Compositional Model Checking of Interlocking Systems for Lines with Multiple Stations

Abstract

Abstract. In the railway domain safety is guaranteed by an interlocking system which translates operational decisions into commands leading to field operations. Such a system is safety critical and demands thorough formal verification during its development process. Within this context, our work has focused on the extension of a compositional model checking approach to formally verify interlocking system models for lines with multiple stations. The idea of the approach is to decompose a model of the interlocking system by applying cuts at the network modelling level. The paper introduces an alternative cut (the linear cut) to a previously proposed cut (border cut). Powered with the linear cut, the model checking approach is then applied to the verification of an interlocking system controlling a real-world multiple station line.

Compositional Verification of Railway Interlockings: Comparison of Two Methods

“…In [18,19,8,10] a method for performing compositional verification in connection with RobustRailS has been developed. It provides a general definition of allowed network cuts that divide a network into multiple subnetworks.…”

“…In [10,18,19,8] a compositional verification approach based on dividing the network layout into two (or more) portions has been proposed. Extra track sections and signals are added at the border between two portions in order to abstract in one portion the behaviour of the other one.…”

“…Note that the operated cut is the one defined in[19], which slightly differs from the single cut defined in[10], since the t1 section is present in both subnetworks. The compositionality proof of[10] covers this case as well.…”

A Survey on Formal Specification and Verification of Smart Mass Transit Railway Interlocking System

“…The paper by Macedo et al [50] described how to avoid a state space explosion drawback by applying the compositional model checking approach. The goal of this method is to use linear cuts at the network modeling level to break down a model of an interlocking system.…”

Visualising Railway Safety Verification

“…However, uptake of such methods by industry has been hindered by the challenges of: scalability (the proposed mathematical proof techniques do not scale to large industrial examples); faithfulness (the models created fail to capture the intricacies of modern railway signalling, which are often supplier dependent); and usability (existing tools for formal analysis are not necessarily accessible to signalling engineers). In recent years, the formal methods community has proposed solutions to scalability [25] and faithfulness [21]. However accessibility remains an open challenge.…”