Formal Modelling Techniques for Efficient Development of Railway Control Products

  • M. Butler
  • D. Dghaym
  • T. Fischer
  • T. S. Hoang
  • K. Reichl
  • C. Snook
  • P. Tummeltshammer
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10598)


We wish to model railway control systems in a formally precise way so that product lines can be adapted to specific customer requirements. Typically a customer is a railway operator with national conventions leading to different variation points based on a common core principle. A formal model of the core product must be precise and manipulatable so that different feature variations can be specified and verified without disrupting important properties that have already been established in the core product. Cyber-physical systems such as railway interlocking, are characterised by the combination of device behaviours resulting in an overall safe system behaviour. Hence there is a strong need for correct sequential operation with safety “interlocks” making up a process. We utilise diagrammatic modelling tools to make the core product more accessible to systems engineers. The RailGround example used to discuss these techniques is an open source model of a railway control system that has been made available by Thales Austria GmbH for research purpose, which demonstrates some fundamental modelling challenges.


Event-B iUML-B ERS Interlocking 



This work has been conducted within the ENABLE-S3 project that has received funding from the ECSEL Joint Undertaking under Grant Agreement no. 692455. This Joint Undertaking receives support from the European Union’s HORIZON 2020 research and innovation programm and Austria, Denmark, Germany, Finland, Czech Republic, Italy, Spain, Portugal, Poland, Ireland, Belgium, France, Netherlands, United Kingdom, Slovakia, Norway.


  1. 1.
    Abrial, J.-R.: Modeling in Event-B: System and Software Engineering. Cambridge University Press, New York (2010)CrossRefzbMATHGoogle Scholar
  2. 2.
    Abrial, J.-R., Butler, M., Hallerstede, S., Hoang, T.S., Mehta, F., Voisin, L.: Rodin: An open toolset for modelling and reasoning in Event-B. Softw. Tools Technol. