Modelling and Analysing ERTMS L3 Moving Block Railway Signalling with Simulink and Uppaal SMC

Formal Modelling and Verification of a Distributed Railway Interlocking System Using UPPAAL

“…-resSegIndex stores the index of the segment in segments that needs to be reserved next, and resCBIndex stores the index of the control box in boxes at which this segment should be reserved for the train. 2 Hence, the next reservation should be of segment segments[resSegIndex] at boxes[resCBIndex]. -lockIndex stores the index of the control box in boxes that needs its associated point to be locked next.…”

“…There are many examples of formal verification of railway control systems, see e.g. [1,2,6,8,13,15,16,18,21], but only very few for distributed interlocking systems, see e.g. [10,12,14].…”

Model Checking a Distributed Interlocking System Using k-induction with RT-Tester

“…There are examples of using many other model checking tools such as Simulink and UPPAAL ( [5]), SPIN and nuSMV ( [12]), proB ( [3]), mCRL2 ( [7]), and FDR ( [16]) for the verification of railway control systems. For a comparative study, see [15].…”

“…For the considered local railway, trains are shorter than any segment, so they will at most occupy two segments at a time 4. The quantification with the distinct keyword generates only distinct combinations of the parameters -in this case distinct pairs of train identifiers 5. Note that this property is indeed invariant, even though the updates to the train and switchbox reservations/locks happen in separate transitions, because the update to switchbox reservations/locks always happens before the update to the train reservations/locks.…”

Strategy Synthesis for Autonomous Driving in a Moving Block Railway System with Uppaal Stratego

“…Previously, in [6,8], we introduced a concrete case study of a satellite-based moving block railway signalling system, which was developed in collaboration with industrial partners of the ASTRail project and which was modelled and analysed with Simulink and Uppaal SMC (Statistical Model Checker). While those models offered the possibility to fine tune communication parameters that are fundamental for the reliability of their operational behaviour, they did not account for the synthesis of autonomous driving strategies.…”