968 IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL. 11, NO. 4, DECEMBER 2010

Critical Scenarios and Their Identification in ParallelRailroad Level Crossing Traffic Control Systems

Yi-Sheng Huang, Member, IEEE, Yi-Shun Weng, Student Member, IEEE, and MengChu Zhou, Fellow, IEEE

Abstract—Deterministic and stochastic Petri nets (DSPNs) arewell utilized as a visual and mathematical formalism to modeldiscrete event systems. This paper proposes to use them to modelparallel railroad level crossing (LC) control systems. Their appli-cations to both single- and double-track railroad lines are illus-trated. The resulting models allow one to identify and thus avoidcritical scenarios in such systems by conditions and events of themodel that control the phase of traffic light alternations. Theiranalysis is performed to demonstrate how the models enforce thephase of traffic transitions by a reachability graph method. Theirimportant properties are verified. To our knowledge, this is thefirst work that employs DSPNs to model a parallel railroad LCsystem and identify its critical scenarios for the purpose of theircomplete avoidance. This helps advance the state of the art intraffic safety related to the intersection of railroads and roadways.

Index Terms—Deterministic and stochastic Petri net (DSPN),discrete event system, parallel railroad level crossing (LC), Petrinet (PNs), traffic safety.

I. INTRODUCTION

A S THE number of vehicles on the world’s roads growssharply, traffic congestion and transportation delay on

urban arterials are increasing; hence, it is imperative to improvethe safety and efficiency of transportation [17]. Subsequently,several research teams have focussed their attention on the areaof intelligent transportation systems (ITSs) [2], [5], [26], [27],[29]. For example, Shah and Dhal [24] applied advanced com-munication, information, and electronics technology to solvetransportation problems such as traffic congestion, safety, andtransportation efficiency. Additional, Hamza-Lup et al. [14]proposed a smart traffic evacuation management system toprovide rapid and efficient response to human-caused threatsand disasters by automatically generating dynamic evacuationplans. However, they did not address the comparatively com-plicated moment direction of traffic flow. Figueiredo et al. [6]analyze the freeway traffic via a simulator of ITSs.

Manuscript received June 2, 2009; revised September 15, 2009,December 20, 2009, April 26, 2010, and June 25, 2010; accepted July 14,2010. Date of publication October 11, 2010; date of current versionDecember 3, 2010. M. Zhou was supported in part by the National Ba-sic Research Program of China under Contract 10CB328100 and Contract2011CB302804. The Associate Editor for this paper was L. Li.

Y.-S. Huang is with the Department of Electrical and Electronic Engineering,Chung Cheng Institute of Technology, National Defense University, Taoyuan33509, Taiwan (e-mail: yshuang@ndu.edu.tw; huang.ccit@gmail.com).

Y.-S. Weng is with the Department of Electrical and Electronic Engineering,Chung Cheng Institute of Technology, National Defense University, Taoyuan33509, Taiwan, and also with the Department of Electronic Engineering, ArmyAcademy, Jungli 320, Taiwan (e-mail: shun6688@gmail.com).

M. Zhou is with the Department of Computer Science and Engineering,Tongji University, Shanghai 201804, China (e-mail: mengchu@ieee.org).

Color versions of one or more of the figures in this paper are available onlineat http://ieeexplore.ieee.org.

Digital Object Identifier 10.1109/TITS.2010.2076390

In that study, each vehicle can be modeled as a separate entityin the network according to the state diagram. Unfortunately,the concurrent-event problem is inherent in this system model.Recently, Huang [9] proposed to use statecharts to design anurban traffic light controller that included eight, six, and twophases. Although Huang [9] proposed a solution of the urbantraffic light system, it did not consider railroad level crossing(LC) control systems. An intersection of a railway and a roadon the same level, which is called railroad LC, can be foundin busy cities. Here, the vehicles head perpendicularly to thecrossing zone, which is called the direct critical scenario. On theother hand, the vehicles head in parallel with the crossing zone,which is called the indirect critical scenario. Generally, trafficsignals are usually used to manage conflicting requirements forthe use of road space—often at road junctions—by allocatingthe right of way to different sets of mutually compatible trafficmovements during distinct time intervals. However, criticalscenarios happen when the road traffic light signals cannot beautomatically changed according to the passing train. Hence, itis a significant issue to control traffic lights in parallel railroadLC control systems.

Petri nets (PNs) have been proven to be a powerful modelingtool for various kinds of discrete event systems [15], [30], andtheir formalism provides a clear means for presenting simula-tion and control logic. Hence, they can be used to design trafficcontrol systems as done in [25] and [28]. One can realize thatPNs have the ability to model such systems. However, they can-not determine the exact time of transition firing without properextension in the dimension of time. In other words, they can beused to analyze the functional or qualitative behavior of the sys-tems only. To enhance their capability, timed PNs (TPNs) areproposed. Recently, TPNs have successfully been used to modelrailway LC [4], [18], [23] and urban traffic network controlsystems [11], [12]. Moreover, timed colored PNs (TCPNs) areutilized as a visual formalism for the modeling of complex sys-tems. Some of our prior work focused on the use of TCPNs tomodel an intelligent urban traffic light control system [10], [13].

This paper presents a parallel railroad LC traffic controlsystem that has two-phase traffic lights. For convenience, thetwo-phase lights are modeled with a fixed number of discretetime intervals by TPNs. In addition, the railroad LC systemis also modeled by generalized stochastic PNs that allow bothzero-time-consuming transitions (called immediate ones) andtimed transitions with exponentially distributed random delay.This work models and analyzes a parallel railway crossingcontrol system via deterministic and stochastic PNs (DSPNs). Itproposes a new methodology to design a safety control policyfor such systems. Their analysis is performed to demonstrate

1524-9050/$26.00 © 2010 IEEE

HUANG et al.: CRITICAL SCENARIOS IN PARALLEL RAILROAD LC TRAFFIC CONTROL SYSTEMS 969

Fig. 1. (a) Parallel railroad crossing (crossroad-left) (b) Crossroad-left sign.

how the models enforce the phase of traffic transitions by areachability graph method.

