The railway signalling is a system used to control the traffic on the Railway and thereby prevent accidents. The railway signalling in Sweden is a safe system and not a single train passenger has died as a result of an accident since year 2010. However, as railway signalling has been developed nationally and has not always been compatible with each other, a problem has arisen when trains travel between countries. To enable a more compatible signalling system a standardized and digitized system called European Railway Traffic Management System (ERTMS) is now implemented in Europe. Trafikverket (TRV) is responsible for the implementation of ERTMS in Sweden and a ERTMS-programme is established. ERTMS is expected to med implemented in Sweden by 2035. To maintain a safe railway system in Sweden, the implementation of ERTMS need to be at least as safe as the current system. This can be ensured by following different requirements stated in standards regarding safety. The European standard EN 50129, "Railway applications - Communication, signalling and processing systems - Safety related electronic systems for signalling", is one of these standards. EN 50129 is updated from an old version to a new version. The purpose of this master thesis is to identify and analyse the effect of the update of the European standard EN 50129 on the implementation process of ERTMS. In addition, this study aims to suggest which actions need to be done at ERTMS-programme to implement the new version of the standard. To investigate this a qualitative method is used which involves a literature study, an analysis of the differences in the standard and semi-structured interviews with persons working at TRV. Theory about safety, safety management and the concept of Safety-I and Safety-II is used in order to analyse and discuss the safety management at ERTMS-programme regarding the update of EN 50129. The results in this study show that the new version contains some new requirements that need to be implemented in the safety work within the ERTMS-programme, for example IT-security and human factors. Furthermore, the new version also contains additional explanations of subjects which can be helpful in the daily safety work. However, the study also shows that the new version involve already known requirements to a great extent. Therefore, regarding these part, the effect of the update is small. The suggested necessary actions are partly about implement the identified new requirements but also about implementing a more proactive safety approach and share the knowledge about the new version.

This study has investigated the effects various effects that driver behavior has on the analyses and simulations carried out by the Swedish Transport Administration. By making assumptions about train drivers' braking ability - which has been modelled by braking percentage and implementing these in the same analysis methods that the Swedish Transport Administration use - the effect of how different driving behaviours affect the results of these analyses can be assessed.  The analyses have been carried out on the Sundsvall–Umeå line: a section where ERTMS is already implemented. The following analyses have been performed in the Railsys tool: runtime analysis, headway analysis (how close two trains can drive after each other), and punctuality analysis. The result of the runtime analysis shows that the effect on runtime is not significant between different driver behaviors. However, there is a greater effect on the headway analysis; the results show that trains can drive significantly closer after each other on stretches where braking is common. The punctuality analysis shows little difference in punctuality. But based on the result, the assumption was made that it would have a significantly greater effect on a railway system with more traffic - for example Stockholm - than for the simulated system in this study.  The conclusion of the study is that different driver behaviours have an effect on headway and punctuality analyses. However, it is not possible to obtain an exact value on how punctuality and runtimes are affected by variations in train driver behavior with the simulation methods used currently in Sweden.

In the mid-1990s, the European Union started to implement a union-wide,standardised signalling system, called European Rail Traffic Management System(ERTMS). This thesis has been developed alongside and targeted for a developmentproject such as the ERTMS system. The Comité Européen de NormalisationElectrotechnique (CENELEC) standards have been adopted by various transportauthorities to support and guide the safety processes of the signalling systems’development and design. These standards split the development of the products inthree levels: Generic Product (GP), Generic Application (GA) and Specific Application(SA). As a result of this development split, the errors encountered during the laterstages of development often experience an undesired and extended turnaround timebefore they are rectified. The aim of this thesis has been to determine reasons for thishigh turnaround time at Alstom and to propose corrective measures that could increasethe efficiency of the NCR management process adopted by the company. Data, from non-conformity reports (NCRs), has been analysed to obtain keyperformance indicators (KPIs) which have been discussed with employees whowork closely with the system and processes. The results from the data analysisand interviews have revealed issues in the NCR management process, the NCRmanagement system tool and input from the customer’s side. The results from thisresearch indicate that knowledge obtained from the fields of requirements engineering,software development life-cycle models (SDLC) and process-optimisation could beused without extensive additional effort to reduce the turnaround time in rectifyingerrors and optimise the process.

