Aspects of the safety analysis of an on-board automatic train operation supervisor

In today´s train operations the driver may no longer be the primary guardian of the safety of the train, that function being taken over by various forms of automatic train protection (ATP) systems. What is left for the driver is still an important safety supporting function which is their capacity to review the set of train control actions that they intend to apply, and match those with the current state of the train and current external conditions. And as many in the industry would know, ATP systems are not always perfect. In automatic train operation (ATO), where the driver is to be replaced, this residual safety function must be automated also. Where this becomes particularly important is in long heavy-haul trains where the driver´s experience and the undesirability of relying on the emergency braking capability provided by the ATP system is a much more significant issue. This paper focuses on the safety analysis of a train control supervisor for ATO using timed Petri nets as the modelling approach.