Safety justification of train movement dynamic processes using evidence theory and reference models

ARTICLE IN PRESS

JID: KNOSYS

[m5G;October 16, 2017;9:12]

Knowledge-Based Systems 0 0 0 (2017) 1–11

Contents lists available at ScienceDirect

Knowledge-Based Systems journal homepage: www.elsevier.com/locate/knosys

Safety justification of train movement dynamic processes using evidence theory and reference models Yonghua Zhou a,b,∗, Xin Tao a, Lei Luan a, Zhihui Wang a a b

Research Center of Rail Transit Signal and Control, School of Electronic and Information Engineering, Beijing Jiaotong University, China Department of Electronic Information and Control Engineering, Beijing Jiaotong University Haibin College, China

a r t i c l e

i n f o

Article history: Received 27 April 2017 Revised 26 July 2017 Accepted 9 October 2017 Available online xxx Keywords: Evidence theory Reference model Safety analysis Train movement Fault diagnosis

a b s t r a c t The efficient solution to justify train movement safety is to analyze train movement situations via train operation knowledge and knowledge-based inference tools. In this paper, train operation knowledge is represented as train movement models and conditions, collectively called rule-based train movement reference models. The Dempster–Shafer (D–S) evidence theory is employed to infer the model and condition under which a train is running. Consequently, aberrant models and conditions, potentially endangering train operation safety, are identified in advance so that emergency measures can be taken to prevent train operation accidents. The mass function is defined as the approximation level of the train operation time interval within one block section of a railway line to that obtained from various reference models. The D–S theory is also applied to train movement dynamic processes to gradually identify train operation situations, using the combined section and process mass functions. The proposed inference approach using evidence theory and reference models (ETRM) qualitatively and quantitatively judges the rationalities of train operation control logic and variation tendencies. A case study to prevent the occurrence of the 7/23 railway accident in China demonstrates the validity of the proposed inference approach using ETRM. The analysis and inference centering on train movement situations can meanwhile diagnose the operation status of train onboard and ground control systems. © 2017 Elsevier B.V. All rights reserved.

1. Introduction The occurrences of disastrous train movement accidents have aroused attention on operation safety by railway transportation administrations and academic research circles. Safety is guaranteed by signal systems in the current railway infrastructure. However, the catastrophic accident of front-rear collision between multipleunit high-speed trains D301 and D3115 on July 23, 2011 in China, called the “7/23 accident”, revealed that signal systems may sometimes be out of normal logical orders, leading to occurrences of railway accidents, especially in heavy rain, snow, and wind. Current train scheduling and commanding systems (TDCS) and centralized traffic control (CTC) systems require a set of effective inference tools to judge whether train control systems are operating according to the preset logical processes, thereby justifying train movement safety or discerning potential safety hazards. Evidence theory, presented by Dempster [1] and later extended by Shafer [2], known as Dempster–Shafer evidence theory or D–S

∗ Corresponding author at: Research Center of Rail Transit Signal and Control, School of Electronic and Information Engineering, Beijing Jiaotong University, China. E-mail address: [email protected] (Y. Zhou).

theory, directly and quantitatively deals with uncertainty and ignorance with regard to possible hypotheses using available and sometimes insufficient evidence. It is one of the widely accepted theories about uncertainty inference and information fusion. D–S theory defines mass functions, which can be interpreted as probability or confidence levels for asserted hypotheses. A mass function is also called basic probability assignment (BPA). It is not necessary to express confidence levels with regard to the hypotheses one by one. The BPA can be also performed over subsets of hypotheses, but the sum of all alleged expressions should be equal to one. The mass functions, from multiple evidence sources over the same framework of discernment, can be synthesized using the Dempster rule of combination. Furthermore, D–S theory defines the uncertain range of confidence level using belief and plausibility functions. It is for these characteristics that D–S theory has been extensively recognized as a powerful inference tool. D–S theory provides a general framework to handle uncertainty inference. A great deal of literature has contributed to perfect the theory on the approaches of BPA [3-12], combination rules of conflicting evidence [13], uncertainty measures using fuzzy and rough sets [14, 15], Bayesian inference [16], classification and clustering [17-25], and other aspects.

https://doi.org/10.1016/j.knosys.2017.10.012 0950-7051/© 2017 Elsevier B.V. All rights reserved.

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

JID: KNOSYS 2

ARTICLE IN PRESS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

Mass function definition is a pivotal step to applying D–S theory, and it directly affects the inference and decision efficiency. Bloch [3] defined mass functions using grey-level histograms in a trapezoidal form. Yager [4] employed a fuzzy measure rather than a crisp number to express the uncertainty of belief. Denoeux [5] described mass functions proportional to the decreasing function regarding the distance of a test vector to a training vector. Wang and McClean [6] established a systematic approach to derive mass functions from multivariate data spaces. Masson and Denoeux [7] determined mass functions to minimize the objective of evidential c-means (ECM). Xu et al. [8] established neststructured BPA functions having normal distribution models for the attributes of training data. Han et al. [9] proposed a novel approach of BPA transformed from fuzzy membership functions. Zhang et al. [10] developed a BPA approach based on the distance between the test data and core samples of training data. Deng et al. [11] constructed mass functions based on the confusion matrix to improve the classification accuracy and sensitivity. Yang and Han [12] represented the uncertainty by utilizing the distance of belief intervals. Mass function definition still remains an unsolved problem; it is domain-specific and has no general solution. D-S theory appoints an intelligent inference mechanism to data processing and information utilization. It has been applied to various fields such as medical treatment [26], equipment manipulation [27] and economic analysis [28]. Very few studies have addressed the application of D–S theory to railway traffic. Oukhellou et al. [29] applied D–S theory to the classification fusion of track circuit fault diagnosis. Xu et al. [30] utilized D–S theory to locate faults in power transmission lines. Train operation knowledge can facilitate the management of railway transportation [31, 32]. The application of D–S theory depends on domain-specific knowledge for proposition inferences. In order to prevent the reoccurrences of similar railway accidents, some techniques have been explored for analyzing accident causes [33-36]. Baysari et al. employed the human factors analysis and classification system (HFACS) to analyze rail accidents/incidents in Australia [33]. Ouyang et al. established an analysis approach to railway accidents using the system-theoretic accident models and process (STAMP) [34]. Belmonte et al. utilized the functional resonance accident model (FRAM) to perform the safety analysis of automatic train supervision (ATS) systems [35]. Fan et al. developed an accident causal loop model using a system thinking approach to perform a thorough analysis of 7/23 accident between multiple-unit trains in China [36]. Those methods address how to learn from railway accidents to improve railway operation safety. In this paper, we attempt to employ D–S theory and train operation knowledge to judge train movement status based on intermittent information feedback, in order to infer potential safety hazards of train operations and thereby provide decision grounds to take measures to avoid accidents. The train movement reference models are established to act as various kinds of sensors, providing multisource information for D–S theory to evaluate train movement status from respective angles using train movement models [37, 38]. The current leading control modes of train operations cannot access the continuous train position information, which signifies that the only known position information regards what section of a railway line a train locates at within a time interval. With regard to this characteristic of information feedback, a mass function is proposed, which measures the differences between the movements of an actual train and reference models. Moreover, decision making cannot often be accomplished at one time, and involves dynamic evolutions. The combined section and process mass functions are further defined to represent individual decision activities and accumulated decision consequences. With the process advancement of train movements, train movement status will be

