Assessing the impact of cyclic/acyclic EVC-DMI interactions in Automatic Train Control systems

The ERTMS-ATC system is a distributed system where the Driver Machine Interface (DMI) is a slave unit of the train onboard vital computer (EVC). Consequently, as for the information visualization and the input data acquisition, the data transfer between DMI and EVC must also be safe. A safe communication protocol stack has therefore to be provided for connecting safety-related peer agents as part of the architectural design. In this paper we analyze two types of communication protocols that could be used for the EVC-DMI interactions, based, respectively, on cyclic and acyclic messages’ exchange. Using the Stochastic Activity Network formalism, we adopt a modular modeling methodology to assess their impact on some significant dependability-related indicators, like the probability to successfully complete a mission without failures (unscheduled train stops), the steady-state system availability and the probability that a DMI failure causes a mission failure. The analysis of the obtained results allows the early design refinement of the system architecture, pointing out the improvements in adopting an acyclic protocol, possibly with one spare DMI component.