Journal of Transportation Technologies, 2011, 1, 21-29
doi:10.4236/jtts.2011.12004 Published Online April 2011 (http://www.scirp.org/journal/jtts)
Secure Interchange Routing
Mark Hartong1, Rajni Goel2, Duminda Wijesekera3
1Federal Railroad Administration, Washington DC, USA
2Howard University, Washington DC, USA
3George Mason University, Fairfax, USA
Received January 24, 2011; revised February 21, 2011; accept ed April 6, 2011
Abstract
Locations that connect tracks from different rail-road companies—referred to as interchange points—ex-
change crew, locomotives, and their associated consists. Because trains have a single degree of freedom in
movement, that is, they can only operate along the tracks, any delay occurring at an interchange point causes
cascading delays in connecting tracks. In addition, authentication and authorization that is expected to take
place at interchanges in PTC controlled train movement may add extra delays due to mutual authentication
between two security domains. In this paper we propose a model that can address safety and security con-
cerns and their interrelationships that govern train movement through an interchange point. We show how a
profile of safe operations can be computed for operating an interchange point.
Keywords: Railroad, Routing, Interchange, Safety, and Security
1. Introduction
The primary objective of inter-domain rail operation is to
minimize rail traffic delay at interchange points while
maintaining safe operating conditions. Delays add to a
railroads cost of business and can have a significant im-
pact on the US economy. Techniques used to minimize
delays are categorized as tactical (i.e. addresses local
scheduling decisions) and strategic (i.e. addresses global
scheduling decisions over regions). Taken together they
control the end-to-end delays encountered by a trains
moving from point A to point B. We address the specific
case where points A and B are on different sides of a
single rail track that connects two regions belonging to
two railroad companies that is commonly referred to as
an interchange point. This problem is significant because,
if both regions are controlled by the proposed Positive
Train Control (PTC) systems, then each side has its own
authentication and authorization system that must com-
municate with the other side to allow an approaching
train to go through the interchange point. Our model
shows how the two regions can control the movements of
trains while maintaining safe inter-train distance and au-
thenticating the crew, and locomotives.
The rest of the paper is written as follows. Section 2
discuses delay in the trail environment as it applies to se-
cure interchange operations. Section 3 outlines our pro-
posed model, and the conditions required for safe secure
interchange operation. Section 4 takes the conditions for
safe secure interchange operations and relates them to
underlying physics associated with train operations and
communications. Section 5 illustrates the application of
our model. Finally Section 6 discusses the limitations of
our model, and outlines areas of further research to re-
duce those limitations.
2. Delays and Delay Modeling
Delays impact train operations significantly. For exam-
ple, in 1997, due to service delays on the Union Pacific
(UP) railroad, the State of Texas alone encountered ex-
cess costs of over $1.0 billion [1-2]. General delay mini-
mization planning must take into account a whole host of
issues such as particular rail lines that are used (line
planning), customer service requirements (demand anal-
ysis), consist management (allocation of train cars and
locomotives), and crew management (distribution and al-
location of the train and crew). Each of these has differ-
ent, and often competing goals. Computing an optimal
system wide (strategic) solution requires the ability to
schedule the right trains frequently enough to be service-
responsive to customers, long enough to be cost effective,
and spaced so as to minimize transfer time in yards and
congestion over the right of way, including interchange

M. HARTONG ET AL.
22
points. In this larger planning and scheduling problem,
we model the tactical behavior of regarding inter-domain
operations.
Figure 1 shows three railroads referred to as Rail-
road A, Railroad B and Railroad C, where we concen-
trate on the interchange point between Railroad A and
Railroad B. As independent entities, each one operates its
own trust management system within its own security
domain, and consequently has Certificate authorities CA,
CB and Dispatcher systems DSA and DSB respectively.
We consider the case where trains arriving on Railroad
A’s track attempts to enter the interchange point to Rail-
road B’s side (that is from the bottom right hand side to
the bottom left hand track in Figure 1). The trains are
named T1,, TX ,XN T where X and N are integers.
When Railroad A wishes to send Train TX,,XN T

