See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/335939861

Obtaining Generic Petri Net Models of Railway Signaling Equipment

Chapter · September 2019

DOI: 10.1007/978-3-030-30329-7_17

CITATIONS READS

0 682

5 authors, including:

Mustafa Seçkin Durmuş Roman Tsarev

Sadenco Engineering Siberian Federal University
48 PUBLICATIONS   261 CITATIONS    97 PUBLICATIONS   214 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Symmetry in Software Engineering and E-learning View project

Turkish National Railway Signalization Project View project

All content following this page was uploaded by Mustafa Seçkin Durmuş on 27 September 2019.

The user has requested enhancement of the downloaded file.

Obtaining Generic Petri net Models of Railway Signaling
Equipment

İlker Üstoğlu1[0000-0003-3192-2246], Danie Töpel2, Mustafa Seckin Durmus3[0000-0003-3891-2817]

and Roman Yurievich Tsarev4[0000-0002-6740-1840]
1 YildizTechnical University, Control and Automation Engineering Dept., Istanbul, Turkey
2 Sheffield Hallam University, Sheffield, United Kingdom
3 Sadenco (Safe, Dependable Engineering & Consultancy), Antalya, Turkey
4 Siberian Federal University, Department of Informatics, Krasnoyarsk, Russia

ustoglu@yildiz.edu.tr

Abstract. This paper describes a model for railway signals in the context of in-
terlocking. Since the design and construction of the software models shall be ob-
tained in a formal way, the models were created using Petri nets to allow auto-
matic verification and validation. A generic model for railway signals was de-
signed and further utilized for the German railway signaling systems (The Ks
signaling system). Simplified Petri net models for points, track segments and sig-
nals are given as a frame. The obtained models are also applied to a real station
layout.

Keywords: Railway signaling, Ks-signaling system, timed arc Petri nets.

1 Introduction

Railways are said to be a safe transport system when compared to other means of
transport over the land. The interlocking is a safety-critical system that controls the
movement of trains in a station and between neighboring stations, and it needs to ensure
that the system prevents dangerous situations.
In the railway engineering domain, Petri nets are used in some applications like su-
pervisory control approach [1], scheduling [2], signaling systems [3], modeling and
simulation [4] and developing interlocking [5]. Various more attempts have been made
to model railway interlocking with Petri nets [6]. Doing this has two main reasons. The
first is to ease verification and validation of the model. The second is to get one step
closer to generating interlocking software, as done in [7]. This paper will concentrate
on the elaboration of those parts of the Petri net which represent the railway signals. A
basic interlocking model will also be included as a frame.
A Petri net of a railway signal is shown in [8], [9] and [10] uses a simple signal
model. In these nets, two points are missing: The first point is blown bulbs. For the case
a missing light would upgrade the signal aspect, measurements must be taken to prevent
this situation. This could be done by designing signal aspect which is immune to such
2

failures or by using a diagnose mechanism. The second point missing is the full func-
tionality for distant signaling. In the cases mentioned above a signal changes its aspect
according to the next signal’s aspect when the route is opened, but after that no longer
listens the evolution at the following signal. Whereas the signals above know only a
small number of aspects, German railway signals know a much wider variety of signal
aspects. Speed restrictions are specified in increments of 10 𝑘𝑚/ℎ and route letters can
indicate a direction. Additionally three major signaling systems are currently in use.
Further complexity is added by the fact that not all signals can show the same aspects.
Therefore, the Petri net for every signal looks different.
This paper tries to find patterns to determine the characteristic attributes of a signal
and to generate a Petri net from this information. Section II will give an overview on
Petri Nets. The model is described in Section III and a concrete example is presented
in section IV. Finally, a conclusion is given in Section V.

