Formal development and verification of a distributed railway control system

Abstract

ÐIn this article, we introduce the concept for a distributed railway control system and present the specification and verification of the main algorithm used for safe distributed control. Our design and verification approach is based on the RAISE method, starting with highly abstract algebraic specifications which are transformed into directly implementable distributed control processes by applying a series of refinement and verification steps. Concrete safety requirements are derived from an abstract version that can be easily validated with respect to soundness and completeness. Complexity is further reduced by separating the system model into a domain model and a controller model. The domain model describes the physical system in absence of control and the controller model introduces the safety-related control mechanisms as a separate entity monitoring observables of the physical system to decide whether it is safe for a train to move or for a point to be switched.

Formal Specification and Verification of Real-Time Systems using Graph Grammars

“…This example is similar to the one presented in [17] (and in many other papers that propose new specification and verification techniques for real-time systems). In a railroad system, the most important issue that should be guaranteed is that trains do not crash.…”

Formal modelling and verification of interlocking systems featuring sequential release

“…Several research groups have investigated how formal methods would help efficiently producing more robust railway control systems. An overview of recent trends can be found in [16], and recommendations and best-practices for efficient development and verification of safe railway control systems are summarised in [22]. Re-configurable systems and automated verification are among these recommendations that we have followed.…”

“…In the current work, a combination of SMT-based BMC with inductive reasoning allowed us to verify safety properties without having to explore the whole state space, hence we were able to push the bounds even further to handle larger networks of industrial size. As an alternative to the model checking approach, theorem-proving-based techniques have also shown success in the railway domain, see, e.g., [2,21], but these provide a lesser degree of automation.…”

The UniForM workbench a universal development environment for formal methods

“…The whole system (with single tracks and deviations) has been modelled and specified with CSP in a student project at Bremen (cf. also [HP98] for a solution of the general train control problem). The on-board computer has a layered architecture (see fig.…”

“…Moreover, the experience of [HP98] when solving the train control problem in general (cf. also section 5.3) has been that reasoning about algebraic properties at a high level of abstraction is necessary, with subsequent refinements; model-oriented specifications and model-checking are not enough for this very practical problem that had defied a general solution thus far.…”