Railway Signalling System

Rationale: Route-locking is the foundational safety function of any interlocking. Verification must confirm both positive (correct lock) and negative (conflict rejection) behaviours, using the EN 50128 SIL 4 test strategy requiring structured test cases derived from the interlocking application data.

Rationale: The Object Controller's command authentication is a defence against spurious field equipment actuation. The test must prove both correct-path (valid command drives output) and attack-path (forged or replayed command rejected) behaviours per EN 50159 Category 1 communication requirements.

Rationale: Interlocking Application Data integrity is the basis of safe operation — a corrupted data set could create unsafe route conflicts. Verification must confirm both positive (valid data accepted) and negative (corrupted data rejected at startup) paths, consistent with CENELEC EN 50128 software verification requirements for SIL 4.

Rationale: The 2oo3-to-2oo2 degradation path is the primary availability mechanism for the interlocking. Verification must prove both the transition (no momentary loss of service) and the continued safe operation in degraded mode, since the system may operate in this state for up to 30 minutes before requiring repair action.

Rationale: Axle counting accuracy directly determines track occupancy state correctness. The test matrix covers the full speed and wheel diameter envelope specified in SUB-REQS-FUNC-015, with 1000 repetitions providing statistical confidence in the 10^-9 miscount probability bound.

Rationale: Count discrepancy handling is the fail-safe mechanism of axle counting — when counts disagree, the section must default to occupied to prevent collision. The 200ms response time ensures the interlocking receives the restrictive indication before the next processing cycle can clear conflicting routes.

Rationale: Cybersecurity boundary is a critical defence layer — verification must demonstrate both that the unidirectional enforcement holds under attack and that legitimate traffic passes without disruption. DPI and allowlisting are tested with deliberately crafted adversarial traffic.

Rationale: Network monitoring data must flow through the cybersecurity boundary to reach maintenance systems — verifying the path through the Boundary Gateway confirms both functional routing and security zone compliance. The 60-second polling interval and alarm latency bounds must be validated end-to-end including the gateway transit.

Rationale: SIL4 safety requirement — the failsafe default to danger aspect is the primary defence against signal driver failures. Testing must demonstrate both the timing bound (200ms) and the mechanism (de-energised relay) to confirm that the failsafe operates even under complete power loss.

Rationale: The 2oo2 comparison architecture for lamp monitoring is a safety-critical function — a single monitoring channel failure must not cause a false healthy indication. Testing channel disagreement proves the failsafe mechanism operates when one monitor is unreliable.

Rationale: A lit JRI alongside a red signal is a hazardous misleading indication — driver may infer a route is set and pass the danger signal. The hardware interlock independence from the software route data path must be positively demonstrated.

Rationale: The 2mm detection threshold is the boundary between safe (locked) and unsafe (unlocked) blade position. Testing at the threshold boundary with calibrated displacement confirms the detection transition point is correctly set, and temperature cycling verifies thermal expansion does not shift the threshold.

Rationale: WCET analysis provides formal proof of timing compliance independent of test coverage. Combined with hardware measurement, this covers both theoretical and practical bounds.

Rationale: Hardware reliability claims must be supported by quantitative analysis per EN 50129 Annex B. Field testing alone cannot demonstrate MTBFd within practical project timescales.

Rationale: Integration test at system boundaries validates the actual message protocol and timing between CBI and train detection equipment.

Rationale: Tests the safety-critical fail-safe signal behaviour and the complete command chain from VPU through Object Controller to signal head.

Rationale: Point detection is safety-critical — an undetected point allows route setting over unsecured switches. The timeout test verifies the fail-safe behaviour.

Rationale: Validates the safety communication protocol and timeout behaviour on the most critical external interface for ETCS Level 2 operations.

Rationale: Demonstrates that the non-vital TMS interface cannot compromise interlocking safety logic, which is the fundamental safety principle of the CBI-TMS boundary.

Rationale: The level crossing interlock is a critical safety function — verifying that the signal cannot clear without barrier confirmation protects road users.

Rationale: The 2oo3 voting mechanism is the primary safety architecture — this test validates both correct voting and fault detection.

Rationale: Full cable length and temperature extremes test worst-case signal attenuation. Speed range covers operational envelope endpoints.

Rationale: 5 Hz toggle rate exceeds expected real-world transition rates and stress-tests the polling mechanism. 10000 cycles provides statistical confidence in reliability.

Rationale: Maximum counting-point load (24) tests throughput limits. Simultaneous changes test worst-case bus utilisation and message scheduling.

Rationale: 128-section load tests maximum capacity. Cryptographic authentication verification confirms the safety communication layer rejects tampered data, which is the primary defence against undetected data corruption on the vital link.

Rationale: 0.06 ohm shunt is the standard test resistance per EN 50238. Multiple positions test sensitivity across the full section length, including the known weak points near transmitter and receiver ends.

Rationale: Tests all credible failure modes that could cause loss of received signal. Each must independently trigger the fail-safe occupied state within the specified time.