gradually revealed from decision ignorance to sufficient confidence. This paper ultimately establishes the safety inference framework utilizing evidence theory and train movement knowledge. The validity of the framework is demonstrated through a case study of the disastrous 7/23 railway accident in China. The rest of this paper is organized as follows. Section 2 outlines the basic principle of evidence theory. Section 3 develops the rulebased reference models of train movements. Section 4 elucidates the reference model-based inference framework for safety justification of train movements. Section 5 demonstrates the validity of the proposed framework using case study. The final section discusses the conclusions. 2. Evidence theory 2.1. Mass function D–S theory defines a frame of discernment , which is a set of mutually exclusive and exhaustive hypotheses and constructs the domain that a mass function concerns. If  has N elements, 2N possible subsets can be formed using these elements, called power set 2 . If one subset contains only one element of , it is called a singleton. A mass function is a mapping from the power set 2 to [0, 1], denoted as m : 2 → [0, 1]. It stands for the probability or confidence level assigned to a subset, also called BPA. If A is a subset of , then BPA should satisfy the following conditions:

m (φ ) = 0 

(1)

m (A ) = 1

(2)

A ⊆

If m(A) > 0, A is called a focal element. 2.2. Rule of evidence combination With regard to multiple evidence sources, the corresponding mass functions defined over the same framework of discernment  can be merged together using Dempster’s rule of combination based on an orthogonal sum. Suppose m1 and m2 are the defined mass functions. The combined mass function m = m1  m2 is calculated as



m (A ) = k=

B∩C=A



m1 (B )m2 (C ) 1−k

m1 (B )m2 (C )

(3) (4)

B∩C=φ

where A, B and C are subsets of . k describes the sum of basic probabilities for the subsets without intersections over which m1 and m2 are defined, and it should be excluded for the combined mass functions because Eqs. (1) and (2) must hold. 2.3. Measures of belief degree In D–S theory, two measures of belief degree are defined to represent the uncertain range of an inference, i.e., the belief function and plausibility function. The belief function of A is defined as

Bel (A ) =



m (B )

(5)

B⊆A

The plausibility function of A is defined as

P l (φ ) = 0

(6)

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS

[m5G;October 16, 2017;9:12]

Speed

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

3

vlim(x)

vmax fb(x-x(n))

fm(x-x(n))

dr v(n)

v(n)

ds vb

dm db x(n)

pb

pm

Position

Fig. 1. Spatial-temporal conditions of train movements.



P l (A ) =

m(B ).

(7)

B∩A=φ

Eq. (7) is also equivalent to

P l (A ) = 1 − Bel(A¯ )

 |A ∩ B| × m(B ) |B|

Code

HU

U

LU

L

L2

L3

L4

L5

Number

0

1

2

3

4

5

6

≥7

(8)

Bel(A) and Pl(A) represent the lower- and upper-limit estimations of the probabilities assigned to A. The interval [Bel(A) Pl(A)] manifests the probable variation range of belief degree of A. For the ultimate inference decision, the belief interval is often transferred into a crisp number, for example, using Pignistic probability [39]:

Ppig (A ) =

Table 1 Relationship between track circuit codes and the number of unoccupied block sections.

(9)

B ⊆

where | · | denotes the number of singleton elements in the specified set. 3. Rule-based reference model Train movement models are related to train operation control mechanisms. In this study, we addressed only the model corresponding to the control mechanism that movement authorities are granted through the codes, i.e., modulating signals carrying specific frequencies, emitted by track circuits along railway lines. Under such a control mechanism, trains can reach a maximum speed of 250 km/h depending on the railway line conditions and weather. The D301 and D3115 trains involved in the 7/23 accident were controlled in that manner.

The position and speed of a train at instant n are defined as x(n) and v(n), respectively. Two kinds of target points that a train runs toward are defined. The first one is the stop point, denoted as pm , for example, the front station for a stop, the appropriate position after the front adjacent train, or the stop position specified by a scheduling command. This kind of target points inform the space constraints on train movements from x(n) to pm , implying how far a train can run, denoted as

dm = pm − x ( n )

Railway lines are segmented into block sections through track circuits. When a train runs within a block section, it is occupied and another train cannot enter that block section. The information of unoccupied block sections between two adjacent trains is transmitted to each train’s on-board equipment through the track circuit codes. Table 1 shows the relationship between the track circuit codes and the number of unoccupied block sections between two trains in the same running direction. The variable signal is the code that a train receives from a track circuit, code(i) denotes the ith element in the code set {HU, U, …, L5}, de (x(n)) describes the distance from x(n) of a train to the rear end of the block section that the front adjacent one locates at, and du (x(n), i) represents the length of i unoccupied block sections in front of the train. Thus, the distance dm of a train to the front adjacent one is calculated using the following rule:

3.1. Spatial-temporal conditions Train movements are subject to various speed restrictions which may be imposed by railway lines, train operation modes, scheduling commands and railway signals. When the minimum values of various speed restrictions are adopted, the most restrictive stair-like speed profile (MRSSP) will be generated, denoted as vlim (x) where x is the position along a railway line, as shown in Fig. 1.