One can realize that many parallel railroad crossing systemsare visible in urban traffic networks, as shown in Fig. 1(a).Considering the safety factor, a yellow diamond-shaped par-allel track sign, as shown in Fig. 1(b), identifies roadway-railintersections that appear immediately after making either a rightor a left turn. If the distance between the railroad tracks and aparallel roadway, from the edge of the tracks to the edge of theparallel roadway, is less than 30 m (100 ft), parallel railroadcrossing signs are installed on each approaching side of theparallel roadway to warn road users making a turn that theywill encounter a roadway-rail grade crossing soon after makinga turn [31].

It is interesting that some critical scenarios could immedi-ately happen while a train is approaching the parallel railroadcrossing, which is called the crossing zone in this paper. Forexample, a green traffic light is going on, and a train isentering the crossing zone at the same time, resulting in acritical scenario. Therefore, it is an important issue of howto evaluate the safety control policy for the parallel railroadLC control systems. This work proposes a new way to avoidthe critical scenarios from being taken. Then, traffic safetycan be guaranteed. In particular, a PN toolbox [21] is used toextract the critical scenarios from such a system. Reachabilityanalysis is performed to ascertain the liveness, boundedness,and reversibility of the developed model.

The rest of this paper is organized as follows: Section IIprovides the definitions of DSPNs via a compactway. Section III describes a crossroad traffic light controlsystem. Section IV shows how to model a railroad LC usingDSPNs. Section V identifies the critical scenarios. Section VIpresents the simulation results using HPSim. Conclusions arepresented in Section VII.

II. BASIC DEFINITIONS OF DETERMINISTIC AND

STOCHASTIC PETRI NETS

A PN is a particular kind of bipartite directed graphs pop-ulated by three types of objects. They are places, transitions,and directed arcs connecting places to transitions and transi-tions to places [15], [30]. Deterministic and stochastic delayscan be associated with transitions in the aforementioned PN,leading to DSPNs [19]. DSPNs allow three types of transitions:1) an immediate one that is represented by a thin bar and whosefiring takes no time; 2) a random one that is represented by

empty bars and whose firing takes an exponentially distributeddelay; and 3) a deterministic one that is represented by thickblack bars and whose firing takes a constant delay. Formally,we have [3], [16] DSPN=(P, T, I,O,H,M0, τ, λ), where thefollowing hold.

1) P = {p1, p2, . . . , pm} is a finite set of places that can bemarked with tokens.

2) T = Timm ∪ Texp ∪ Tdet = {t1, t2, . . . , tn} is a finite setof transitions, partitioned into three disjoint sets, Timm,Texp, and Tdet, representing immediate, exponential, anddeterministic ones, respectively. P ∪ T �= ∅, and P ∩T = ∅.

3) I : P × T → N is the input function that defines directedarcs from places to transitions.

4) O : P × T → N is the output function that defines di-rected arcs from transitions to places.

5) H ⊆ P × T is a set of inhibitor arcs from p to t.6) M0 : P → N is an initial marking.7) τ : Tdet → R+ is the firing time for deterministic transi-

tion t, where R+ is the set of positive real numbers.8) λ : Texp → R+ is the firing rate vector whose element

λ(t) is the firing rate of transition t that is associated withexponentially distributed time delay.

Since DSPNs allow immediate (Timm), deterministic (Tdet),and exponential (Texp) transitions, they are well suited for themodeling of real-time systems in which events may occur atunknown instants. However, the problem of conflicting transi-tions is hard to avoid. For this conflict problem, the stochasticbehavior of DSPNs requires a specification for selecting thenext transition to fire. In [16], if transitions are enabled atthe same time, one of the transitions with the shortest delaywill fire first. In addition, an immediate transition also hashigher priority to fire than a timed one in DSPNs. However,this control policy [16] cannot be used in parallel railroad LCtraffic control systems. In our case, one cannot predict when atrain will be there. Recalling the definition of an SPN, the mostnatural way for choosing the next transition to fire is to selectthe enabled transition whose associated delay is statisticallythe minimum called a race model [20]. When we use thismodel in the case of concurrent transitions, we easily obtaincritical scenario system behaviors. Hence, this work uses theexponentially distributed-random-delay transitions to model theevents of a train approaching the crossing zone and adoptsthe race model in the DSPN model. Our control policy focuseson how to avoid the occurrence of critical scenarios.

III. MODELING CROSSROAD TRAFFIC LIGHT

CONTROL SYSTEMS

Based on the preceding discussions, this section presents andillustrates how to model a crossroad traffic light control systemusing DSPNs. Fig. 2(a) shows a general traffic system with two-phase traffic lights. Considering the safety of vehicles, someimportant rules are needed.

1) A traffic light control system can be started if its trafficsignal lights are all in a red state.

2) There is a 2-s overlap between the phases to change, e.g.,in Fig. 2(c), there is a 2-s overlap between the durationsof Rwe and Rns.

970 IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL. 11, NO. 4, DECEMBER 2010

Fig. 2. (a) Two-phase traffic light control system. (b) DSPN model.(c) Duration diagram. (d) Reachability graph (untimed) (e) Reachability graph(with priority).

3) No green lights are allowed to be on simultaneously.4) A traffic light changes on the order of red, green, and

yellow.

This DSPN in Fig. 2(b) clearly models the whole systemoperation. It describes a two-phase traffic light control systemwith three traffic signal lights, i.e., red (R), yellow (Y ), andgreen (G). For convenience, the directions of vehicles headingnorthward, southward, westward, and eastward are symbolizedby the notations sn, ns, ew, and we, respectively. Here, twotypes of places are used to construct the DSPN model. Type-Iplaces consist of Rns, Yns, and Gns that represent the threetraffic lights R, Y , and G, respectively. Type-II ones consistof Rwe, Ywe, and Gwe. Based on them, the transitions in theDSPNs for the two-phase system can be derived.

