ATO Simulator

Non-vital automatic train operation riding on a vital ATP / interlocking stack — a late-1970s monorail, in software. Inject faults and watch it fail safe.

t 0.0 s
What am I looking at?

This is a working reference implementation of the ATO (Automatic Train Operation) layer from a design for a late-1970s monorail: 750 V DC traction, fixed-block audio-frequency cab signalling, centralized speed management, and a laser-barcode overlay for ±5 cm platform berthing.

The governing idea is CPUs are advisory, hardware is vital. ATO drives the train and proposes door release, but it can never grant anything — every permissive decision belongs to fail-safe relay / 2-out-of-2 hardware (ATP, the interlocking). Here you are poking the inputs ATO depends on and watching it fail safe: traction to zero, brakes on, doors locked.

  • ATP — the vital decoder. Gives ATO a speed code from {0, 20, 40, 60, 80} km/h plus a health bit. ATO stays 3 km/h under it so ATP never has to trip.
  • Berthing — ATO arms 200 m out and follows v = √(2·a·d) toward the platform; dense barcode plates in the last 20 m provide the ±5 cm fix. Lose them and the window widens to ±40 cm on odometry.
  • Door enable — an AND of independent checks. Any single one false → locked. The checklist below shows each input live.

Pick a scenario for a scripted fault, or flip individual signals mid-run in Manual controls. Reset run replays the selected scenario from the start; auto-cycle keeps the demo looping.

Guideway — Clean run

cab 60
cab 40
cab 20
ATO arms berthing
0 m400 m700 m1000 m · berth

Scenarios

ATO state

Modestandby
Speed–
Target speed–
Position · ATO estimate–
Position · true–
Estimate error–
Position source–
Distance to berth–
Precise-stop OK–
Dwell–

Commands out (advisory)

Traction demand0.00
Service brake demand0.00

Door enable — §4 AND chain

LOCKED

    Inputs

    ATP (vital decoder)

    Cab speed code–
    ATP healthy–
    Berth authority–

    Train

    Speed (tach mean)–
    Tach A / B–
    Service brake healthy–
    E-brake tripped–
    Direction–

    Wayside / platform

    PSD align OK–
    Barcode reader–

    ATO requests

    Cut-out requested–
    Depart requested–

    Manual controls

    Toggles apply to the current run and clear on reset. Red = override active.

    ATP overrides

    Cab code override

    Train overrides

    Wayside overrides

    ATO

    Depart is honoured only after the minimum dwell and only from BERTHED — the controller ignores it otherwise.

    Event log