4 ms·

Can you turn all the lights at a given intersection green at the same time?

magmastonealex 2y ago
Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (usually flashing red/yellow lights). There are of course some edge cases where this is technically possible (as long as the cabinet door is open in CalTrans TEES cabinets, you can actually remove the MMU entirely and do whatever you want), and I'm not familiar with safety mechanisms used in other localities. (Note: I work in the industry, not for any of the companies in this article, and my views are my own).
- megous 2y ago
  How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?
  - magmastonealex 2y ago
    Now you start to get into the differences between the various standards :) In NEMA TS2 (and the more modern ITE ATC), the MMU does enforce a yellow clearance time - you need the light to turn yellow for a period of time before a conflicting phase goes green. Usually this is a few seconds. Changing phases rapidly would likely confuse drivers, but in _theory_ shouldn't cause a collision if people respect yellows. (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) In CalTrans TEES, I do not believe the standard calls for the MMU to enforce clearance times - the attack you describe would potentially be possible.
    - rootusrootus 2y ago
      > (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) This was definitely true in the past, I feel like the concept of a 'red clearance time' is something that only became common within the last 5-10 years. Do you think it has become (with rare exceptions) ubiquitous at this point?
      - magmastonealex 2y ago
        I'd like to think it's become ubiquitous - it has been a while since I've seen a signal without a red clearance configured. However, the Federal Highway Administration in the US (which sets guidelines, but most states define actual rules at the state level) still says in their Signal Timing Manual [1] > The use of a red clearance interval is optional, and there is no consensus on its application or duration. [...] there may not be safety benefits associated with increased red clearance intervals. and goes on to describe how it has negative traffic flow implications. so I suspect at least some agencies out there still are not using them. [1]: https://ops.fhwa.dot.gov/publications/fhwahop08024/chapter5.htm https://ops.fhwa.dot.gov/publications/fhwahop08024/chapter5....
        pests 2y ago
        I feel like my area (where I've lived my whole life) does not have red clearance interval. It's not something Ive paid attention to before. I'm sure it's proper driving technique but I feel it's ingrained in my head to give a couple seconds when a red turns into a green for all cross traffic to finish / anyone who runs the light. It's a common thing around me and I don't think it would be happening as much if an all-red period was implemented.
      - 0xffff2 2y ago
        I moved up to Oregon for a few years during/after the pandemic. I can say from experience that the entire state consistently did not have red clearance times at least up to when I left in late 2023.
    - 2y ago
  - deleted 2y ago
    [deleted]
- SoftTalker 2y ago
  In the old timer-and-cam based systems I also believe this was electrically impossible. IIRC the green light in one direction was grounded through the green light in the crossing direction. So it was impossible for both of them to be on at the same time.
- EvanAnderson 2y ago
  > I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. Presumably the logic for this MMU could be implemented in strictly electrical components (relays or such). That would give me the most comfort (since its functionality would be, literally hard-wired). I worry that some enterprising manufacturer, out to save a few bucks, would implement this functionality in a microcontroller with firmware that could be updated remotely. Does the standard specify the functionality of the MMU must be hard-wired, or at the very least not able to be changed without physical access?
  - magmastonealex 2y ago
    Unfortunately those fears are well-founded. The majority of MMUs on the market that I have had a close look at implement safety-critical functionality on a microcontroller with updatable firmware. Some can even be updated over IP. I haven't had the opportunity to dig into if those firmware upgrades are signed or otherwise integrity-protected. The standard unfortunately does not specify a functional safety standard or other measures to ensure absolute safety. In theory it would be possible to implement it in discrete logic (or an FPGA or other formally-verifiable process), but as far as I know no manufacturer has done so (I'd love to be wrong!)
- mcswell 2y ago
  Fiction... indeed, science fiction. There was a short story (I believe in Analog) in the 1960s about this, later amplified by the author into a book. But getting to your real point, about the use of an MMU safety monitor: I'm sure this works. But I confess, the first thing I thought about when I read that was Cloudstrike's explanation of their pre-release testing mechanism: running "validation checks" on the content, rather than running the actual software. Had they actually run their release, they would surely have detected the bug, since it apparently bricked every single Windows machine that downloaded it.
boznz 2y ago
As an embedded engineer I would design that as an interlock in the circuit and not rely on firmware
- mschuster91 2y ago
  Assuming that's possible and the design of the control cabinet isn't boiling down to "a raspi wth a CAN bus adapter" that controls the individual lights via CAN Bus or whatever and an electrical distribution panel for mains AC to the light poles. With old incandescent bulbs you absolutely needed a cabinet full of relays, but given that you can make a fully working traffic light out of Philips Hue lamps, an USB Zigbee controller and a day worth of time, I would not be surprised if a manufacturer opts for going the easy route.
quickthrowman 2y ago
I would hope they still use physical interlocks instead of implementing it in software, even though it’s semiconductors instead of relays controlling stoplights these days.
akira2501 2y ago
No. There is a thing called a "conflict monitor." It uses a hard wired control board. This board has solderable links on it. When you connect a link you're describing two phases which CANNOT be green at the same time. You then slide the board into the monitor. If the monitor sees that current for the green lights on two opposing phases are green at the same time, or any of several other fault conditions, it will trip, then "throw the intersection into flash" as a roadway protection mechanism. At this point none of the controllers or other logic is capable of controlling the intersection and it stays in flash until someone comes and manually resets it. Here's an example of what one of those cards looks like. Wonderfully old school and absolutely nothing active about it. https://i.ebayimg.com/images/g/9roAAOSwKOFfh3gM/s-l1600.jpg https://i.ebayimg.com/images/g/9roAAOSwKOFfh3gM/s-l1600.jpg
burningChrome 2y ago
I remember back in the day some guy was selling the strobe light devices that emergency vehicles use on some nefarious site and it came with a warning that its a felony to even possess one of these and you should only use it for "research" purposes wink wink. The funny part of his ad was him saying its still dangerous AF to just switch a light to green so quickly, it has the very real potential to cause accidents which back in the early aughts when this was online, I could totally believe him. You don't need a light to change to green in all directions, using this and then thinking you're good to go and you blow through the intersection while someone is trying to beat a yellow light in the opposite direction could be disastrous.