to
Railroad B’s tracks, two communications may occur. The
first is that CA and CB may exchange certificates LX, and
DSA and DSB may exchange messages (say MX) in addi-
tion to DSA and/or DSB exchanging messages with trains.
Figure 1, only illustrate the communications of DSA with
CA, TX with DSB and DSA with CA, where other trust ma-
nagement messages may flow.
Traffic delays can be a combination of two separate,
but interrelated elements. First are delays resulting from
the specific physical operating characteristics of the trust
management, dispatching and communication systems.
The physical operating characteristics include slack time
built into the train schedule, traffic congestion, scheduled
stops, authorized speeds, location of other trains, on track
equipment, maintenance of way work zones, track physi-
cal condition, status of signals and communication band-
width. Although there is an extensive body of work on
optimization of network wide routing in general, and
railroad networks in particular, such as those described in
[3-10], we do not attempt to either develop new, or imp-
rove upon existing dispatching and routing methodolo-
Figure 1. Railroad security domains.
gies or consider more complex interchange configura-
tions in this paper.
The second category of delays arise due to sched-
uleing at interchange points, where two pre-requisites
must be satisfied before movement authority is granted:
1) Lo- comotive and the crew must be authenticated and
2) Tra- ck space must be available in the second domain.
Assuming a single unidirectional track with a single
siding but no other merging or branching greatly simpli-
fies the optimization of delay at interchanges. Although
there are numerous approaches ([11-21]), addressing this
configuration these solutions do not consider authentica-
tion delays that may occur due to the imposition of a trust
management system. Although other more complex track
configurations such as using multiple parallel facing or
reverse spurs can be built or combinations of facing and
reverse spurs can be considered, these cost more money
to construct [22].
Having one siding gives the dispatcher much needed
room to rearrange the order of trains that proceed to the
interchange. For example, the delay of Train TX at the in-
terchange point may be mitigated to some extent by the
availability of a siding S. If the train dispatcher for Com-
pany A is aware, sufficiently in advance of the arrival of
TX , to the interchange point of a potential delay, the dis-
patcher could direct TX into the siding S, allowing Train
1X
T

to proceed along the main line to the interchange
point. However, if the siding S is not available, or TX has
passed the point in which will allow the dispatcher to
direct TX into the siding S, TX will block the following
trains from reaching the interchange point. Even if the
dispatcher was able to safely divert TX into the siding S,
allowing 1X T

to proceed along the mainline to the in-
terchange point, any delay encountered in the process of
moving Train 1X T

at the interchange point will delay
the following Trains 2X T

through XN
T.
3. Cross Domain Operations
Our model of the tactical behaviors of Dispatcher A and
Dispatcher B relies on the following assumptions:
 There is a main track and a single siding in do-
main A and a single main track in domain B.
 All trains in domain A are of the same length, but
may have different priorities for movement.
 Train movements are from Domain A to Domain B.
 Dispatcher A (DSA) and B (DSB) have exchanged a
session key between each other. Dispatcher A (DSA)
has authenticated locomotive TX and the associated
engineer EX prior to receiving movement requests.
 Dispatcher A (DSA) controls the signal whose aspect
controls the movement of a train from domain A
while Dispatcher B (DSB) controls the signal whose
aspect controls the movement of a train into domain

M. HARTONG ET AL.
23
B.
 For a train to leave domain A and enter domain B,
both the Dispatcher A and Dispatcher B have to au-
thorize movement, coordinating the signal aspects.
 The siding S is of length L and can contain only one
train. The main track parallel to the siding may also
contain one train.
 There are up to N trains in the queue awaiting au-
thorization to enter domain B.
 Requests for authorizations from A to B are in order
of increasing distance of trains from interchange
point.
 A train TX is comprised of EX the engineer’s certifi-
cate, LX the locomotive certificate, PTCX’, the in-
stalled PTC system, VX, the initial train velocity,
and DBX the safe stopping (braking) distance.
 CAA is the certificate authority of domain A. CAB is
the certificate authority of domain B.
 MAX is a movement authority.
These conditions reflect actual railroad operating prac-
tices.
A train TX that has requested entry from one domain to
another is prohibited from proceeding into the new do-
main until the movement authority MAA has been appro-
ved by the dispatcher of the new domain. In the event
that TX does not receive a response to a request, or the
response to a request is delayed, TX proceeds to the limit
of its currently granted authority and stops. If TX is al-
ready at the limits of the authority, then TX remains
halted until the authority to proceed is received. The mo-
vement of subsequent trains, Ti for i > (X + 1) and i ≤ N,
are rescheduled by the dispatcher in the cur- rent domain
by modifying the movement authorities to preclude col-
lisions and overrun of authority limits as necessary. If the
dispatcher DSB approves MAX for TX (i.e. the track in
domain B is available), dispatcher DSA relays the ap-
proved MAX to TX , and TX transitions from domain A to
domain B. Dispatcher DSA may then reschedule 1X
T