2 Preliminaries

2.1 Abbreviations and Notations

Ks system : Kombinationssignale (combination signal)
Hp system : Hauptsignale (main signal, West Germany signaling system)
Hl system : East Germany signaling system
PN : Petri net
TAPAAL : Tool for Verification of Timed-Arc Petri Nets
TAPN : Timed Arc Petri net
PNML : Petri net Markup Language
XML : Extensible Markup Language

2.2 Petri nets and Timed-Arc Petri nets

A Petri net is a kind of bipartite directed graphs consisting of four types of objects.
These objects are transitions, places, directed arcs, and tokens. Transitions (the active
components) symbolize the actions (signified by bars or rectangles), and they model
the activities which can occur thus changing the marking of the Petri net. A marking
can be considered as an assignment of tokens to the places of a Petri net.
The places, signified by circles, symbolize the conditions (=states) that need to be
met before an action can be carried out. Directed arcs connect places to transitions or
transitions to places. The places from which an arc runs to a transition are known as the
input places of the transition and the places to which arcs run from a transition are called
the output places of the transition. Places may contain tokens that may move to other
places by executing firing actions.
Transitions are only allowed to fire if all the preconditions for the activity are ful-
filled, i.e., there are enough tokens available in the input places. Recall that the tokens
 3

can represent the jobs performed, the flow control, resource availability or synchroni-
zation conditions. When the transition fires, it removes tokens from its input places and
adds some at all of its output places. The number of tokens added or removed depends
on the weight of each arc.
Let ℕ denote the set of natural numbers and let ℕ = {0} ∪ ℕ. The Petri net PN as a
mathematical discrete event simulation modeling tool can be defined by a quintuple as
follows:

𝑃𝑁 = (𝑃, 𝑇, 𝑃𝑟𝑒, 𝑃𝑜𝑠𝑡, 𝑀0 ) (1)

 𝑃 = {𝑝1 , 𝑝2 , … , 𝑝𝑘 } is the finite set of places,

 𝑇 = {𝑡1 , 𝑡2 , … , 𝑡𝑧 } is the finite set of transitions,
 𝑃𝑟𝑒: (𝑃 × 𝑇) → ℕ represents the directed ordinary arcs from places to transitions,
 𝑃𝑜𝑠𝑡: (𝑇 × 𝑃) → ℕ represents the directed ordinary arcs from transitions to
places,
 𝑀0 : 𝑃 → ℕ0 is the initial marking,
 𝑃 ∩ 𝑇 = ∅ and 𝑃 ∪ 𝑇 ≠ ∅.
Timed arc Petri nets as defined in [11], [12] are an extension to standard PNs which
has invariants, inhibitor arcs (circle arrow tip, ⊸), enabling arcs (⇾) and transport arcs
(diamond arrow tip, ), and are characterized by a tuple as follows:

𝑇𝐴𝑃𝑁 = (𝑃, 𝑇, 𝐹, 𝑐, 𝐹𝑡𝑎𝑟𝑐 , 𝑐𝑡𝑎𝑟𝑐 , 𝐹𝑖𝑛ℎ𝑖𝑏 , 𝑐𝑖𝑛ℎ𝑖𝑏 , 𝑡) (2)

 𝐹 ⊆ (𝑃 × 𝑇) ∪ (𝑇 × 𝑃) is the set of normal arcs called the flow relation,

 𝑐: 𝐹|𝑃×𝑇 → 𝐼 is the function assigning time intervals to arcs from places to transi-
tions,
 𝐹𝑡𝑎𝑟𝑐 ⊆ (𝑃 × 𝑇 × 𝑃) is the set of transport arcs,
 𝐹𝑖𝑛ℎ𝑖𝑏 ⊆ (𝑃 × 𝑇 × 𝑃) is the set of inhibitor arcs,
 𝑐𝑡𝑎𝑟𝑐 : 𝐹𝑡𝑎𝑟𝑐 → 𝐼 ℕ0 is the function assigning time intervals to transport arcs,
 𝑡: 𝑃 → 𝐼 is the function assigning invariants to places.

