# Case Study of an Integrated Design and Technical Concept for a Scalable Hyperloop System
## 4 Functional Definition
### Safety  
Because the hyperloop system features a highly controlled environment, it is inherently safer than existing forms of transportation. Nevertheless, a thorough hazard analysis reveals some scenarios that require special consideration. A preliminary version of the safety concept presented here was reviewed by independent safety experts. Two major problems, safe real-time communication and the possibility to exit at every point of the tube, are avoided early on conceptually to guarantee a feasible and manageable safety concept. For better understanding, we present three core safety system functions that address all the identified hazard scenarios. Those system functions are illustrated in Figure 6 and are explained below:  
* Uncritical branch off:In the event of medical issues or non-critical technical problems, the pod will branch off automatically at the next lane switch and enter the station nominally. The situation is handled by the complex operation control architecture, and no safety features are activated. * Forced branch off: Critical failures in the pod, such as fire, operation control software issues, or a blocked track ahead can necessitate a forced branch off. In this case, the safety relay on-board cuts power to the levitation system shortly before the vertical lane switch, safely forcing a branch off. The pod will therefore branch off at every vertical lane switch and arrive at an emergency platform (marked red in Figure 7), where a gate seals the emergency platform once the pod has arrived. Following the repressurization of this segment, passengers can safely exit the pod. As shown in Table 9, an evacuation within 15 min, including 2 min for repressurization, can be guaranteed, even when lane switches are more than 100 km apart and due to the separate safety system, even in case of an operation control failure. If the segment ahead is blocked, all pods not fitting into the station will line up on the rescue lane, where safe exiting through doors is possible after repressurization. According to Table 9, such a rescue lane needs to be about 3.7 km long. * System failure handling: In the event of a critical earthquake, a terror attack, or simultaneous failure of several subsystems, one track segment between two lane switches will be isolated with gates. All pods within this section will perform an emergency brake at \(8\,\frac{\mathrm{m}}{3^{2}}\), featuring eddy current brakes. At the same time, the section \begin{table}
\begin{tabular}{l c} \hline \hline
**Description** & **Value** \\ \hline Heat production per passenger & 100 W \\ Heat from passengers & 2.10 kW \\ Heat from lev\&guid & 13.50 kW \\ Heat from nom propulsion & 38.16 kW \\ Heat from cabin systems & 5.67 kW \\ Heat from service electronics & 4.50 kW \\ Total heat load & 63.93 kW \\ Evaporation cooling capacity & 0.00145 \(\frac{\mathrm{kg\,h}}{\mathrm{W}}\) \\ Max travel time at nom speed & 4 h \\ Worst-case water tank for evaporation & 370.58 kg \\ Nom cooling requirement per pod per km & 0.17 kg \\ Water release in average per day per km & 182.44 \(\frac{\mathrm{kg}}{\mathrm{d\,km}}\) \\ Ice build-up per month (nom speed) & 0.34 mm \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Cooling characteristics. Values with a grey background are calculated, while others are input values. will be repressurized. This ensures that all pods can be brought to a safe state within one minute, from which they can await rescue. The rescue operation involves remotely controlled movement of the pods to the nearest stations and rescue teams for damaged pods. Table 9 also shows that the theoretical maximum number of passengers affected by an instantaneous breakdown is less than 150. Although the passengers are advised to remain seated, standing in the cabin is not prevented, which could lead to injuries during emergency braking. Pressure loss in the pod is managed according to the leakage rate.