(10)

IF signal = code(i) dm = de (x(n )) + du (x(n), i) ENDIF

The second target point is the instantaneous or temporary target point, denoted as pt ; it is related to the position relationship between the next speed step-change point pb in the curve of vlim (x) and the stop point pm . If pb < pm , then pt = pb , or pt = pm , that is, pt = min( pb , pm ). Define the distance from x(n) to pm as

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

JID: KNOSYS 4

ARTICLE IN PRESS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

db . The instantaneous space restriction is described as

dt = min(dm ,db )

4. Reference model-based evidence inference

(11)

The speed-distance braking curve is generally described as v = f(x−x(n)) from the maximum speed vmax to 0, which is a known kinetic characteristic of train movements. The braking curve v = f(x−x(n)) moves such that it passes through the points (pm , 0) and (pb , vb ), respectively. Accordingly, we can obtain two braking curves, denoted as fb (x−x(n)) and fm (x−x(n)), as shown in Fig. 1. The instantaneous target speed vt at pt is formulated as

vt = min(vlim ( pt ), fb ( pt − x(n )), fm ( pt − x(n )), vmax )

(12)

3.2. Speed and position update rules ds is the braking distance from v(n) to vt , as shown in Fig. 1, where vt = vb . The instantaneous reference distance for acceleration, speed holding and deceleration is formulated as dr = ds + v(n). The acceleration and deceleration at instant n in absolute values are denoted as a(n) and b(n), which can be statistically attained from the historic data of train movements or derived from the statistically average traction and braking curves of a train. The variables corresponding to instant n in the train movement model such as a(n), b(n), v(n), and vt are measured in the user-defined unit time. Therefore, the speed update rules are described as R1 IF v (n ) > vlim (x(n )), v (n + 1 ) = max(v (n ) − b(n ), 0 ) R2 ELSEIF v (n ) = vlim (x(n )) AND dt ≥ dr , v (n + 1 ) = v (n ) R3 ELSE IF dt > dr , v (n + 1 ) = min(v (n ) + a (n ), vmax ) R4 ELSEIF dt = dr , v (n + 1 ) = v (n ) R5 R6 ELSE IF v (n ) = vt = 0, v (n + 1 ) = v (n ) R7 R8 ELSE v (n + 1 ) = min(max(v (n ) − b(n ), vt ),dm ) R9 ENDIF ENDIF R10 R11 ENDIF

where Ri (i = 1, 2, …, 11) indicates rule i. R1 –R11 indicate the combined speed control role of vlim (x(n)) and dr . R1 indicates that the current speed v(n) will be unconditionally decreased if v(n) > vlim (x(n)). However, if v(n ) = vlim (x(n )), a train can hold its current speed v(n) when dt ≥ dr as described by R2 . The remaining conditions are v(n) < vlim (x(n)) or dt < dr for R3 –R10 , where dr controls the behaviors of train acceleration, speed-holding, and deceleration. From Fig. 1, we can learn that, if dt > dr , a train has the chance to accelerate as described by R4 . If dt = dr , the train should hold its current speed v(n) so that the train speed and position just transit onto the braking curve, as R5 represents. If dt < dr , the train should hold its current speed v(n) in the case v(n ) = vt and vt = 0, which is expressed in R7 , denoting that the train will pass the target point pt with a speed of vt . However, if dt < dr , the train should decelerate when v(n) = vt or vt = 0, otherwise it cannot decelerate from v(n) to vt within a distance of ds , which is represented by R8 . The speed v(n) is decelerated to vt within the movement confinement dm . Now that v(n) is measured in the user-defined unit time, the position update at next unit instant n + 1 is expressed as

x (n + 1 ) = x (n ) + v (n )

(13)

With the advancement of train movements, (pt , vt ) approaches (pm , 0), which indicates that the train will stop at pm . The train movement model describes the mechanism of speed adjustment, and the safe distance between two trains is guaranteed through dr . The model depends on the acceleration and deceleration data, so the train movement model is a data-driven rule-based model.

4.1. Global framework Fig. 2 demonstrates the global framework of reference modelbased evidence inference. Day-to-day train movements are transmitted to the TDCS or CTC systems. Thus, train movement acceleration and deceleration rules and data can be abstracted under certain movement conditions, and the reference model depository can be formulated for on-line prediction. Reference models include spatial-temporal conditions and rule and data models of train movements. The movement models specify speed and position update rules, and statistical acceleration and deceleration data related to train movement speeds. During the dynamic process of train movements, some unexpected events, such as heavy weather or equipment failure, may occur, which will affect train movements. Successively, new movement conditions and models may be added for on-line prediction. Under the same movement condition, the movement models may be different. For example, the on-sight (OS) mode and the full supervision mode of train movements have different maximum speeds, i.e., 20 km/h and 250 km/h, respectively. The same train movement model may have different movement situations under different movement conditions. For instance, different signal conditions may lead to different acceleration and deceleration tendencies. Conditions and models are the possible speculations from known evidence. Because of the insufficiency of known evidence, the movement conditions and models cannot be confirmed immediately. In this case, multiple possible conditions and models are added to predict train movement tendencies and identify potential unsafe operations. Through evidence theory, belief degrees are assigned to movement models and conditions. With the information feedback of train movements, belief degrees are updated. Finally, the models and conditions with high belief degrees will appear, and consequently, the true operation conditions and models will be identified. When train movement situations are qualitatively and quantitatively proved to be consistent with rational expectations, train movement safety can be justified.

