Reliability and Safety Evaluation of COTS Based Cloud Railway Signalling Systems

In recent years, especially in Europe, cloud-based railway signalling systems are becoming practical. These systems centrally control field equipment (such as signals and switches) from a central unit located remotely via a network, rather than being installed at the field equipment's location. To achieve a highly available and cost-effective cloud-based railway signalling system, a COTS (Commercial-Off- The-Shelf) based cloud railway signalling system have been proposed, which implements the central unit with cost-effective and high-performance COTS hardware. Railway signalling systems require high levels of safety and reliability. For safety, it is required that the occurrence of hazardous failures leading to train derailments or collisions be once every 10,000 to 100,000 years. Regarding reliability, it is required to maintain adequate availability of the system during the mission time (approximately 20 hours) and to avoid emergency stops as much as possible to ensure safety. This study discusses countermeasures against non-human-induced failures and human-induced failures, which are challenges for the aforementioned system. For non-human-induced failures, we focus on transmission interruptions lasting several seconds in the message transmission path between the central unit and the field terminals connected near each field equipment. For human-induced failures, we focus on the compromise of less than the majority of the multiplexed central units. We then propose countermeasures for these challenges. Next, we construct a Markov model to describe system behavior in various scenarios: normal conditions, transmission interruption, compromise, and simultaneous transmission interruption and compromise. Furthermore, based on these models, we analytically evaluate the reliability and safety of the proposed countermeasures.