What is the Point: Formal Analysis and Test Generation for a Railway Standard

Abstract

1, arend.rensink, m.i.a.stoelinga}@utwente.nl EULYNX is an EU-level collaboration between railway infrastructure managers to standardize signaling interfaces. The main goal of EULYNX is to provide, on an EU scale, a modular and flexible railroad architecture where components can easily be exchanged. This also opens the market for specialized manufacturers that do not supply the full range of control assets, but only single components. Related to EULYNX is FormaSig, an effort to establish the safety of the EULYNX standard with mathematical rigor. In particular, one of the main objectives of FormaSig is to translate the entire EULYNX standard from the semi-formal language SysML to the formal language mCRL2. The resulting mCRL2 models will subsequently be checked for important safety requirements and used for automated testing of actual EULYNX systems. This paper presents a first case study in this direction, focusing on the EULYNX Point interface, which we have converted to an mCRL2 model. We have also derived nine safety requirements, which have all been automatically compared with the mCRL2 model. Finally, we have used the mCRL2 model to test an industrial simulator of the EULYNX Point interface fully automatically.

Formal Modeling and Initial Analysis of the 4SECURail Case Study

“…Many other formal notations have been the target of translations from SysML design. Another work very similar to our from the point of view of the goal is the one described by Bouwman et al [5]. Also in that case the goal was aimed at the analysis of a signaling standard under development rather than the verification of a specific system.…”

“…Moreover, it would have tied the whole analysis approach to a specific commercial tool, a fact which was not considered desirable. Therefore our initial SysML models have the structure of simple graphical designs; their role is just that one of constituting an intermediate, easy-to-understand documentation halfway between the natural language requirements and the formal models 5 . Starting from the UMC notation, further formal models have been automatically generated in the notations accepted by the ProB 6 and CADP/LNT 7 tools.…”

A Formalisation of SysML State Machines in mCRL2

“…We reckon that significant optimization can be done to reduce the state space. One such optimization possibility was discovered in a case study of the EULYNX Point interface [4]. In our model all updates to variables are stored in the vars parameter of the StateMachine process.…”

“…In a first case study, we have demonstrated the viability of this idea. We took the EULYNX SysML model of the Point interface, associated an mCRL2 model with it, used the mCRL2 model checker to analyse its correctness and used the model-based test tool JTorX [2] to check conformance of a SysML simulator of Point [4]. The EULYNX standard is under development, and it is likely that also in the future it will be subject to changes.…”

The 4SECURail Formal Methods Demonstrator

“…Several other studies (e.g., [39]) instead describe the translation of UML/SysML models in mCRL2. Still, the approach which is the most similar to ours is the one by Bouwman et al [40], which has the same goal of enriching EULYNX interfaces with formal models, that in this case, are encoded in mCRL2.…”