Downloaded from orbit.dtu.dk on: Oct 03, 2021 Formal Development and Verification of Railway Control Systems - In the context of ERTMS/ETCS Level 2 Vu, Linh Hong Publication date: 2015 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Vu, L. H. (2015). Formal Development and Verification of Railway Control Systems - In the context of ERTMS/ETCS Level 2. Technical University of Denmark. DTU Compute PHD-2015 No. 395 General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. Ph.D. Thesis Doctor of Philosophy Formal Development and Verification of Railway Control Systems In the context of ERTMS/ETCS Level 2 Linh Hong Vu Kongens Lyngby 2015 The work presented in this dissertation is part of the RobustRailS project funded by by Innovation Fund Denmark. www.robustrails.man.dtu.dk DTU Compute Department of Applied Mathematics and Computer Science Technical University of Denmark Richard Petersens Plads Building 324 2800 Kongens Lyngby, Denmark Phone +45 4525 3031 [email protected] www.compute.dtu.dk PHD-2015-395 ISSN: 0909-3192 Summary (In English) This dissertation presents a holistic, formal method for efficient modelling and verification of safety-critical railway control systems that have product line char- acteristics, i.e., each individual system is constructed by instantiating common generic applications with concrete configuration data. The proposed method is based on a combination of formal methods and domain-specific approaches. While formal methods offer mathematically rigorous specification, verification and vali- dation, domain-specific approaches encapsulate the use of formal methods with familiar concepts and notions of the domain, hence making the method easy for the railway engineers to use. Furthermore, the method features a 4-step verification and validation approach that can be integrated naturally into different phases of the software development process. This 4-step approach identifies possible errors in generic applications or configuration data as early as possible inthe software development cycle, and facilitates debugging/troubleshooting if errors are discovered. The proposed method has successfully been applied to case studies of the forthcoming Danish railway interlocking systems that are compatible with the European standardized railway control systems ERTMS/ETCS Level 2. Experiments showed that the method can be used for specification, verification and validation of systems of industrial size. ii Resumé (På Dansk) Denne afhandling præsenterer en holistisk, formel metode til effektiv modeller- ing og verifikation af sikkerhedskritiske jernbanestyresystemer, der har produktlinje- egenskaber, dvs hvert enkelt system konstrueres ved at instantiere fælles generiske applikationer med konkrete konfigurationsdata. Den foreslåede metode er baseret på en kombination af formelle metoder og domæne-specifikke metoder. Mens de formelle metoder tilbyder matematisk stringent specifikation, verifikation og valid- ering, indkapsler de domæne-specifikke metoder brugen af de formelle metoder med velkendte begreber og notationer for det givne domæne, og gør dermed metoden let at bruge for jernbaneingeniører. Metoden tilbyder en 4-trins verifikations-og valid- eringsproces, der kan integreres naturligt i de forskellige faser af software-udvikling. Denne 4-trins proces identificerer eventuelle fejl i generiske applikationer og kon- figurationsdata så tidligt som muligt i softwareudviklingsprocessen, og faciliterer debugging/fejlfinding. Den foreslåede metode har med succes været anvendt i casestudier af de kommende danske jernbanesikringsanlæg, der er kompatible med det europæiske standardiserede jernbanestyresystem, ERTMS/ETCS niveau 2. Forsøg har vist, at fremgangsmåden kan anvendes til specifikation, verifikation og validering af systemer af industriel størrelse. iv To my family. vi Acknowledgements “Every party must come to an end and when it does, there are kisses and promises and waves goodbye.” – LIFE Magazine The last three years have been one of the hardest journeys of my life. Luckily, I didn’t have to walk it alone: my two supervisors, colleagues, friends, and family have always been there for me through all the ups and downs. Anne (Haxthausen): I am grateful to you for your guidance and help with everything from the beginning to the end of my study! The lessons that I learned from you through all these years have