As mentioned previously, the places in the model may contain tokens, which are
associated with a real numbers giving the age of the token. Invariants can be assigned
to places that restrict the ages of tokens in that place. The normal arcs from places to
transitions will consume tokens whereas normal arcs from transitions to places will
produce tokens. The only difference of a transport arc is that any token produced will
have the same age as the one consumed.
Inhibitor arcs are used to test for the absence of tokens of particular ages in places.
In other words, they allow a transition to fire only when the inhibiting place is empty.
Therefore it is a read-only arc. Recall that it is only used from places to transitions. The
enabling arc is a bidirectional transport arc, giving back the used tokens unaltered,
which makes it also a read-only arc.
As mentioned previously, the places in the model may contain tokens, which are
associated with a real numbers giving the age of the token. Invariants can be assigned
to places that restrict the ages of tokens in that place. The normal arcs from places to
transitions will consume tokens whereas normal arcs from transitions to places will
4

produce tokens. The only difference of a transport arc is that any token produced will
have the same age as the one consumed. Inhibitor arcs are used to test for the absence
of tokens of particular ages in places. In other words, they allow a transition to fire only
when the inhibiting place is empty. Therefore it is a read-only arc. Recall that it is only
used from places to transitions. The enabling arc is a bidirectional transport arc, giving
back the used tokens unaltered, which makes it also a read-only arc.

2.3 PNML

The files read and written by TAPAAL are written in PNML. The general format of
PNML is a labeled graph with two kinds of nodes: places and transitions [13]. PNML
is based on the XML [14]. The Petri net, the objects, and the labels are represented as
XML elements. A Petri Net file contains (in this case) shared places and nets. A net
contains places, transitions, and arc [15]

2.4 The Ks Signaling System

A railway yard is made up of the following components: Train lines are split up into
track segments, and each segment is associated with an axle counter or a track circuit
which can detect if a train is in the segment.
A point is a mechanical tool used to merge two lines into one line and lets the trains
to be guided from one segment to another at a railway intersection. The two possible
positions of a point are called normal and reverse. These two positions are determined
at the mounting stage and cannot be changed furthermore. A train can drive over a point
if it has been locked into a position physically.
Routes are sequentially-connected track segments that begin and end at signals.
They are defined on the interlocking control tables at the beginning of the design phase.
A signal is a device placed next to the track which uses color lights or other means
to give information to the train driver. A signal aspect encodes the information provided
to the train driver, for example one green light above a yellow light. A signal book
describes the appearance and meaning of a signal aspect. A signal information is an
actual information given to the driver, for example proceed with 40 𝑘𝑚/ℎ.
There are three types of signals: Main, distant and combined signals. Main signals
show stop or an allowed speed and optionally a direction indicator and a left track in-
dicator. A distant signal announces the information from the main signal. If two signals
follow within breaking distance, a combined signal may show the distant information
for the next signal.
The signaling system presented in this paper is the Ks signal system used in Ger-
many. This system was designed to replace the West German Hp system and the East
German Hl system with a single new one and like the Hl signals, they combine the
functions of main and distant signals in one single head by indicating the speed after
the signal (Zs3, a white number above the signal) as well as the speed limit from the
next signal (Zs3v, a yellow number below the signal). If such a yellow number is dis-
played then the green light will flash. Note that the Ks system has three lights; green,
yellow and red. It uses one colored light which shows the number of open blocks. Here,
 5

red means no block is open, whereas yellow and green mean one and two blocks are
free, respectively. A green light can also mean that information is only available for
one block. At distant signals, the track section following the signal is treated like a
block which will always be open, therefore never allowing a red light. For each block
a speed and direction information can be given. Alphanumerical indicators are used to
display that information. The following aspects defined in the signal-book [16] will be
used here (See Fig. 1):

 Hp0: One red light, Stop,

 Ks1: One green light, Proceed,
 Ks2: One yellow light, Proceed, expect to stop,
 Zs2: A white letter, Route is set to a direction specified by the letter,
 Ks2v: A yellow letter, Route at the next signal is set to a direction specified by
the letter,
 Zs3: A white number, Proceed with speed indicated by the number multiplied by
10 𝑘𝑚/ℎ,
 Zs3v: A yellow number, Expect speed restriction at the next signal with speed
indicated by the number multiplied by 10 𝑘𝑚/ℎ,
 Zs6: A white symbol shaped like a backslash, Proceed on the left track.

Fig. 1. Example of Ks signals.

6

3 Modeling

3.1 Signal Model

A signal net has subnets for each of the lamps. These subnets have a locally shared
place (indicated with dashed outer line) for a request for lighting and turning off the
lamp as well as for lit and unlit lamp. It also has a place for being in a malfunctioning
state (See Fig. 2 and Table 1).