According to the specification of the traffic light system, thesystem DSPN model can be constructed in Fig. 2(b). Fig. 2(b)shows its initial state. To model a physical system, it is natural

TABLE IATTRIBUTION OF TRANSITIONS IN FIG. 2

to consider an upper limit of the number of tokens that eachplace can hold. This leads to a finite capacity net. For such anet, each place p has an associated capacity K(p), which is themaximum number of tokens that p can hold at any time. For atransition t to be enabled, there is an additional condition thatthe number of tokens in each output place p of t cannot exceedits capacity K(p) after firing t. This rule with the capacityconstraint is called the strict transition rule [22]. Here, we applyit to our proposed traffic control system models. For instance,Fig. 2(b) is a finite capacity net (N,M0), and each place p hasan associated capacity K(p) = 1. The two sets of traffic signallights are in a red state. After 5 s (i.e., firing t1), a token ismoved into places Gns and p7, respectively. At this moment,the green light is on such that the northward/southward vehiclescan pass through the intersection. Next, the green light shouldbe off after the duration of t2. It implies that the green light hasbeen on for 60 s. Then, the yellow light is on for 3 s because theduration of t3 is 3 s. Then, the token is moved into Rns again.After 2 s (firing t4), a token in Rwe is moved into Gwe. At thistime, the traffic light Gwe goes green, and t5 can fire. It meansthat the green light has been on for 60 s. Then, the yellow lightis on for 3 s because the duration of t6 is 3 s. Finally, the tokenis moved into Rwe again. For convenience, the authors show theperiodic time of the traffic light control system in Fig. 2(c).

For better understanding, we proposed both untimed andtimed reachability graphs to analyze whether the system mod-els are reversible or not. Fig. 2(d) shows two conflicts dueto the firing of transitions t3, t4 and t6, t1. However, ac-cording to Table I, one can realize that the priority of thedeterministic transitions t3(t6) is higher than that of t4(t1).Based on the priority rule, a reachability graph with timedinformation can be obtained, as shown in Fig. 2(e). As aresult, no conflict can be found in Fig. 2(b) as verified by itsreachability graph in Fig. 2(e). The reachability set R(M0) ={M0,M1,M2,M3,M4,M5} contains all the markings thatare reachable from M0. Here, M0 = (0, 0, 1, 0, 0, 1, 0, 0),M1 = (1, 0, 0, 0, 0, 1, 1, 0), M2 = (0, 1, 0, 0, 0, 1, 1, 1), M3 =(0, 0, 1, 0, 0, 1, 1, 1), M4 = (0, 0, 1, 1, 0, 0, 1, 0), and M5 =(0, 0, 1, 0, 1, 0, 0, 0). Since this graph is a finite circuit contain-ing all transitions, the DSPN model in Fig. 2(b) is live andreversible according to [15].

IV. MODELING RAILROAD LEVEL CROSSING SYSTEMS

An intersection of a railway and a road on the same level iscalled a railroad LC. Generally, a railway crossing is equippedwith half barriers, i.e., a red and green road traffic light. PNs

HUANG et al.: CRITICAL SCENARIOS IN PARALLEL RAILROAD LC TRAFFIC CONTROL SYSTEMS 971

Fig. 3. Railroad LC model (single-track line).

are successfully used as a formal model for an LC controlsystem aiming for security [23] and have dealt with the safetyof the LC control system [1]. Reference [7] provided a col-ored PN model to describe a railway network system and toderive the traffic controller. However, they focus on only thesafety of the LC control system. In [8], Ghazel dealt with aparticular phenomenon that may cause collisions at LCs andcorresponds to the accumulation of vehicle waiting queues onthe LC exit zone. However, they emphasize more particularlythe phenomenon of a traffic jam in the LC exit zone, and thegoal is to evaluate the collision risk on LCs induced by thesecircumstances. The existing methods do not deal with the safetyof the parallel railroad crossing control systems. This workproposes and demonstrates a detailed modeling methodologyfor a general single-track line system. Then, it extends it to adouble-track line system.

A. Single-Track Line of the Railroad LC Control System Model

Considering the safety of the single-track line railway traffic,two pairs of sensors are needed. The detailed configuration isdepicted in Fig. 3. The function of the two pairs of sensors isgiven as follows: One pair of sensors (A1 and A2) are usedto detect southbound trains. The second pair (B1 and B2)detect northbound trains. For convenience, sensors A1, A2,B1, and B2 are set to correspond to transitions t7, t11, t15,and t13, respectively. Places p13–p15 are used to model thebarriers, red right, and green light, respectively. The operationof the heading southbound trains is introduced in detail. Theimmediate transition t7 should fire when sensor_A1 detects atrain. At this moment, both p13 and p14 should obtain a token,and a token should be removed from p15. It means that thebarriers are going to close, the red light of the LC sign is goingon, and the green light is off. Once the train passes through theLC and is detected by sensor_A2, the immediate transition t11should fire. At this moment, the tokens of p13 and p14 should bereleased. It states that the barriers are going to lift up and thatthe red (green) light is going off (on).

It is known that the token system was developed in Britain inthe 19th century to facilitate safe work of single-line railways.In the railway signaller, a token is a physical object that a loco-motive driver is required to have before entering a particularsection of a single track. To consider the token system, our

Fig. 4. Bidirectional model of a single-track line.

Fig. 5. Railroad LC model (a double-track line).

Fig. 6. Bidirectional model of double track.

single-track line control system model needs to be modified,as shown in Fig. 4. We use a resource places p17 to model thestate of the token. Notice that one token in p17 can be regardedas a physical object token. It can be moved by firing either t7or t15. It means that there is only one way to go through thesection of the railroad. Then, railroad safety can be guaranteed.The reason is that the railway system is a single-track line.Contrarily, the token cannot be moved to p18/p16 while thetoken is staying in p16/p18. As a result, the single-track linerailroad LC model can be obtained as shown in Fig. 4.