equipped me well for the future. Jan (Peleska): I admire you for your excellences in both theory and practice, and for being inspiring professionally and personally. Thank you for your invaluable suggestions, and for your hospitality during my visits in Bremen! Jan (Bertelsen), Nikhil (Mohan Pande), and Ross (Edwin Gammon): thank you for sharing your immense expertise about Danish interlocking systems with me, and for being always helpful when I had questions! I am thankful to my colleagues and partners in RobustRailS project for their valuable inputs and discussions. Florian (Lapschies) and Uwe (Schulze): I am grateful to you for your precious help with the implementation of the method in RT-Tester. Birgit (Michaelis), Blagoy (Genov), Cécile (Braunstein), Cornelia (Zahlten), Christoph (Hilken), Elena (Gorbachuk), Felix (Hübner), and Wen-ling (Huang): many thanks to you for making it feel like home when I was in Bremen. Andreas (Foldager), Jacob (Hansen), Kim (Sørensen), and Peter (Østergaard): thanks for the interesting discussions! It has been fun working with you. Janne (Lassen) and Hanne (Jensen): thanks for your help with all administrative procedures! If it hasn’t been for you, it would have taken me long time to get around. Bahram (Zarrin), Dilshan (Makavitage), Jóhan (Davidsen), and Vlad (Acretoaie): thanks for your accompany and discussions about everything! I have been enjoying having you guys as office mates. viii Acknowledgements Anh-Dung (Phan), Nhut (Nguyen), Huynh (Luong), Trung (Trinh), Thang (Pham), The (Ngo), Nong (Ngo), Hiep (Nguyen), Hung (Tran), and their families; Ninh (Pham), Hong (Phan), Ha (Nguyen), Hang (Cao), Tuan (Nguyen), and Hoa (Le): I am grateful to you for recharging me with laughters, good time, good food, and always reminding me to enjoy every moment in the long journey. To friends and colleagues that I couldn’t list all here: thanks for being there when I need you. A special thank is dedicated to my friend, my companion, my ally, and my sweetheart Soňa. You made the journey an adventure. Finally, I would have never come this far, if it has not been for the unconditional love, trust, and support from my family. Preface This dissertation was prepared at the department of Applied Mathematics and Computer Science (DTU Compute) at the Technical University of Denmark in partial fulfilment of the requirements for acquiring a degree of Doctor of Philosophy (PhD). The work presented in this dissertation deals with formal development and verification of railway control systems. The primary focus is to develop a holistic method and an associated toolchain to facilitate the efficient development of safe railway interlocking systems that are compatible with European Train Control System (ETCS) Level 2. The dissertation summarises all the studies conducted during the period 2012- 2015. Some of the work has been presented in publications published during the PhD study. The work presented in this dissertation is part of the work package WP.4.1 of the RobustRailS project, which is funded by Innovation Fund Denmark. Kongens Lyngby, October 31, 2015 Linh Hong Vu x Contents Summary i Resumé iii Acknowledgements vii Preface ix Contents xi List of Papers xv Acronyms xvii 1 Introduction 1 1.1 The Danish Signalling Programme ..................... 1 1.2 RobustRailS Project .............................. 2 1.3 Goals, Scope, and Contributions of the Thesis ............... 3 1.4 Structure of the Thesis ............................ 4 2 Background 7 2.1 ERTMS/ETCS ................................. 8 2.2 ETCS Level 2 Architecture .......................... 9 2.3 Railway Interlocking Systems ........................ 12 2.4 Interlockings and ETCS Level 2 ....................... 13 2.5 The new Danish Interlocking Systems ................... 13 2.6 Product Line Characteristics ......................... 19 2.7 Formal Methods ................................ 20 2.8 Model Checking ................................ 22 2.9 Model-based Testing ............................. 22 2.10 Domain-specific Languages ......................... 24 2.11 Mathematical Preliminaries ......................... 26 3 Method Overview 31 3.1 Motivation ................................... 31 3.2 Ingredients ................................... 32 3.3 Why Two Domain-specific Languages? ................... 32 3.4 Verification and Validation Flow .....................