Compositional Verification of Interlocking Systems for Large Stations

Abstract

Abstract. Railway interlocking systems are responsible to grant exclusive access to a route, that is a sequence of track elements, through a station or a network. Formal verification that basic safety rules regarding exclusive access to routes are satisfied by an implementation is still a challenge for networks of large size due to the exponential computation time and resources needed. Some recent attempts to address this challenge adopt a compositional approach, targeted to track layouts that are easily decomposable into sub-networks such that a route is almost fully contained in a sub-network: in this way granting the access to a route is essentially a decision local to the sub-network, and the interfaces with the rest of the network easily abstract away less interesting details related to the external world. Following up on previous work, where we defined a compositional verification method that started considering routes that overlap between sub-networks in interlocking systems governing a multi-station line, we attack the verification of large networks, which are typically those in main stations of major cities, and where routes are very intertwined and can hardly be separated into sub-networks that are independent at some degree. At this regard, we study how the division of a complex network into sub-networks, using stub elements to abstract all the routes that are common between sub-networks, may still guarantee compositionality of verification of safety properties.

Compositional Verification of Railway Interlockings: Comparison of Two Methods

“…In [18,19,8,10] a method for performing compositional verification in connection with RobustRailS has been developed. It provides a general definition of allowed network cuts that divide a network into multiple subnetworks.…”

“…In [10,18,19,8] a compositional verification approach based on dividing the network layout into two (or more) portions has been proposed. Extra track sections and signals are added at the border between two portions in order to abstract in one portion the behaviour of the other one.…”

Decomposing the Verification of Interlocking Systems

“…However, networks of very large stations still exceed the model checking capacity. Therefore, to be able to perform verification for any size of networks, we have previously [2,8,15,16] suggested to use a compositional verification method on top of the RobustRailS verification method.…”

“…Locality has also enabled our proposal of a compositional approach for addressing verification for very large networks: the idea is to divide the network to be verified into two (or more) sub-networks and then model check the model instances for these sub-networks instead of model checking the model instance of the full network [2,8,15,16]. For model checking, we use the RobustRailS verification tools.…”

Safety Interlocking as a Distributed Mutual Exclusion Problem

“…However, the experience with railway interlocking systems says that when several trains (processes) may require tens of track circuits and points, out of a pool of some hundreds, the combinatorial combination of the possibilities produces a state space explosion problem. This problem asks for suitable abstraction or compositional techniques, and for the power of recently available SAT and SMT-solvers to verify safety of the largest systems of realistic size [28,9].…”