Abstract:The European Rail Traffic Management System (ERTMS) is a state-of-the-art train control system designed as a standard for railways across Europe. It generalises traditional discrete interlocking systems to a world in which trains hold on-board equipment for signalling, and trains and interlockings communicate via radio block processors. The ERTMS aims at improving performance and capacity of rail traffic systems without compromising their safety. The ERTMS system is of hybrid nature, in contrast to classical railway signalling systems which deal with discrete data only. Consequently, the switch to ERTMS poses a number of research questions to the formal methods community, most prominently: How can safety be guaranteed? In this paper we present the first formal modelling of ERTMS comprising all subsystems participating in its control cycle. We capture what safety means in physical and in logical terms, and we demonstrate that it is feasible to prove safety of ERTMS systems utilising Real-Time Maude model-checking by considering a number of bi-directional track layouts. ERTMS is currently being installed in many countries. It will be the main train control standard for the foreseeable future. The concepts presented in this paper offer applicable methods supporting the design of dependable ERTMS systems. We demonstrate model-checking to be a viable option in the analysis of large and complex real-time systems. Furthermore, we establish Real-Time Maude as a modelling and verification tool applicable to the railway domain. The approach given in this paper is a rigorous one. In order to avoid modelling errors, we follow a systematic approach: First, as a requirement specification, we identify the event-response structures present in the ERTMS. Then, we model these structures in Real-Time Maude in a traceable way, i.e., specification text in Real-Time Maude can be directly mapped to requirements. We explore our models by checking if they have the desired behaviour, and apply systematic model-exploration through error injection – both these steps are carried out using the formal method Real-Time Maude. Finally, we analyse ERTMS by model-checking, thus applying a formal method to the railway domain, and we mathematically prove that our analysis of ERTMS by model-checking is complete, i.e., that it guarantees safety at all times.

Tuning Trains Speed in Railway Scheduling

Train Timetabling on double track and multiple station capacity railway with useful upper and lower bounds

Railway Scheduling Using Boolean Satisfiability Modulo Simulations

A Driving Strategy Based Integrated Rescheduling Model for High-Speed Railway by Using the Parallel Intelligent Method.

An Optimization Model for Scheduling Freight Trains on a Single Rail Track

Assessing the Compatibility of Railway Station Layouts and Mixed Heterogeneous Traffic Patterns by Optimization-Based Capacity Estimation

A feasible timetable generator simulation modelling framework for train scheduling problem

Iterative Train Scheduling under Disruption with Maximum Satisfiability

Ten Diverse Formal Models for a CBTC Automatic Train Supervision System

Uncertain demand based integrated optimisation for train timetabling and coupling on the high-speed rail network

Scope Restriction for Scalable Real-Time Railway Rescheduling: An Exploratory Study

Data-Driven Railway Vehicle Parameter Tuning using Markov-Chain Monte Carlo Bayesian updating

An Efficient Train Scheduling Algorithm on a Single-Track Railway System.

A Comprehensive Stochastic Programming Model for Transfer Synchronization in Transit Networks

Optimizing and synchronizing timetable in an urban subway network with stop-skip strategy

Infrastructure Modeling and Optimization to Solve Real-time Railway Traffic Management Problems

A Multistage Decision Optimization Approach for Train Timetable Rescheduling Under Uncertain Disruptions in a High-Speed Railway Network

A Constraint Programming Model for Scheduling the Unloading of Trains in Ports: Extended

Efficient Real-time Rail Traffic Optimization: Decomposition of Rerouting, Reordering, and Rescheduling Problem

Verification of the European Rail Traffic Management System in Real-Time Maude

Simulations for Train Traffic Flow on Single-Track Railways with Speed Limits and Slopes