B. Double-Track Lines of the Railroad LC ControlSystem Model

Fig. 5 shows a double-track railway system that alwaysinvolves running one track in each direction.

The double-railroad-track system allows the trains running ina direction for each track. The LC operates like the bidirectionalmodel of a single-track system. To model a double-railroad-track system, this work puts two tokens in p17, as shown inFig. 6. Fig. 6 states that the system allows the two differentheading trains to concurrently pass through the crossing zone.The inhibited arcs are able to avoid being hit by two trains goingthe same way.

972 IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL. 11, NO. 4, DECEMBER 2010

Fig. 7. (a) Priority (token arrives at p2 before the delay in t1 passes).(b) Probability (t1 and t2 ready to fire at the same time).

V. EXTRACTION OF CRITICAL SCENARIOS

Critical scenarios can happen at a railroad LC, particularlywhen a road interacts with a parallel railroad crossing on thesame level. To extract them, one has to carefully deal withrailroad LC control systems. This paper tries to propose asolution to handle the dynamic alternation of traffic lights whilea train is approaching the crossing zone. The direct/indirectcritical scenarios can then be avoided early by our controlpolicy. In other words, this study focuses on how to preventtraffic jams in the LC zone from happening. It is worth noticingthat our traffic control policy totally depends on the threefundamental rules if no trains are going to approach the crossingzone. Once a train is going to approach the crossing zone,critical scenarios will occur. To avoid critical scenarios fromhappening, the related transitions can control the traffic lightsin time such that the safety of the vehicles can be ensured. Toobtain the system model, this work employs DSPNs as a toolto model such systems, detect critical scenarios, and designthe resulting control system to prevent such scenarios fromhappening. Basically, our traffic control policy of the trafficsignals depends on three fundamental rules.

1) The order of the traffic signal lights forms a cycle (i.e., R,G, and Y ).

2) Both the traffic signals Gns and Rwe turn on when a trainis approaching.

3) Once the train leaves, the traffic light control systemshould be resumed.

It is interesting to discuss the conflict problems in DSPNswhen both deterministic and immediate transitions are concur-rently firing. The operation of the DSPN should be interruptedwhen conflicts occur. For example, in Fig. 7, two cases happenwhen the delay time of t1 meets the value of τ . Therefore,two kinds of firing rules can be triggered in Fig. 7. In case I[see Fig. 7(a)], the firing time of t1 and t2 is determined bythe immediate transition t2 if the token arrives at p2 before thedelay in t1 passes. It hints no conflict problem. In case II [seeFig. 7(b)], the firing time of t1 and t2 cannot be determined if atoken arrives at p2 at time τ . Here, t1 also has the same time τ .For example, the phase of traffic lights is changing while a trainis approaching. Then, a conflict is formed.

Three dangerous scenarios could happen in the traffic lightsystem for each phase while a train is approaching the crossingzone. To avoid the dangerous scenarios, this work intends toprevent early the vehicles from entering the crossing zone whilethe train is approaching. In addition, it analyzes the states of the

Fig. 8. (a) Extraction from feared scenarios_a. (b) Reachability graph (un-timed). (c) Reachability graph (with priority).

traffic lights and expects to submit a safety rule. The safety ruleis that it is consistent between the action of the barriers (i.e.,railway) and the change of a phase (i.e., road). For example, atrain is approaching the crossing zone, and place Rwe/Rns ismarked as shown in Fig. 8. In the meantime, one of the threelights Gns/Gwe, Yns/Ywe, and Rns/Rwe goes on. Therefore,dangerous situations could happen while the train is passingthrough the crossing zone. In the following section, six criticalscenarios are discussed. They are divided into two parts: threeindirect and three direct critical scenarios. Here, the vehicleheading perpendicularly to the crossing zone is called the directcritical scenario. The vehicle heading parallel with the crossingzone is called the indirect critical scenario.

A. Three Indirect Critical Scenarios

1) Rwe and Rns Are Marked: At this moment [seeFig. 8(a)], both the red lights are on. The duration of the stateis 2 s. Next, p10 has a token while a train is approaching thecrossing zone. It means that sensor_A1 detects a train in themeantime. It also means that t7 fires such that p10 obtains atoken at this moment. At the same time, a token is immediately

HUANG et al.: CRITICAL SCENARIOS IN PARALLEL RAILROAD LC TRAFFIC CONTROL SYSTEMS 973

Fig. 9. (a) Extraction from feared scenarios_b. (b) Reachability graph.

moved into p9 and p11. After firing t1, each of Gns and p7

receives a token. Notably, the strict transition rule is alsoemployed in Fig. 8(a), and each place p has an associatedcapacity K(p) = 1. According to the rule, the token of p9

can be removed if t11 fires. Once t11 fires, both p9 and p11

are empty. At this moment, it states that the train completelypasses through the crossing zone and that the barriers should belifted. It is worth noticing that the token of p9 is used to ensurethe duration of the traffic lights. Therefore, traffic safety can beguaranteed while a train is passing through the crossing zone.An untimed reachability graph of this scenario is depicted inFig. 8(b). M0a = (0, 0, 1, 0, 0, 1, 0, 0, 0, 1, 0) is the initialmarking. It is worth noticing that two transitions (t2, t10) areenabled when the system is in state M1 = (1, 0, 0, 0, 0, 1, 1, 0,0, 1, 0). At this moment, by considering the transitions delaytime, t10 will fire since the delay time of t10 is less thanthat of t2. It hints that t2 cannot be fired. Hence, we canobtain a timed reachability graph from the untimed one. Thereachability graph with the priority information as shownin Fig. 8(c) indeed proves that the system model is live andreversible. Obviously, R(M0a) = {M0a,M1–M9}. Forconvenience, the notations (I and II) are used to representthe operation sequence of the system state that forms acircle, as shown in Fig. 8(c). In this paper, notations Iand II are called circles I and II, respectively. Circle I isM4t2M5t3M6t4M7t5M8t6M9t1M4, and circle II is M0at1M1

t10M3 (M0at10M2t1M3) t11M4t2M5t3M6t4M7t5M8t6M0a.The former states that the traffic lights are normally run afterthe train passes through the crossing zone. The latter states thatwill go back to the initial state while a train is approaching thecrossing zone again. Circles I and II are thus used to explainthe cases that a train passes and is approaching, respectively.

