Formal modelling and simulation of train control systems using petri nets

Abstract

A formal model was prepared on behalf of the German railways (Deutsche Bahn AG) starting from an informal (natural language) specifications of the European Train Control System (ETCS) system. Proceeding from the existing models of the system design-the waterfall and the spiral model-a model for the system design was developed so as to use Petri nets as a universal means of description for all the phases of the ETCS. Following a thorough and detailed comparison, it was decided to use Petri nets as a means of description for this procedure, as they permit universal application, the use of different methods and formal analysis. The method developed is an integrated event-and data-oriented approach, which shows the different aspects of the system on their own net levels. The model comprises three sub-models with a model of the environment developed next to the onboard and trackside systems. This environment model covers all the additional systems connected through the system interfaces, examples of which are interlocking or regulation. Starting from a net representing the system context, the process of the onboard and trackside subsystems was modelled. Here, the different operations and processes are visualized in the form of scenarios, which in turn have access to additional refinements representing specific functions. System modelling was supported by the tool Design/CPN. It was chosen after a careful evaluation of several Petri net tools. ETCS system modelling was taken to a point permitting partial model simulation. On the basis of these models, additional options of the spiral model of the system design now appear: the train and trackside models may expand into specific visualizations, the algorithms can be further refined and compared, the models can be used for different kinds of tests and also for purposes of system quality assurance, which may go as far as furnishing proof of safety standards. Additional phases of system development may now be elaborated on the basis of the spiral model. Our experience has shown that it is possible to take real-life and operational systems specifications written in a natural language and express their content as a formal specification. Our experience has also demonstrated that it is possible to incorporate real life practices of software development cycles (spiral model, waterfall model) into formal models. The paper makes an overview of our experiences and highlights the various problems which were encountered and solved.

Some Trends in Formal Methods Applications to Railway Signaling

“…Several formal modeling and verification studies have been conducted regarding ETCS protocols and components, starting from a model of ETCS given by coloured Petri nets [43], to the use of statecharts with the aim of proving safety properties by model checking an early version of the radio-based train control system [18], to the recent studies of real-time properties using stochastic Petri nets [47] or CSP-OZ-DC [30].…”

Study on Formal Modeling and Safety Verification of Train‐to‐Train Communication

“…Formal modeling is the process of converting the natural description language into a formal description language during the system's requirement design phase, which can improve the completeness and consistency of the system design. According to the description of the system characteristics, it can be divided into two categories: one is used to describe the system sequence characteristics based on mathematical analysis methods, such as Z method [10], B method [11], and VDM method [12]; the other method is preferable to describe concurrent characteristics of system, such as Petri net [13][14][15], finite automata [16,17], and LTS [18].…”

Reliability Analysis of CTCS Based on Two GSM-R Double Layers Networks Structures

“…In [3]the European Train Control Systems (ETCS) communication structure is modeled with colored Petri nets. The model is used for a division of the system into modules, visualization of the functional behavior, and a check of different scenarios.…”