published_or_final_version / Transport Policy and Planning / Master / Master of Arts

Safety analysis is a process involving several techniques.The purpose of this thesis is to test and develop methodssuitable for the safety analysis of railway risks and railwaysafety measures. Safety analysis is a process comprisingproblem identification, risk estimation, valuation of safetyand economic analysis. The main steps are described in separatechapters, each of which includes a discussion of the methodsand a review of previous research, followed by the contributionof this author. Although the safety analysis proceduredescribed can be used for analysing railway safety, it has suchgeneral foundations that it can be used wherever safety isimportant and wherever safety measures are evaluated. Itcombines cost benefit analysis with criteria for thedistribution and the absolute levels of risk. Risks are estimated with both statistical and risk analysismethods. Historical data on railway accidents are analysed andstatistical models fitted to describe trends in accident ratesand consequences. A risk analysis model is developed usingfault tree and event tree techniques, together with Monte Carlosimulation, to calculate risks for passenger train derailments.The results are compared with the statistical analysis ofhistorical data. People's valuation of safety in different contexts isanalysed, with relative values estimated in awillingness-to-pay study. A combination of focus groups andindividual questionnaires is used. Two different methods areused to estimate the value of safety and the results arecompared. Comparisons are also made with other studies. Different approaches for safety analysis and methods foreconomic analysis of safety are reviewed. Cost-benefit analysisas a decision criterion is discussed and a study on theeconomic effectsof a traffic control system is presented. There are several results of the work. Historical data showsa decrease in the accident rate. The average consequence ofeach accident has not changed over time. The risk analysismodel produces comparable results and enables analysis ofvarious safety measures. The valuation study shows that peopleprefer the prevention of small-scale accidents over theprevention of larger, catastrophic accidents. There are onlysmall differences in the valuation of safety in differentcontexts.

<p>Safety analysis is a process involving several techniques.The purpose of this thesis is to test and develop methodssuitable for the safety analysis of railway risks and railwaysafety measures. Safety analysis is a process comprisingproblem identification, risk estimation, valuation of safetyand economic analysis. The main steps are described in separatechapters, each of which includes a discussion of the methodsand a review of previous research, followed by the contributionof this author. Although the safety analysis proceduredescribed can be used for analysing railway safety, it has suchgeneral foundations that it can be used wherever safety isimportant and wherever safety measures are evaluated. Itcombines cost benefit analysis with criteria for thedistribution and the absolute levels of risk.</p><p>Risks are estimated with both statistical and risk analysismethods. Historical data on railway accidents are analysed andstatistical models fitted to describe trends in accident ratesand consequences. A risk analysis model is developed usingfault tree and event tree techniques, together with Monte Carlosimulation, to calculate risks for passenger train derailments.The results are compared with the statistical analysis ofhistorical data.</p><p>People's valuation of safety in different contexts isanalysed, with relative values estimated in awillingness-to-pay study. A combination of focus groups andindividual questionnaires is used. Two different methods areused to estimate the value of safety and the results arecompared. Comparisons are also made with other studies.</p><p>Different approaches for safety analysis and methods foreconomic analysis of safety are reviewed. Cost-benefit analysisas a decision criterion is discussed and a study on theeconomic effectsof a traffic control system is presented.</p><p>There are several results of the work. Historical data showsa decrease in the accident rate. The average consequence ofeach accident has not changed over time. The risk analysismodel produces comparable results and enables analysis ofvarious safety measures. The valuation study shows that peopleprefer the prevention of small-scale accidents over theprevention of larger, catastrophic accidents. There are onlysmall differences in the valuation of safety in differentcontexts.</p>

