Twenty-Five Years of Formal Methods and Railways: What Next?

Science of Computer Programming

2017

In this article, we present a method and an associated toolchain for the formal verification of the new Danish railway interlocking systems that are compatible with the European Train Control System (ETCS) Level 2. We have made a generic and reconfigurable model of the system behaviour and generic safety properties. This model accommodates sequential release -a feature in the new Danish interlocking systems. To verify the safety of an interlocking system, first a domain-specific description of interlocking configuration data is constructed and validated. Then the generic model and safety properties are automatically instantiated with the well-formed description of interlocking configuration data. This instantiation produces a model instance in the form of a Kripke structure, and concrete safety properties expressed as invariants. Finally, using a combination of SMT based bounded model checking (BMC) and inductive reasoning, it is verified that the generated model instance satisfies the generated safety properties. Using this method, we are able to verify the safety properties for model instances corresponding to railway networks of industrial size. Experiments show that BMC is also efficient for finding bugs in the railway interlocking designs. Additionally, benchmarking results comparing the performance of our approach with alternative verification techniques on the interlocking models are presented.

Section: Related Workmentioning

confidence: 99%

Formal modelling and verification of interlocking systems featuring sequential release

Science of Computer Programming

2017

“…Several research groups have investigated how formal methods would help efficiently producing more robust railway control systems. An overview of recent trends can be found in [7], and recommendations and best-practices for efficient development and verification of safe railway control systems are summarized in [12]. Re-configurable systems and automated verification are among these recommendations that we have followed.…”

Section: Related Workmentioning

confidence: 99%

“…The experimental results are shown in Sect. 7. Related work and concluding remarks are presented in Sect.…”

Section: Introductionmentioning

confidence: 99%

Formal Modeling and Verification of Interlocking Systems Featuring Sequential Release

Communications in Computer and Information Science

2015

Abstract. In this paper, we present a method and an associated tool suite for formal verification of the new ETCS level 2 based Danish railway interlocking systems. We have made a generic and reconfigurable model of the system behavior and generic high-level safety properties. This model accommodates sequential release -a feature in the new Danish interlocking systems. The generic model and safety properties can be instantiated with interlocking configuration data, resulting in a concrete model in the form of a Kripke structure, and in high-level safety properties expressed as state invariants. Using SMT based bounded model checking (BMC) and inductive reasoning, we are able to verify the properties for model instances corresponding to railway networks of industrial size. Experiments also show that BMC is efficient for finding bugs in the railway interlocking designs.

“…An overview of trends in formal methods applications to railway signalling can be found in [6,14]. As of today, three major formal verification approaches are applied to railway control systems: theorem proving, global model checking, and bounded model checking.…”

Section: Introductionmentioning

confidence: 99%

Model Checking and Model-Based Testing in the Railway Domain

Formal Modeling and Verification of Cyber-Physical Systems

2015

Abstract. This chapter describes some approaches and emerging trends for verification and model-based testing of railway control systems. We describe state-of-the-art methods and associated tools for verifying interlocking systems and their configuration data, using bounded model checking and k-induction. Using real-world models of novel Danish interlocking systems, it is exemplified how this method scales up and is suitable for industrial application. For verification of the integrated HW/SW system performing the interlocking control tasks, a modelbased hardware-in-the-loop testing approach is presented. The trade-off between complete test strategies capable of uncovering every error in implementations of a given fault domain on the one hand, and on the other hand the unmanageable load of test cases typically created by these strategies is discussed. Pragmatic approaches resulting in manageable test suites with good test strength are explained. Interlocking systems represent just one class of many others, where concrete system instances are created from generic representations, using configuration data for determining the behaviour of the instances. We explain how the systematic transition from generic to concrete instances in the development path is complemented by associated transitions in the verification and testing paths.