For PoC Projects: The agent profile formulated via self-play architecture demonstrates a strictly quantifiable potential to maintain higher disturbance tolerance (robustness) within environments containing deterministic anomalies, when juxtaposed directly against agents calibrated via rigid analytical inputs (LQR references).

Project Portfolio

Current Situation and Problem

Context: Inverted pendulum structures function natively as mechanically unstable systems. In scenarios demanding an external mechanical conflict (combat) vector, coordinating stabilization simultaneously with reactive action planning exponentially complicates the optimization plane. Critical Issues: Calibration logic bounded purely by static limits (such as LQR) exhibits an inherent tendency to fail within flexible operational domains where definitive system equations cannot be assumed. Optimizing models strictly over static parameters (overfitting) empirically generates collapse reactions driven by overconfidence when subjected to dynamic threats.

Solution Architecture and Action

Architectural Approach: To systematically dissect overconfidence deviations manifesting in under-defined control environments, a 4-phase training framework encompassing a variable difficulty curve was architectured.

Applied Methodology:

Phase 1: LQR Baseline (Reference Data Extraction)

Purpose: To map foundational system dynamics and catalog baseline responses for establishing a comparative testing platform.

• A native LQR controller block was built strictly independent of external library functions.
• A customized test physics engine was computed leveraging the CTMS Michigan structural model.
• The formulated output matrices (state → action) were archived to serve as the reference model benchmark.

Phase 2: Self-Balancing (Standalone Stabilization)

Purpose: Optimizing the capability of the system to maintain stability via native error functions without applying a preemptive input map (supervised learning).

• Training parameters were designated by migrating structural mechanics to a Deep Q-Network (DQN) array topology.
• Experience Replay and Target Network latency loops were engaged to secure computational stabilization.
• Specific constraint mechanisms (Reward Shaping) were applied: The system was filtered by calculating target axis deviation, axial position error, and momentum expenditure.

Phase 3: Disturbance Resistance and Attack

Purpose: The activation of physical anomalies within the given simulation scope and the binary segregation of the computational action space to test steady-state firmness.

• Supplementary external forces (disturbance) mapped under a Poisson distribution were generated to simulate non-deterministic stochastic physical impacts.
• The computing structure subsequently weighted parameters commanding planned combat movements while strictly preserving structural balance.
• The primary “Balance force” vector and the independent “Attack force” vector were processed across fully isolated phase spaces.

Phase 4: Self-Play Fighting (Adversarial Training)

Purpose: The empirical execution of overconfidence tolerance testing—originated from isolated training phases—under mutual adversarial pressure.

• To guarantee a flawless measurement baseline across the array, two distinct agent profiles were spawned from the exact same neural network starting weights.
• During each independent epoch of the routine, dual modules executed logic disrupting the opponent’s balance function while actively calculating their own internal stabilization.
• The modules were cross-evaluated symmetrically against a dynamic clone reacting directly to mutual behaviors, explicitly discarding static functional parameters.

Architectural Decision: Employing two segregated neural network blocks invariably triggered asymmetric superiority deviations, categorized structurally within early epochs as “model dominance”. Unifying the calculation into a singular common network topology (YSA) actively neutralized this computational chaos and constrained asymmetric variance scaling.

Dual Mode Operational Conditions:

1. Isolated Mode: During early epoch cycles, competitive routines remain strictly inactive, prioritizing exclusively Cartesian balance assessment.
2. Combined Mode: As stabilization gradients hit operational maturity, adversarial policies (Q-Values) are activated simultaneously alongside the balance vectors.

To actively prevent control disruption scaling within the system, the maximum threshold limits dictating combat actions were held to a fractional ratio of ~15% of the associated balance boundaries. (Balance Tolerance: [-10, +10] N, Attack Tolerance: [-1.5, +1.5] N).

Results and Operational Gains

Test Results

Simulation Visuals

Demo: Self-Play Combat Simulation

Related Links

 Detailed Article: Control Strategies in Non-Linear Systems: LQR and Deep RL Comparison 
 Source Paper PDF: Makina Öğrenmesi Teknikleri Kullanılarak Bir Dövüşen Robotun Eğitilmesi (Turkish) 
 Source Code: Github/neural-adaptive-control-simulation

This research was conducted within the ITU Control and Automation Engineering program and presented under the graduation project titled: “Self-adaptive training architectures utilizing machine learning methodologies”.

Last Updated: January 2026

Scope: An integration application operating on the zero-copy principle, developed to establish data exchange between SCADE’s closed-loop structure and the control layer.