Rationale: 24-hour endurance test at full load verifies sustained interface performance, not just burst capability. Sequence gap and ordering checks validate the safety-relevant message integrity properties.

Rationale: Variable message sizes test boundary conditions including the 1023-byte maximum. 10,000 messages provide statistical confidence in the delivery confirmation timing across the session population.

Rationale: Graduated error injection from nominal to worst-case validates that the safety layer correctly handles the full range of bearer quality conditions. 10^6 messages per level provides statistical confidence in the residual error rate claim.

Rationale: Testing across the speed range validates that the interface performs consistently regardless of the urgency of the handover (higher speed = less time available). 100 iterations provide confidence in worst-case latency.

Rationale: 1-hour sustained peak load test validates the message queue's guaranteed delivery mechanism under worst-case conditions. Timestamp accuracy verification ensures the recording is usable for incident reconstruction.

Rationale: 10,000 cycles across route complexity variants validate worst-case performance. The 99th percentile check at 600ms provides margin assurance — if the distribution is tight, the 800ms budget is well-allocated.

Rationale: 50 failure scenarios cover the range of failure modes (hardware, software, communication). Full 60-train load during failover tests the worst case where all sessions must transfer simultaneously.

Rationale: Testing at multiple load levels validates that emergency message prioritisation works correctly — the 500ms budget must hold even when the RBC is at peak MA computation load. This is the most safety-critical timing requirement in the ETCS RBC.

Rationale: 1000 sequences provide statistical confidence in timing. Communication fault injection validates the safety communication layer's error detection and fail-safe reporting.

Rationale: Boundary testing at threshold height validates discrimination between hazardous and non-hazardous objects. Fail-safe test validates the critical safety property that sensor failure is treated as obstacle present.

Rationale: 500 cycles test mechanical endurance and interface reliability. Independent angle measurement validates feedback accuracy. Stall detection timing is critical for the controller to stop driving a barrier that has contacted an obstacle.

Rationale: Integration test at the power interface boundary. Inline power analyser provides independent measurement of voltage and frequency. Obstruction injection validates the current monitoring path end-to-end, not just the sampling rate in isolation.

Rationale: Precision actuator enables controlled displacement testing at the exact detection threshold. Oscilloscope timing verifies the 50ms latency requirement. Single-channel disconnection test validates the independence and dual-channel logic required for SIL 4.

Rationale: Displacement transducers provide continuous position tracking to verify the sequencing interlock at the mechanical level, not just the electrical command level. The nose detection failure test validates the critical safety interlock: a route must never be set over a high-speed turnout with an unproven nose position.

Rationale: Network traffic monitoring provides independent verification of reporting interval and content completeness. The simulated element failure validates the diagnostic path for the most common point heater failure mode.

Rationale: Temperature extremes test hydraulic fluid viscosity effects on throw time — low temperature increases viscosity and slows the actuator. 20 throws provide statistical significance. Both throw directions must be tested as hydraulic circuits may have asymmetric flow characteristics.

Rationale: Validates the SIL 4 fail-safe path. Power removal simulates the worst-case detection circuit failure. Oscilloscope measurement at the PDC output boundary provides precise timing. Both positions must be tested as the relay circuits may have different release characteristics for normal vs reverse contacts.

Rationale: Calibrated obstruction forces test the sensitivity of current signature analysis across the throw profile. Different positions along the stroke have different normal current profiles, so the 150% threshold must work at all positions. The 5N level tests that small obstructions below the threshold do not cause false trips.

Rationale: Direct test of PRP zero-recovery-time claim under realistic traffic conditions. Sequence number analysis provides frame-level detection of any loss that traditional packet counters might miss.

Rationale: 24-hour duration captures diurnal traffic patterns and background maintenance activities. Hardware timestamping eliminates software-induced measurement jitter. 99.99th percentile threshold ensures the requirement is met under worst-case conditions, not just average.

Rationale: Fault injection verifies each EN 50159 threat class is independently detected. Testing all threat classes ensures the safety case claim of Category 3 coverage is substantiated by evidence.

Rationale: 72-hour test duration exercises holdover behavior beyond the 24-hour requirement to verify margin. Independent GPS reference eliminates circular measurement dependency on the system under test.

Rationale: Penetration testing from the non-vital side validates the allowlist enforcement. Concurrent permitted traffic measurement ensures security inspection does not degrade safety-critical communication timing.

Rationale: Validates both alarm timing and correct link identification under controlled degradation conditions. 60-second diagnostic propagation confirms the cross-subsystem interface operates correctly.

Rationale: 48-hour BER measurement provides statistical confidence at 10^-12 level. 3dB optical margin accounts for connector aging, cable splice degradation, and temperature-dependent attenuation variation over the link lifetime.

Rationale: Integration test at system boundaries to verify interface compliance between Signal Aspect Driver and LED Signal Module.

Rationale: Critical safety verification: the hardwired failsafe relay must operate correctly independent of software state, and must default safe on power loss.

