Stepwise development and model checking of adistributed interlocking system using RAISE

Abstract

 Users may download and print one copy of any publication from the public portal for the purpose of private study or research.  You may not further distribute the material or use it for any profit-making activity or commercial gain  You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.

Formal Modelling and Verification of a Distributed Railway Interlocking System Using UPPAAL

“…[1,2,6,8,13,15,16,18,21], but only very few for distributed interlocking systems, see e.g. [10,12,14].…”

“…This system was first modelled and verified in [14] using RSL [20] and the RAISE theorem prover. As verification by means of theorem proving is rather time consuming, while verification by means of model checking is fully automated, the use of the latter was later, in [12], investigated for the same case study. In [12], RSL* and the SAL symbolic model checker were used only for a proof of concept, and hence efficiency was here of less concern.…”

“…As verification by means of theorem proving is rather time consuming, while verification by means of model checking is fully automated, the use of the latter was later, in [12], investigated for the same case study. In [12], RSL* and the SAL symbolic model checker were used only for a proof of concept, and hence efficiency was here of less concern. It actually turned out that the tool did not scale up well for larger networks, in which case compositional reasoning was used instead.…”

“…Furthermore, we will investigate what it means for the verification performance if the control algorithm is restricted to a variant having a more specific execution order. We also use the opportunity to model additional functionality not included in [12]: an operation for cancelling reservations. Finally, we will also examine how well suited UPPAAL is as a modelling tool compared to RSL* and SAL.…”

“…Our control algorithm variants are similar to the ones presented in [12,14], but our models differ of course wrt the choice of data types as UPPAAL offers fewer data types than RSL and RSL*. They also differ from [12] by using channels instead of shared variables for modelling the communication between control components.…”