Y_repair
•
Req_Y_Off Y_Off

Y_failed Req_Y_On Y_fail

Y_On
•

Y_repair
•
Req_Y_Off Y_Off

Y_failed Req_Y_On Y_fail

Y_On
•

Fig. 2. Sub-PN for a signal lamp.

Table 1. Yellow lamp states.

States Definition
Y_Off Yellow lamp is unlit
Y_On Yellow lamp is lit
Y_Failed Yellow lamp is failed (and unlit)
Req_Y_Off Yellow lamp is requested to be switched off
Req_Y_On Yellow lamp is asked to be switched on
Y_Fail Yellow lamp fails
Y_Repair Yellow lamp is repaired
 7

The signal aspect to be shown will be divided into main and distant aspect. All pos-
sible main aspects and all possible distant aspects will be listed. Each route requires the
signal to show a specific main aspect. The net will be designed in a way that on the
(granted) request of a route the lamps will be switched on or off as required by the main
aspect. Therefore the main signal aspects have to be defined. They are prefixed H
(=Hauptsignal). Next is the speed allowed in 𝑘𝑚/ℎ, assuming a general limit of
160 𝑘𝑚/ℎ, followed if applicable by a direction letter and a "\" for the left track indi-
cator. Table 2 shows some examples.

Table 2. Main signal aspects.

States Definition
H0 Stop
H40 Proceed at 40km/h
H160 Proceed without speed restriction
H160A Proceed without speed restriction to direction A
H160A\ Proceed without speed restriction to direction A on the left track

V (=Vorsignal) to indicate their distant usage. For main signals, each route is as-
signed a signal aspect. For combined signals each route is assigned a signal aspect and
optionally a target signal. For distant signals the route is implicit and only a target signal
is assigned. A signal net will have an H-subnet for each route. This subnet will be ac-
cessed by setting a route from this signal. It will switch on or off the relevant lamps and
leave a token in a place indicating the signal’s aspect, and that it is open for one block.
A signal net will have a V-subnet for each route from each subsequent signal. Each
subnet will observe the status of a signal aspect from a subsequent signal. When that
signal shows the observed aspect and this signal is open for one block to that signal, the
net switches on or off the relevant lamps for the distant aspect and leave a token in a
place indicating that this signal is open for two blocks.
A signal net will have one 0-subnet. This subnet will be accessed by closing this
signal. It will switch on or off the relevant lamps and leave a token in a place indicating
the signal’s stop aspect, and that it is closed. An example for a full signal net for a given
signal will be shown in Section IV.

3.2 Point Model

Fig. 3 shows a Petri Net similar to the yellow lamp model from Fig. 2. The model
represents an item, which can be in one of two states. It can be requested to change to
each of the states without checking before if it already is in this state. The net does not
check if the change of status is desired. Additionally, it has states which represent the
time delay while the point is moving.
It is assumed that the point is in Normal position initially. By an incoming position
request (Req_W1_R) the token in W1_Normal moves to place N_to_R. Later, the token
8

in place N_to_R moves to place W1_Reversed by an incoming position sensor infor-

mation from the railway field. Requesting both position at the same time is prohibited
by using the enabling arcs.

R_to_N
•
Req_W1_N W1_Normal

Req_W1_R W1_Reversed
N_to_R

Fig. 3. Point model.

3.3 Track Model

A track segment will maintain information about a physical occupation and a logical
reservation (see Fig. 4). An occupation is caused by the train entering or leaving the
segment. The occupancy detector type is unspecified. The only information gathered
from the detector is if a train is in the track segment. A reservation is caused by the
interlocking. Each track segment can only be used by one route at a time. A free track
segment can be reserved by a route. After it has been occupied and unoccupied again,
the reservation will be released.

T1Reserved_Unoccupie
T1Reserved T1Reserved_Occupied
d

Req_T1Reserv
e

T1Physically_Occupied

T1Free

Req_T1UnReserv
e

T1Occupied_Unreserved

Fig. 4. Track model.

