Modeling Railway Control Systems in Promela

  • Roberto NardoneEmail author
  • Ugo Gentile
  • Massimo Benerecetti
  • Adriano Peron
  • Valeria Vittorini
  • Stefano Marrone
  • Nicola Mazzocca
Conference paper
Part of the Communications in Computer and Information Science book series (CCIS, volume 596)


This paper presents an approach to systematically build Promela models with the aim of generating test cases within the system level testing process of railway control systems. The paper focuses on the encoding of the system model, of the aspects related to the representation of possible execution environments and their interaction with the system. The input for building a Promela model of the system under test is a state machine based specification. Indeed, state machines are one of the most common notations used in industrial settings to model critical systems and allow for easily obtaining the Promela model of the system by applying a well structured transformational approach; furthermore, state-based formalism are also highly recommended by CENELEC norms to model railway control systems.

In our approach Dynamic State Machines (DSTMs) are used, a newly developed extension of hierarchical state machines which allow for modeling dynamic instantiation of processes. The approach is applied to a functionality of the Radio Block Centre, the vital core of the ERTMS/ETCS Control System, in order to show the feasibility and effectiveness of the generation of the Promela model on a real system.


Model checking Promela SPIN Dynamic state machine CRYSTAL Railway control systems Test case generation 



This paper is partially supported by research project CRYSTAL (Critical System Engineering Acceleration), funded from the ARTEMIS Joint Undertaking under grant agreement no. 332830 and from ARTEMIS member states Austria, Belgium, Czech Republic, France, Germany, Italy, Netherlands, Spain, Sweden, United Kingdom.


  1. 1.
    Alur, R., Kannan, S., Yannakakis, M.: Communicating hierarchical state machines. In: Wiedermann, J., Van Emde Boas, P., Nielsen, M. (eds.) ICALP 1999. LNCS, vol. 1644, pp. 169–178. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  2. 2.
    Di Martino, B., et al.: An interoperable testing environment for ERTMS/ETCS control systems. In: Bondavalli, A., Ceccarelli, A., Ortmeier, F. (eds.) SAFECOMP 2014. LNCS, vol. 8696, pp. 147–156. Springer, Heidelberg (2014)Google Scholar
  3. 3.
    CENELEC EN50128: communication, signalling and processing systems - software for railway control and protection systems (2011)Google Scholar
  4. 4.
    Riccobene, E., Rinzivillo, S., Gargantini, A.: Using spin to generate testsfrom ASM specifications. In: Börger, E., Gargantini, A., Riccobene, E. (eds.) ASM 2003. LNCS, vol. 2589, pp. 263–277. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  5. 5.
    Haxthausen, A.E., Peleska, J., Kinder, S.: A formal approach for the construction and verification of railway control systems. Formal Aspects Comput. 23(2), 191–219 (2011)CrossRefzbMATHGoogle Scholar
  6. 6.
    Holzmann, G.J.: The SPIN Model Checker: Primer and Reference Manual, vol. 1003. Addison-Wesley, Reading (2004)Google Scholar
  7. 7.
    Jouault, F., Allilaire, F., Bézivin, J., Kurtev, I.: Atl: a model transformation tool. Sci. Comput. Program. 72(1), 31–39 (2008)CrossRefzbMATHGoogle Scholar
  8. 8.
    Lanotte, R., Maggiolo-Schettini, A., Peron, A., Tini, S.: Dynamic hierarchical machines. Fundam. Inf. 54(2–3), 237–252 (2002)MathSciNetGoogle Scholar
  9. 9.
    Nardone, R., et al.: Dynamic state machines for formalizing railway control system specifications. In: Artho, C., Ölveczky, P.C. (eds.) FTSCS 2014. CCIS, vol. 476, pp. 93–109. Springer, Heidelberg (2015)Google Scholar
  10. 10.
    Pflügl, H., El-Salloum, C., Kundner, I.: Crystal, critical system engineering acceleration, a truly european dimension. ARTEMIS Mag. 14, 12–15 (2013)Google Scholar
  11. 11.
    UIC. ERTMS/ETCS class1 system requirements specification, ref. SUBSET-026, issue 2.2.2 (2002)Google Scholar
  12. 12.
    Yin, L., Mallet, F., Liu, J.: Verification of marte/ccsl time requirements in promela/spin. In: 16th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS), pp. 65–74 (2011)Google Scholar
  13. 13.
    Zheng, Y., Zhou, J., Krause, P.: A model checking based test case generation framework for web services. In: Fourth International Conference on Information Technology, ITNG 2007, pp. 715–722. IEEE (2007)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Roberto Nardone
    • 1
    Email author
  • Ugo Gentile
    • 1
  • Massimo Benerecetti
    • 1
  • Adriano Peron
    • 1
  • Valeria Vittorini
    • 1
  • Stefano Marrone
    • 2
  • Nicola Mazzocca
    • 1
  1. 1.Università di Napoli Federico IINaplesItaly
  2. 2.Seconda Università di NapoliNaplesItaly

Personalised recommendations