SAET-METEOR

Line 14 is a distribnted real-time complex system, the main function of which is to transport passengers, while guaranteeing high safety for travelers. The system needs to ensrtre that it meets certain functional constraints said to be safe [CHA 96], The real-time character reflects the fact that the railway system interacts with its physical enviromnent, the behavior of which is uninterruptible and irreversible in nature. 

Regarding technical aspects, the service is currently provided by 19 trains, each composed of six cars (an extension is planned to eight) with a service speed of 40 ktn/hour and an interval between trains of 85 seconds in full automatic driving. 

One of the characteristics of line 14 is that it allows the movement of non-equipped trains with a driver and equipped trains with or without a driver allowing for automatic driving. In the case of equipped trains, there are two operating modes manual steering and automatic integrated driving. 

The VAL is a hght underground railway running on several sites in France (for example LiUe, Toulouse, Orly-Val and CdG-Val) and abroad (for example Chicago, Taipei and Turin). 

To this complexity must be added objectives for safety engineering, such as failure rates, contrary to the safety for equipment ranging from 10 to 10 per hour and which are reflected by the fact that  

---

The breakdown of the SAET-METEOR system into sub-systems, equipment, software and hardware is presented in Figure 2.6... 

Figure 2.7. Breakdown of the SAET-METEOR automatic pilot...

As indicated by [FOR 96], the equipment of the SAET-METEOR is stractured around the coded safe processor. This combines arithmetic encoding and signature verification in the context of processes said to be safe. 

The demonstration of the effectiveness of the coded safe processor has been made in the context of the implementation of several automatic and semi-automatic railways (SACEM [FOR 89], MAGGALY [MAI 93], etc.). As the SCP was lacking in performance, SAET-METEOR was an opportunity to add a coprocessor. 

In the French railway field, the use of formal methods, including the use of method B [ABR %], is increasingly common in the development of critical systems. The software of these safety systems (railway signaUng, automatic driving) must meet strict criteria for quality, reliability, and robustness. One of the first applications of these formal methods was done retrospectively on SACEM [GUI 90]. More recent projects, such as CTDC, KVS or SAET-METEOR [BEH 93 BEH 96], used method B throughout the development process (from the specifications to the code). 

To learn more about the implementation of method B on the SAET-METEOR project, the interested reader is referred to [BOU 06], which presents both the woik of the industry and the RATP. 

In view of the principles of safely, of redundancy and semi-active repUcation implemented within SAET-METEOR, woik has been undertaken to optimize the process of commutation failure. 

ESS 98] presents a realistic implementation of the PADRE protocol on the SAET-METEOR example, but requires a real experiment. 

As shown in Figitre 2.12, the railway reference CENELEC EN 5012x is a variation of the generic standard lEC 61508, which takes into accoimt the specificities of the railway sector and of various success stories (SACEM, TVM, SAET-METEOR, etc.). 

This chapter has provided an opportunity to present the first architecture implemented in the context of railway systems the coded safe processor. Several systems have been constructed based on this system (SACEM, TVM, MAGGALY, SAET-METEOR, etc.). Since then, industries have implemented 2oo3-type architectures in addition to the SCP. Chapters 3,4 and 5 will present some examples of this evolution. 

After SAET-METEOR, another approach was investigated in order to achieve a solution with fully integrated redundancy, based on the same hardware architecture, but this time completely seamless from an application viewpoint. This approach comes from work nndertaken on PADRE, a redimdancy management protocol where consistency is guaranteed by a process on the execution contexts of the applications [ESS 99]. 

For the railway transport field, Chapters 2, 3, 4, 5 and 11 present the applicable standards (CENELEC EN 50126, EN 50128, and EN 50129) as well as tangible examples (SACEM, SAET-METEOR, CSD, PIPC and the DIGISAFE XME architecture). 

---