to
advance to the block vacated by TX and advance subse-
quent trains Ti for i ≥ (X + 2).
This process is illustrated in Figure 2. This scenario
assumes that Dispatcher A is already in possession of the
authentication information associated with EX and LX. A
train TX that intends to move from domain A to domain B
submits the requested movement authority MAX, the en-
gineers certificate EX and the locomotive certificate, LX ,
(the Access Request in Figure 2) to the Dispatcher A. .
Dispatcher A, already being in possession of the neces-
sary certificate information authenticates the requests and
forwards it to the Dispatcher in Domain B. Dispatcher B
evaluates the feasibility of allowing TX to enter B’s do-
main. If Dispatcher B approves the movement, he appro-
ves MAX and returns it to Dispatcher A. Dispatcher A then
Figure 2. Movement authority approval.
passes MAX back to TX. TX enters Railroad B’s domain,
and Dispatcher A reschedules the movement of 1X
T

.
Additional scenarios are described in [22].
There are three possible situations that may be en-
countered by a train 1X
T

that is following train TX in
Domain A with a single siding.
 If the main line and siding are clear, 1X
T

may take
the main or siding and proceed to the interchange
point without delay.
 If the main is clear and the siding is blocked or the
main is blocked and the siding is cleared, 1X
T

may take the clear track and proceed to the inter-
change point without delay.
 If the main and siding are blocked 1X T may have
to wait until the main or siding is clear in order to
proceed to the interchange point.
In the later situation 1X T

can continue movement to
the interchange point if the length of time it takes for TX
to receive their authority MAA and move beyond the in-
terchange point is less than the time it takes to stop
1X
T

.
In the simplest case, where there is a single mainline
running between domains A and B, denial of entry of
Train TX will require rescheduling of the movement of
subsequent trains 1X T

,2X T,,
N
T. In order to pre-
clude a train-to-train collision between the end of Train
TX with the head of train 1X
T, train 1X T must receive
notification of the requirement to stop before it proceeds
beyond the safe stopping distance 1X
BD . If the move-
ment of train 1X
T

is not rescheduled, and train 1X
T

does not stop before reaching the location of TX, 1X T

,
and TX may collide. If the stopped train TX is released to
proceed into the next domain before the train 1X T

,
reaches the safe stopping distance, a collision can be
avoided.
The potential for a collision between train 1X
T

and

M. HARTONG ET AL.
24
train TX will be affected by the velocity of train 1X T

, the
time of release of a stopped train TX, the communication
delays associated with information exchanges between
CAA and CAB , the dispatcher processing delays DSA and
DSB , as well as the PTC system processing times PTCX,
and 1X PTC . The velocity 1X V of train 1X T directly
affects the safe stopping distance 1X BD . As 1X V

in-
creases, the safe stopping distance 1X BD  increases, re-
quiring greater separation of trains TX and 1X T

to pre-
clude a collision.”
3.1. Safe Stopping Distance
Stopping distances and times for train have been exten-
sively studied (for example [23-26]). Commercial tools
to calculate this information using more complex models
are exist, most notably the RailSim Train Performance
Calculator (TPC) by Systra Consulting, and the Train
Operation and Energy Simulator (TOES) by the Associa-
tion of American Railroads. These estimators reflect a
railroads operating philosophy, the type of train (for ex-
ample passenger or freight), the mass and its distribution
of the train, the gradient of the territory the train is oper-
ating on at the time of braking, the crews reaction time,
and the type of braking (full service, dynamic, or emer-
gency) and the associated deceleration rate induced by
the brakes. The braking calculation variables include the
types of cars (i.e. tank, box, railrider, etc.), variations in
the methods and type of braking (emergency or dynamic,
conventional air or electronic pneumatic), track profile
(grades and curves), behavior of the locomotive power
based on track conditions, details of consist loading and
position in the consist of power (head end, middle, or
pushing). More approximate estimates for to calculate
braking distance exist. For example, [27] is used to pre-
dict braking distances for the European Train Control
System (ETCS) system. The International Union of
Railways (UIC) has promulgated standard 546 [28]. A
similar standard is under development by the IEEE [29].
Additional work on braking curves can be found in Ref-
erences [30-35].
3.2. Delay
In general, delays of trains proceeding from A to B are
prevented when the total delay time associated with cer-
tificate authentication and movement authorization is
less than the time required to stop the train. If the former
is less than the later, then the dispatcher is able to pass
the appropriate authorizations to an on-coming train suf-
ficiently in advance of the required safe stopping dis-
tance to enable the oncoming train to pass at speed. Pre-
vention of a collision requires that the delays for a train
occupying either a siding or mainline block and the clea-
rance time for the train to clear the block must be less or
equal to the time it takes for a following train to brake to
a zero velocity.
At maximum capacity, the movement of a train from
one location to the next requires that the lead train clear
the location it is occupying before the trailing train can
stop in the location just cleared. This worst-case scenario
may occur as a consequence of communication delays
compounded by initial authentication of the actors and
the first message exchanged. To obtain the total time for
a consist to clear, or a consist to stop, the communica-
tions overhead times TOH must added to the time to clear
of TX and time to stop 1X T