Generally no, this is something from fiction. I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. That device will catch so-called "conflicts" (two conflicting directions green at the same time) and put the intersection into a fail-safe state (usually flashing red/yellow lights). There are of course some edge cases where this is technically possible (as long as the cabinet door is open in CalTrans TEES cabinets, you can actually remove the MMU entirely and do whatever you want), and I'm not familiar with safety mechanisms used in other localities. (Note: I work in the industry, not for any of the companies in this article, and my views are my own).

megous 2y ago
How about switching lights in quick succession, enough to cause real-world issue, but avoiding the direct conflict?
- magmastonealex 2y ago
  Now you start to get into the differences between the various standards :) In NEMA TS2 (and the more modern ITE ATC), the MMU does enforce a yellow clearance time - you need the light to turn yellow for a period of time before a conflicting phase goes green. Usually this is a few seconds. Changing phases rapidly would likely confuse drivers, but in _theory_ shouldn't cause a collision if people respect yellows. (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) In CalTrans TEES, I do not believe the standard calls for the MMU to enforce clearance times - the attack you describe would potentially be possible.
  - rootusrootus 2y ago
    > (believe it or not, in some localities a "red clearance" time - all red - is not required and lights will go from yellow in one direction to green in another.) This was definitely true in the past, I feel like the concept of a 'red clearance time' is something that only became common within the last 5-10 years. Do you think it has become (with rare exceptions) ubiquitous at this point?
    - magmastonealex 2y ago
      I'd like to think it's become ubiquitous - it has been a while since I've seen a signal without a red clearance configured. However, the Federal Highway Administration in the US (which sets guidelines, but most states define actual rules at the state level) still says in their Signal Timing Manual [1] > The use of a red clearance interval is optional, and there is no consensus on its application or duration. [...] there may not be safety benefits associated with increased red clearance intervals. and goes on to describe how it has negative traffic flow implications. so I suspect at least some agencies out there still are not using them. [1]: https://ops.fhwa.dot.gov/publications/fhwahop08024/chapter5.htm https://ops.fhwa.dot.gov/publications/fhwahop08024/chapter5....
      - pests 2y ago
        I feel like my area (where I've lived my whole life) does not have red clearance interval. It's not something Ive paid attention to before. I'm sure it's proper driving technique but I feel it's ingrained in my head to give a couple seconds when a red turns into a green for all cross traffic to finish / anyone who runs the light. It's a common thing around me and I don't think it would be happening as much if an all-red period was implemented.
    - 0xffff2 2y ago
      I moved up to Oregon for a few years during/after the pandemic. I can say from experience that the entire state consistently did not have red clearance times at least up to when I left in late 2023.
  - 2y ago
- deleted 2y ago
  [deleted]
SoftTalker 2y ago
In the old timer-and-cam based systems I also believe this was electrically impossible. IIRC the green light in one direction was grounded through the green light in the crossing direction. So it was impossible for both of them to be on at the same time.
EvanAnderson 2y ago
> I'm mostly familiar with North American traffic signal control, and in those traffic cabinets there is a device known as an "MMU" (Malfuction Management Unit) which acts as a safety monitor for the rest of the traffic cabinet. Presumably the logic for this MMU could be implemented in strictly electrical components (relays or such). That would give me the most comfort (since its functionality would be, literally hard-wired). I worry that some enterprising manufacturer, out to save a few bucks, would implement this functionality in a microcontroller with firmware that could be updated remotely. Does the standard specify the functionality of the MMU must be hard-wired, or at the very least not able to be changed without physical access?
