Formal Modelling Techniques for Efficient Development of Railway Control Products

Abstract

Abstract. We wish to model railway control systems in a formally precise way so that product lines can be adapted to specific customer requirements. Typically a customer is a railway operator with national conventions leading to different variation points based on a common core principle. A formal model of the core product must be precise and manipulatable so that different feature variations can be specified and verified without disrupting important properties that have already been established in the core product. Cyber-physical systems such as railway interlocking, are characterised by the combination of device behaviours resulting in an overall safe system behaviour. Hence there is a strong need for correct sequential operation with safety "interlocks" making up a process. We utilise diagrammatic modelling tools to make the core product more accessible to systems engineers. The RailGround example used to discuss these techniques is an open source model of a railway control system that has been made available by Thales Austria GmbH for research purpose, which demonstrates some fundamental modelling challenges.

Formal Modeling and Data Validation of General Railway Interlocking System

“…the Event-B method with the support platform Rodin combines the two methods, which has been used in the research of interlocking system [11]. The literature [12] discussed how to effectively establish the formalized model of railway control products based on an example of interlocking system. Now validating the industrial Data becomes a great challenge which has attracted the researchers' attention.…”

“…The literature [14], described the successful application of ProB for data validation in Communication-based Train Control (CBTC). We present and evaluate an approach of formal modelling and data validation for railway interlocking system based on the successful research experiences from [12], [14]. 7 CONCLUSION AND FUTURE WORK In this paper, after extracting the environmental, functional and safety properties, as well as each event flow, we built a general interlocking system function model by multistep refinement using the Event-B language.…”

Formalising the Hybrid ERTMS Level 3 specification in iUML-B and Event-B

“…Train control is a familiar domain for Formal Methods, and specifically for B and Event-B-based approaches. Butler et al [37] give a methodical treatment of the diagrammatic modelling of the rail interlocking system Railground with both iUML-B and Event Refinement Structures [38]. In [19], the authors present the Event-B development of a Communications-based Train Control (CBTC) system from Hitachi Ltd. Their focus is on the use of Abstract Data Types (ADTs) to manage the complexity of modelling a graph-based rail network and its dynamics.…”

“…This example is comparable to European Rail Traffic Management System (ERTMS) Level 3 and uses moving blocks. The authors further proposed [39] the extension of iUML-B to support diagrammatic modelling of ADTs, using the same Railground case study as [37].…”

Diagram-Led Formal Modelling Using iUML-B for Hybrid ERTMS Level 3

“…Train control is a familiar domain for Formal Methods, and specifically for B and Event-B-based approaches. Butler et al [4] give a methodical treatment of the diagrammatic modelling of the rail interlocking system Railground with both iUML-B and Event Refinement Structures [15]. In [7], the authors present the Event-B development of a Communications-based Train Control (CBTC) system from Hitachi Ltd. Their focus is on the use of Abstract Data Types (ADTs) to manage the complexity of modelling a graph-based rail network and its dynamics.…”