. Provided TX and 1X T

re-
quire the same length of time to authenticate (i.e. TOH is a
constant for train TX or train 1X T, the delay TOH cancels
out and the delay between individual trains (TX and 1X T

)
remains the same as previously calculated.
The assumption that there are no authentication or
communications delays is, however, unrealistic. Even in
a benign environment, communications disruptions may
occur as a consequence of phenomena such as normal at-
mospheric interference, electromagnetic interference by
the AC or DC generators onboard the locomotive, or
physical items such as buildings or foliage. To ensure
that collisions between a leading train TX and a following
train 1X T

do not occur, the authentication and the com-
munications delays TCOMMDELAYX associated with train TX
must be less than the communications delays
1COMMDELAYX
T

associated with train 1X T. If the differ-
ence in communications delays is greater than the al-
lowable delay between TX and 1X T, then the potential
exists for the trains to collide.
System designs assume that communications disrupt-
tions are likely to occur. To mitigate against this eventu-
ality, not only are the commands retransmitted several
times to ensure receipt and acknowledgement, each
transmitting and receiving device is equipped with a ti-
mer. In the event of a communications disruption that
precludes receipt of a valid message, a timer on the de-
vice will expire, forcing the device to its most restrictive
safe state. This ensures the safety of following trains,
albeit with a decrease in system throughput.
4. Physics of Braking and Accelerating
Trains
The approximate estimate for time to stop assumes con-
stant deceleration in ideal track conditions (i.e. straight
(no curvature), level (no up or down grade, and dry). It
also assumes the same constant variables (train length,
train mass, braking efficiency, target speed, gradient, and
distance to target) and that all cars in a particular consist

M. HARTONG ET AL.
25
are identical and have similar braking characteristics.
Likewise, the time to clear a block assumes an identical
train operating under the same conditions.
4.1. Time to Clear Tx
Assuming constant acceleration from an initial velocity
of 0, the time for a train TX stopped at an interchange
point (in seconds) where the corresponds to the consist
length can be estimated as follows:
 


2
375
XX
X
XXA
X
LM
TC F
M
R
V




(1)
RA is estimated using the Davis equation. First developed
in the mid 1920’s, and modified in the late 1970’s, it
provides an estimate of the rolling resistance in pounds
per ton [28].
 
 

2
20
0.6 0.01
AX X
X
aX
XXX
RM V
KV
Car n














(2)
Where
MX is the weight of the train TX (tons)
LX is the length of the TX (feet)
VX is the final velocity of TX (mph)
FX is the tractive force of TX locomotives (HP)
RA is the drag of the consist when accelerating (lb/ton)
wX is the weight per axle per consist car in TX (tons)
nX is the number of axles per consist car in TX
CarX is the number of cars in the consist in TX
Ka is the acceleration drag coefficient Ka = 0.07
The tractive force FX is given by


 
XLoco
F
NHPE (3)
Where
NLoco is the number of locomotives in TX
HP is the Horsepower per locomotive in TX
E is the locomotive efficiency %.
4.2. Time to Stop
X
+1
T
Assuming constant deceleration, the time to stop 1X TS

(i.e. final velocity 10
X
V) in seconds is


 
11
1
1
0.04583 XX
XXD
MV
TS FR



 (4)
and the drag RD of 1X T is given by
 
 

11
1
2
1
111
20
0.6 0.01
DX X
X
bX
XXX
RM V
KV
Car n













 



(5)
Where
1X
M

is the mass of the train 1X
T (tons)
1X
V

is the initial velocity of 1X
T (mph)
1X
F

is the braking force of consist 1X T
RD is the drag of the consist 1X T when decelerating
1X


is weight per axle per consist car in 1X T

1X
n

is the number of axles per consist car in 1X
T

Kb is the braking drag coefficient. Kb = 1.4667
1X
Car

is the number of cars in the consist in 1X
T

The braking force 1X
F

is given by

 
  