Today’s rail industry is under great demand. People will use trains even more in the future. Rail industry has to develop and integrate new systems towards a secure transportation system. One of these steps is investigated in this master thesis. Until now, many sensitive and vital data were transferred by using old methods like USB storage devices. In this master thesis, a new and secure way to store authentication keys in a central database is described as well as a secure way of communication between this database and the RBC entities. Different technologies are used and have as result the proposed goal. The creation of a database with PHP and the implementation of a server-client communication using TLS and HTTPS are described in this project. Improvements and future development of the project are discussed at the end. / Det råder hög efterfrågan på dagens järnvägsindustri. I framtiden kommer ännu fler människor åka med tåg. Järnvägsindustrin måste utvecklas och skapa nya system för att uppnå säkra transportsystem. I denna avhandling kommer detta behandlas. Fram till idag har många känsliga och viktiga data överförts med gamla metoder såsom USB-stickor. I denna masteravhandling beskrivs ett säkert sätt att lagra autentiseringsnycklar i en central databas och även ett säkert sätt att kommunicera mellan denna databas och RBC-enheterna. Olika tekniker har använts med det uppsatta målet som resultat. Upprättandet av en PHP-databas och klient-serverkommunikation med TLS och HTTPS beskrivs i detta projekt. Förbättringar och framtida utveckling av projektet diskuteras i slutet.

Anomaly detection in computer systems operating within complex environments,such as cyber-physical systems (CPS), has become increasingly popularduring these last years due to useful insights this process can provide aboutcomputer systems’ health conditions against known reference nominal states.As performance anomalies lead degraded service delivery, and, eventually,system-wide failures, promptly detecting such anomalies may trigger timelyrecovery responses. In this thesis, Process Mining, a discipline aiming at connectingdata science with process science, is broadly explored and employedfor detecting performance anomalies in complex computer systems, proposinga methodology for connecting event data to high-level process models forvalidating functional and non-functional requirements, evaluating system performances,and detecting anomalies. The proposed methodology is appliedto the industry-relevant European Rail Traffic Management System/EuropeanTrain Control System (ERTMS/ETCS) case-study. Experimental results sampledfrom an ERTMS/ETCS system Demonstrator implementing one of thescenarios the standard prescribe have shown Process Mining allows characterizingnominal system performances and detect deviations from such nominalconditions, opening the opportunity to apply recovery routines for steeringsystem performances to acceptable levels.

Les travaux développés dans cette thèse visent à assister le processus d’ingénierie des exigences temporelles pour les systèmes complexes à contraintes de temps. Nos contributions portent sur trois volets : la spécification des exigences, la modélisation du comportement et la vérification. Pour le volet spécification, une nouvelle classification des exigences temporelles les plus communément utilisées a été proposée. Ensuite, afin de cadrer l’utilisateur durant l’expression des exigences, une grammaire de spécification à base de motifs prédéfinis en langage naturel est développée. Les exigences générées sont syntaxiquement précises et correctes quand elles sont prises individuellement, néanmoins cela ne garantie pas la cohérence de l’ensemble des exigences exprimées. Ainsi, nous avons développé des mécanismes capables de détecter certains types d’incohérences entre les exigences temporelles. Pour le volet modélisation du comportement, nous avons proposé un algorithme de transformation des state-machine avec des annotations temporelles en des automates temporisés. L’idée étant de manipuler une notation assez intuitive et de générer automatiquement des modèles formels qui se prêtent à la vérification. Finalement, pour le volet vérification, nous avons adopté une technique de vérification à base d’observateurs et qui repose sur le model-checking. Concrètement, nous avons élaboré une base de patterns d’observation (ou observateurs) ; chacun des patterns développés est relatif à un type d’exigence temporelle dans la nouvelle classification. Ainsi, la vérification est réduite à une analyse d’accessibilité des états correspondants à la violation de l’exigence associée / The work developed in this thesis aims to assist the engineering process of temporal requirements for time-constrained complex systems. Our contributions concern three phases: the specification, the behaviour modelling and the verification. For the specification of temporal requirements, a new temporal properties typology taking into account all the common requirements one may meet when dealing with requirements specification, is introduced. Then, to facilitate the expression, we have proposed a structured English grammar. Nevertheless, even if each requirement taken individually is correct, we have no guarantee that a set of temporal properties one may express is consistent. Here we have proposed an algorithm based on graph theory techniques to check the consistency of temporal requirements sets. For the behaviour modelling, we have proposed an algorithm for transforming UML State Machine with time annotations into Timed Automata (TA). The idea is to allow the user manipulating a quite intuitive notation (UML SM diagramsduring the modelling phase and thereby, automatically generate formal models (TA) that could be used directly by the verification process. Finally, for the verification phase, we have adopted an observer-based technique. Actually, we have developed a repository of observation patterns where each pattern is relative to a particular temporal requirement class in our classification. Thereby, the verification process is reduced to a reachability analysis of the observers’ KO states relatives to the requirements’ violation

