When a signaling system reaches its end of life, an overall replacement is necessary. The replacement may be in-kind but for many mass transit agencies, it is common that capacity needs will have grown significantly, and the transit agency is required to increase capacity while tackling obsolescence. Capacity and obsolescence are the primary reasons for deploying Communications Based Train Control (CBTC) technology to replace conventional trip stop and track circuit-based systems operated by New York City Transit (NYCT) or cab signaling systems operated by Baltimore Maryland Transit Administration (MTA) and the San Francisco Bay Area Rapid Transit District (BART). Resignaling projects are often refereed as brownfield train control projects. Due to the technical and commercial complexity, the quantity of stakeholders, the number of interfaces, the regulatory involvement via safety certification, the temporal and geographic scale of the project and the continual evolution of the existing system, a robust Systems Engineering (SE) process is necessary to achieve success in large signaling replacement projects. This paper describes the software tools and processes that were deployed to meet the technical, legal and commercial needs of a large signaling replacement project during the specification development phase. The processes put in place were tailored to the size and location of the team members. The paper describes the software tools, such as IBM Rational DOORS, Microsoft SharePoint Online and Office 365 which were integrated and configured to allow for collaboration while accounting for the security, commercial and legal requirements of the agency. The selection, deployment and management of these processes and tools enabled the large, complex project to succeed.

Conventional problem solving is a time-honored and accepted methodology for solving many problems we encounter in our daily home and work lives. Thought processes can be linear (like a programmer) or non-linear and still use conventional problem solving skills. Conventional problem solving begins with a statement of the problem, accumulation of data, analysis of data and proposals of solutions to the problem, then testing of the hypotheses. Non-conventional problem solving often skips some of these steps, beginning with a statement of the problem and ending with possible solutions. The tools of conventional problem solving include “critical thinking”, Fool-proofing, “thinking outside the box” and Statistical techniques. Consider the first of our ancestors to figure out that harnessing fire would provide security from large predators, make food safer and easier to eat and make tools such as fire hardened tips on spears. Did all these inventions occur in one moment of genius, or did they take innumerable years to accomplish? Sometime in this process of non-conventional thinking our ancestors brought forth a new technology which ensured the survival of our species. So, how does non-conventional problem solving work? When current theory does not appear to work, then we look to the margins of our science to see if current theory continues to be ineffective. Most theories fail in the margins of the science. A classic example of conventional science failing in the margins is the general and special theory of relativity. Non-conventional problem solving offers greater opportunity for revolutionary rather than incremental, or evolutionary advancements to our science. Other examples are included in this paper. Two wheel related problems are also presented using non-conventional problem solving techniques to provide alternative solutions.

Advanced Train Control System (ATCS) is a proprietary network protocol that expands the functionality and efficiency of Centralized Traffic Control (CTC) systems, by using radio communications (radio code line) for message delivery. However, end-to-end cyber security issues were not considered during initial design of ATCS in the 1980s. Meanwhile, the landscape of cyber-physical threats and vulnerabilities has changed dramatically over the last three decades. Even though cutting-edge systems like Positive Train Control (PTC) have adopted security properties such as integrity check and encryption methods, major railroads in North America still deploy legacy ATCS standards to maintain their individual CTC system. This paper first illustrated the background and general specifications of ATCS applications in North American railroads. The research team has noticed that few studies have systematically analyzed this topic since the emergence of ATCS, though its applications are still prevailing in the industry. Divided by both vital and non-vital operational scenarios, this paper presented case studies for ATCS-related vulnerabilities. We used a sender-receiver sequencing-based analysis and proposed a consequence-based simulation model to identify and further evaluate the cyber and physical risks under potential cyber-attacks. For the identified risk, the paper evaluated the likelihood based on the practical operational sequences, and recommended potential countermeasures for the industry to improve the security over the specific case. The research concluded that the fail-safe design in the ATCS systems would prevent the exploiting known security vulnerabilities which could result in unsafe train movements. However, the service disruptions under certain speculated attacks need further evaluation. At the end of this paper, we discussed our ongoing work for disruption evaluation in the wake of successful cyber attacks.

