Haxthausen, Anne Elisabeth

Peleska, Jan

Vu, Linh Hong

In this paper, we present a method for formal verification of the new Danish railway interlocking systems. We made a generic and reconfigurable model of the behaviors and high-level safety properties of non-collision and nonderailment. This model accommodates sequential release – a new feature in the new Danish interlocking systems. Instantiating the generic model with interlocking configuration data results in a concrete model and high-level safety properties. Using bounded model checking and inductive reasoning, we are able to verify safety properties for model instances corresponding to railway networks of industrial size

Online Research Database In Technology

                       General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.  • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal   If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.     Downloaded from orbit.dtu.dk on: Dec 20, 2017Formal Verification of the Danish Railway Interlocking SystemsVu, Linh Hong; Haxthausen, Anne Elisabeth; Peleska, JanPublished in:Pre-proceedings of 14th International Workshop on Automated Verification of Critical Systems (AVoCS 2014)Publication date:2014Document VersionPublisher's PDF, also known as Version of recordLink back to DTU OrbitCitation (APA):Vu, L. H., Haxthausen, A. E., & Peleska, J. (2014). Formal Verification of the Danish Railway InterlockingSystems. In M. Huisman, & J. van de Pol (Eds.), Pre-proceedings of 14th International Workshop on AutomatedVerification of Critical Systems (AVoCS 2014)  (pp. 257-258). University of Twente.  (C T I T WorkshopProceedings Series; No. WP 14-01).ECEASSTFormal Veriﬁcation of the Danish Railway Interlocking SystemsLinh H. Vu1, Anne E. Haxthausen1, and Jan Peleska 21 DTU Compute, Technical University of Denmark, Denmark2 Department of Mathematics and Computer ScienceUniversity of Bremen, GermanyAbstract: In this paper, we present a method for formal veriﬁcation of thenew Danish railway interlocking systems. We made a generic and reconﬁgurablemodel of the behaviors and high-level safety properties of non-collision and non-derailment. This model accommodates sequential release – a new feature in thenew Danish interlocking systems. Instantiating the generic model with interlockingconﬁguration data results in a concrete model and high-level safety properties.Using bounded model checking and inductive reasoning, we are able to verify safetyproperties for model instances corresponding to railway networks of industrial size.Keywords: railway interlocking systems, formal veriﬁcation, bounded modelchecking, k-induction, safety-critical software systems, RobustRailsIntroduction. An interlocking system is responsible for guiding trains safely through a givenrailway network. It is a vital part of any railway signaling system and has the highest safetyintegrity level (SIL4) according to the CENELEC 50128 standard [CEN11]. Conventionally, thedevelopment and veriﬁcation process of interlocking systems is informal and mostly manual,hence time-consuming, costly, and error-prone. As part of the RobustRails research project1,our work aims at establishing a holistic method supporting such a process. The method shouldbe formal and facilitate automation in order to provide a better development and veriﬁcationprocess compared to the conventional one. In Denmark, in the period of 2009–2021, newinterlocking systems that are compatible with ETCS Level 2 [ERT12] will be deployed in theentire country within the context of the Danish Signalling Programme2. In the context of theRobustRail project accompanying the signalling programme on a scientiﬁc level, the proposedmethod will be applied to these new systems.Figure 1 shows the veriﬁcation process of our proposed method. The process begins withthe conﬁguration data [VHP14] in XML of an interlocking system consisting of: (i) a railwaynetwork layout specifying the geographical information of the railway network, and (ii) aninterlocking table specifying how routes must be set so that trains can travel safely throughthe network. This conﬁguration data is then used to instantiate our generic behavioral model ofthe Danish interlocking systems, and its high-level safety properties of non-collision and non-derailment. The behavioral model accommodates sequential release, a new feature that providesthe potential to increase the capacity of the network. For veriﬁcation and validation (V&V), wefollow the typical two-step approach. In the ﬁrst step, the data validation is performed on theconﬁguration data to ensure the well-formedness of the model. In the second step, for a given1 http://robustrails.man.dtu.dk2 http://uk.bane.dk/visArtikel eng.asp?artikelID=60901 / 2 Volume XXX (2014)AVoCS 2014 257Formal Veriﬁcation of the Danish Interlocking Systemsconﬁguration data, the concrete high-level safety properties are veriﬁed for the concrete modelinstance using bounded model checking (BMC) in combination with inductive reasoning. If themodel instance does not satisfy the properties, counter-examples will be generated. The methodhas been implemented as a tool-chain for verifying interlocking systems using the RT-Testertoolbox [Pel13] and its state-of-the-art SMT solver – SONOLAR.��� ������������ �������� ���� ������ �������������������������� ������������������������ ��������������������������������������������� ���������������Figure 1: Veriﬁcation ProcessExperiments. We have successfully used the tool-chain to verify the safety properties formodel instances of a number of railway networks, ranging from a trivial tiny toy network toa large station (Køge) extracted from the early deployment line of the new Danish signallingsystems. The results demonstrate the advantages of the combined approach of BMC andinductive reasoning for veriﬁcation of safety properties. First, it allows errors to be spottedquickly. Our experiences with BMC show that the counter-examples, if there are any, are foundwithin a relatively short time of the model checking process. Second, the method can be scaledup to the size of real applications in practice, hence facilitating the automated V&V process ofinterlocking systems.Bibliography[CEN11] E. CENELEC. 50128 - Railway Applications-Communication, Signalling andProcessing Systems-Software for Railway Control and Protection Systems. Book EN50128 Railway Application-Communications, Signalling and Processing Systems-Software for Railway Control and Protection Systems, 2011.[ERT12] ERTMS. Annex A for ETCS Baseline 3 and GSM-R Baseline 0. April 2012.http://www.era.europa.eu/[Pel13] J. Peleska. Industrial-Strength Model-Based Testing - State of the Art and CurrentChallenges. In Petrenko and Schlingloff (eds.), Proceedings 8th Workshop on Model-Based Testing. Electronic Proceedings in Theoretical Computer Science 111, pp. 3–28. Open Publishing Association, 2013.[VHP14] L. H. Vu, A. E. Haxthausen, J. Peleska. A Domain-Speciﬁc Language for RailwayInterlocking Systems. In Schnieder and Tarnai (eds.), FORMS/FORMAT 2014Proceedings. To appear online by Elsevier, 2014.Proc. AVoCS 2014 2 / 2258 Formal Veriﬁcation of the Danish Railway Interlocking Systems

Formal Verification of the Danish Railway Interlocking Systems

http://orbit.dtu.dk/ws/files/102282365/publishedversion.pdf

Formal Verification of the Danish Railway Interlocking Systems

Abstract

Similar works

Full text

Available Versions

Online Research Database In Technology