4.2. Mass function The

set

of

movement

models

is

defined

as

M=

{M1 , M2 , . . . , Mu } and that of movement conditions as C = {C1 , C2 , . . . , Cv }. The frame of discernment is defined as

 = { θl |θl = (Mi ,C j )}

(14)

where i = 1, 2, . . . , u; j = 1, 2, . . . , v; l = 1, 2, . . . , x. The set of block sections is defined as B = {B1 , B2 , . . . , Bw }, and block section k is symbolized as Bk . When a train runs within one block section, some evidence about train operation status can be attained by the TDCS or CTC system. The set of available evidence regarding train movement status is denoted as E = {E1 , E2 , . . . , Ey }. In this study, evidence Ez (z = 1, ..., y ) was modeled as a time interval, denoted as Ez = [t1 t2 ], where t1 indicates the instant that a train actually enters a block section, and t2 the instant that it actually leaves that section. Accordingly, the operation time interval of a train is represented as Ti, j,k = [t3 t4 ](i = 1, . . . , u; j = 1, . . . , v; k = 1, . . . , w ) in accordance with model i under condition j within block section k, where t3 signifies the instant that a train enters block section k, and t4 the instant that it leaves that section, predicted using reference model l. Compared with evidence Ez , which is obtained from the operation status of a train within block section k, the mass function that a train runs in accordance with model i under condition j at block

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

Event

Movement condition 1

Reference model depository

Movement model 1

5

Movement condition v

Dynamic Process

c

c

c

c

Assign belief degrees

Movement model u

Evidence theory: Dynamically calculate belief degrees Fig. 2. Global framework of reference model-based evidence inference.

section k is defined as

Len(Ti, j,k ∩ Ez ) ml (θl , Bk ) = ml ((Mi , C j ), Bk ) = Len(Ti, j,k )

K= (15)

where Len( · ) shows the length of a time interval. For example, Len(Ti, j,k ) = Len([t3 t4 ] ) = t4 − t3 . The intersection of two time intervals is calculated as

Ti, j,k ∩ Ez = [t3 t4 ] ∩ [t1 t2 ]



=

[max (t3 , t1 ) min (t4 , t2 )]

if (t4 > t1 )or (t2 > t3 )

0

otherwise

(16)

The remaining belief degree is assigned to the total frame of discernment  as follows:

ml (, Bk ) = 1 − ml (θl , Bk ).

(17)

The defined mass functions attempt to reveal what train movement models and conditions the realistic train movements more resemble. The variation of train movement situations lies in the adjustment of train speeds, which is embodied as the alteration of running time within one block section. Afterwards, it will affect the instants entering into and leaving from the subsequent block sections. Therefore, the processing approach of time intervals in the defined mass functions for successive block sections incorporates the accumulation effects of the differences between train operation status in reality within one block section and that in accordance with a reference model. On the other hand, the instants of occupying a block section can be obtained through track circuits and transmitted to the TDCS and CTC systems via networked systems. Hence, the definition method of mass functions also takes the availability of evidence sources into account. 4.3. Process description of the evidence combination rule 4.3.1. Combination rule within one block section At first, the D–S rule of combination is implemented within one block section. After a train has passed through one block section, according to the operation time interval within that block section, the basic probabilities are assigned to a reference model and the total frame of discernment  according to Eqs. (15) and (17). After all the candidate reference models are assigned with basic probabilities, the mass functions are synthesized using the D–S rule of combination. Suppose the mass functions at block section Bk are denoted as m1 (A1 , Bk ), m2 (A2 , Bk ), , and mx (Ax , Bk ), respectively, where A1 ⊆, A2 ⊆, , and Ax ⊆. Given A = A1 ∩ A2 · · · ∩ Ax , its combined section mass function at Bk , denoted as mB (A, Bk ), is calculated as

mB (A, Bk ) = (m1  m2 · · ·  mx )(A, Bk )  = K1 m1 ( A1 , Bk )m2 ( A2 , Bk ) · · · mx ( Ax , Bk ) A1 ∩A2 ···∩Ax =A

(18)

 A1 ∩A2 ···∩Ax =∅

= 1−



m1 ( A1 , Bk ) · m2 ( A2 , Bk ) · · · mx ( Ax , Bk )

A1 ∩A2 ···∩Ax =∅

. m1 ( A1 , Bk ) · m2 ( A2 , Bk ) · · · mx ( Ax , Bk )

(19)

4.3.2. Combination rule between block sections With the advancement of train movement processes, the mass functions are accumulatively combined between block sections, and called the process mass function. At block section Bk , the accumulative process mass function is denoted as mP (A1 , Bk ) for subset A1 ⊆. Provided the section mass function mB (A2 , Bk+1 ) for subset A2 at successive block section Bk +1 , the process mass function mP (A, Bk+1 ) for subset A = A1 ∩ A2 at Bk +1 is calculated as

mP (A, Bk+1 ) = mP (A1 , Bk )  mB (A2 , Bk+1 ) 1  = mP (A1 , Bk )mB (A2 , Bk+1 ) K

(20)

A1 ∩A2 =A

K=



mP (A1 , Bk ) · mB (A2 , Bk+1 )  mP (A1 , Bk ) · mB (A2 , Bk+1 )

A1 ∩A2 =∅

=1−

(21)

A1 ∩A2 =∅

where mP (A1 , Bk ) = mB (A1 , Bk ) if k = 1. Initially, the information feedback of train movements may not be sufficient to judge whether a train is running in accordance with which train movement model and condition. With the forward motion of a train, the information feedback gradually becomes sufficient to identify train movement situations. Some mass functions are strengthened, and others become weak. Ultimately, train movement situations are discerned out. If there exist potential safety hazards for the identified train movement model and condition, the corresponding emergency measures must be adopted to avoid an accident. 5. Case study 5.1. Introduction of 7/23 accident The 7/23 accident occurred between the Yongjia and Wenzhounan stations on the Yongwen railway line, where there was a red tape at the failed 5829AG track circuit as shown in Fig. 3. The total distance from Yongjia to Wenzhounan stations is 15.563 km, including 12 block sections, sequentially denoted as B1 , B2 , …, and B12 along the train running direction. The position of Yongjia station is marked as 571.931 km on the Yongwen railway line. In the 7/23 accident, the following four events occurred, denoted as e1 , e2 , e3 and e4 : e1 : At 20:15:00, train D3115 departed from Yongjia station at the maximum speed of 120 km/h.