Movable railroad bridges, consisting of lift, bascule, or swing bridges have been used by American rail tracks that cross usable waterways for over a century. Although custom made, movable bridges share many common components and designs. Most of them use weight bearing towers for the movable span using electric or electro-hydraulic systems lift and/or rotate these movable spans. Automated locks hold the bridge in place as soon as the movement stops. The bridge operation, train and ship signaling systems work in synchrony for trains and waterway traffic to be granted safe passage with minimal delay. This synchrony is maintained by using custom-made control systems using Programmable Logic Controllers (PLCs) or Field Programmable Gate Arrays (FPGAs). Controllers located on the movable and the static parts of the bridge communicate using radio and/or wired underwater links sometimes involving marine cables. The primary objective of this paper is to develop a framework to analyze the safety and security of the bridge operating systems and their synchronous operations with railway and waterway systems. We do so by modeling the movable physical components and their control system with the interconnected network system and determine the faults and attacks that may affect their operations. Given the prevalence of attacks against PLCs, FPGAs and controllers, we show a generic way to determine the effect of what if scenarios that may arise due to attacks combined with failures using a case study of a swing bridge.

Cameras are substantial elements to provide security to passengers in public spaces, e.g. in urban subway environments. Automated image processing algorithms are used more and more often to analyze the cameras’ video streams. However, misaligned cameras may produce serious problems by either generating false alarms or even being blind due to a shifted field of view. This paper presents two simple, real-time, and straight-forward software methods to detect camera movement and also allow for an adjustable tolerance, i.e. small changes are acceptable. The first approach shifts a reference edge (from a master image) along a convenient path; the second method uses distance measuring to detect a critical camera movement. Both methods are tested on real-world video from a subway environment. Since the algorithms are proposed for application in a railway environment with typically high requirements on operational robustness and reliability, special emphasis is put on constraints and limitations of the presented algorithms.

The mission of the U.S. Transportation Security Administration (TSA) is protection of the nation’s transportation systems to ensure freedom of movement for people and commerce. In furtherance of its mission, TSA’s Office of Security Capabilities has contracted with Transportation Technology Center, Inc. (TTCI) and Arup North America Ltd (Arup) to conduct research to quantify the vulnerability of railcars and infrastructure to damage caused by the use of explosives. The main objectives of the ongoing research program are to develop tools to evaluate the performance of existing railcar structures, develop potential mitigation measures for current railcars, and investigate future advanced designs under blast conditions. TTCI performed a series of full-scale tests on three major passenger railcar types: light rail, commuter and transit. Test scenarios were developed based on extensive risk assessment and historical data. Tested scenarios include single internal charges in various locations, simultaneous internal charges and external charges on a station platform. Well instrumented tests provide experimental assessments of existing railcars’ blast performance and data for validation and refinements of finite element blast models developed by Arup. The blast models incorporate sophisticated computational fluid dynamics (CFD) modeling of blast events to predict blast wave propagation and pressure applied on the structure. Hitherto research has focused on the railcar structure. However the test series has provided information on damage to infrastructure, including rail, ties, ballast, and both catenary and third-rail electrification systems. The finite-element blast models will provide railcar designers the means to investigate the effects of blast mitigation measures and reduce the need for physical tests. Several mitigation measures were installed and tested to evaluate their effectiveness. One car was equipped with typical interior components including seats and partition walls. One side of the car was equipped with standard components and the other side with remedial components that are intended to mitigate the effects of a blast. A similar approach was used for windows. This configuration allowed direct comparisons and performance assessments of the blast mitigation measures. Companion modeling and finite element analysis (FEA) of the blast response of the railcar and interior components provided a computational tool by which mitigation measures may be assessed and refined. This paper summarizes recent research sponsored by TSA and conducted by TTCI and Arup on blast vulnerability of railcars and infrastructure to damage caused by the use of explosives.

This paper deals with Physical Safety and Security at rail crossings. There are about 150,000 public railroad grade crossings in the U.S. Unfortunately, approximately 2,000 accidents occur every year in the U.S., resulting not only in many injuries, but also in over 200 deaths annually. The predicament is that for various reasons, people, cars, and trucks find themselves on the rail tracks of an oncoming train at a railroad crossing. The system discussed in this paper provides a relatively inexpensive Internet of Things (IoT)-based capability that can be used to alert a rail operator that there is an obstruction on the tracks, and/or possibly to interwork with (but not replace) a Positive Train Control (PTC) system thus attempting to automatically stop an incoming train. In fact, IoT is now being deployed in railroads for a variety of applications. A brief description of cybersecurity issues related to IoT deployment is also included.