- magmastonealex 2y ago
  Unfortunately those fears are well-founded. The majority of MMUs on the market that I have had a close look at implement safety-critical functionality on a microcontroller with updatable firmware. Some can even be updated over IP. I haven't had the opportunity to dig into if those firmware upgrades are signed or otherwise integrity-protected. The standard unfortunately does not specify a functional safety standard or other measures to ensure absolute safety. In theory it would be possible to implement it in discrete logic (or an FPGA or other formally-verifiable process), but as far as I know no manufacturer has done so (I'd love to be wrong!)
mcswell 2y ago
Fiction... indeed, science fiction. There was a short story (I believe in Analog) in the 1960s about this, later amplified by the author into a book. But getting to your real point, about the use of an MMU safety monitor: I'm sure this works. But I confess, the first thing I thought about when I read that was Cloudstrike's explanation of their pre-release testing mechanism: running "validation checks" on the content, rather than running the actual software. Had they actually run their release, they would surely have detected the bug, since it apparently bricked every single Windows machine that downloaded it.

boznz 2y ago

As an embedded engineer I would design that as an interlock in the circuit and not rely on firmware

mschuster91 2y ago
Assuming that's possible and the design of the control cabinet isn't boiling down to "a raspi wth a CAN bus adapter" that controls the individual lights via CAN Bus or whatever and an electrical distribution panel for mains AC to the light poles. With old incandescent bulbs you absolutely needed a cabinet full of relays, but given that you can make a fully working traffic light out of Philips Hue lamps, an USB Zigbee controller and a day worth of time, I would not be surprised if a manufacturer opts for going the easy route.

quickthrowman 2y ago

I would hope they still use physical interlocks instead of implementing it in software, even though it’s semiconductors instead of relays controlling stoplights these days.

akira2501 2y ago

No. There is a thing called a "conflict monitor." It uses a hard wired control board. This board has solderable links on it. When you connect a link you're describing two phases which CANNOT be green at the same time. You then slide the board into the monitor. If the monitor sees that current for the green lights on two opposing phases are green at the same time, or any of several other fault conditions, it will trip, then "throw the intersection into flash" as a roadway protection mechanism. At this point none of the controllers or other logic is capable of controlling the intersection and it stays in flash until someone comes and manually resets it. Here's an example of what one of those cards looks like. Wonderfully old school and absolutely nothing active about it. https://i.ebayimg.com/images/g/9roAAOSwKOFfh3gM/s-l1600.jpg https://i.ebayimg.com/images/g/9roAAOSwKOFfh3gM/s-l1600.jpg

burningChrome 2y ago

I remember back in the day some guy was selling the strobe light devices that emergency vehicles use on some nefarious site and it came with a warning that its a felony to even possess one of these and you should only use it for "research" purposes wink wink. The funny part of his ad was him saying its still dangerous AF to just switch a light to green so quickly, it has the very real potential to cause accidents which back in the early aughts when this was online, I could totally believe him. You don't need a light to change to green in all directions, using this and then thinking you're good to go and you blow through the intersection while someone is trying to beat a yellow light in the opposite direction could be disastrous.