Formal Verification and Validation of ERTMS Industrial Railway Train Spacing System

Abstract

Abstract. Formal verification and validation is a fundamental step for the certification of railways critical systems. Many railways safety standards (e.g. the CEN-ELEC EN-50126, EN-50128 and EN-50129 standards implement the mandatory safety requirements of IEC-61508-7 standard for Functional and Safety) currently mandate the use of formal methods in the design to certify correctness. In this paper we describe an industrial application of formal methods for the verification and validation of "Logica di Sicurezza" (LDS), the safety logic of a railways ERTMS Level 2 system developed by Ansaldo-STS. LDS is a generic control software that needs to be instantiated on a railways network configuration. We developed a methodology for the verification and validation of a critical subset of LDS deployed on typical realistic railways network configurations. To show feasibility, effectiveness and scalability, we have experimented with several state of the art symbolic software model checking techniques and tools on different network configurations. From the experiments, we have successfully identified an effective strategy for the verification and validation of our case study. Moreover, the results of experiments show that formal verification and validation is feasible and effective, and also scales reasonably well with the size of the configuration. Given the results, Ansaldo-STS is currently integrating the methodology in its internal Development and Verification & Validation Flow.

Techniques for modelling and verifying railway interlockings

“…Prominent studies from the B community include [20,33,3] whilst [35,28] are classical contributions from process algebra and [10] uses techniques from Algebraic Specification. On a lower abstraction layer, [7,18,16,5] verify the safety of interlocking programs with logical approaches.…”

“…Ferrari et al [7] state that model checking large interlocking systems is infeasible with current state-of-the-art model checkers, in particular SPIN and NuSMV. However, Cimatti et al [5] have demonstrated considerable success using NuSMV on industrial scale problems. James et al [16] also demonstrate better results and the feasibility of the lower level approach involving program slicing.…”

Verification of Scheme Plans Using CSP$$||$$B

“…Prominent studies from the B community include [17,18] whilst [19,20] are classical contributions from process algebra and [21] uses techniques from Algebraic Specification. On a lower abstraction layer, [22][23][24][25] verify the safety of interlocking programs with logical approaches.…”

“…control tables) by Haxthausen [30] also falls into the first category and is supported by automated tools that generate the models. Cimatti et al [25] also have had considerable success using NuSMV but their analysis is focussed on the implementation descriptions.…”

Defining and Model Checking Abstractions of Complex Railway Models Using CSP||B

“…The results achieved are comparable in size to our Single Junction scenario. Cimatti et al [5] also have had considerable success using NuSMV but their analysis is focussed on the implementation descriptions.…”