In urban area, frequent train services during peak hours often keep interrupting roadway traffic approaching level crossings (LXs). In Taiwan, more than 24 trains per hour pass the LXs in peak hours, and it leads to more than 40% time blocked by the barriers. To mitigate the potential risk of accidents between trains and roadway vehicles, almost 20% LXs had been installed with obstacle detection devices. It, however, leads to the following issues: (1) when the level crossings open and then close within a short period of time, the vehicles would likely be trapped in the dangerous area; (2) if the closing time at level crossings is not adjusted effectively, it would seriously impact the traffic flow and increase the possibility of trespassing; (3) the false alarm triggered by the obstacle detection devices has serious impact on train punctuality. To mitigate the influence on roadside traffic and improve the safety, this study developed an intelligent module which consists of the following functions: (1) transmitting real-time videos of level crossings to the approaching trains, (2) constant alarm time for trains with different approaching speeds, and (3) extending alarm time for trains from the opposite directions within short time periods. A level crossing located on curved line in urban area was selected to test the performance of these functions in an actual scenario. Alternative solutions were also adopted in the tests to compare the performance for reference. The results show that the module can be viable in practice, but needs further works to ensure the safety, such as developing a fail-safe mechanism and overcoming the software security issues.

American Railroads are planning to complete implementing their Positive Train Control (PTC) systems by 2020. Safety objectives of PTC are to avoid inter-train collisions, train derailments and ensuring railroad worker safety. Under published specifications of I-ETMS (the PTC system developed by Class I freight railroads), the on-board PTC controller communicates with two networks; namely, the Signaling network and the Wayside Interface Unit network to gather navigational information such as the positions of other trains, the status of critical infrastructure (such as switches) and any hazardous conditions that may affect the train path. By design, PTC systems are predicated on having a reliable radio network operating in reserved radio spectrum, although the PTC system itself is designed to be a real-time fail safe distributed control systems. Secure Intelligent Radio for Trains (SIRT) is an intelligent radio that is customized to train operations with the aim of improving the reliability and security of the radio communication network. SIRT has two tiers. The upper tier has the Master Cognitive Engine (MCE) which communicates with other SIRT nodes to obtain signaling and wayside device information. To do so, the MCE communicates with cognitive engines at the lower tier of SIRT; namely the Cryptographic Cognitive Engine (CCE) (that provide cryptographic security and threat detection) and the Spectrum Management Cognitive Engine (SCE) (that uses spectrum monitoring, frequency hopping and adaptive modulation to ensure the reliability of the radio communication medium). We presented the architecture and the prototype development of the CCE in [1]. This paper presents the design of the MCE and the SCE. We are currently developing a prototype of the SCE and the MCE and testing the performance of our cognitive radio system under varying radio noise conditions. Our experiments show that SIRT dynamically switches modulation schemes in response to radio noise and switches channels in response to channel jamming.

Positive Train Controller (PTC) is a communication based system designed to enforce PTC safety objectives for trains such as train-to-train collisions, train derailments, and ensure railroad worker safety. Existing PTC designs consider risks due to operational environment such as location of other trains, switches, and speed limits. We propose to enhance PTC by using a multi-tiered cognitive radio network that considers multiple risks such as those due to bandwidth congestion, packet length limitations, propagation losses, detectable exploitation of Software Defined Radio vulnerabilities, and protocol vulnerabilities. Radios operating at PTC nodes (such as train, WIU and Base station) is equipped with a cognitive layer, which communicates with other nodes to create a cognitive radio network. The proposed network as a whole strives to provide spectrum management and security for the radio communication system, which can enhance the PTC functionality. Each cognitive radio in our proposed network consists of multiple tiers. The upper tier consists of a master cognitive engine that holistically evaluates the operational risks of the network and acts to mitigate them using the lower tiers. The lower tier (immediate slave tier to the master) consists of sub cognitive engines for cryptographic operations and spectrum management. The traditional PTC protocol is implemented at a lower tier module that interface with the master Cognitive Engine (CE). The master-slave communications within one radio is implemented using middleware. The proposed cognitive radio network can be modeled as a cyber-physical system by incorporating train movement dynamics, radio transmission characteristics and cryptographical computations, thereby constituting a distributed system of communicating hybrid automatons. This design enables us to verify safety and the security of the system using formal methods, which constitutes our ongoing work. We also discuss potential issues such as FRA mandated safety cases that needs to be addressed if the proposed features are to be added to the PTC systems.

