic Route Cancellation (required) 2 1
1. Route #1 requires 111T = Normal and Lock
2. Route #2 requires 111T = Reverse
 keep attempting to move 111T to Reverse
3.After route #1 released, route #2 is still pending
due to FP = 62T is not clear.
4. Another deadlock  route #2 should be cancelled.

20. Automatic Route Setting and Automatic Route Cancellation
26/04/62
Automatic Route Setting and
Automatic Route Cancellation
These two functions are not in the Interlocking Table.
Normally a signalman conducts the two functions.
3. Our model combines the specification
and human action.

21. 26/04/62
UserCommand Page

22. Objectives of Analysis
26/04/62
Objectives of Analysis
The desired property is no train collision.
Confidence in the model correctness and the Content of Interlocking Tables
After route(s) setting and train(s) movement ,
The terminal markings shall be as we expected.

23. Initial Markings Case A
26/04/62
Set All Routes
Initial Markings Case A
Case B

24. Initial Markings Case C3
26/04/62
Initial Markings Case C3

25. 26/04/62

26. 26/04/62
With Flank
Protection

27. 26/04/62
With Flank
Protection

28. Concluding Remarks
26/04/62
We can use the same (CPN) net structure to model any interlocking systems regardless of the size of the station. (CPN-09)
Geographic information (how each wayside equipment connects to each other) is encoded into tokens. (Coordination 2010)
We extend the model to include “Flank protection” (FSFMA2014)
We include human action “Automatic Route Setting” and “Automatic Route Cancellation.
However state explosion is still the problem.

29. Future work Refine the model.
26/04/62
Future work
Refine the model.
“Sectional Route Release” some part of the route is released so that we can reuse the equipment such as point for something else e.g. for another route, for shunting etc.
Use symmetry property to reduce the size of state space.
Apply the sweep-line method to tackle the state explosion problem.

30. Questions and comments?
26/04/62
Thank You!
Questions and comments?