 9

3.4 Route Reservation and Route Release Model

The interlocking checks if the required track segments are free, i.e., neither reserved
nor occupied. If that is the case, the segments are reserved, and the points are set. After
the reservations and points are confirmed, the signal is opened and the route marked as
open. A Place Dispatcher_busy prevents other routes from setting at the same
time. When the last segment is occupied, and all previous segments have been unoccu-
pied, the route is released, which means the reservation on the segments will be re-
moved. The segment reservation prevents the interlocking from setting conflicting
routes automatically (see Fig. 5 and Fig. 6).

C2

C1
A B D E

Req_RouteA-C1
Dispatcher_Busy

BFree

C1Free

BReserved ReserveB

C1Reserved ReserveC1

Point_BNormal
Req_Point_BNormal

Route_A-C1Open

Fig. 5. Route reservation model.

Route_A-C1Open
BReserved_and_Occupied
BReserved_and_Unoccupied

C1Reserved_and_Occupied
OR _Unoccupied
+Timer

ReleaseB

ReleaseC1
Req_Signal_A-C1Stop

Fig. 6. Route release model.

10

4 Case Study

The diagram shows the southern part of the station Obervellmar where the line splits
into the lines to Kassel Hauptbahnhof and to junction Berg where the line further splits
to Rangierbahnhof and Wilhelmshöhe. The letters “R” and “W” are shown as direction
indicators (Zs2). The PN model of signal A will be created.

Route 2.1
Direction ‘R’
Speed 40km/h
Speed 100km/h
Route 2 Route 2.2 Direction ‘R’
Speed 160km/h

Route 2.3
Signal B
Direction ‘W’
Speed 160km/h
Route
1 No distant signal
Speed 160km/h

Signal A
Fig. 7. Railway layout for the case study.

From signal A (Ks signal) there are two possible routes. Route 1 allows unreduced
speed. The next signal on this route has its distant signal, so signal A does not show
distant aspects for this route. Route 2 allows 100 𝑘𝑚/ℎ and will end at signal B (Hp
signal). From there three subsequent routes are possible, influencing the main aspect of
signal B. Signal A can show the following main aspects:
 H0: Stop (no route set),
 H160: Route 1 (no speed restriction),
 H100: Route 2 (100km/h).
Signal B has a direction indicator, which will show “R” for Routes 2.1 and 2.2 and “W”
for Route 2.3. Route 2.1 has a speed limit of 40 𝑘𝑚/ℎ. Therefore Signal B can show
the following main aspects:
 H0: Stop (no route set),
 H40R: Route 2.1 (expect speed restriction to 40 𝑘𝑚/ℎ, direction indicator “R”),
 H160R: Route 2.2 (no speed restriction, direction indicator “R”),
 H160W: Route 2.3 (no speed restriction, direction indicator “W”).
Additionally, if the route 2 is set, then the main (H-Hauptsignal) aspects of signal
B becomes distant (V-Vorsignal) aspects for signal A. This allows the following
combinations for Signal A, as seen in Figure 8:
 H0: Stop (no route set),
 H160: Route 1 (no speed restriction),
 11

 H100+V0: Route 2 (100 𝑘𝑚/ℎ and expect stop),

 H100+V40R: Route 2+2.1 (100 𝑘𝑚/ℎ and expect 40 𝑘𝑚/ℎ, direction indicator
“R”),
 H100+V160R: Route 2+2.2 (100 𝑘𝑚/ℎ and expect no speed restriction, direc-
tion indicator “R”),
 H100+V160W: Route 2+2.3 (100 𝑘𝑚/ℎ and expect no speed restriction, direc-
tion indicator “W”),
The lamps to be lit are different for each signaling system. The appearance of the ab-
stract signal aspects shown above is shown for one of the three major signaling systems
which are currently in use in Germany. The Ks signal [16], (see Fig. 8), shows a green,
yellow or red light to indicate the number of open blocks. For Route 1, as information
is only available for one block, green indicates that the block is free. The speed reduc-
tion for Route 2 is shown with a white 10 on a speed indicator. Route 2.2 is announced
with a distant route indicator “R”. Route 2.3 is announced with a distant route indicator
“W”. For Route 2.1 the speed reduction is declared by a flashing green light and a
distant speed indicator with digit “4”. Its direction is declared with a distant route indi-
cator “R”.

