Techniques for modelling and verifying railway interlockings

  • Phillip James
  • Faron Moller
  • Hoang Nga Nguyen
  • Markus Roggenbach
  • Steve Schneider
  • Helen TreharneEmail author


We describe a novel framework for modelling railway interlockings which has been developed in conjunction with railway engineers. The modelling language used is CSP\(||\)B. Beyond the modelling we present a variety of abstraction techniques which make the analysis of medium- to large-scale networks feasible. The paper notably introduces a covering technique that allows railway scheme plans to be decomposed into a set of smaller scheme plans. The finitisation and topological abstraction techniques are extended from previous work and are given formal foundations. All three techniques are applicable to other modelling frameworks besides CSP\(||\)B. Being able to apply abstractions and simplifications on the domain model before performing model checking is the key strength of our approach. We demonstrate the use of the framework on a real-life, medium-size scheme plan.


Railway verification CSP  Model checking Safety 



The authors would like to thank S. Chadwick and D. Taylor from the company Siemens Rail Automation for their support and encouraging feedback. Thanks also to Matthew Trumble for the initial version of the OnTrack tool which will be the basis of future implementation. Thanks also to the reviewers for their detailed feedback.


  1. 1.
    Abrial, J.-R.: The B-Book: Assigning Programs to Meanings. CUP, Cambridge (1996)Google Scholar
  2. 2.
    Abrial, J.-R.: Modeling in Event-B, chapter 17-Train System. CUP, Cambridge (2010)Google Scholar
  3. 3.
    Antoni, M.: Practical formal validation method for interlocking or automated systems. In: 3rd International Workshop on Dependable Control of Discrete Systems (DCDS), 2011, pp. ix–x (2011)Google Scholar
  4. 4.
    Bjørner, D.: Dynamics of railway nets: on an interface between automatic control and software engineering. Elsevier. In: CTS (2003)Google Scholar
  5. 5.
    Cimatti, A., Corvino, R., Lazzaro, A., Narasamdya, I., Rizzo, T., Roveri, M., Sanseviero, A., Tchaltsev, A.: Formal verification and validation of ERTMS industrial railway train spacing system. In: CAV, volume 7358 of LNCS, pp. 378–393. Springer (2012)Google Scholar
  6. 6.
    Fantechi, A., Gnesi, S.: On the adoption of model checking in safety-related software industry. In: Computer Safety, Reliability, and Security, pp. 383–396 (2011)Google Scholar
  7. 7.
    Ferrari, A., Magnani, G., Grasso, D., Fantechi, A.: Model checking interlocking control tables. FORMS/FORMAT 2010, 107–115 (2011)Google Scholar
  8. 8.
    Fowler, M.: Domain Specific Languages. Addison-Wesley, Reading (2010)Google Scholar
  9. 9.
    Haxthausen, A.E.: Automated generation of safety requirements from railway interlocking tables. In: ISoLA (2), volume 7610 of LNCS, pp. 261–275. Springer (2012)Google Scholar
  10. 10.
    Haxthausen, A.E., Peleska, J.: Formal development and verification of a distributed railway control system. IEEE Trans. Softw. Eng. 26(8), 687–701 (2000)CrossRefGoogle Scholar
  11. 11.
    Hoare, C.A.R.: Communicating Sequential Processes. Prentice-Hall, Englewood Cliffs (1985)Google Scholar
  12. 12.
    Isobe, Y., Moller, F., Nguyen, H.N., Roggenbach, M.: Safety and line capacity in railways-an approach in Timed CSP. In: IFM, pp. 54–68 (2012)Google Scholar
  13. 13.
    Jacquart, R. (ed.): IFIP 18th World Computer Congress, Topical Sessions, chapter TRain: The Railway Domain-A Grand Challenge. Kluwer, Dordrecht (2004)Google Scholar
  14. 14.
    James, P., Beckmann, A., Roggenbach, M.: Using domain specific languages to support verification in the railway domain. In: Proceedings of HVC’12: Eighth Haifa Verification Conference, LNCS. Springer (to appear)Google Scholar
  15. 15.
    James, P., Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S., Treharne, H. : On Modelling and Verifying Railway Interlockings: Tracking Train Lengths. Technical Report CS-13-03, University of Surrey, Department of Computing (2013)Google Scholar
  16. 16.