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS 6

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

Wenzhounan station

Yongjia station

C D 5829AG

2.913km

750m

11.9km Fig. 3. Railway line of 7/23 accident.

Table 2 Events and related possible reference models of train movements. Event

Time

Related train

Reference models

e1 e2 e3 e4

20:15:00 20:21:22 20:24:25 20:30:05

D3115 D3115 D301 D3115, D301

Moving toward Wenzhounan station before 5829AG (θ 1 ) Emergency braking and switching to OS mode unsuccessfully (θ 2 )Emergency braking and switching to OS mode successfully (θ 3 ) Moving toward and stopping at Wenzhounan station (θ 4 )Moving toward and stopping before B10 (θ 5 ) /

Table 3 Possible signals from track circuits encountered by D3115 and D301. Block section

Signal 1 (C1 )

Signal 2 (C2 )

B1 B2 B3 B4 B5 B6 B7 B8 B9

L5 L5 L5 L5 L5 L5 L4 L3 L2

L5 L5 L4 L3 L2 L LU U HU

e2 : At 20:21:22, the red-tape signal from track circuit 5829AG at the position of 583.834 km forced D3115 to implement emergency braking. e3 : At 20:24:25, train D301 departed from Yongjia station at the maximum speed of 160 km/h with a notice that attention should be paid by the D301 driver to D3115 running ahead. e4 : At 20:30:05, D301 ran into the rear end of D3115 at the position of 583.831 km with a speed of 99 km/h. The catastrophic train collision accident incredibly occurred in the history of China’s railway transportation. The main reason lies in that D301 ran under the illogical signals from track circuits that indicated that as if there were no train in front of it. The following will address how D–S theory and reference models could be utilized to identify the illogical signals and the incurred operation danger in advance. 5.2. Configuration of reference models 5.2.1. Event-driven reference-model addition Reference models are added in accordance with available events, representing the predicted possible operation situations of trains. Table 2 lists the events in the 7/23 accident and related possible reference models of train movements. When e1 occurred, D3115 moved toward Wenzhounan station (M1 ) under the control signal 1 (C1 ) from track circuits as shown in Table 3, and only one reference model θ 1 = (M1 , C1 ) is utilized for the inference of train movement situations. When e2 occurred, D3115 might perform emergency braking and switch to the OS operation mode successfully, and the reference model is denoted as θ 2 = (M2 , C1 ). However, in an exceptional case, the train might implement emergency braking but switch into the OS mode unsuccessfully, whose reference model is θ 3 = (M3 , C1 ). Under the OS operation mode, a train can run only at a maximum speed of 20 km/h. If D3115

switches into the OS mode unsuccessfully, D3115 will stop there, which is highly dangerous to D301 running behind. For emergency braking, different decelerations will be utilized for train movement models, compared with those of service braking. Thus, M2 and M3 have the same movement rules as described in Section 3.2, but with different configurations of deceleration parameters. When e3 occurred, because the dispatcher actually knew that D3115 might stop within block section B10 , two possible signals 1 and 2 (C1 and C2 ) from track circuits might exist for D301, as shown in Table 3. In this case, D301 either moved toward and stopped at Wenzhounan station, denoted by the reference model θ 4 = (M4 , C1 ), or moved toward and stopped before block section B10 , represented as θ 5 = (M4 , C2 ). In these two cases, two train movement models are the same (M4 ) but with different control signals (C1 and C2 ) from track circuits, implying two different train movement situations. For the last event, e4 , the two trains collided, so no additional reference models are necessary. 5.2.2. Selection of acceleration and deceleration The selection of general acceleration and deceleration is based upon Fig. 4 in the train movement model as described in Section 3.2. The service braking distances ds are dynamically configured according to the relationships of current speeds with the acceleration and deceleration as shown in Fig. 5. As to the emergency braking of D3115 and D301, the deceleration should be chosen according to Fig. 6. Figs. 4–6 are derived from the statistically average traction and braking laws of train movement processes. 5.3. Identification of train movement situations 5.3.1. Identification of D3115 movement situations Fig. 7 demonstrates the trajectories of accident scenario AS1 and reference models θ 1 , θ 2 , and θ 3 of D3115. The minimum time scale in Fig. 7 is 30 s. It is reported that at 20:29:26, D3115 had successfully switched to OS mode in the end, but had not run out of B10 before the accident, so at the final 39 s trajectory of AS1 , the speed of D3115 is not equal to 0 in Fig. 7(b). Table 4 displays the mass functions using the evidence Ez provided by AS1 of D3115 and assigned to the three reference models. The cells having no data in Table 4 are because there is no related definition. As shown in Fig. 7 and Table 4, the trajectories between AS1 and θ 1 are similar when D3115 runs from block sections B1 to B9 , so mass functions m1 (θ 1 , Bk ) (k = 1, 2, …, 9) are close to 1. θ 2 describes that D3115 switches to OS mode unsuccessfully after it performs emergency braking, which is similar to the case of AS1 within B10 , so the mass function m2 (θ 2 , B10 ) also approaches 1. θ 3 represents that D3115 switches to OS mode successfully with

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

7

Fig. 4. Acceleration and deceleration of D3115 and D301. Table 4 Evidence and mass functions of D3115 alternative movement situations. Block section

Ez of D3115

m1 (θ 1 , Bk )

B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12

[20:15:00 20:16:02] [20:16:02 20:16:39] [20:16:39 20:17:17] [20:17:17 20:17:54] [20:17:54 20:18:32] [20:18:32 20:19:10] [20:19:10 20:19:47] [20:19:47 20:20:25] [20:20:25 20:21:02] [20:21:02 20:30:05]

1.0 0 0 0 0.9770 0.9764 0.9775 0.9766 0.9771 0.9772 0.9780 0.9777

m2 (θ 2 , Bk )

m2 (, Bk )

m3 (θ 3 , Bk )

m3 (, Bk )

mB (θ 2 , Bk )

mB (θ 3 , Bk )

mB (, Bk )

0.9985

0.0015

0.9918 0.0 0 0 0 0.0 0 0 0

0.0082

0.4998

0.4998

0.0 0 05

Fig. 5. Deceleration processes of D3115 and D301.

