Verification of the European Rail Traffic Management System in Real-Time Maude

Abstract

The European Rail Traffic Management System (ERTMS) is a state-of-the-art train control system designed as a standard for railways across Europe. It generalises traditional discrete interlocking systems to a world in which trains hold on-board equipment for signalling, and trains and interlockings communicate via radio block processors. The ERTMS aims at improving performance and capacity of rail traffic systems without compromising their safety. The ERTMS system is of hybrid nature, in contrast to classical railway signalling systems which deal with discrete data only. Consequently, the switch to ERTMS poses a number of research questions to the formal methods community, most prominently: How can safety be guaranteed? In this paper we present the first formal modelling of ERTMS comprising all subsystems participating in its control cycle. We capture what safety means in physical and in logical terms, and we demonstrate that it is feasible to prove safety of ERTMS systems utilising Real-Time Maude model-checking by considering a number of bi-directional track layouts. ERTMS is currently being installed in many countries. It will be the main train control standard for the foreseeable future. The concepts presented in this paper offer applicable methods supporting the design of dependable ERTMS systems. We demonstrate model-checking to be a viable option in the analysis of large and complex real-time systems. Furthermore, we establish Real-Time Maude as a modelling and verification tool applicable to the railway domain. The approach given in this paper is a rigorous one. In order to avoid modelling errors, we follow a systematic approach: First, as a requirement specification, we identify the event-response structures present in the ERTMS. Then, we model these structures in Real-Time Maude in a traceable way, i.e., specification text in Real-Time Maude can be directly mapped to requirements. We explore our models by checking if they have the desired behaviour, and apply systematic model-exploration through error injection-both these steps are carried out using the formal method Real-Time Maude. Finally, we analyse ERTMS by model-checking, thus applying a formal method to the railway domain, and we mathematically prove that our analysis of ERTMS by model-checking is complete, i.e., that it guarantees safety at all times.

Topological manifold‐based monitoring method for train‐centric virtual coupling control systems

“…Definition 14: The area of feasible operation of the following train is the interior of a 2-manifold with boundary which is denoted by Intℳ afo . The ℳ afo is defined by (16). The chart is represented by (U afo , η), where U afo and η are defined by (17) and 18, respectively.…”

“…Lots of research has been studied to ensure the safety of the railway signalling systems [13][14][15]. Berger verified the European Rail Traffic Management System (ERTMS) with real-time Maude [16]. A formal model checking method for ERTMS level 2 system has been integrated into the development and verification flow of Ansaldo [17].…”

Strategy Synthesis for Autonomous Driving in a Moving Block Railway System with Uppaal Stratego

“…Thus, while GNSS-based positioning systems are in use for some time now in the avionics and automotive sectors, current train signalling systems are still based on fixed blocks. However, experiments are being conducted and case studies are being validated in order to move to Level 3 signalling systems [2,5,6,8,14,15,21,25,33,40].…”

“…Finally, there have been several recent attempts at modelling and analysing ERTMS Level 3 signalling systems (in particular Hybrid Level 3 systems with virtual fixed blocks) with Promela/Spin, mCRL2, Alloy/Electrum, iUML, SysML, ProB, Event-B, and real-time Maude [2,5,14,21,25,33,40,43]. None of these concern quantitative modelling and analysis, typically lacking uncertainty, which is fundamental for demonstrating the reliability of the operational behaviour of next generation satellite-based ERTMS Level 3 moving block railway signalling system models.…”

A Train Protection Logic Based on Topological Manifolds for Virtual Coupling

“…Vu et al presented a formal verification tool suite to verify the sequential release feature of interlocking systems [17]. Berger et al verified the European Rail Traffic Management System (ERTMS) with real-time Maude [18] whilst James et al have presented an extendable tool-set to verify the interlocking system combining several formal verification methods [19]. Another research issue is model-based functional testing, which could also improve the safety of the system effectively [20].…”