11 1
2000
XX X
Avail
FCar CarWeight
BF Brake
 
 (6)
Where
1X
Car

is the number of cars in the consist 1X T

1X
CarWeight

is the weight of a car in the consist
1X
T

(tons)
BF is the brake ratio (5%)
BrakeAvail is the % operable brakes.
4.3. Consist Delay and Safety
Safe operation of the railroad requires that any Train 1X
T


not run into the preceding Train TX. For this safety crite-
rion to occur the consist delay between Train TX and 1X T

must satisfy the equation.
1XX
ConsistDelayTCTS   (7)
Solving Equation (7) for Consist Delay and substitut-
ing Equations (1) and (4) yields the maximum delay that
between two trains TX and 1X T.

 


11
1
0.04583
2
375
XX
XD
XX
XXA
X
MV
ConsistDelay FR
LM
FMR
V















 








(8)
where RA and RB are as defined in Equations (2) and (5).
At maximum capacity, the movement of a train from
one block to the next requires that the lead train clear the
block it is occupying before the trailing train can stop in
the block just cleared. This is no different than the case

M. HARTONG ET AL.
26
of advancing through the interchange point, the inter-
change point is simply a special case of a block boundary.
Instead of being the boundary between two adjacent blo-
cks in the same domain, it is simply the boundary be-
tween two adjacent blocks, one of which is one domain,
the other of which is a second domain. If trains TX and
1X
T occupy the main and siding, subsequent trains
2X
T through XN T are blocked from advancing since
the trains are restricted to a single degree of motion
along the track.
4.4. Communications Delay
The physics of train movement, and the impact of com-
munications and authentication delays can be combined
into a single equation. The right hand of the inequality is
Equation (8), while the left hand side is the time delay
due to padding, propagation, and processing delays plus
the system response time (SYSRESPONSETIME and SYSPROPA-
GATION) and the operators response time (OPRESPON- SE-
TIME ). See Equation (9), where 1X
M, MX, VX, 1X V

, LX,
1X
L, LX, 1X L, RD, RA, FX, and FX + 1 are as previ-
ously defined and
BSENDERADDRES is the number of bytes of information to
identify the sender
BRECEIVERADDRESS is the number of bytes of information
required to identify the receiver
PINFORMATION is the number of bytes of information re-
quired to format the information I for transmission
CDATA is the number of bytes of information required
to control the transmission across the media
CPADDING is the number of bytes of information re-
quired to format CDATA
SDATA is the number of bytes required to convey any
security information required for integrity and authentic-
ity
SPADDING is the number of bytes required to format
SDATA,
TR is the communication transmission rate
SYSRESPONSETIME is the length of time it takes for the
system to process the data once received and change it
into information
OPRESPONSETIME is the length of time it takes for the op-
erator to respond to a command once received.
SYSPROPAGATION is the propagation delay for the com-
munications medium
SYSRESPONSETIME is a function of the performance char-
acteristics of the office subsystem, wayside subsystem,
and the onboard subsystem involved in a particular mes-
sage exchange. OPRESPONSETIME is a function of human
factors behavior in receiving, processing, and executing a
received command.
The advantage of establishing this single safety equa-
tion relating all elements is that it allows for the designer
to develop risk based performance budgets for the vari-
ous elements in their design. As long as the overall equa-
tion remains true, the designer is free to experiment with
various options to achieve the required performance at a
particular cost point.
5. An Illustrative Example
The behavioral characteristics of the railroad vary greatly
depending upon the operating parameters of the trains
operating along the railroad. Finding the optimal combi-
nation of train parameters that minimizes Consist Delay
is a complex problem in operations research. The follow-
ing example, however, illustrates the use of these equa-
tions. For the purposes of this example we will assume
TX and 1X T

are identical with properties as follows:
 Number of Locomotives = 3
 Length of locomotive = 100 feet
 Horsepower per locomotive = 4500 HP
 Weight per locomotive = 200 tons
 Locomotive Efficiency = 95%
 Number of Cars = 100
 Weight of a Car = 60 tons
 Length of a Car = 100 feet
 Braking Efficiency = 5%
 Axles per Car = 2
 Percent of Brakes Operable = 85% (Minimum op-
erating brakes allowed by Federal Regulations)
 Train Length = 10300 Feet
 Communications Bandwidth = 4800 bps
All braking is provided by consist cars, locomotive dy-
namic braking is not considered. More complex scenar-
ios are analyzed in [22].