Project Portfolio

Current Situation and Problem

Context: The necessity to migrate the interlocking simulation system (4 tracks, 6 signals, 1 switch) at the ITU Railway Systems Laboratory to a SCADE Display-supported HMI architecture compliant with industrial and certifiable standards. Critical Issues: The absence of a native Modbus interface within SCADE Display and the platform’s closed-network design. The inability of the HMI interface to communicate directly with actual field controllers (HIMA HiMatrix F35), and the lack of dynamic field configuration for IP/port maps.

Solution Architecture and Execution

Architectural Approach

Architectural Constraint Assessment: To preserve DO-178C / EN 50128 certification integrity, the SCADE platform features a “closed system” design philosophy stripped of all asynchronous external network operations. Consequently, for physical PLC integration in the laboratory, developing an independent, externally operating asynchronous middleware layer became mandatory.

A C99 middleware wrapper layer was designed between SCADE’s generated code and the libmodbus library:

Communication Flow

Applied Methodology

• Zero-Copy Integration: Copy overhead was eliminated by hooking directly into the SCADE main loop.
• Dynamic Configuration: A 3-region INI file was utilized to prevent recompilation requirements during field deployment.

Security mechanism: Upon detecting a missing or corrupted configuration file, the system automatically creates and saves default settings (localhost connection).

• Auto-Reconnection: Connection drops in industrial environments are inevitable; an autonomous auto-reconnect cycle was activated.
• Change Detection: A batch read and selective write strategy was implemented to optimize network traffic.

Architectural Decision: Since HMI hardware’s capability for simultaneous physical command processing is limited, outputs are evaluated in a sequential loop. This structural preference prevents unnecessary fieldbus traffic (network flooding).

• Thread-Safe Logging: Every event in critical systems must be logged securely.

Interlocking Scope

Example route: RT01: SN01E → TC01 → TC04 → TC02 → SN02E (Switch: Normal)

Safety Rule: Based on critical design principles, all signals not explicitly demanded by the system are configured to default to a restrictive state (red).

Results and Operational Takeaways

Quantitative Gain: (Potential values obtained during laboratory PoC tests)

Project Visuals

Related Links

 Source Code: Github/ansys-scade-modbus-integration-middleware 
Download TOK 2025 Paper: SCADE Modbus Paper Turkish (PDF)

Authors: Dora Demir¹, İbrahim Can Kolotoğlu², Muhammet Işık², Serhat Boynukalın³, Mehmet Turan Söylemez²
¹ ITU Electronics and Communication Eng. | ² ITU Control and Automation Eng. | ³ ITU Graduate School

This work was conducted at the ITU EEF Railway Systems Laboratory and published at the Turkish Automatic Control 2025 (TOK 2025) conference.

Can high-security industrial relays be used in interlocking systems? Or are only component-level certified SIL 4 relays permitted? This question points to a widespread conceptual confusion in the sector. The answer is not simply yes or no: Utilization is subject to specific architectural conditions.

Theoretical Background

The Two Worlds of Safety Relays

The selection of relays in railway safety depends on the design philosophy and certification approach. There are two primary categories:

Vital Relays

These relays represent the gold standard of railway signaling, rooted in a century of engineering heritage.

Gravity Fail-Safe (e.g., Mors Smitt N.S1):

• When the coil energy is removed, the opening of the contacts is entrusted not to a friction-prone spring force, but directly to gravity.
• A spring can fatigue or snap, but gravity never disappears.
• Therefore, these relays must always be mounted in a specific vertical orientation defined by their design parameters.

Carbon-Silver Contact Technology (e.g., Clearsy RS4):

• One of the contact tips is made of silver, and the mating tip is made of a carbon (graphite) alloy.
• By its metallurgical nature, carbon does not weld to silver; this physically prevents the contacts from fusing.
• Contact welding is rendered physically near-impossible.

Industrial Safety Relays: Forcibly Guided Contacts

Manufactured according to the EN 61810-3 (formerly EN 50205) standard, these relays pursue an entirely different safety strategy. Companies like Dold, Finder, and Arteche have established industry-standard products in this class.

Mechanical Linkage Principle:

• Normally Open (NO) and Normally Closed (NC) contacts are mechanically interlocked via a guiding rod (comb).
• If an NO contact welds due to excessive current or a short circuit, the mechanical rod physically prevents the NC contact from closing and the system from transitioning to an unsafe state.
• As mandated by the standard, a minimum functional gap of 0.5 mm is guaranteed between contacts.

The Critical Difference:

These relays do not prevent the metallurgical occurrence of welding; they merely report the condition to the controller once it happens.

Coil De-energized Contact Pushed by SPRING Force

Contact Welded?

Contact OPENS
(Normal State)

NC Contact Stays OPEN(Mechanical Failure) PLC Detects andLOCKS the SystemNOYES!