Rationale: Monitoring accuracy verification ensures the proving unit can reliably distinguish degraded strings from healthy ones across the full operating temperature range.

Rationale: Diagnostic interface verification at integration level to confirm data format, timing, and content accuracy.

Rationale: Combined functional and safety test verifying both the route data path and the independent hardware interlock that prevents misleading indications.

Rationale: Statistical verification of the safety-critical failsafe timing requirement across multiple test cycles to establish confidence in the 500ms bound.

Rationale: Integration test at the feeder-UPS boundary confirms power quality at the handoff point and validates circuit protection sizing.

Rationale: Confirms UPS output quality meets track circuit sensitivity requirements and validates bypass path for maintenance access.

Rationale: Validates earth-fault detection sensitivity and response time at track circuit distribution boundary.

Rationale: Confirms end-to-end data flow from power monitoring to diagnostic system and validates alarm propagation timing.

Rationale: Full-load discharge test confirms battery capacity meets the 2-hour backup requirement under worst-case conditions.

Rationale: Validates the load-shedding sequence timing and confirms extended vital runtime calculation is correct.

Rationale: Confirms cell-level monitoring detects incipient battery failure before it affects backup capacity.

Rationale: Validates alarm delivery latency and data completeness at the AMP-Workstation boundary under representative load.

Rationale: Tests guaranteed delivery and reconnection behaviour under network disruption conditions.

Rationale: Tests MFA enforcement and audit logging at the remote access boundary.

Rationale: Validates EEMUA 191 alarm rate compliance under sustained high-rate input.

Rationale: Validates timestamp accuracy against GPS reference over extended period to detect drift.

Rationale: Integration test at CBI-workstation boundary. 200 simultaneous changes represents peak traffic load. Corruption injection verifies RaSTA safety layer protects display integrity.

Rationale: Tests both timing and access control enforcement at the command interface boundary. Out-of-area rejection test verifies defence-in-depth for area authority.

Rationale: 50-alarm burst tests interface capacity under alarm flood conditions while verifying structured message completeness.

Rationale: Tests TMS-CBI interface boundary under load. Invalid route injection verifies CBI validates all TMS commands independently.

Rationale: 100 concurrent steps tests interface throughput at peak berth-stepping rate. Visual verification confirms end-to-end identity-to-berth correctness.

Rationale: Tests the full conflict alert path from detection to signaller presentation. Option ranking verification ensures decision support quality.

Rationale: Tests alarm flood detection threshold and root-cause grouping accuracy under realistic cascade conditions.

Rationale: Three distinct failure injection modes (process, display, network) verify the Workstation Redundancy Controller detects all monitored failure types. State verification confirms complete transfer.

Rationale: Tests both positive authentication path and negative cases (wrong credentials, area violation) to verify access control enforcement.

Rationale: 500-train load test verifies ARS performance at rated capacity. Decision cycle measurement confirms algorithmic scalability.

Rationale: Tests both rate limiting enforcement and queue overflow behaviour under burst conditions exceeding rated capacity.

Rationale: Validates lamp monitoring detection threshold and reporting latency. Degradation thresholds chosen to match EN 50129 signal visibility safety case requirements.

Rationale: Validates end-to-end monitoring latency under worst-case concurrent reporting. 30-second threshold ensures maintainers have near-real-time visibility of degradation trends before safety functions are compromised.

Rationale: Security boundary verification through adversarial testing. Must prove no diagnostic protocol or API endpoint can be exploited to inject control commands into the vital signalling chain.

Rationale: Validates both the 60-second performance requirement and the conflict detection accuracy. Injected conflicts represent real-world scheduling errors observed in UK Network Rail timetable data.

Rationale: Validates the primary safety chain from detection to protection. The 2-second end-to-end budget derives from SYS-REQS-FUNC-005 (ETCS MA computation) and SYS-REQS-PERF-002 (signal aspect update). The 500ms sub-budget for safety actions ensures the interlocking can meet its worst-case reaction time. 1000 cycles validates statistical reliability of the chain.

Rationale: AWS/TPWS intervention reliability must be demonstrated by statistical testing across multiple signal locations to account for installation variation. The 1000-demand test programme provides 95 percent confidence for the 99.9 percent reliability claim per IEC 61508 statistical testing requirements.

Rationale: Degraded mode transition must be demonstrated end-to-end including human operator procedures because the 60-second target includes signaller recognition and mode selection time, not just system response. The 4 trains per hour throughput test validates operational viability under degraded conditions.

Rationale: Event recording must be verified at peak load across all subsystems simultaneously because event storms during major failures are exactly when complete recording is most critical. The 24-hour sustained test validates storage capacity. The 6-month retention test validates long-term data integrity.

Rationale: TSR management must be verified for both lineside and ETCS paths simultaneously because a mismatch between lineside indication and ETCS MA speed profile would create hazardous inconsistency. The 5-concurrent-TSR test validates the system under realistic operational load since major possessions often impose multiple simultaneous restrictions.