  


ReRe RePr
11
1
0.04583 2
375
Data Padding
SenderAddressceiverAddress InformationDataPaddingsponseTimesponseTimeopagation
XX XX
XD XXA
X
SS
BB PCCSYSOPSYS
TR
MV LM
FR FMR
V




 
 

 

 















(9)

M. HARTONG ET AL.
27
Based on the assumptions in the example, the time re-
quired for TX to accelerate and clear, the time for the fol-
lowing 1X T to decelerate and stop, and the associated
delays between the two is shown in Table 1.
Negative numbers indicate that a collision can occur.
Train TX will not have cleared the interchange point be-
fore Train 1X T arrives. An alternative way to view
combinations of leading train clearance time, and follow-
ing train stopping time is with a radar chart (Figure 3).
In this chart, the spokes represent the locomotive speeds,
the rings represent clearance times in seconds. As can be
seen, for the example configuration, in almost all cases,
the time for a leading train to clear the block is less than
the time it takes to stop the following train and some
delay can occur without adversely impacting subsequent
train movements. Changes in locomotive tractive effort
and train length also can affect clearance and stopping
times, This also is more fully discussed in [22].
The allowable delays previously calculated are based
on the physical characteristics of the locomotive and con-
sist as well as the communications bandwidth (4800 bps)
available to exchange data. Provided TX and 1X T

re-
Table 1. Allowable delays
X
X+1
V=V .
Velocity
TX
(MPH)
Velocity
TX+1
(MPH)
Clearance
Time TX
(Seconds)
Stop Time
TX+1
(Seconds)
Max Delay
Time
(Seconds)
10 10 17.05 11.27 −5.78
20 20 24.48 22.51 −1.97
30 30 30.53 33.69 3.17
40 40 36.00 44.81 8.81
50 50 41.28 55.86 14.58
60 60 46.57 66.82 20.25
Figure 3. Clearance & stopping time.
quire the same length of time to authenticate (i.e. TOH is a
constant for train TX or train 1X
T), the delay TOH can-
cels out and the delay between individual trains (TX and
1X
T

) remains the same as previously calculated.
With trains TX and 1X T

operating with under condi-
tion of nearly simultaneous movement authorities (a me-
thod of operation known as moving block and a capa-
bility made possible with Positive Train Control (PTC),
the required train separation is significantly less than if
train movements were not simultaneously. PTC is a wire-
less communication SCADA system that utilizes a con-
tinuous high bandwidth RF data communications net-
work that allows train-to-wayside and wayside-to-train
exchange of control and status information. Wayside,
office, and trainborne computers process received train
status and control data to provide continuous train con-
trol [36,37].
With the moving block method of operations, the se-
paration between trains moving at 60 mph can be as low
as roughly 3/10th of a mile. When contrasted to the r-
oughly 1.1 miles required by fixed blocks, the traffic
density can be increase by roughly a factor of three. This
makes significantly better use of the available track re-
sources, and increases system throughput.
6. Conclusions
We presented a model for an interchange between two
railroad domains governed by interoperating PTC sys-
tems for a unidirectional track with a single siding. We
showed how to compute the safe conditions by using
communication and trust management delays between
the two domains. This work provides the signal engineer
designing interchanges of some idea of the feasibility of
the proposed design. The work needs to be expanded to
account for bidirectional train movements on a single tra-
ck, multiple mainline track with crossovers, multiple sid-
ings, and spurs. Once these more complex tactical rou-
ting configurations have be addressed, they can be inte-
grated into strategic models, Establishing these relation-
ships is essential to determine the optimum use of limited
resources and continues to remain an open research area.
A closed form solution for determining the optimal
combination of resources is unlikely, making statistical
evaluation of open form solutions necessary and is a sub-
ject of future research. There are also a number of im-
plementation related issues that have not been fully ad-
dressed in this work. In a operational environment where
rail traffic is heavy and close together, the volume of
operational and environmental data that must be trans-
mitted may exceed the communications bandwidth. The
complete unification of tactical and strategic routing can
only be determined in the context of the railroads opera-