2) Rns and Ywe Are Marked: Fig. 9(a) describes the yellowlight (place Ywe) that goes on while a train is entering thecrossing zone. In this case, the proposed system model doesnot seem to do any control work because the traffic light shouldbe changed to red soon. The reachability graph in Fig. 9(a) isshown in Fig. 9(b). Obviously, R(M0b) = {M0b,M1–M10}.

3) Places Rwe and Gns Are Marked: Fig. 10(a) shows thetraffic light signals red (place Rwe)/green (place Gns) alongthe east-westward/south-northward traffic direction. Then, a

Fig. 10. (a) Extraction of critical scenarios_c. (b) Reachability graph.

conflict problem happens. Which one fires first if both t2 andt10 are enabled? It means that the phase of a traffic light shouldbe changed in the meantime. Case I (firing t10) means that atrain is approaching the crossing zone. Then, a token should beput into p9. It prevents t2 from firing. Therefore, the phase ofa traffic light should not be changed. It shows that the trafficlight signals are still red in the east-westward traffic direction.As a result, the critical scenario can be avoided by our trafficcontrol system. Case II (firing t2) is the same as discussed [seeFig. 12(a)].

Next, direct critical scenarios are discussed, particularlywhen a green light is on at a crossroad-left traffic light system.At this moment, a train is approaching the crossing zone. Here,the reachability graph shows R(M0c) = {M0c,M0e,M1–M7}.

B. Three Direct Critical Scenarios

1) Rns and Gwe Are Marked: Fig. 11(a) shows a directcritical scenario. It states that the green light (i.e., place Gwe

goes on while a train is entering the crossing zone. The durationof a green light is 60 s. In Fig. 11(a), each of p4 and p7

has a token. A direct dangerous scenario may happen in themeantime. To avoid it, the token of place p4(p7) must be movedto p5(p9) by firing t8 before t5. It states that sensor_A1/B1

detects the train before the green light is normally changed toyellow. The proposed model can urge the traffic light to changeits phase in a short time. Therefore, the traffic light is changedto yellow right away. Two tokens are removed from p4 and p7,and one goes to p5. This situation states that the train is notpresent in the duration of the green light. It also implies thatthis case is safe. Its reachability graph is shown in Fig. 11(b),and R(M0d) = {M0d,M0b,M1–M9}

2) Rwe and Yns Are Marked: In Fig. 12(a), the redlight (Rwe) is changing to green (Gwe) while a train is ap-proaching the crossing zone. It would be a very critical scenarioif the traffic lights were not controlled. The proposed controlpolicy is used to avoid it. The tokens in p7 and p8 should beremoved while the train is approaching (i.e., sensor_A1 istriggered) the crossing zone. A token should be moved intop11. Then, it is transferred to place Rns and finally moved

974 IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL. 11, NO. 4, DECEMBER 2010

Fig. 11. (a) Extraction from feared scenarios_d. (b) Reachability graph.

Fig. 12. (a) Extraction of critical scenarios_e. (b) Reachability graph.

into place Gns. Next, t2 can fire when the train passes (firingt11 the crossing zone. It is worth noticing that the tokens inp7 and p8 are used to coordinate the alternation of the trafficlights regularly. Places p7 and p8 control t1(t5) and t2(t4),respectively. For example, transition t9 occurs while a train isapproaching the crossing zone. Therefore, the critical scenariocan be avoided by our traffic control system. In this case,R(M0e) = {M0e,M1–M10} is obtained.

3) Places Rns and Rwe Are Marked (Change Phase):Fig. 13(a) demonstrates that the red light (Rwe) should bechanged to green while a train is entering the crossing zone.Notice that both traffic lights are red with 2 s. It shows a directdangerous scenario that may happen. Two control policies areproposed to avoid it.

One is to use the unmarked place p8 to prevent t4 from firing.It shows that the proposed model is able to ensure the durationof the red light until the train has passed. The detailed operationof our proposed model is explained as follows: Both tokens ofp7 and p8 are removed when t9 fires (i.e., the train entersthe crossing zone). At this moment, p8 becomes empty whilep9 is marked. After 5 s, the traffic phase should be changed

Fig. 13. (a) Extraction of critical scenarios_f. (b) Reachability graph.

Fig. 14. Whole system model of the single-track line.

from red (Rns) to green (Gns). In the meantime, the markedplace p9 prevents t2 from firing. It means that the traffic phasecannot be changed when a train is passing the crossing zone.As a result, the direct dangerous scenario can be avoided.Notice that the next one is the same as that previously men-tioned [i.e., Fig. 11(a)]. In this example, we have R(M0f ) ={M0f ,M0d,M1–M8}.

C. Whole System Model for the Single-Track Line

Based on the preceding discussions, the three control policiesare merged in a whole system model. Fig. 14 shows the wholesystem model for the single-track line.

In this model, t8, t9, and t10 are enabled when Sensor_A1 orSensor_B1 is activated. It means that a train is passing throughthe crossing zone. The transitions are able to control the roadtraffic signal to prevent the three direct critical scenarios fromhappening. To avoid the critical scenarios, deciding the firingpriority of the transitions becomes an important issue. Thiswork assumes that the logic relations of t8, t9, and t10 areexclusive. However, their deployment better characterizes thetrain-arrival processes.

