Model Checking Interlocking Control Tables

Science of Computer Programming

Peleskã

2017

In this article, we present a method and an associated toolchain for the formal verification of the new Danish railway interlocking systems that are compatible with the European Train Control System (ETCS) Level 2. We have made a generic and reconfigurable model of the system behaviour and generic safety properties. This model accommodates sequential release -a feature in the new Danish interlocking systems. To verify the safety of an interlocking system, first a domain-specific description of interlocking configuration data is constructed and validated. Then the generic model and safety properties are automatically instantiated with the well-formed description of interlocking configuration data. This instantiation produces a model instance in the form of a Kripke structure, and concrete safety properties expressed as invariants. Finally, using a combination of SMT based bounded model checking (BMC) and inductive reasoning, it is verified that the generated model instance satisfies the generated safety properties. Using this method, we are able to verify the safety properties for model instances corresponding to railway networks of industrial size. Experiments show that BMC is also efficient for finding bugs in the railway interlocking designs. Additionally, benchmarking results comparing the performance of our approach with alternative verification techniques on the interlocking models are presented.

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Formal modelling and verification of interlocking systems featuring sequential release

Science of Computer Programming

Peleskã

2017

“…Unfortunately, due to the state explosion problem, the technique is only able to verify applications of small size [8]. Several techniques have been proposed in order to push the applicability bounds toward industrial size.…”

Section: Related Workmentioning

confidence: 99%

“…Thus, automated verification of interlocking systems is an active research topic, investigated by several research groups, see e.g. [10,8,23,15,9,14]. As part of the RobustRailS research project 3 , our work aims at establishing a holistic method supporting the verification of such systems.…”

Section: Introductionmentioning

confidence: 99%

Formal Modeling and Verification of Interlocking Systems Featuring Sequential Release

Communications in Computer and Information Science

Peleskã

2015

Abstract. In this paper, we present a method and an associated tool suite for formal verification of the new ETCS level 2 based Danish railway interlocking systems. We have made a generic and reconfigurable model of the system behavior and generic high-level safety properties. This model accommodates sequential release -a feature in the new Danish interlocking systems. The generic model and safety properties can be instantiated with interlocking configuration data, resulting in a concrete model in the form of a Kripke structure, and in high-level safety properties expressed as state invariants. Using SMT based bounded model checking (BMC) and inductive reasoning, we are able to verify the properties for model instances corresponding to railway networks of industrial size. Experiments also show that BMC is efficient for finding bugs in the railway interlocking designs.

“…However, full formal verification of interlocking systems demands heavy if not infeasible computational resources 2 , a phenomenon known as the state explosion problem. The pioneering research in model checking and in applying model checking to the domain of railways [3][4][5]7,9,20] has developed techniques allowing the verification of models of the interlocking systems controlling larger and highly-complex networks. For example, abstraction techniques can be applied at the domain modelling level before the model checking is performed [9].…”

Section: Introductionmentioning

confidence: 99%

Compositional Model Checking of Interlocking Systems for Lines with Multiple Stations

Macedo

Fantechi

Lecture Notes in Computer Science

2017

Self Cite

Abstract. In the railway domain safety is guaranteed by an interlocking system which translates operational decisions into commands leading to field operations. Such a system is safety critical and demands thorough formal verification during its development process. Within this context, our work has focused on the extension of a compositional model checking approach to formally verify interlocking system models for lines with multiple stations. The idea of the approach is to decompose a model of the interlocking system by applying cuts at the network modelling level. The paper introduces an alternative cut (the linear cut) to a previously proposed cut (border cut). Powered with the linear cut, the model checking approach is then applied to the verification of an interlocking system controlling a real-world multiple station line.