M. HARTONG ET AL.
28
ting environment and the particular implementation me-
chanisms. Ongoing research in this will provide us with
more accurate estimators to support detailed system de-
sign and cost evaluation.
7. References
[1] B. Weinstein and T. Clower, “The Impact of the Union
Pacific Service Disruptions on the Texas and National
Economies: An Unfinished Story,” Railroad Commission
of Texas, Austin, February 1998.
[2] “Joint Petition for Service Order, STB Service Order No.
1518,” Surface Transportation Board, Washington DC,
31 October 1997.
[3] Transportation Research Board of the National Acad-
emies, “US Railroad Efficiency: A Brief Economic Over-
view,” Proceedings of the Workshop on Research to En-
hance Rail Network Performance, Washington DC, 5-6
April 2006, pp. 63-71.
[4] M. Dessouky, Q. Lu, J. Zhao and R. Leachman, “An
Exact Solution Procedure to Determine the Optimal Dis-
patching Times for Complex Rail Networks,” IEE
Transactions, Vol. 32, No. 2, 2006, pp. 141-152.
[5] M. Khan, D. Zhang, M. Jun and J. Zhu, “An Intelligent
Search Technique to Train Scheduling Problem Based on
Genetic Algorithms,” Proceedings of the 2006 Interna-
tional Conference on Emerging Technologies, Perhwar,
13-14 November 2006, pp. 593-598.
doi:10.1109/ICET.2006.335970
[6] A. Tazoniero, R. Gonclaves and F. Gomide, “Decision
Making Strategies for Real Time Train Dispatch and
Control Analysis and Design of Intelligent Systems Using
Soft Computing Techniques,” Advances in Soft Comput-
ing, Springer, Vol. 41, 2007, pp. 193-204.
[7] F. Li, Z. Gao, K. Li and L. Yang, “Efficient Scheduling
of Railway Traffic Based on Global Information of
Train,” Transportation Research, Part B: Methodological,
Vol. 42, No. 10, 2008, pp. 1008-1030.
[8] M. Penicka, “Formal Approach to Railway Applications,”
Formal Methods and Hybrid Real Time Systems, Lecture
Notes in Computer Science, Springer, Vol. 4700, 2007,
pp. 504-520. doi:10.1007/978-3-540-75221-9_24
[9] M. Carey and I. Crawford, “Scheduling Trains on a Net-
work of Busy Complex Stations,” Transportation Re-
search, Part B: Methodological, Vol. 41, No. 2, 2007, pp.
159-178.
[10] J. Tornquist, “Computer-Based Decision Support for
Railway Traffic Scheduling and Dispatching, A Review
of Models,” Proceedings of the 5th Workshop on Algo-
rithmic Methods and Models for Optimization of Rail-
ways, Palma de Mallorca, 14 September 2005.
[11] L. Anderegg, I. Stephan, E. Gantenbein and I Stature,
“Train Routing Algorithms: Concepts, Design Choices,
and Practical Considerations,” Proceedings of the 5th
Workshop on Algorithm Engineering and Experiments,
Baltimore, 11 January 2003, pp. 106-118.
[12] M. Lubbecke and U. Zimmermann, “Engine Routing and
Scheduling at Industrial In-Plant Railroads,” Transporta-
tion Science, Vol. 37, No. 2, 2003, pp. 183-197.
[13] A. E. Kozan and A. Higgins, “Modeling Train Delays in
Urban Networks,” Transportation Science, Vol. 32, No.4,
1998, pp. 346-357.
[14] Q. Lu, M. Dessouky and R. Leachman, “Modeling Train
Movements through Complex Rail Networks,” ACM
Transactions on Modeling and Computer Simulations
(TOMACS), Vol. 14, No. 1, 2004, pp. 48-75.
[15] D. Parkes and L. Ungar, “An Auction Based Method For
Decentralized Train Scheduling,” Proceedings of the 5th
International Conference on Autonomous Agents, Mont-
real, 28 May-1 June 2001, pp. 43-50.
[16] J. Lee, K. Sheng and J. Guo, “Fast and Reliable Algo-
rithm for Railway Train Routing,” Proceedings of the
IEEE Region 10 Conference on Computers, Communica-
tions, Control Engineering, Beijing, 19-21 October 1993,
pp. 652-655.
[17] D. Ariano, M. Pranzo and I. Hansen, “Conflict Resolution
and Train Speed Coordination for Solving Time Table
Perturbations,” IEEE Transactions on Intelligent Trans-
portation Systems, Vol. 8, No. 4, 2007, pp. 208-222.
[18] T. Ho, J. Norton and C. Goodman, “Optimal Traffic Con-
trol at Railway Junctions,” IEE Proceedings of Electric
Power Applications, Vol. 144, No. 2, 1997, pp. 140-148.
[19] M. Lewellen and K. Tumay, “Network Simulation of a
Major Railroad,” Proceedings of the 30th Winter Simula-
tions Conference, Washington DC, 13-16 December 1998,
pp. 1133-1138.
[20] S. Graff and P. Shenkin, “A Computer Simulation of a
Multiple Track Rail Network,” Sixth International Con-
ference on Mathematical Modeling, St. Louis, 4-7 August
1987, pp. 472-475.
[21] T. Ho and T. Yeung, “Railway Junction Traffic Control
by Heuristic Methods,” IEE Proceedings of Electric
Power Applications, Vol. 148, No. 1, 2001, pp. 771-772.
[22] M. Hartong, “Secure Communications Based Train Con-
trol Operations,” Doctoral Dissertation, George Mason
University, Fairfax, May 2009.
[23] D. Barney, D. Haley and G. Nkandros, “Calculating Train
Braking Distances,” Proceedings of the 6th Australian
Workshop on Safety Critical Systems and Software, Bris-
bane, 6 July 2001, pp. 23-29.
[24] “IEEE Std. 1474.1-2004,” IEEE Standard for Communi-
cations-Based Train Control, Appendix D, IEEE, Pis-
cataway, 2004.
[25] T. M. Malvezzi, P. Presciani, B. Allotta and P. Toni,
“Probabilistic Analysis of Braking Performance In Rail-
ways,” Proceedings of the Institution of Mechanical En-
gineers, Part F: Journal of Rail and Rapid Transit, Vol.
217, No. 3, 2003, pp. 149-165.
[26] B. Vincze and G. Tarmai, “Development and Analysis of
Train Brake Curve Calculation Methods with Complex
Simulation,” Proceedings of International Exhibition of
Electrical Equipment for Power Engineering, Electrical
Engineering, Electronics, Energy and Resource-Saving
Technologies, Household Electric Appliances, Zilina, 23-