HUANG et al.: CRITICAL SCENARIOS IN PARALLEL RAILROAD LC TRAFFIC CONTROL SYSTEMS 975

TABLE IIINTERPRETATION OF TRANSITIONS IN FIG. 14

The interpretation of the whole system model’s transitionsis listed in Table II. Transitions t1(t4), t2(t5), and t3(t6) withdeterministic firing times are represented by the red signal time,and green and yellow are for direction ns(we), respectively.Transitions t7(t15) and t11(t13) with immediate firing time areused to explain the train passing through the LC of directionsns and sn, respectively. Transitions t8, t9, and t10 are enabledwhen Sensor A1 or B1 is activated. In our system model, t8,t9, and t10 are employed to prevent the critical scenarios fromhappening while the train is approaching the crossing zone.However, the critical scenarios cannot be prevented if t8, t9,and t10 are immediate. Here, the transitions are all associatedwith an exponentially distributed firing time that is fit to modelthe fire timing of the trains approaching the crossing zone.To avoid the critical scenarios, the priority of the transitionfiring sequence becomes an important issue. To fit the practicalsituations, we assume that the logic relations of t8, t9, and t10are exclusive. Moreover, since λ1 = λ2 = ∞ and λ3 = 1, t8and t9 are almost approximated as immediate transitions suchthat t8 and t9 can prevent the direct critical scenarios.

However, t10 is used to prevent the indirect critical scenariossince t10 has the lowest priority. According to the traffic model,the duration of the road traffic lights we(ns) can be coordinatedby t8, t9, and t10 such that the safety of the vehicles can beensured. Fig. 15 shows the reachability graph of the wholesystem. It reveals that the whole system model is live andreversible. It is noted that to the knowledge of the authors, thismodel is the first complete model for such a system.

D. Whole System Model for the Double-Track Line

A railway system with double-track line is considered. Usu-ally, trains run on the same track when the trains are headingto the same direction. This work constructs a double-track linesystem model by extending the single-track line system. It isobtained as shown in Fig. 16. It is worth noticing that the newsystem is formed by modifying the attributes of the single-trackline system. We modify the capacity of places p9, p10, and p11

from one to two and change the weight of arcs (i.e., t2 → p9

Fig. 15. Reachability graph of Fig. 14.

Fig. 16. Whole system model of the double-track line.

and p9 → t4) from one to two. In Fig. 16, the red light (Rwe)is changing to green (Gwe) while a train is approaching thecrossing zone. The token of p9 can be removed if t9 fires. Oncethe train leaves, place p9 is empty. It is worth noticing that anarc (p9 → t9) is used to describe how to ensure the systemoperation well while the train is leaving. It states that the systemmodel allows two trains concurrently approaching the crossingzone, regardless of the heading directions of the trains. Fig. 17shows the reachability graph of the whole system. It reveals thatthe whole system model is also live and reversible.

The detailed execution of the system model is given asfollows: Fig. 16 shows the initial state of the traffic controlsystem. Fig. 17 states the system’s reachability graph. Forconvenience, the reachability graph is represented with threetypes of arcs, i.e., thick, thin, and dotted. For example,thick-arc-formed path: M0t1M1t2M3t3M7t4M12t5M18t6M0

states that no train is coming, regardless of the phase ofthe traffic light. The thin-arc-formed paths depict severalbusy cases that include all the traffic situations, exceptfor the former case. For example, thin-arc-formed pathM0t10M2t11M6t1M10t2M16t3M22t4M27t8M28t11M30t6M0

indicates that there is only one train approaching the crossingzone, regardless of its heading direction. As an exampleof dotted-arc formed paths, M0t1M1t10M4t10M9t11M15

976 IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, VOL. 11, NO. 4, DECEMBER 2010

Fig. 17. Reachability graph of Fig. 16.

Fig. 18. Snapshot of HPSim for the single-track control system DSPN model.

t11M21t2M26t3M29t4M31t5M30t6M0 indicates that there aretwo trains approaching the crossing zone and that their headingdirections are not the same.

VI. ANALYSIS AND SIMULATION

This work proposes DSPN models for the parallel railroadLC systems. It is worth noticing that the concept of hybridsystems is used in the proposed models. The timing analysis canbe obtained from them. In particular, two types of transitions,i.e., timed and immediate, are employed. The former is usedto model the traffic light control systems. The latter is usedto describe the dynamic behavior of the trains approaching thecrossing zone. Fig. 18 shows the simulation environment of thetool of HPSim [32]. It depicts our single-track control systemmodel. Here, sensor_A1(B1) looks out for approaching trains.Sensor_A2(B2) detects the trains leaving the crossing. It is im-portant to point out that the critical scenarios can be accuratelyidentified from the proposed models. After the examination,

Fig. 19. Snapshot of HPSim for the double-track control system DSPN model.

the proposed system model is deadlock free, exhibits repetitivebehavior, and is structurally bounded and live.

Fig. 19 shows the whole double-track lines control systemmodel in the HPSim. The bidirectional trains approaching therailroad LC are considered in Fig. 19.

VII. CONCLUSION

This paper has presented the modeling, analysis, and sim-ulation of parallel railroad LC control systems using DSPNmodels. It has proposed the module of basic traffic lights witha parallel railroad LC system that can assist in designing theextended models. The liveness and reversibility of the proposedDSPN models have been proven by the reachability graphanalysis method. By using an HPSim tool, this work simulatesand validates the models. The advantage of the proposed ap-proach is that the critical scenarios in the parallel railroad LCsystem can be identified and avoided successfully. To summa-rize, this work has new contributions.

1) It has demonstrated how to use DSPNs to model a parallelrailroad LC control system.

2) It performs reachability analysis of the resultant newDSPN models.

3) It identifies critical scenarios of the parallel railroad LCtraffic systems from the models and ways to avoid them.