    James, P., Roggenbach, M.: Automatically verifying railway interlockings using SAT-based modelchecking. ECEASST, 35 (2010)Google Scholar
  17. 17.
    James, P., Trumble, M., Treharne, H., Roggenbach, M., Schneider, S.: OnTrack: an open tooling environment for railway verification. In: Proceedings of NFM’13: Fifth NASA Formal Methods Symposium (2013)Google Scholar
  18. 18.
    Kanso, K., Moller, F., Setzer, A.: Automated verification of signalling principles in railway interlockings. Electron. Notes Theor. Comput. Sci. 250, 19–31 (2009) Google Scholar
  19. 19.
    Leuschel, M., Butler, M.: ProB: an automated analysis toolset for the B method. Int. J. Softw. Tools Technol. Transf. 10(2), 185–203 (2008)CrossRefGoogle Scholar
  20. 20.
    Leuschel, M., Falampin, J., Fritz, F., Plagge, D.: Automated property verification for large scale B models with ProB. Formal Asp. Comput. 23(6), 683–709 (2011)MathSciNetCrossRefGoogle Scholar
  21. 21.
    Mernik, M., Heering, J., Sloane, A.M.: When and how to develop domain-specific languages. ACM Comput. Surv., 37(4) (2005)Google Scholar
  22. 22.
    Moller, F., Nguyen, H.N., Roggenbach, M.: Covering for CSP. Swansea University, Technical report (2013)Google Scholar
  23. 23.
    Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S., Treharne, H.: Combining Event-Based and State-Based Modelling for Railway Verification. Technical Report CS-12-02, University of Surrey (2012)Google Scholar
  24. 24.
    Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S., Treharne, H.: Defining and model checking abstractions of complex railway models using CSP\(\parallel \)B. In: Proceedings of HVC’12: Eighth Haifa Verification Conference, p. 16 (2012) (to appear in Springer Lecture Notes in Computer Science)Google Scholar
  25. 25.
    Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S., Treharne, H.: Railway modelling in CSP\(\parallel \)B: The double junction case study. Electron. Commun. EASST, 53, 15 (2012)Google Scholar
  26. 26.
    Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S., Treharne, H.: Using ProB and CSP\(\parallel \)B for railway modelling. In: Proceedings of IFM’12 and ABZ 2012 Posters and Tool demos session, pp. 31–35 (2012)Google Scholar
  27. 27.
    Morgan. C.C.: Of wp and CSP. In: Beauty is Our Business: A Birthday Salute to Edsger J. Dijkstra, pp. 319–326. Springer (1990)Google Scholar
  28. 28.
    Morley, M.J.: Safety in railway signalling data: a behavioural analysis. In: HOLTPA, pp. 464–474. Springer (1993)Google Scholar
  29. 29.
    National Electronic Sectional Appendix. Accessed: 01/05/2013
  30. 30.
    Nock, O.-S.: Railway Signalling. IRSE (1980)Google Scholar
  31. 31.
    Office of Rail Regulations. Estimates of station usage 2011/12 report. (2013).
  32. 32.
    The ProB animator and model checker (ProB 1.3.6-final). (2013). Accessed: 01/05/2013
  33. 33.
    Sabatier, D., Burdy, L., Requet, A., Guéry, J.: Formal proofs for the NYCT line 7 (flushing) modernization project. In: ABZ, pp. 369–372 (2012)Google Scholar
  34. 34.
    Schneider, S., Treharne, H.: CSP theorems for communicating B machines. Formal Asp. Comput. 17(4), 390–422 (2005)CrossRefzbMATHGoogle Scholar
  35. 35.
    Simpson, A., Woodcock, J., Davies, J.: The mechanical verification of solid-state interlocking geographic data. In: Formal Methods Pacific 97. Springer (1997)Google Scholar
  36. 36.
    UIC: The International Union of Railways. ETCS reference documents. (2013). Accessed: 01/05/2013
  37. 37.
    Winter, K.: Model checking railway interlocking systems. Aust. Comput. Sci. Commun. 24(1) (2002)Google Scholar
  38. 38.
    Winter, K., Robinson, N.: Modelling large railway interlockings and model checking small ones. In: Proceedings of the 26th Australasian Computer Science Conference-Volume 16, pp. 309–316. Australian Computer Society Inc, (2003)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2014

Authors and Affiliations

  • Phillip James
    • 1
  • Faron Moller
    • 1
  • Hoang Nga Nguyen
    • 1
  • Markus Roggenbach
    • 1
  • Steve Schneider
    • 2
  • Helen Treharne
    • 2
    Email author
  1. 1.Swansea UniversityWalesUK
  2. 2.University of SurreySurreyUK

Personalised recommendations