Abstract:The European Rail Traffic Management System (ERTMS) is a state-of-the-art train control system designed as a standard for railways across Europe. It generalises traditional discrete interlocking systems to a world in which trains hold on-board equipment for signalling, and trains and interlockings communicate via radio block processors. The ERTMS aims at improving performance and capacity of rail traffic systems without compromising their safety. The ERTMS system is of hybrid nature, in contrast to classical railway signalling systems which deal with discrete data only. Consequently, the switch to ERTMS poses a number of research questions to the formal methods community, most prominently: How can safety be guaranteed? In this paper we present the first formal modelling of ERTMS comprising all subsystems participating in its control cycle. We capture what safety means in physical and in logical terms, and we demonstrate that it is feasible to prove safety of ERTMS systems utilising Real-Time Maude model-checking by considering a number of bi-directional track layouts. ERTMS is currently being installed in many countries. It will be the main train control standard for the foreseeable future. The concepts presented in this paper offer applicable methods supporting the design of dependable ERTMS systems. We demonstrate model-checking to be a viable option in the analysis of large and complex real-time systems. Furthermore, we establish Real-Time Maude as a modelling and verification tool applicable to the railway domain. The approach given in this paper is a rigorous one. In order to avoid modelling errors, we follow a systematic approach: First, as a requirement specification, we identify the event-response structures present in the ERTMS. Then, we model these structures in Real-Time Maude in a traceable way, i.e., specification text in Real-Time Maude can be directly mapped to requirements. We explore our models by checking if they have the desired behaviour, and apply systematic model-exploration through error injection – both these steps are carried out using the formal method Real-Time Maude. Finally, we analyse ERTMS by model-checking, thus applying a formal method to the railway domain, and we mathematically prove that our analysis of ERTMS by model-checking is complete, i.e., that it guarantees safety at all times.

Formalization and Verification of Mobile Systems Calculus Using the Rewriting Engine Maude

Formal Verification Technique for Grid Service Chain Model and Its Application

Strategies, model checking and branching-time properties in Maude

Model checking strategy-controlled systems in rewriting logic

Verification of AADL Models with Timed Abstract State Machines

Model Checking Classes of Metric LTL Properties of Object-Oriented Real-Time Maude Specifications

Towards a bisimulation congruence for ROAM

Simulating and model checking membrane systems using strategies in Maude

A Workflow Verification Method Based on Calculus.

An Research for Formal Verification of Safety-Critical Software

An approach for design and formal verification of safety-critical software

Intensionality of Modal Logic for Robust Ambient Calculus.

Formal Analysis and Verification of Max-Plus Linear Systems

Graph-transformation verification using monadic second-order logic

MDE-Based Verification of SysML State Machine Diagram by UPPAAL

A Hybrid Approach to System Verification in Early Design for Complex Mechatronic Systems Based on Formal Functional Semantics

Verification of the European Rail Traffic Management System in Real-Time Maude

Modeling and Verification of Natural Language Requirements based on States and Modes

Model Checking of Adaptive Programs with Mode-extended Linear Temporal Logic

A New Duration Calculus and Its Verification

Symbolic model checking quantum circuits in Maude