On the fail-safety of critical systems in high-speed rail

Aim. To identify acceptable fail-safety architectures for critical high-speed rail systems, as well as their capabilities and limitations. Methods. Construction and study of several mathematical models of system dependability and functional safety. Selection of acceptable faail-safety architectures for critical high-speed rail systems. Results. An analytical and numerical analysis of the dependability of the widely used 2oo3 safety architecture has shown that majority logic can significantly improve the reliability of the results (mean time to functional failure of a majority system is twice that of the original object). However, the system’s dependability, and, consequently, its fail-safety, is lower than that of the original object. Therefore, such an architecture is not acceptable beyond SIL3. For the purpose of ensuring this level of fail-safety, the alternative (1oo2)P architecture may prove to be preferable as it lacks restoring organs and switching devices. It is made of two components that operate in parallel, each of which uses a hot standby setup. However, one should not forget that such systems are prone to false alarms. It has been shown that hybrid majority architectures (2oo3)P or 2oo4 can provide SIL4 fail-safety. However, it should be noted that a significant portion of the majority setups that ensure fail-safety of critical systems are switching circuits designed for disconnecting failed components and activating backup components. This circumstance affects the effectiveness of majority redundancy, as it requires the use of additional tools and procedures. This shortcoming is due to the fact that in both hardware and software implementations, the fault masking mechanism, i.e., voting, faulty channel identification, blocking thereof, and then resuming normal operation, is repeated in every system cycle, regardless of the presence or absence of faults. Practically, the associated time losses are as high as 30 to 50%. The disadvantages of majority redundancy also include the large number of connections between channels and certain design difficulties. These limitations have a negative, but not decisive, effect on the selection of an acceptable fail-safety architecture. They should be taken into account given each specific object and its operating conditions.

1. IEC 62278-3:2025. Railways – Specification and demonstration of reliability, availability, and safety.

2. IEC 62278-1:2025. Railway applications – Specification and demonstration of reliability, availability, maintainability and safety (RAMS) – Part 1: Generic RAMS process.

3. GOST 33358-2015 Functional safety. Control and safety systems for train operation. Terms and definitions. Moscow: Standartinform; 2018. (In Russ.)

4. Platunov A., Pinkevich V. [Creating cyberphysical systems: matters of IT worker training]. Control Engineering (Russia) 2021;3(93):64-70. (In Russ.)

5. Shubinsky I.B., Rozenberg E.N. [Functional safety of control systems in railway transportation]. Moscow; Vologda: Infra-Inzheneria; 2023. (In Russ.)

6. Gapanovich V.A., Rozenberg E.N., Shubinsky I.B. Some concepts of fail-safety and cyber protection of control systems. Dependability 2014;2:95-100.

7. Shubinsky I.B. [Functional dependability of information systems. Analysis methods]. Moscow: Dependability Journal Publishing; 2012. (In Russ.)

8. Shubinsky I.B., Rozenberg E.N. [Fail-safety of control systems: a monograph]. Moscow; Vologda: Infra-Inzheneria; 2026. (In Russ.)