Fig. 6. Deceleration of emergency braking of D3115 and D301.

a maximum speed of 20 km/h after it performs emergency braking. However, at first, m3 (θ 3 , B10 ) verges on 1 when D3115 is simulated to run within B10 according to reference model θ 3 . After D3115 is simulated to run out of B10 , according to Eq. (15), there is no time intersection between the time intervals of AS1 and θ 3 within B11 , so m3 (θ 3 , B11 ) is 0. For the same reason, m3 (θ 3 , B12 ) is 0 until the instant of accident occurrence at 20:30:05. When combining completely or even highly conflicting evidence, Dempster’s

rule of combination has been found to generate counter-intuitive results. Therefore, the combined section mass functions mB (θ 2 , B10 ) and mB (θ 3 , B10 ) are equally assigned as mB (θ l , Bk ) = (1 − m2 (, Bk )m3 (, Bk ))/2, where l = 2 and 3, and k = 10. This combination approach is consistent with the intuitive cognition and without successive accumulative counter-intuitive effects. At that instant, we have no sufficient evidence to distinguish the true movement situation of D3115 between θ 2 and θ 3 . According to θ 3 , after 20:22:39, D3115 is simulated to run out of B10 , and after 20:27:01, it is out of B11 . However, there actually is no occupancy information for block sections B11 and B12 reflected in the station CTC system from 20:22:39 to the instant of accident occurrence at 20:30:05, which is Ez of D3115. At 20:27:01, D3115 can be inferred as being within B10 . If the station dispatcher paid much attention to the identification of D3115 movement situations after D301 departed at 20:24:25 and directly commanded that D301 stop immediately before B10 , the train collision tragedy could be avoided.

5.3.2. Identification of D301 movement situations Fig. 8 represents the trajectories of accident scenario AS2 and reference models θ 4 and θ 5 of D301. Table 5 illustrates the evidence Ez of D301 operations and the basic probabilities of that evidence assigned to θ 4 and θ 5 . The process mass functions, corresponding belief and plausibility functions, and Pignistic probabilities are listed in Table 6 for making decisions. The empty cells in Tables 5 and 6 mean that those table header items are not applicable for them. From Fig. 8 and Tables 5 and 6, we can learn that before block section B8 , it is difficult to discriminate the trajectories of AS2 , θ 4 , and θ 5 , which are identical, so the mass functions of m4 (θ 4 , Bk ) and m5 (θ 5 , Bk ) (k = 1, 2, …, 7) are near 1. Similar to Table 4, the combined section mass functions mB (θ 4 , Bk ) and mB (θ 5 , Bk ) are equally assigned as mB (θ l , Bk ) = (1 − m4 (, Bk )m5 (, Bk ))/2 where l = 4 and 5, and k = 1, 2, …, 7. That is to say, the train movement

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS 8

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

588

Position (km)

585

B11 B10 AS1

582

θ1

θ2

θ3

579 576 573 570 20:15

20:19

20:23 Time (h:m) (a) position versus time

20:27

20:31

200 AS1

θ1

θ2

θ3

Speed (km/h)

150

100

50

0 20:15

20:19

20:23 Time (h:m) (b) speed versus time

20:27

20:31

Fig. 7. Trajectories of accident scenario and reference models of D3115. Table 5 Evidence and section mass functions of D301 movement situations. Block section

Ez of D301

m4 (θ 4 , Bk )

m4 (, Bk )

m5 (θ 5 , Bk )

m5 (, Bk )

mB (θ 4 , Bk )

mB (θ 5 , Bk )

mB (, Bk )

B1 B2 B3 B4 B5 B6 B7 B8 B9 B10

[20:24:25 20:25:42] [20:25:42 20:26:19] [20:26:19 20:26:48] [20:26:48 20:27:16] [20:27:16 20:27:44] [20:27:44 20:28:12] [20:28:12 20:28:41] [20:28:41 20:29:09] [20:29:09 20:29:37] [20:29:37 20:30:05]

1.0 0 0 0 0.9898 0.9817 0.9773 0.9794 0.9812 0.9823 0.9805 0.9809 0.9730

0.0 0 0 0 0.0102 0.0183 0.0227 0.0206 0.0188 0.0177 0.0195 0.0191 0.0270

1.0 0 0 0 0.9898 0.9817 0.9773 0.9794 0.9812 0.9823 0.8888 0.4742

0.0 0 0 0 0.0102 0.0183 0.0227 0.0206 0.0188 0.0177 0.1112 0.5258

0.50 0 0 0.4999 0.4998 0.4997 0.4998 0.4998 0.4998 0.8483 0.9643

0.50 0 0 0.4999 0.4998 0.4997 0.4998 0.4998 0.4998 0.1348 0.0169

0.0 0 0 0 0.0 0 01 0.0 0 03 0.0 0 05 0.0 0 04 0.0 0 04 0.0 0 03 0.0169 0.0188

feedback evidence provided is not sufficient to judge whether the train is running according to which reference models. From B8 , D301 should decelerate as shown in Fig. 8, so the trajectories of θ 5 begin to render discrepancies with those of AS2 and θ 4 . The mass functions assigned to reference model θ 5 are gradually decreased. The section mass function mB (θ 4 , Bk ) increases, but

mB (θ 5 , Bk ) decreases when k = 8 and 9, which implies that D301 did not run toward B10 and stop before it, and the signals are illogically emitted from malfunctioning track circuits. Such an argument could be inferred after D301 ran out of B8 and would be further strengthened after it ran out of B9 , at 20:29:08 and 20:29:37, respectively. Even if at 20:29:37 the station dispatcher commanded