White plate
or light

Signal
aspects
}
1
No Route
2 3
Route 2
Route 1
Yellow plate
or light

white-red-white
post plate (main signal)

4 5 6
Route 2.1 Route 2.2 Route 2.3

Fig. 8. Aspects of signal A.

12

Fig. 9 shows the whole PN for this signal. The boxes H, V and 0 have to be created
depending on the abstract aspect required by the route and the signaling system requir-
ing a specific appearance of the aspect. The net is accessed by the six public places on
the left, which are:
 Request route 1,
 Request route 2,
 Signal B shows man aspect H160W,
 Signal B shows man aspect H160R,
 Signal B shows man aspect H40W,
 Close signal.
The boxes H1 and H2 are magnified in Fig. 10. From the V-boxes only box V2.3 is
shown in Fig. 11. Box V2.2 would look similar as only the Zs2v indicator shows a
different letter. Box V2.1 would additionally require a Zs3v indicator and a flashing
green light. The current lamp net is not able to handle a flashing lamp, but could be
easily extended to do so. The box 0 is not shown at all. It would switch the red light on
and all other lights off. As a request to switch off a lamp does not require information
if the light is on, this box can be created for all routes equally.

Signal_AAspect_H160
Route1_ReqSignal_Open

H1
Signal_AAspect_H0
Route1Cleared_for_one_block
Signal_AAspect_H100
Route2_ReqSignal_Open
Signal_AClosed H2

Route2Cleared_for_one_block

V2.3
Signal_BAspect_H160_2W Route2Cleared_for_two_block
s

V2.2
Signal_BAspect_H160_2R

V2.1
Signal_BAspect_H40_2R

0
Req_Signal_AClose

Fig. 9. Model of signal A (the whole).

 13

Fig. 10 shows the implementation of main aspects for routes 1 and 2 for the Ks signal-
ing system. For Route 1 only the green light is switched on and the red light is switched
off. For Route 2, a distant signal information is available. Therefore the most restrictive
distant signal aspect V0 is assumed. After switching on the speed indicator and the
yellow light, the red light is switched off. The verification later should make sure, that
if route two is opened, the signal never shows a yellow light alone.

H1
GreenOn RedOn Signal_AAspect_
Route1_Req H160
Signal_Open
WaitGreen_On WaitRed_Off

Route1Cleared_
for_one_block
Req_GreenOn Req_RedOff

Signal_AClosed
Signal_AAspect_H0(RED)
10_WhiteOn YellowOn RedOn Signal_A
Aspect_H100

Wait_10_WhiteOn Wait_YellowOn WaitRed_Off

Route2_Req Route2

H2
Signal_Open Cleared_for
_one_block
Req_10_WhiteOn Req_YellowOn Req_RedOff

Fig. 10. Both subnets H.

Fig. 11 shows the implementation of distant aspects for Route 2.3. When Route 2.3
opens, signal B will show main aspect H160W. The Ks signal aspect for H100+V160W
shows a green light, a white speed indicator 10 and a yellow direction indicator W.
Therefore the direction indicator will be switched on first. This switching has to happen
before the next step to avoid a green light without a direction indicator. The next step
is to switch off the yellow light and to switch on the green light. A variation of this
behavior would be to wait for the green light to show before switching off the yellow
light.

W_YellowOn
V2.3
YellowOn
Route2Cleared
_for_one_block
GreenOn
WaitYellow_On

WaitYellow_to_Green
Route2Cleared_for_
Req_GreenOn two_blocks

Signal_BAspect
_H160_2W
Req_W_YellowOn Req_YellowOff

Fig. 11. Subnet V for Route 2.3.

14

5 Conclusion and Future Works

In this study, a generic signal model was created for a railway layout. The model of the
point was derived from the bulb sub-model. An example entrance signal model is con-
structed. The example was specified in PNML for use in TAPAAL for future studies.
The signal and point models created in this paper will be used to create an interlocking
model, including track segment models and route models. That model will be applied
to a simple station layout and extended by a train model and a dispatcher model. The
models will be generated automatically from a given layout. As a future work, obtained
models will be tested in TAPAAL for verification.

