Page 98 - 360.revista de Alta Velocidad - Nº 5

Meyer zu Hörste, Michael. Asbach, Lennart. Hardi, Hungar. Lemmer, Karsten.

to replace the driver s eyes or diagnostic systems to ensure the proper function of the train,
they have to be included by adding new test cases in the test specification. Since this should
be relatively easy for all pure digital -interfaces, like diagnostic information of the train, it
will be more complex for kind of analogue information like the camera image. If, maybe due to
legal restrictions, there is a certain reaction required based on the output of image recognition,
this will lead to very complex tests. The challenge is the number of possible inputs. It gets even
worse, if state-of-the-art methods like machine learning are used for the image recognition.
In the current authorization process the certification of a machine learning systems seems to
be impossible. Current research approaches are trying to solve certification issues for machine
learning algorithms by using watch-dogs, which assure that the machine cannot leave certain
boundaries. But right now there is no efficient methodology found.
Even if there is no approach with artificial intelligence and self-learning algorithms the
certification and testing of obstacle detection systems will be challenging. Spot checks are
possible, but their results are questionable. The number of possible inputs is simply too high
(32*10^12 possibilities for a full HD image with 24bits colour depth), to ensure a proper test
coverage. Two solutions are conceivable at the moment. Maybe the easiest approach is to
ensure no obstacles by fencing the track completely. If a safe fencing is not productive, another
possibility would be the acquisition of real data from real train journeys for testing obstacle
detection. I.e. a proper way would be to equip all current trains with cameras and use this
material (ideally commented) for testing the obstacle detection systems. By this approach, at
least a very real test can be assured and the result is more resilient. This procedure can be
used for different sensors and is not limited to video based sensors. The following section will
exclude the testing of video based obstacle detection and will focus on functional interfaces.

2.2 Solution Approach

Components and systems for railway applications, especially for safe applications, need to be
tested comprehensively before taken into operation. These tests have different aims: they can
be used to show that a system fulfils the relevant specification, the foreseen operational profile
or safety requirements. All these tests need to be described to be performed in the field or to
be formalized to be executed in a lab. Both need a formal definition and description to prove
the correctness of the results.

The approach used for the conformity tests for ETCS can be extended for operational and
safety lab tests, operational field tests and fits very well for testing ATO-systems, too. It
may, as demonstrated in the section on interface conformity for digital track side systems,
even applied to partial standardisations. The principle method of the generation of the test
sequences can be used for the different types of tests. The optimization criteria as well as the
rules for the parameterization differ for the different kinds of tests. If the same approach for
the formalisation and parameterization is used, the lab environment can be used for any type
of test, with, however, some adaptations to be made to achieve sufficient flexibility.
Test case generation and the test sequence construction profit substantially from the applica-
tion of formal approaches. This field features a variety of languages, methods and tools. Pre-
sent-day solutions cover only part of the needs of practice, but show potential to be much more
useful if applied in a carefully designed process employing adequate formalisations.

3. Test Generation

3.1 Conformity Test Sequences

The group of eight suppliers of train control systems called UNISIG (Union of European

96 360.revista de alta velocidad