Die vorliegende Diplomarbeit enthält eine Analyse von Untersuchungsberichten der deutschen Eisenbahnunfalluntersuchung sowie den darin betrachteten Unfallereignissen. Als Grundlage der Überlegungen wird dargestellt, welche Kriterien bei der Einstufung von gefährlichen Ereignissen zur Anwendung kommen. Anhand der festgestellten Unfallursachen erfolgen eine Kategorisierung von Ursachen und eine Zuordnung aller untersuchten Ereignisse gemäß den erarbeiteten Definitionen. Die Analyse befasst sich neben einer quantitativen und qualitativen Auswertung der Ursachenkategorien mit vielen weiteren berichts- sowie ereignisbezogenen Aspekten von Eisenbahnunfällen. Dabei werden auch mögliche Ansätze zur Verbesserung der Betriebssicherheit genannt. Anhand eines Beispiels werden abschließend die Zuständigkeiten in der Umsetzung von Sicherheitsempfehlungen erarbeitet. / This thesis analyses reports on accidents by the German railway accident investigation body as well as the investigated accidents themselves. Criteria for the assessment of railway incidents are presented. Corresponding to the identified causes, a categorisation of the accidents is made and all investigated events are classified according to definitions developed in advance. In addition to evaluating categories of accident causes both by quantity and by quality, this thesis addresses additional reporting-related and event-related aspects of railway accidents. Possible approaches to improving railway safety are proposed. Finally, following a case model, different jurisdictions for implementing safety recommendations are elaborated on.

This thesis aims at systematically studying the possibilities of minimizing devastating consequences of high-speed rail vehicle derailments by appropriate measures and features in the train design including the running gear. Firstly, an empirical database is established containing as much relevant information as possible of past incidents and accidents that have occurred at substantial running speeds due to mechanical failure close to the interface between the running gear and the track. Other causes that ultimately brought the train in a derailed condition are also covered. Although various accidental circumstances make each derailment a unique event, certain patterns appear to emerge which lead to several critical vehicle parameters capable of influencing the outcome of a derailment or preventing a derailment to occur. Secondly, the possibility of preventing wheel climbing derailments after an axle journal failure is studied by implementing mechanical restrictions between wheelsets and bogie frame. In this respect, a multi body system (MBS) computer model is developed to account for such an axle failure condition, which is successfully validated on the basis of two authentic passenger car events. In order to study the overall post-derailment vehicle behaviour, in particular the wheelsets’ vertical motion and lateral deviation on sleepers, a comprehensive MBS post-derailment module is developed and implemented in the commercially available software GENSYS. The model detects wheel-sleeper impact conditions and applies valid force resultants calculated through linear interpolation based on a pre-defined look-up table. The table was constructed through exhaustive finite element (FE) wheel to concrete sleeper impact simulations utilising the commercially available software LS-DYNA. The MBS post-derailment module has been validated successfully in several stages, including a correct prediction of the derailing wheelset’s trajectory over ten consecutive sleepers in comparison with an authentic passenger vehicle derailment event. An extensive simulation analysis on the feasibility of utilizing alternative substitute guidance mechanisms attached to the running gear on rail vehicles is presented, as means of minimizing the lateral deviation. Three low-reaching guidance mechanisms attached onto the running gear (bogie frame, brake disc and axle journal box) are analysed in terms of geometrical parameters for a successful engagement with the rail in order to prevent large lateral deviations after twelve different derailment scenarios. Three conventional coupled passenger trailing cars are investigated in terms of lateral deviation and vehicle overturning tendency after derailments on tangent and curved track. This is performed as a function of various vehicle design features and parameters such as: maximum centre coupler yaw angle, carbody height of centre of gravity, coupler height and additional running gear features. In a similar manner, the articulated train concept is investigated in terms of the post-derailment vehicle behaviour as a function of different inter-carbody damper characteristics and running gear features. / QC 20100701