M. HARTONG ET AL.
29
24 May 2006, pp. 199-211.
[27] B. Friman, “An Algorithm for Braking Curve Calcula-
tions in ERTMS Train Protection Systems,” COMPRAIL
2006 10th International Conference on Computer System
Design and Operation in the Railway and Other Transit
Systems, Prague, 10-12 July 2006, pp. 421-430.
[28] “BS 05/19984709 DC (UIC-546) EN 15179. Railway
Applications Braking. Requirements for the Brake Sys-
tem of Passenger Coaches,” British Standards Institution,
London, March 2005.
[29] “Draft Guide for the Calculation of Braking Distances for
Rail Transit Vehicles, IEEE P1698/D1.3,” IEEE, Pis-
cataway, 2008.
[30] F. Yan and T. Tang, “Formal Modeling and Verification
of Real-time Concurrent Systems,” Proceedings of the
IEEE International Conference on Vehicular Electronics
and Safety, ICVES 2007, Beijing, 13-15 December 2007,
pp. 1-6.
[31] E. Khmelnitsky, “On an Optimal Control Problem of
Train Operation,” IEEE Transactions on Automatic Con-
trol, Vol. 45, No. 7, 2000.
[32] L. Y. Zhang, P. Li, L. M. Jia and F. Y. Yang, “Study on
the Simulation for Train Operation Adjustment under
Moving Block,” Proceedings of the 2005 Intelligent
Transportation Systems,” Vienna, 13-16 September 2005,
pp. 351-356. doi:10.1109/ITSC.2005.1520153
[33] H. Takeuchi, C. Goodman and S. Sone, “Moving Block
Signaling Dynamics: Performance Measures and
Re-starting Queued Electric Trains,” IEE Proceedings
Electric Power Applications, Vol. 150, No. 4, 2003, pp.
483-492.
[34] H. Krueger, E. Vaillancourt, A. Drummie, S. Vucko and J.
Bekavac, “Simulation in the Railroad Environment,”
Proceedings of the 2000 Winter Simulation Conference,
Orlando, 10-13 December 2000, pp. 1048-1055.
[35] W. Rudderham, “Longitudinal Control System of the
Intermediate Capacity Transit System,” Proceedings of
the 33rd IEEE Vehicular Technology Conference, To-
ronto, 25-27 May 1983, pp. 183-190.
doi:10.1109/VTC.1983.1623131
[36] “Railroad Communications and Train Control, Report to
Congress,” Federal Railroad Administration, Washington
DC, July 1994
[37] “Report of the Railroad Safety Advisory Committee to
the Federal Railroad Administrator, Implementation of
Positive Train Control Systems,” Federal Railroad Ad-
ministration, Washington DC, August 1999.