VITAL RELAY

Coil De-energized Armature Drops by GRAVITY Carbon-Silver Contact Opens

SAFE STATE

Research Details: Root Cause Analysis

Field Scenario: Relay Selection in Interlocking Panels

An EPC (Engineering, Procurement, and Construction) contractor is selecting relays for an electronic interlocking project. There are two options on the table:

Cost Discrepancy: The per-unit cost difference in the field is approximately tenfold. The Critical Question: Can Option B be utilized in the design?

Why Aren’t Industrial Relays SIL 4 Standalone?

Deduction: Industrial safety relays do not possess a SIL rating on their own. However, within a redundant architecture boasting a 99% diagnostic coverage rate (employing 1oo2 redundancy alongside the readback process), they can be utilized as an integral component of a CENELEC SIL 4 compliant system.

Architectural Solution and Operational Logic

There are two distinct safety architectures in the market. One is predicated on purchasing safety, while the other revolves around constructing it holistically.

Approach A: Component-Level Architecture

Representative: Clearsy RS4 Series

This approach positions the product itself as a certified black box. The relay is a sealed unit designed according to SIL 4 requirements during the hardware design and manufacturing phases, possessing internal redundancy and inherent fail-safe capabilities.

• Operational Principle: The integrator drives the relay using standard industrial relay logic. The product’s safety case documentation is securely provided directly by the manufacturer.
• Wiring: Only the driving coil and transmission contact terminals are connected. It does absolutely not require an external control cable or specialized monitoring software on the safety PLC side.
• Internal Mechanism: The configuration of the mechanism and gravity within the relay inherently eliminates the risk of contact welding.

Commercial Equation:

•  Plug-and-Play: The engineering burden and Independent Safety Assessor (ISA) approval process for the integrator are radically minimized.
•  Cost: The standalone unit cost is exceedingly high (~€500).
•  Supply Chain: Creates total dependency on a single or highly restricted supplier base (Monopoly).

Approach B: System-Level Architecture

Representatives: Arteche, Finder, Dold (Forcibly Guided Relays)

This approach aims to achieve the firm SIL 4 target by combining standard safety relays through an intelligent system architecture. Safety is not strictly embedded in the off-the-shelf product; it is meticulously concealed within the entirety of the designed circuit.

• Operational Principle: Instead of using a single relay, at least two relays with forcibly guided contacts are utilized, electrically wired in series (1oo2 Architecture).
• Wiring and Monitoring:
  • Series Safety: The NO contacts of the dual relay set are wired in series to the field load. Even if one relay effectively welds, the other interrupts the circuit, mitigating the fault efficiently.
  • Readback Process: The closed (NC) contacts of the relays are carefully wired to the digital input (DI) card of the safety PLC, enabling instantaneous monitoring of the relays’ mechanical states.
• Audit Logic: The safety PLC strictly verifies the state of the NC contacts before dispatching a drive command to the field. If a contact appears open while no energy is supplied to the field (indicating a welding syndrome), the system categorically refuses the drive command and locks into a safe state.

Commercial Equation:

•  Cost-Effective: Up to 90% CAPEX savings in projects are achieved due to fundamentally low unit costs.
•  Flexibility: Any EN 61810-3 (EN 50205) compliant standard product can be utilized.
•  Engineering Burden: Circuit design, wiring complexity, and the ultimate safety proof responsibilities of the final system lie squarely on the shoulders of the integrator architect.

Conclusion

Decision Matrix

Summary Deductions:

• The concept of a “SIL 4 Relay” does not equate to a “SIL 4 System”: A single component may possess a SIL 4 hardware label, but system engineering is a comprehensive, holistic endeavor.
• Gravity vs. Spring Force: The safety of vital relays relies heavily on immutable physical laws of nature, whereas industrial safety relays necessitate external diagnostic intelligence to effectively detect latent flaws.
• Cost vs. Responsibility Trade-off: Choosing inexpensive components decisively incurs a high engineering burden and continuous ISA auditing, whereas expensive components systematically yield a comfortable, stress-free integration. The supply chain strategy is directly proportional to a firm’s internal engineering confidence.

References

• EN 61810-3: Electromechanical elementary relays – Relays with forcibly guided contacts
• EN 50129: Railway applications – Communication, signalling and processing systems
• Mors Smitt N.S1 Technical Documentation
• Clearsy RS4 Functional Safety Guidelines
• HIMA SILworX Application Notes

Related Links

 Related Article: → Strategic Analysis: CENELEC SIL 4 Relay Procurement Strategies and Market Dynamics in Railway Signaling

Last update: March 2026 | Version: 1.1