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

ARTICLE IN PRESS

JID: KNOSYS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

9

588

Position (km)

θ4

AS2

585

θ5

B 582 B9 8

579 576 573 570 20:15

20:19

20:23 Time (h:m) (a) position versus time

20:27

20:31

200

θ4

AS2

θ5

Speed (km/h)

150

100

50

0 570

573

576

579 Position (km) (b) speed versus position

582

585

588

Fig. 8. Trajectories of accident scenario and reference models of D301. Table 6 Combined process mass functions, belief degree measures, and Pignistic probabilities. Block section

mP (θ 4 , Bk )

mP (θ 5 , Bk )

mP (, Bk )

Bel(θ 4 , Bk )

Pl(θ 4 , Bk )

Ppig (θ 4 , Bk )

Bel(θ 5 , Bk )

Pl(θ 5 , Bk )

Ppig (θ 5 , Bk )

B1 B2 B3 B4 B5 B6 B7 B8 B9 B10

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.8508 0.9937 0.9730

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.1492 0.0063

0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0 0.0 0 0 0

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.8508 0.9937

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.8508 0.9937

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.8508 0.9937

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.1492 0.0063

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.1492 0.0063

0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.50 0 0 0.1492 0.0063

the D301 driver to perform emergency braking, the disastrous accident could still be avoided. Fig. 9 shows the case of avoiding the 7/23 accident if D301 performed emergency braking immediately after B9 . In all, in the 7/23 accident, through the proposed inference approach using ETRM, the movement situations of the front D3115

and the rear D301 can be identified prior to the accident occurrence instant. If D301 were commanded to perform emergency braking earlier, the collision accident could have been prevented. Emergency detection and control play a vital role in guaranteeing the safe operation of railway transportation. Compared with the posterior evaluation about railway accidents for future prevention

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

JID: KNOSYS 10

ARTICLE IN PRESS

[m5G;October 16, 2017;9:12]

Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

Fig. 9. Trajectories of D3115 and D301 if D301 performed emergency braking immediately after B9 .

[33-36], the proposed approach provides a solution to identify potential accident precursors of train movement collisions and prevent them from occurring. It diagnoses the rationalities of control flows and the consistency of multisource information such as track circuit signals and actual train positions through the quantitative evaluation criteria provided by reference models and dynamic inference algorithms based on D–S theory. In essence, the questions progressively attempt to obtain clarification using the proposed approach, about where the trains are, whether the train acceleration and deceleration behaviors are reasonable, whether the train control equipment has malfunctioned, what the level of credibility is about those pieces of information.

6. Conclusions Integrating the inference and decision system based on train operation knowledge with current railway TDCS/CTC systems will facilitate transportation safety and efficiency. Train movement situations are the direct reflection of train control logic and intensity. Therefore, qualitatively and quantitatively analyzing train movement situations, for example, judging when a train should accelerate or decelerate and whether the intensity of acceleration or deceleration control is appropriate, can discern the aberrances of train onboard and ground control equipment as well as potential operation accidents. In general, train operation safety can be guaranteed if a train runs according to preset logical processes and adequate movement tendencies. However, the malfunction of train control equipment is sometimes induced, for example, by lightning strikes as in the 7/23 accident, which causes illogical control flows and inappropriate control intensities. On-line benchmarking with reference models can reveal the true situations of train movements and control equipment. D–S theory provides a mathematical inference mechanism for the identification of train movement situations supplied by reference models. Staged applications of D–S theory into dynamic processes of train movements will make some arguments attain further merit and others disapproval, and ultimate decisions can be gradually reached. The analysis of train movement situations using ETRM assists in discovering useful knowledge to diagnose equipment failures and avoid accident occurrences from abstract feedback data of train movements, which is similar to the human decision processes of pattern-based gradual matching.

Acknowledgments This work was financially supported by the National Natural Science Foundation of China (grant no. 61673049) and the Fundamental Research Funds for the Central Universities of China (grant no. 2017JBM302).