The railroad industry is being challenged by recent state regulations requiring the disclosure of routing information of trains carrying hazardous materials (hazmat) to the general public. While there is a need to know, the dissemination of such information is contrary to both industry practice and Federal Railroad Administration (FRA) rules. The conundrum is that there needs to be disclosure to first responders, law enforcement, fusion centers and the like to ensure the security and safety of the public. This paper addresses the rules regulating the movement and handling of hazmat, to include toxic inhalation hazard (TIH) material; government demands, particularly those at the state level to release the routes, commodities, and quantities to the general public; and the operational impacts and risks that could result. It then explores the security of how hazmat train routing information can be safeguarded while ensuring that first responders and affected communities have what is needed to address the risks and be able to effectively respond to incidents. The overlaps and conflicts found in the rules and regulations of the Transportation Security Administration (TSA) and the Pipeline and Hazardous Material Safety Administration (PHMSA) are also addressed.

Railroads are increasingly using Communication-Based Train Control (CBTC) technology to improve service capacity and operating efficiency. CBTC is a mission-critical system under which train monitoring and train control are integrated into a single unified system through data links between vehicles, central processors, and wayside equipment. Radio over fiber technology provides a flexible and efficient solution for the Data Communication System (DCS) which needs to ensure integrity and reliability of message delivery in a transparent manner for the train control functions. A Security Device (SD) is defined as a network entity located between the railroad administration’s (the customer) trusted wired network and the non-trusted portion of the DCS network including the radio-based segment, which runs on a customized piece of hardware with a secure operating system and provides secure gateway functionality. This paper puts forward a network architecture and SD software platform design which meets the requirements of a typical CBTC system. The IPSEC protocol used by the SD for data protection renders authentication service through X.509 certificates. A network setup is put together as the proof-of-concept for the presented design proposal and performance assessment is conducted through experimental studies.

Level crossing risk continues to be a significant safety concern for the security of rail operations around the world. Over the last decade or so, a third of railway related fatalities occurred as a direct result of collisions between road and rail vehicles in Australia. Importantly, nearly half of these collisions occurred at railway level crossings with no active protection, such as flashing lights or boom barriers. Current practice is to upgrade level crossings that have no active protection. However, the total number of level crossings found across Australia exceed 23,500, and targeting the proportion of these that are considered high risk (e.g. public crossings with passive controls) would cost in excess of AU$3.25 billion based on equipment, installation and commissioning costs of warning devices that are currently type approved. Level crossing warning devices that are low-cost provide a potentially effective control for reducing risk; however, over the last decade, there have been significant barriers and legal issues in both Australia and the US that have foreshadowed their adoption. These devices are designed to have significantly lower lifecycle costs compared with traditional warning devices. They often make use of use of alternative technologies for train detection, wireless connectivity and solar energy supply. This paper describes the barriers that have been encountered for the adoption of these devices in Australia, including the challenges associated with: (1) determining requisite safety levels for such devices; (2) legal issues relating to duty of care obligations of railway operators; and (3) issues of Tort liability around the use of less than fail-safe equipment. This paper provides an overview of a comprehensive safety justification that was developed as part of a project funded by a collaborative rail research initiative established by the Australian government, and describes the conceptual framework and processes being used to justify its adoption. The paper provides a summary of key points from peer review and discusses prospective barriers that may need to be overcome for future adoption. A successful outcome from this process would result in the development of a guideline for decision-making, providing a precedence for adopting low-cost level crossing warning devices in other parts of the world. The framework described in this paper also provides relevance to the review and adoption of analogous technologies in rail and other safety critical industries.