Le but de ce rapport est de présenter une méthode globale de développement à partir de spécifications informelles, depuis la modélisation graphique des exigences temporelles d'un système ferroviaire critique jusqu'à une implantation systématique au moyen de méthodes formelles. Nous proposons d'utiliser ici les réseaux de Petri temporels pour décrire le comportement attendu du logiciel de contrôle-commande à construire.Tout d'abord nous construisons un modèle des exigences p-temporel prenant en compte toutes les contraintes que doit vérifier le système. Nous proposons des outils et des méthodes capables de valider et de vérifier ce modèle. Ensuite, il s'agit de construire un modèle de processus solution en réseau de Petri t-temporel. Ce modèle illustre des exigences techniques relatives à un choix technologique ou architectural. L'objectif est double : tout d'abord il est nécessaire de vérifier la traçabilité des exigences ; ensuite, il faut vérifier que l'ensemble des exigences sources sont bien implémentées dans la solution préconisée et dans sa mise en oeuvre. Enfin, nous proposons une approche visant à transformer de façon systématique le modèle de processus en machine abstraite $B$ afin de poursuivre une procédure formelle $B$ classique. Finalement, le cas d'étude du passage à niveau, composant critique dans le domaine de la sécurité ferroviaire est décrit / The introduction of new European standards for railway safety, coupled with an increasing use of software technology changes the method of development of critical railway systems. Indeed, new systems have to be at least as good as the previous ones. Therefore the appropriate safety level of critical systems has to be proved in order to obtain the necessary approval from the authorities. Accordingly a high level of reliability and correctness must be reached by the use of mathematical proofs and then formal methods. We focus on the treatment of the temporal requirements in the level crossing case study which is modelled with p-time Petri nets, and on the translation of this model in a more formal way by using the B method. This paper introduces a methodology to analyse the safety of timed discrete event systems. First, our goal is to take out the forbidden state highlighted by a p-time Petri net modelling. This model deals with the requirements of the considered system and has to contain all the constraints that have to be respected. Then we aim at describing a process identified as a solution of the system functioning. This method consists in exploring all the possible behaviours of the system by means of the construction of state classes. Finally, we check if the proposed process corresponds to the requirements model previously built.Our case-study is the level crossing, a critical component for the safety of railway systems

Nowadays, rail transport has become one of the most widely utilised forms of transport thanks to its high safety level, large capacity, and cost-effectiveness. With the railway network's continuous development, including urban rail transit, one of the major areas of increasing attention and demand is ensuring safety or risk management in operation long-term remains for the whole life cycle by scientific tools, management of railway operation (Martani 2017), specifically in developed and developing countries like Vietnam. The situation in Vietnam demonstrates that the national mainline railway network has been built and operated entirely in a single narrow gauge (1000mm) since the previous century, with very few updates of manual operating technology. This significantly highlights that up to now, the conventional technique for managing the safety operation in general, and collision in particular, of the current Vietnamese railway system, including its subsystems, is only accident statistics which is not a scientific-based tool as the others like risk identify and analyse methods, risk mitigation…, that are already available in many countries. Accident management of Vietnam Railways is limited and responsible for accident statistics analysis to avoid and minimise the harm caused by phenomena that occur only after an accident. Statistical analysis of train accident case studies in Vietnam railway demonstrates that, because hazards and failures that could result in serious system occurrences (accidents and incidents) have not been identified, recorded, and evaluated to conduct safety-driven risk analysis using a well-suited assessment methodology, risk prevention and control cannot be achieved. Not only is it hard to forecast and avoid events, but it may also raise the chance and amount of danger, as well as the severity of the later effects. As a result, Vietnam's railway system has a high number of accidents and failure rates. For example, Vietnam Rail-ways' mainline network accounted for approximately 200 railway accidents in 2018, a 3% increase over the previous year, including 163 collisions between trains and road vehicles/persons, resulting in more than 100 fatalities and more than 150 casualties; 16 accidents, including almost derailments, the signal passed at danger… without fatality or casual-ty, but significant damage to rolling stock and track infrastructure (VR 2021). Focusing and developing a new standardised framework for safety management and availability of railway operation in Vietnam is required in view of the rapid development of rail urban transport in the country in recent years (VmoT 2016; VmoT 2018). UMRT Line HN2A in southwest Hanoi is the country's first elevated light rail transit line, which was completed and officially put into revenue service in November 2021. This greatly highlights that up to the current date, the UMRT Line HN2A is the first and only railway line in Vietnam with operational safety assessment launched for the first time and long-term remains for the whole life cycle. The fact that the UMRT Hanoi has a large capacity, more complicated rolling stock and infrastructure equipment, as well as a modern communica-tion-based train control (CBTC) signalling system and automatic train driving without the need for operator intervention (Lindqvist 2006), are all advantages. Developing a compatible and integrated safety management system (SMS) for adaption to the safety operating requirements of this UMRT is an important major point of concern, and this should be proven. In actuality, the system acceptance and safety certification phase for Metro Line HN2A prolonged up to 2.5 years owing to the identification of difficulties with noncompliance to safety requirements resulting from inadequate SMS documents and risk assessment. These faults and hazards have developed during the manufacturing and execution of the project; it is impossible to go back in time to correct them, and it is also impossible to ignore the project without assuming responsibility for its management. At the time of completion, the HN2A metro line will have required an expenditure of up to $868 million, thus it is vital to create measures to prevent system failure and assure passenger safety. This dissertation has reviewed the methods to solve the aforementioned challenges and presented a solution blueprint to attain the European standard level of system safety in three-phase as in the following: • Phase 1: applicable for lines that are currently in operation, such as Metro Line HN2A. Focused on operational and maintenance procedures, as well as a training plan for railway personnel, in order to enhance human performance. Complete and update the risk assessment framework for Metro Line HN2A. The dissertation's findings are described in these applications. • Phase 2: applicable for lines that are currently in construction and manufacturing, such as Metro Line HN3, Line HN2, HCMC Line 1 and Line 2. Continue refining and enhancing engineering management methods introduced during Phase 1. On the basis of the risk assessment by manufacturers (Line HN3, HCMC Line 2 with European manufacturers) and the risk assessment framework described in Chapter 4, a risk management plan for each line will be developed. Building Accident database for risk assessment research and development. • Phase 3: applicable for lines that are currently in planning. Enhance safety requirements and life-cycle management. Building a proactive Safety Culture step by step for the railway industry. This material is implemented gradually throughout all three phases, beginning with the creation of the concept and concluding with an improvement in the attitude of railway personnel on the HN2A line. In addition to this overview, Chapters 4 through Chapter 9 of the dissertation include particular solutions for Risk assessment, Vehicle and Infrastructure Maintenance methods, Inci-dent Management procedures, and Safety Culture installation. This document focuses on constructing a system safety concept for railway personnel, providing stringent and scientific management practises to assure proper engineering conditions, to manage effectively the metro line system, and ensuring passenger safety in Hanoi's metro operation