The proposed DSPN models can easily be extended forfurther applications. For example, our system model can easilybe modified for an ITS, which is able to interrupt the regularityof traffic lights if one allows emergency cars with the priority.DSPN should be explored for other applications [33], [34].

REFERENCES

[1] D. Adomaitis, A. Andziulis, E. Guseinoviene, J. Vaupsas, andR. Steponavièius, “Modelling and optimization of train traffic,” in Proc.Int. Conf. Transp. Means, 2006, pp. 1–5.

[2] A. R. Beresford and J. Bacon, “Intelligent transportation systems,” Perva-sive Comput., vol. 5, no. 4, pp. 63–67, Oct.–Dec. 2006.

[3] G. Ciardo and C. Lindemann, “Analysis of deterministic and stochasticPetri nets,” in Proc. IEEE 5th Int. Workshop, Oct. 1993, pp. 160–169.

[4] S. C. Dutilleul, F. Deffossez, and P. Bon, “Safety requirements and p-timePetri nets: A level crossing case study,” in Proc. IMACS-IEEE Multiconf.Comput. Eng. Syst. Appl., Beijing, China, Oct. 2006, pp. 1118–1123.

HUANG et al.: CRITICAL SCENARIOS IN PARALLEL RAILROAD LC TRAFFIC CONTROL SYSTEMS 977

[5] L. Figueiredo, I. Jesus, J. A. Tenreiro Machado, J. R. Ferreira, andJ. L. Martins de Carvalho, “Towards the development of intelligenttransportation systems,” in Proc. IEEE Intell. Transp. Syst., Aug. 2001,pp. 1206–1211.

[6] L. Figueiredo, J. A. Tenreiro Machado, and J. R. Ferreira, “Dynamicalanalysis of freeway traffic,” IEEE Trans. Intell. Transp. Syst., vol. 5, no. 4,pp. 259–266, Dec. 2004.

[7] M. P. Fanti, A. Giua, and C. Seatzu, “A deadlock prevention method forrailway networks using monitors for colored Petri nets,” in Proc. IEEEInt. Conf. Syst., Man, Cybern., Oct. 2003, vol. 2, pp. 1866–1873.

[8] M. Ghazel, “Using stochastic Petri nets for level-crossing collision riskassessment,” IEEE Trans. Intell. Transp. Syst., vol. 10, no. 4, pp. 668–677, Dec. 2009.

[9] Y. S. Huang, “Design of traffic light control system using statecharts,”Comput. J., vol. 49, no. 6, pp. 634–649, Nov. 2006.

[10] Y. S. Huang and T. H. Chung, “Modeling and analysis of urban trafficlights control systems using timed CP-nets,” J. Inf. Sci. Eng., vol. 24,no. 3, pp. 875–890, 2008.

[11] Y. S. Huang and P. J. Su, “Modeling and analysis of traffic light controlsystems,” IET Control Theory Appl., vol. 3, no. 3, pp. 340–350, Mar. 2009.

[12] Y. S. Huang and T. H. Chung, “Modeling and analysis of air traffic controlsystems using hierarchical timed coloured Petri nets,” Trans. Inst. Meas.Control, DOI: 10.1177/0142331208095623, Feb. 8, 2010.

[13] Y. S. Huang and T. H. Chung, “Modeling and analysis urban traffic lightcontrol systems,” J. Chin. Inst. Eng., vol. 32, pp. 85–95, 2009.

[14] G. L. Hamza-Lup, K. A. Hua, M. Le, and R. Peng, “Dynamic plangeneration and real-time management techniques for traffic evacuation,”IEEE Trans. Intell. Transp. Syst., vol. 9, no. 4, pp. 615–624, Dec. 2008.

[15] B. Hruz and M. C. Zhou, Modeling and Control of Discrete Event Dy-namic Systems. London, U.K.: Springer-Verlag, 2007.

[16] C. Kelling and G. Hommel, “Modeling priority schemes with timed Petrinets,” in Proc. 2nd Workshop Parallel Distrib. Real-Time Syst., Apr. 1994,pp. 110–118.

[17] J. H. Lee and L. K. Hyung, “Distributed and cooperative fuzzy controllersfor traffic intersection group,” IEEE Trans. Syst., Man, Cybern., vol. 29,no. 2, pp. 263–271, May 1999.

[18] M. Medjoudj and P. Yim, “Extraction of critical scenarios in a railwaylevel crossing control system,” J. Comput. Commun. Control, vol. 2, no. 3,pp. 252–268, 2007.

[19] M. A. Marsan and G. Chiola, “On Petri nets with deterministic andexponentially distributed firing times,” in Advances in Petri Nets 1987.Berlin, Germany: Springer-Verlag, 1987, pp. 146–161.

[20] M. A. Marsan, G. Balbo, A. Bobbio, G. Chiola, G. Conte, and A. Cumani,“The effect of execution policies on the semantics and analysis of sto-chastic Petri nets,” IEEE Trans. Softw. Eng., vol. 15, no. 7, pp. 832–846,Jul. 1989.

[21] M. H. Matcovschi, C. Mahulea, C. Lefter, and O. Pastravanu, “Petri nettoolbox in control engineering education,” in Proc. IEEE Conf. Comput.Aided Control Syst. Design, Munich, Germany, Oct. 2006, pp. 2298–2303.

[22] T. Murata, “Petri nets: Properties, analysis and applications,” Proc. IEEE,vol. 77, no. 4, pp. 541–580, Apr. 1989.

[23] J. Padberg and M. Gajewsky, “Rule-based refinement of Petri nets formodeling train control systems,” in Proc. IFAC Conf. Control Syst. De-sign, 2000, pp. 299–304.

[24] A. A. Shah and L. J. Dal, “Intelligent transportation systems in transitionaland developing countries,” IEEE Aerosp. Electron. Syst. Mag., vol. 22,no. 8, pp. 27–33, Aug. 2007.