Implementeringen av ERTMS/ETCS har haft betydande inverkan på lokförarnas roll och arbetssituation. Denna studie undersöker konsekvenserna av ERTMS/ETCS gällande lokförarnas ansvar, grad av kontroll och den viktiga balansen mellan automation och mänsklig kompetens. Intervjuer med lokförare och branschexperter visade på en tydlig förändring från aktivt beslutsfattande och operativ kontroll till en mer passiv roll där lokförarna följer systemets instruktioner. Med ERTMS/ETCS har lokförarnas självständighet minskat, eftersom systemet kan ta över kontrollen om förarna avviker från systemets rekommendationer. Därmed förskjuts maktbalansen mot systemets fördel och minskar lokförarnas inflytande. För att upprätthålla en balans mellan bevarandet av lokförarnas kompetens och användningen av avancerade system övervägs en strategi där lokförarna utbildas som "Säkerhetsoperatörer". Faktorer såsom ljuskänslig display och dess positionering är tydliga tecken på att ERTMS/ETCS inte beaktat den sociala aspekten ur ett sociotekniskt perspektiv. / The implementation of ERTMS/ETCS has had a significant impact on the role and work situation of train drivers. This study examines the consequences of ERTMS/ETCS in terms of train drivers' responsibilities, level of control, and the crucial balance between automation and human competence. Interviews with train drivers and industry experts revealed a clear shift from active decision-making and operational control to a more passive role where train drivers follow the system's instructions. With ERTMS/ETCS, train drivers' autonomy has decreased as the system can take control if the drivers deviate from its recommendations. Consequently, the power dynamics shift in favor of the system, diminishing train drivers' influence. To maintain a balance between preserving train drivers' competence and utilizing advanced systems, a strategy is being considered to train train drivers as "Safety Operators." Factors such as the light-sensitive display and its positioning indicate that ERTMS/ETCS has not considered the social aspect from a socio-technical perspective.

Mit der Einführung des europäischen Zugsicherungssystems ETCS sind durch die umfassenden Telegrammdaten, die zwischen Zug und Strecke ausgetauscht werden, neue Herausforderungen bei der Planung, Projektierung, aber auch Prüfung und Validierung verbunden. Im Rahmen der Dissertation wird ein neuartiges Verfahren zur Validierung sicherheitskritischer Anteile von ETCS-Nachrichten entwickelt. Der Ansatz beruht auf der topologischen Aufbereitung der Nachrichteninhalte in einem vierstufigen Prozess. Das Ergebnis der Aufbereitung erlaubt sowohl den automatisierten Abgleich gegen Referenzdaten als auch eine visuelle Prüfung gegen Topologiepläne. Das Optimierungspotential des Ansatzes bei der Validierung wird im Rahmen einer Erprobung anhand realer Projektdaten bestätigt. Mit der topologischen Aufbereitung werden die komplexen Nachrichteninhalte in eine für den Prüfer erfassbare und zu den Referenzdaten vergleichbare Form überführt. Redundante Nachrichteninhalte werden im Zuge der Aufbereitung erkannt und zusammengefasst, was gleichermaßen zur Minimierung des Prüfaufwands sowie zur Erhöhung des Abdeckungsgrades beiträgt.