A vital aspect of safety and security management during the development of new rail and transit projects is ensuring that safety and security requirements are properly developed and incorporated into the work products in a planned, systematic and traceable manner. The completed rail or transit project will need to operate as a fully integrated system, but it will likely be designed, supplied, constructed and tested by many parties organized through multiple contracts. Each contracted entity has a responsibility to do some aspect of the work, and can have an impact on the safety and security of the completed rail or transit project. In addition, other impacts to safety and security can arise from system interfaces and inter-modal systems, from other rail and bus systems servicing the corridor/region to highways, bike, pedestrian walkways and para-transit. This paper discusses the critical role of safety and security requirements management during the development and delivery of rail or transit projects to ensure that safety and security is inherent in the project, consistent with US DOT regulations. Safety and security requirements management should be an integrated part of project management, rather than an after-thought at the end of the project. Requirements are not prescribed solutions; rather they are explicit statements, categorized into a logical framework, describing the functions, behaviors and qualities to be achieved. Requirements are typically specified by the owner to express what a new rail or transit project needs to accomplish from an operations perspective. Amongst the project requirements are the safety and security requirements that must be satisfied. The designer proposes a solution to satisfy the requirements, taking into account risk, cost, schedule, and other constraints such as technical issues and human factors. By using the techniques of requirements management, owners of rail and transit properties will have visibility into the status of safety and security throughout project implementation to facilitate control over the project to realize successful outcomes. It should be noted that requirements management techniques are also applicable during the operations and maintenance, retrofit and disposal phases of a rail or transit project. Managing safety and security requirements including the verification process in a planned, systematic and documented manner confirms to the owner, operators, oversight agencies and the general public that safety and security risks have been appropriately taken into account. Thus the owner can ultimately state with confidence that the completed system is safe for operations and public use.

The timely delivery, correctness, integrity, and authenticity of signaling messages sent to trains running under Positive Train Control (PTC) are necessary to ensure safe train operations and to prevent the insertion of malicious messages or the alteration of authentic ones in transit in train control traffic. Mutual authentication of trains and messages must occur when a train enters a zone under PTC from dark territory, when a train moves from one railroad company’s network to another’s, when a train communicates with a Wayside Interface Unit, or when it communicates with the head of a work crew on the railroad line. We describe concerns about performance requirements and protocol security related to this process, and develop a framework for defining use cases, performance models, and secure methods to meet them.

Ensuring rail safety is a priority for the Federal Railroad Administration (FRA) and the railroad industry in North America. One such endeavor is to leverage Wireless Sensor Networks (WSN) to monitor and report in real-time the status of mechanical and electrical components for each railcar, and in conjunction with other railroad subsystems, ensure the safety, security and integrity of transported goods. The envisioned solution utilizes sensors installed on each railcar to form a train-based wireless network and collect real-time (or near real-time) information on different elements of a train and transmit aggregated information to the locomotive, dispatch centers or regional offices for early fault detection and accident prevention. The railroads have been interested in using a standards-based low-cost communication protocol for this purpose, such as IEEE 802.15.4, often referred to as ZigBee. Our results show, however, that ZigBee was designed for smaller wireless networks, such as a single railcar. It exhibits several critical problems associated with the unique network topology found on a freight train and the size of such a network. In essence, the network would take the shape of a very long chain of nodes. Some of the problems stemming from this topology are excessively long synchronization delays for establishing the network along the entire train, severe problems with route discovery and maintenance necessary for selecting the next relay node along the chain, aggregation of data errors and a resulting unacceptable packet loss rate, the lack of a traffic prioritization mechanism to protect important packets such as those containing critical alarms of equipment failure, and many more. In this paper, we describe our findings and experiences in our evaluation of ZigBee for railcar monitoring onboard freight trains, a detailed analysis of the identified problems and their impact on the envisioned railcar monitoring as well as discuss potential solutions to these problems.