[25] C. Tolba, P. Thomas, A. EIMoudni, and D. Lefebvre, “Performancesevaluation of the traffic control in a single crossroad by Petri nets,”in Proc. IEEE Emerging Technol. Factory Autom., Lisbon, Portugal,Sep. 2003, vol. 2, pp. 157–160.

[26] F.-Y. Wang, “Driving into the future with ITS,” IEEE Intell. Syst., vol. 21,no. 3, pp. 94–95, May 2006.

[27] F.-Y. Wang, “Toward a revolution in transportation operations: AI forcomplex systems,” IEEE Intell. Syst., vol. 23, no. 6, pp. 8–13, Nov. 2008.

[28] J. Wang, C. Jin, and Y. Deng, “Performance analysis of traffic networksbased on stochastic timed Petri net models,” in Proc. IEEE Eng. ComplexComput. Syst., Las Vegas, NV, Oct. 1999, pp. 77–85.

[29] N. Zhang, F.-Y. Wang, F. Zhu, and D. Zhao, “DynaCAS: Computationalexperiments and decision support for ITS,” IEEE Intell. Syst., vol. 23,no. 6, pp. 19–23, Nov./Dec. 2008.

[30] R. Zurawski and M. C. Zhou, “Petri nets and industrial applications:A tutorial,” IEEE Trans. Ind. Electron., vol. 41, no. 6, pp. 567–583,Dec. 1994.

[31] U.S. Department of Transportation Federal Highway AdministrationManual on Uniform Traffic Control Devices.

[32] HPSim. [Online]. Available: http://www.winpesim.de/

[33] Z. W. Li, H. S. Hu, and A. R. Wang, “Design of liveness-enforcingsupervisors for flexible manufacturing systems using Petri nets,” IEEETrans. Syst., Man, Cybern., Part C: Applications Reviews, vol. 37, no. 4,pp. 517–526, Jul. 2007.

[34] N. Wu, F. Chu, C. Chu, and M. C. Zhou, “Hybrid Petri net modeling andschedulability analysis of high fusion point oil transportation under tankgrouping strategy for crude oil operations in refinery,” IEEE Trans. Syst.,Man Cybern., Part C, vol. 40, no. 2, pp. 159–175, Mar. 2010.

Yi-Sheng Huang (M’05) received the B.S. degree inautomatic control engineering from Feng Chia Uni-versity, Taichung, Taiwan, in 1989, the M.S. degreein electronic engineering from Chung Yuan Chris-tian University, Chung Li, Taiwan, in 1991, and thePh.D. degree in electrical engineering from NationalTaiwan University of Science and Technology,Taipei, Taiwan, in 2001.

He was an Associate Professor with the Depart-ment of Aeronautical Engineering, Chung ChengInstitute of Technology (CCIT), National Defense

University, Taoyuan, Taiwan. He is currently a Full Professor with the De-partment of Electrical and Electronic Engineering, CCIT. He has been servingas a Reviewer for Automatic, IET Control Theory and Application, IET Intel-ligent Transport Systems, the International Journal of Production Research,The Computer Journal, the International Journal of Advanced ManufacturingTechnology, the Asian Journal of Control, the Journal of the Chinese Instituteof Engineers, and the Journal of Information Science and Engineering. His re-search interests include discrete event systems, Petri nets, computer-integratedmanufacturing, automation, reactive systems, air traffic control, intelligenttransport systems, and motor control systems.

Prof. Huang has been serving as a Reviewer for the IEEE TRANS-ACTIONS ON SYSTEMS, MAN, AND CYBERNETICS—PART A: SYSTEMSAND HUMANS, the IEEE TRANSACTIONS ON SYSTEMS, MAN, ANDCYBERNETICS—PART C: APPLICATIONS AND REVIEWS, the IEEE TRANS-ACTIONS ON AUTOMATION SCIENCE AND ENGINEERING, and the IEEETRANSACTIONS ON INDUSTRIAL ELECTRONICS.

Yi-Shun Weng (S’10) was born in Yunlin, Taiwan,in 1973. He received the B.S. degree in electri-cal engineering from National Taipei University ofTechnology, Taipei, Taiwan, and the M.S. degreefrom the Institute of Maritime Technology, NationalTaiwan Ocean University, Keelung, Taiwan, in 2000.Since 2006, he has been working toward the Ph.D.degree in electrical and electronic engineering withthe Department of Electrical and Electronic Engi-neering, Chung Cheng Institute of Technology, Na-tional Defense University, Taoyuan, Taiwan.

He is currently an Instructor with the Department of Electronic Engineering,Army Academy, Jungli, Taiwan. His research interests include Petri nets andintelligent transportation systems.

MengChu Zhou (S’88–M’90–SM’93–F’03) re-ceived the B.S. degree in electrical engineeringfrom Nanjing University of Science and Technology,Nanjing, China in 1983, the M.S. degree in automaticcontrol from the Beijing Institute of Technology,Beijing, China in 1986, and the Ph.D. degree incomputer and systems engineering from RensselaerPolytechnic Institute, Troy, NY, in 1990.

He was a Professor of electrical and computerengineering with the New Jersey Institute of Tech-nology, Newark. He is presently a professor with

Tongji University, Shanghai, China. He has more than 360 publications, in-cluding ten books, more than 160 journal papers (the majority of them inIEEE TRANSACTIONS), and 17 book chapters. His research interests arePetri nets, computer-integrated systems, wireless ad hoc and sensor networks,semiconductor manufacturing, and energy systems.

Prof. Zhou is a Life Member of the Chinese Association for Science andTechnology-USA and served as its President in 1999. He is currently an Editorfor the IEEE TRANSACTIONS ON AUTOMATION SCIENCE AND ENGINEER-ING and an Associate Editor for the IEEE TRANSACTIONS ON SYSTEMS,MAN, AND CYBERNETICS: PART A and the IEEE TRANSACTIONS ONINDUSTRIAL INFORMATICS.