A European project is gradually replacing the current train control systems to a mutual control system called as the European Railway Traffic Management System (ERTMS). I Sweden they have implemented the new train control system on a few train-lines in the northern part of Sweden. There has been reported problems from train drivers that have used the new control system, the problems consist of both negative affects on train performance and railroad capacity. This study is part of a larger project conducted by The Swedish National Road and Transport Research Institute, with an aim to investigate how the attention is affected in the new train control system compared to the Automatic Train Control (ATC) system. Data collection through eye-tracking have shown significant results in the distribution of visual glances inside and outside the cabin of the train. Drivers tend to distribute more and longer glances inside the train with the ERTMS. Drivers also tend to miss information presented on the track, such as signs informing when to make a sound before an unattended level crossing. These results suggest that ERTMS could have a negative impact on the drivers situation awareness and also could have a negative affect on the drivers attention that impacts the ability to notice what is happening outside the cabin. / I dagsläget utförs ett projekt i Europa med syfte att ersätta nuvarande tågskyddssystem till ett gemensamt signalsystem kallat ERTMS (European Railway Traffic Management System). Detta nya system har implementerats på ett fåtal tåg-linjer i norra delen av Sverige. Olika problem har rapporterats från tågförare som använt det nya signalsystemet. Dessa problem innefattar negativ påverkan på prestation och järnvägens kapacitet. Denna studie är en del av ett större projekt hos Statens väg- och transportforskningsinstitut med ett syfte att studera hur uppmärksamhet påverkas i det nya tågskyddssystemet ERTMS jämfört med det nuvarande systemet ATC (Automatic Train Control). Data som samlades in via eye-tracking har visat signifikanta resultat i fördelning av visuella blickar inne i och utanför tågets kabin. Förare tenderar att fördela mer och även längre blickar inuti tågets kabin med ERTMS. Dessutom tenderar förare att missa information som presenteras ute på spåret, detta kan exempelvis vara information som påvisar att tuta innan ett obevakat övergångsställe. Dessa resultat föreslår att ERTMS kan ha en negativ påverkan på förares uppmärksamhet vilket kan påverka förarens förmåga att bli varse om vad som händer utanför kabinen, på spåret.

Les travaux développés dans cette thèse visent à assister le processus d'ingénierie des exigences temporelles pour les systèmes complexes à contraintes de temps. Nos contributions portent sur trois volets : la spécification des exigences, la modélisation du comportement et la vérification. Pour le volet spécification, une nouvelle classification des exigences temporelles les plus communément utilisées a été proposée. Ensuite, afin de cadrer l'utilisateur durant l'expression des exigences, une grammaire de spécification à base de motifs prédéfinis en langage naturel est développée. Les exigences générées sont syntaxiquement précises et correctes quand elles sont prises individuellement, néanmoins cela ne garantie pas la cohérence de l'ensemble des exigences exprimées. Ainsi, nous avons développé des mécanismes capables de détecter certains types d'incohérences entre les exigences temporelles. Pour le volet modélisation du comportement, nous avons proposé un algorithme de transformation des state-machine avec des annotations temporelles en des automates temporisés. L'idée étant de manipuler une notation assez intuitive et de générer automatiquement des modèles formels qui se prêtent à la vérification. Finalement, pour le volet vérification, nous avons adopté une technique de vérification à base d'observateurs et qui repose sur le model-checking. Concrètement, nous avons élaboré une base de patterns d'observation (ou observateurs) ; chacun des patterns développés est relatif à un type d'exigence temporelle dans la nouvelle classification. Ainsi, la vérification est réduite à une analyse d'accessibilité des états correspondants à la violation de l'exigence associée