Passenger share research of different transport models will help the transport sector to develop a more rational operating strategy and provide an important basis for the future transport planning and construction. The development of the Agent theory provides a new direction for the simulation of the passenger share. In this paper, we use the Agent theory combining with the Genetic Algorithms to simulate the passenger share of the four travel modes (the High-speed rail, the common rail, the highways and the civil aviation) in the ShangHai-NanJing transport line. First, we consider each passenger as an Agent according to the Agent theory, and then design the passenger’s travel choice and transform mechanism according to the passenger’s travel choice behavior. Second, this paper has used the genetic algorithm to design the passengers’ interaction mechanism under the interaction in the passengers’ travel choice, including the elimination, crossover and mutation mechanism. Third, we choose the five factors, such as Security, Convenience, Comfort, Ticket Price and Train speed to be the indexes to evaluate the passenger’s satisfaction and conducted a questionnaire survey in the ShangHai-NanJing transport Line. Based on this, this paper uses the entropy theory to get the weight of different types of travelers to different factors and establishes evaluation criteria for the passenger’s satisfaction. At last we use the dates that surveyed in the ShangHai-NanJing transport line to simulate the passenger share of the four transport models (the High-speed rail, the common rail, the highways and the civil aviation) and the characteristic of each type of passenger flow structure. Based on the result of the passenger share simulation, we have also analyzed the sensitivity of the five factors (Security, Convenience, Comfort, Ticket Price and Speed) that affect the passenger’s travel choice and researched how these travel factors affect the passengers’ travel choice and the passenger share of different travel modes.

The Southeastern Pennsylvania Transportation Authority (SEPTA), the 6th largest transit system in the U.S. by passenger miles travelled, is among the nation’s commuter rail agencies in the process of implementing Positive Train Control (PTC) that must be completed by the Federal mandate deadline of December, 2015. SEPTA will be implementing ACSES (Advanced Civil Speed Enforcement System), originally introduced on Amtrak on portions of the Northeast Corridor (NEC), as an overlay system applied upon a base of Automatic Train Control (ATC) cab signaling. Every SEPTA train travels on Amtrak territory as a “tenant” at some time during its daily run, and consequently ACSES is required for interoperable PTC operation on Amtrak. The application of ACSES on SEPTA territory will be complemented by a simultaneous upgrading of existing and new ATC on SEPTA. Among the many decisions faced by the SEPTA PTC design team, the PTC communications systems design has proven to be challenging. The communications systems include digital radios, communications managers, ground based networks, office systems, network management and network security. Some elements have been designed from the ground up, with few commercial “off the shelf” components available to meet the design requirements. Moreover, SEPTA had limited 220 MHz spectrum available for a PTC radio network in a relatively compact geographic area of dense commuter rail traffic. The radio network and communications managers, in particular, are breaking new ground for U.S. commuter rail operations with adoption of Time Division Multiple Access (TDMA) digital packet radios operating in the 220 MHz spectrum, under the control of communications managers. This paper will present an overview of SEPTA’s PTC communications systems, and focus upon the design process, subsequent field testing, and the rationale behind key decisions reached by the design team, that led to the selection of the technologies and network topologies that will be utilized in meeting the implementation of PTC at SEPTA.

Excellent condition of track geometry status is the foundation to ensure train travel security. The detection data of track inspection car contains many valuable features of the track status. The technique of gray forecast and Kalman filtering can be used to investigate the problem and predict the status change of the track geometry. In this paper, gray forecast is used in qualitative analysis of track geometry status changes, and we predict the development of track geometry status change using the Kalman filter prediction model and specific recursive algorithm, established prediction model of the track geometry to make an emulation experiment to analyze the data that track inspection car has detected, and predict changing trends of track geometry the state. Experiment results show that the application model of improved Kalman filter to predict the track geometry status changes gets a higher accuracy, and it can reflect the real change tendency of the track status.

The purpose of this IEEE and Transit IDEA project was to develop and test a device to give rail transit personnel and train operators advance warning of dangers well in advance of entering the danger zones such as approaching train and other potential dangers such as Fire, Chemical, and Biological Releases. This device can provide a reliable way of giving the track worker; train operator and emergency responders a warning in enough time to avoid potential accidents, injuries, or death. Further this device cuts down on incident response time from the Operational Control Center to Command Center to provide additional security and eliminate lost response time. The information provided in this report will enable other rail rapid transit agencies the ability to consider using such devices to give early warning of approaching trains and other dangers to track workers, track walkers, track inspectors, emergency responders and signal personnel and also to give the train operator early warning of the presence of personnel in the track area as well as other dangers ahead.