References
[1] Giua, A., Seatzu, C.: Modeling and supervisory control of railway networks using Petri
nets. IEEE Trans. on Automation Science and Engineering 5(3), 431-445 (2008).
[2] Ren, X., Zhou, M.C.: Tactical scheduling of rail operations: A Petri net approach. In:
International Conference on Systems, Man and Cybernetics, pp. 3087-3092. Vancouver
BC, Canada, (1995).
[3] Hei, X., Takahashi, S., Nakamura, H.: Toward developing a decentralized railway signal-
ling system using petri nets. Conference on Robotics, Automation and Mechatronics, pp.
851-855. Chengdu, China, (2008).
[4] Hörste, M. M., Schneider, E.: Modeling and simulation of train control systems using Petri
nets. In: Wing, J. M., Woodcock, J., Davies, J. (eds.) World Congress on Formal Methods
in the Development of Computing Systems, LNCS, vol. 1709, pp. 1867-1883, Springer-
Berlin, Heidelberg (1999).
[5] Hei, X., Takahashi, S., Nakamura, H.: Distributed interlocking system and its safety
verifications. In: The 6th World Congress on Intelligent Control and Automation, pp. 8612-
8615. Dalian, China, (2006).
[6] Anunchai, S. V.: Verification of interlocking tables using coloured Petri nets. In: 10th
Workshop and Tutorial on Practical Use of Coloured Petri Nets and the CPN Tools, pp.
139-158. Aarhus, Denmark, (2009).
[7] Yıldırım, U., Durmuş, M. S., Söylemez, M. T.: Application of functional safety on railways
part II: Software development. In: The 8th Asian Control Conference, pp. 1096-1101.
Kaohsiung, Taiwan, (2011).
[8] Yıldırım, U., Durmuş, M. S., Söylemez, M. T.: Fail-Safe Signalization and Interlocking
Design for a Railway Yard: An Automation Petri Net Approach. In: The 7th International
Symposium on Intelligent and Manufacturing Systems, pp. 461-470. Sarajevo, Bosnia Her-
zegovina, (2010).
[9] Durmuş, M. S., Yıldırım, U., Söylemez, M. T.: Automatic generation of petri net supervi-
sors for railway interlocking design. In: The 2nd Australian Control Conference, pp. 180-
185. Sydney, Australia, (2012).
[10] Kaymakçı, Ö., Anık, V. G., Üstoğlu, İ.: A local modular supervisory controller for a real
railway station. In: The 5th IET International Conference on System Safety, pp. 1-6. Man-
chester, UK, (2010).
[11] Jacobsen, L., Jacobsen, M., Møller, M. H.: Modeling and Verification of Extended Timed-
Arc Petri Nets. MSc Thesis. Aalborg University, Denmark, (2010).
[12] Byg, J., Jorgensen, K. Y., Srba, J.: An Efficient Translation of Timed-Arc Petri Nets to
Networks of Timed Automata. In: Breitman, K., Cavalcanti, A. (eds.) Formal Methods and
Software Engineering, LNCS, vol. 5885, pp. 698-716, Springer-Berlin, Heidelberg, (2009).
 15

[13] Weber, M., Kindler, E.: The Petri Net Mark Up Language. In: Ehrig, H., Reisig, W., Ro-
zenberg, G., Weber, H. (eds.) Petri Net Technology for Communication-Based Systems,
LNCS, vol. 2472, pp. 124-144, Springer-Berlin, Heidelberg, (2003).
[14] World Wide Web Consortium (W3C): Extensible Markup Language (XML).
http://www.w3.org/XML/ (2019/02/22).
[15] ISO/IEC 15909-1: Systems and software engineering - High-level Petri nets - Part 1: Con-
cepts, definitions and graphical notation. (2004).
[16] DB Netz AG, Richtlinie 301 – Signalbuch, Aktualisierung 9:
https://fahrweg.dbnetze.com/re-
source/blob/1355720/e8f119eef14f0b915191c78dbbd11c51/rw_301_aktualisierung_10-
data.pdf (2019/02/22).

View publication stats