System

Railway Signalling System, validation pass after QC review. The project entered this session with 245 requirements, 167 trace links, and 13 diagrams across 11 subsystems. Final state: 255 requirements, 176 trace links. Status moved from qc-reviewed to validated.

Assessment

The decomposition is strong and reflects genuine UK mainline signalling engineering. The 11-subsystem breakdown — {{entity:Computer-Based Interlocking}}, {{entity:Train Detection Subsystem}}, {{entity:ETCS Radio Block Centre}}, {{entity:Level Crossing Protection System}}, {{entity:Points and Crossing Drive System}}, {{entity:Signalling Communication Network}}, {{entity:Colour-Light Signalling Output}}, {{entity:Signalling Power Supply System}}, {{entity:Signalling Diagnostic and Monitoring System}}, {{entity:Signaller Workstation}}, {{entity:Traffic Management System}} — covers the right scope for a modern CBI-based corridor resignalling.

Architecture decisions are well-reasoned: 2oo3 voting over 2oo2D for availability, distributed Object Controllers for cabling reduction, separated Euroradio from RBC application for independent certification. Performance values are in the right ballpark: 10^-9/hr THR for SIL 4, 500ms signal update, 100,000-hour VPU MTBFd, 99.99% system availability. The 69 classified entities in namespace {{entity:SE:railway-signalling}} provide good ontological coverage.

Cross-domain analog search for the {{entity:Vital Processing Unit}} ({{hex:51F53258}}) found strong similarity (0.94 Jaccard, 30 shared traits) with the {{entity:Inertial Navigation System (INS)}} and {{entity:Tactical Data Link Processor}} from the naval domain — consistent with the VPU’s nature as a safety-critical voted processing system.

Gaps

Four system-level gaps were identified, all absent from the prior 245 requirements:

1. No AWS/TPWS train protection. UK Railway Group Standard GK/RT0045 mandates AWS/TPWS at all controlled signals. During ETCS transition, non-fitted trains rely exclusively on lineside signals with TPWS as the final SPAD barrier. This was a critical omission.

2. No system-level degraded mode. Individual component degradation was covered (VPU 2oo3→2oo2, PRP single-path), but total CBI/RBC failure had no system-level requirement. UK Rule Book Module TW1 procedures need system support.

3. No comprehensive event recording. Juridical recording existed for the RBC only. RAIB investigations require correlated timelines across all subsystems — CBI decisions, point movements, track circuits, operator actions.

4. No temporary speed restriction management. TSRs are imposed daily across the UK network. Without integrated management propagating to both lineside signals and ETCS MAs, manual intervention is needed per train.

flowchart TB
  RSS["Railway Signalling System"]
  CBI["Computer-Based Interlocking"]
  TD["Train Detection Subsystem"]
  RBC["ETCS Radio Block Centre"]
  CLS["Colour-Light Signalling Output"]
  PCD["Points and Crossing Drive"]
  LXP["Level Crossing Protection"]
  TMS["Traffic Management System"]
  SW["Signaller Workstation"]
  SCN["Signalling Communication Network"]
  SPS["Signalling Power Supply"]
  SDM["Diagnostic and Monitoring"]
  TPWS["AWS/TPWS Protection"]

  RSS --> CBI
  RSS --> TD
  RSS --> RBC
  RSS --> CLS
  RSS --> PCD
  RSS --> LXP
  RSS --> TMS
  RSS --> SW
  RSS --> SCN
  RSS --> SPS
  RSS --> SDM
  RSS --> TPWS

  TD -->|Track occupancy| CBI
  CBI -->|Aspect commands| CLS
  CBI -->|Point commands| PCD
  CBI -->|Crossing trigger| LXP
  CBI -->|Route status| RBC
  TMS -->|Route requests| CBI
  CBI -->|State display| SW
  SW -->|Signaller commands| CBI

Additions

Created 10 new artefacts to address the gaps:

• {{sys:SYS-REQS-FUNC-009}}: AWS/TPWS requirement — 99.9% TPWS intervention reliability, concurrent ETCS operation. Classified {{entity:AWS/TPWS Train Protection Equipment}} as {{hex:D7E77859}}.
• {{sys:SYS-REQS-FUNC-011}}: Degraded mode — 60-second transition, 4 trains/hour minimum capacity via verbal authorisation.
• {{sys:SYS-REQS-FUNC-012}}: System-wide event recording — 1ms UTC timestamps, 6-month retention, tamper-evident, RAIB-accessible within 4 hours.
• {{sys:SYS-REQS-FUNC-013}}: TSR management — lineside aspect reduction, ETCS MA speed profile propagation, signaller display.

Four verification entries (VER-TEST-087 through VER-TEST-090) with trace links from each system requirement. Five stakeholder-to-system trace links connecting the new requirements to {{stk:STK-NEEDS-OPS-001}}, {{stk:STK-NEEDS-PERF-003}}, and {{stk:STK-NEEDS-CON-005}}.

Verdict

Pass. The decomposition accurately represents a UK mainline railway signalling system. The 4 gaps found were operational completeness issues rather than architectural flaws — the subsystem structure, component selection, and interface definitions are sound. All gaps have been addressed with requirements, verification entries, and trace links. Baseline VALIDATED-2026-03-19 created. Status set to validated for post-validation QC pass.

Next

Flow E post-validation QC should verify that the 10 new artefacts integrate cleanly with existing trace chains and that no orphan requirements were introduced. The 21 pre-existing orphans (mostly architecture decisions) remain — these are acceptable as ARC documents are informational rather than traceable. The empty hazard analysis document should be populated in a future session to complete the safety case documentation.