Cette thèse s'intéresse à l'étude des problèmes de diagnostic des fautes sur les systèmes à événements discrets en utilisant les modèles réseau de Petri. Des techniques d'exploration incrémentale et à-la-volée sont développées pour combattre le problème de l'explosion de l'état lors de l'analyse de la diagnosticabilité. Dans le contexte atemporel, la diagnosticabilité de modèles RdP-L est abordée par l'analyse d'une série de problèmes K-diagnosticabilité. L'analyse de la diagnosticabilité est effectuée sur la base de deux modèles nommés respectivement FM-graph et FM-set tree qui sont développés à-la-volée. Un diagnostiqueur peut être dérivé à partir du FM-set tree pour le diagnostic en ligne. Dans le contexte temporel, les techniques de fractionnement des intervalles de temps sont élaborées pour développer représentation de l'espace d'état des RdP-LT pour laquelle des techniques d'analyse de la diagnosticabilité peuvent être utilisées. Sur cette base, les conditions nécessaires et suffisantes pour la diagnosticabilité de RdP-LT ont été déterminées. En pratique, l'analyse de la diagnosticabilité est effectuée sur la base de la construction à-la-volée d'une structure nommée ASG et qui contient des informations relatives à l'occurrence de fautes. D'une manière générale, l'analyse effectuée sur la base des techniques à-la-volée et incrémentale permet de construire et explorer seulement une partie de l'espace d'état, même lorsque le système est diagnosticable. Les résultats des simulations effectuées sur certains benchmarks montrent l'efficacité de ces techniques en termes de temps et de mémoire par rapport aux approches traditionnelles basées sur l'énumération des états / This PhD thesis deals with fault diagnosis of discrete event systems using Petri net models. Some on-the-fly and incremental techniques are developed to reduce the state explosion problem while analyzing diagnosability. In the untimed context, an algebraic representation for labeled Petri nets (LPNs) is developed for featuring system behavior. The diagnosability of LPN models is tackled by analyzing a series of K-diagnosability problems. Two models called respectively FM-graph and FM-set tree are developed and built on the fly to record the necessary information for diagnosability analysis. Finally, a diagnoser is derived from the FM-set tree for online diagnosis. In the timed context, time interval splitting techniques are developed in order to make it possible to generate a state representation of labeled time Petri net (LTPN) models, for which techniques from the untimed context can be used to analyze diagnosability. Based on this, necessary and sufficient conditions for the diagnosability of LTPN models are determined. Moreover, we provide the solution for the minimum delay ∆ that ensures diagnosability. From a practical point of view, diagnosability analysis is performed on the basis of on-the-fly building of a structure that we call ASG and which holds fault information about the LTPN states. Generally, using on-the-fly analysis and incremental technique makes it possible to build and investigate only a part of the state space, even in the case when the system is diagnosable. Simulation results obtained on some chosen benchmarks show the efficiency in terms of time and memory compared with the traditional approaches using state enumeration