References [1] A.P. Dempster, Upper and lower probabilities induced by a multi-valued mapping, Ann. Math. Stat 38 (2) (1967) 325–339. [2] G. Shafer, A Mathematical Theory of Evidence, Princeton University Press, Princeton, 1976. [3] I. Bloch, Some aspects of Dempster-Shafer evidence theory for classification of multi-modality medical images taking partial volume effect into account, Pattern Recognit. Lett. 17 (8) (1996) 905–919. [4] R.R. Yager, A class of fuzzy measures generated from a Dempster-Shafer belief structure, Int. J. Intell. Syst. 14 (12) (1999) 1239–1247. [5] T. Denoeux, A neural network classifier based on Dempster-Shafer theory, IEEE Trans. Syst. Man Cybernet., Part A: Syst. Hum 30 (2) (20 0 0) 131–150. [6] H. Wang, S. McClean, Deriving evidence theoretical functions in multivariate data spaces: a systematic approach, IEEE Trans. Syst. Man Cybernet., Part B: Cybernet. 38 (2) (2008) 455–465. [7] M.-H. Masson, T. Denoeux, ECM: An evidential version of the fuzzy c-means algorithm, Pattern Recognit 41 (4) (2008) 1384–1397. [8] P. Xu, Y. Deng, X. Su, S. Mahadevan, A new method to determine basic probability assignment from training data, Know. Based Syst. 46 (2013) 69–80. [9] D. Han, Y. Deng, C. Han, Novel approaches for the transformation of fuzzy membership function into basic probability assignment based on uncertain optimization, Int. J. Intell. Syst. 21 (2) (2013) 289–322. [10] C. Zhang, Y. Hu, F.T.S. Chan, R. Sadiq, Y. Deng, A new method to determine basic probability assignment using core samples, Know. Based Syst. 69 (2014) 140–149. [11] X. Deng, Q. Liu, Y. Deng, S. Mahadevan, An improved method to construct basic probability assignment based on the confusion matrix for classification problem, Inf. Sci. 340–341 (2016) 250–261. [12] Y. Yang, D. Han, A new distance-based total uncertainty measure in the theory of belief functions, Know. Based Syst. 94 (2016) 114–123. [13] M.C. Florea, A.-L. Jousselme, É. Bossé, D. Grenier, Robust combination rules for evidence theory, Inf. Fusion 10 (2) (2009) 183–197. [14] L. Dymova, P. Sevastjanov, The operations on intuitionistic fuzzy values in the framework of Dempster–Shafer theory, Know. Based Syst. 35 (2012) 132–143. [15] R.R. Yager, N. Alajlan, Dempster-Shafer belief structures for decision making under uncertainty, Know. Based Syst. 80 (2015) 58–66. [16] T. Reineking, Particle filtering in the Dempster-Shafer theory, Int. J. Apporx. Reason. 52 (8) (2011) 1124–1135. [17] K. Zhou, A. Martin, Q. Pan, Z.-G. Liu, Median evidential c-means algorithm and its application to community detection, Know. Based Syst. 74 (2015) 69–88. [18] T. Denoeux, O. Kanjanatarakul, S. Sriboonchitta, EK-NNclus: a clustering procedure based on the evidential K-nearest neighbor rule, Know. Based Syst. 88 (2015) 57–69. [19] T. Denoeux, S. Sriboonchitta, O. Kanjanatarakul, Evidential clustering of large dissimilarity data, Know. Based Syst. 106 (2016) 179–195. [20] M. Tabassian, R. Ghaderi, R. Ebrahimpour, Combining complementary information sources in the Dempster-Shafer framework for solving classification problems with imperfect labels, Know. Based Syst. 27 (2012) 92–102. [21] A. Sarabi-Jamab, B.N. Araabi, T. Augustin, Information-based dissimilarity assessment in Dempster-Shafer theory, Know. Based Syst. 54 (2013) 114–127. [22] Z.-G. Liu, Q. Pan, J. Dezert, Evidential classifier for imprecise data based on belief functions, Know. Based Syst. 52 (2013) 246–257. [23] Z.-G. Liu, Q. Pan, J. Dezert, Classification of uncertain and imprecise data based on evidence theory, Neurocomputing 133 (2014) 459–470. [24] Z.-G. Liu, Y. Liu, J. Dezert, Q. Pan, Classification of incomplete data based on belief functions and K-nearest neighbors, Know. Based Syst. 89 (2015) 113–125. [25] D. Han, W. Liu, J. Dezert, Y. Yang, A novel approach to pre-extracting support vectors based on the theory of belief functions, Know. Based Syst. 110 (2016) 210–223. [26] A. Castiglione, R. Pizzolante, C. Esposito, A. De Santis, F. Palmieri, A. Castiglione, A collaborative clinical analysis service based on theory of evidence, fuzzy linguistic sets and prospect theory and its application to craniofacial disorders in infants, Future Gener. Comput. Syst. 67 (2017) 230–241.

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012

JID: KNOSYS

ARTICLE IN PRESS Y. Zhou et al. / Knowledge-Based Systems 000 (2017) 1–11

[27] H. Lü, W.-B. Shangguan, D. Yu, An imprecise probability approach for squeal instability analysis based on evidence theory, J. Sound Vib. 387 (2017) 96–113. [28] Z. Xiao, X. Yang, Y. Pang, X. Dang, The prediction for listed companies’ financial distress by using multiple prediction methods with rough set and Dempster-Shafer evidence theory, Know. Based Syst. 26 (2012) 196–206. [29] L. Oukhellou, A. Debiolles, T. Denoeux, P. Aknin, Fault diagnosis in railway track circuits using Dempster-Shafer classifier fusion, Eng. Appl. Artif. Intel. 23 (1) (2010) 117–128. [30] Z. Xu, M. Liu, G. Yang, N. Li, Application of interval analysis and evidence theory to fault location, IET Electr. Power Appl. 3 (1) (2009) 77–84. [31] G. Geng, L.X. Li, Scheduling railway freight cars, Know. Based Syst. 14 (5-6) (2001) 289–297. [32] M.A. Salido, M. Abril, F. Barber, L. Ingolotti, P. Tormos, A. Lova, Domain-dependent distributed models for railway scheduling, Know. Based Syst. 20 (2) (2007) 186–194. [33] M.T. Baysari, A.S. McIntosh, J.R. Wilson, Understanding the human factors contribution to railway accidents and incidents in Australia, Accid. Anal. Prevent. 40 (5) (2008) 1750–1757.

[m5G;October 16, 2017;9:12] 11

[34] M. Ouyang, L. Hong, M.-H. Yu, Q. Fei, STAMP-based analysis on the railway accident and accident spreading: Taking the China – Jiaoji railway accident for example, Saf. Sci. 48 (5) (2010) 544–555. [35] F. Belmonte, W. Schön, L. Heurley, R. Capel, Interdisciplinary safety analysis of complex socio-technological systems based on the functional resonance accident model: an application to railway traffic supervision, Reliab. Eng. Syst. Safe. 96 (2) (2011) 237–249. [36] Y. Fan, Z. Li, J. Pei, H. Li, J. Sun, Applying systems thinking approach to accident analysis in China: Case study of “723” Yong-Tai-Wen high-speed train accident, Saf. Sci. 76 (2015) 190–201. [37] Y. Zhou, C. Mi, Modeling and simulation of train movements under scheduling and control for a fixed-block railway network using cellular automata, Simulation 89 (6) (2013) 771–783. [38] Y. Zhou, Z. Zhang, D. Liu, Analysis of train movement dynamics under various temporal-spatial constraints in fixed-block railway network using extended cellular automaton model, Mod. Phys. Lett. B 28 (8) (2014) 1450060.1–1450060.11. [39] P. Smets, R. Kennes, The transferable belief model, Artif. Intell. 66 (2) (1994) 191–234.

Please cite this article as: Y. Zhou et al., Safety justification of train movement dynamic processes using evidence theory and reference models, Knowledge-Based Systems (2017), https://doi.org/10.1016/j.knosys.2017.10.012