La sécurité est un enjeu majeur dans le cycle de développement des systèmes critiques, notamment dans le secteur du transport ferroviaire. Cette thèse vise la modélisation, la vérification et la validation des règles d'exploitation ferroviaires au regard des exigences de sécurité. Ces règles ont pour but de définir les autorisations de déplacement des trains sur des lignes ferroviaires nationales équipées du système européen de gestion du trafic ferroviaire (ERTMS). De manière analogue, on trouve les concepts liés aux autorisations dans la description des politiques de contrôle d'accès des systèmes d'information. Par conséquent, nos contributions portent sur l'adaptation d'une approche UML/B pour le contrôle d'accès des systèmes d'information afin de modéliser et de valider les règles d'exploitation ferroviaires. Dans un premier temps, nous avons adapté le modèle Role Based Access Control (RBAC) sur une étude de cas ferroviaire extraite des règles d'exploitation appliquées sur la ligne à grande vitesse LGV Est-Européenne en France. La plate-forme B4MSecure nous a permis de modéliser ces règles à l'aide d'un profil UML de RBAC inspiré de SecureUML. Ensuite, ces modèles sont transformés en des spécifications B qui ont été enrichies par des propriétés de sécurité ferroviaire et soumises à des activités de vérification et de validation formelles. Aux concepts du modèle RBAC, le modèle Organization Based Access Control (Or-Bac) introduit la notion d'organisation, au centre de ce modèle, et la notion de contexte. Nous avons donc proposé d’utiliser ce modèle en tant qu’extension du modèle RBAC dans l’optique d’une interopérabilité ferroviaire en ERTMS. / The safety is a major issue in the development cycle of the critical systems, in particular in the rail transportation sector. This thesis aims at the modeling, the verification and at the validation of the railway operating rules with regard to the safety requirements. These rules intend to define the authorizations of trains movement on national railway lines equipped with the European Rail Traffic Management System (ERTMS). In a similar way, we find the concepts of authorizations in the description of access control policies of information systems. Consequently, our contributions concern the adaptation of an UML/B approach for the access control of information systems to model and validate the railway operating rules. At first, we adapted the Role Based Access Control (RBAC) model on a railway case study extracted from the operating rules applied on the LGV-Est-Européenne line in France. The B4MSecure platform enables the modeling of these rules by means of a UML profile of RBAC inspired by SecureUML. Then, these models are transformed into B specifications. which are enhanced by railway safety properties and formally verified and validated. In addition to the concepts of the RBAC model, the Organization Based Access Control (Or-Bac) model introduces the notion of organization, in the center of this model, and the notion of context. We have therefore proposed to use this model as extension of the RBAC model in the context of railway interoperability in ERTMS.

This Diploma thesis deals with the preparation of the realization of the railway viaduct in Ostrov nad Oslavou. Realization of major technological stages is addressed in building technological study. Technological processes of each sub-job phases are supplemented by technical regulations, the design of the main building machines and mechanisms, inspection and test plan, schedule of occupational health and safety, time and financial plan construction, construction budget, a plan for securing material resources. I also worked out the technical report of the building sites facilities including drawings needed. I also worked out design rehabilitation of the substructure of the railway viaduct, which is consist of technical regulations for remediation work and drawings.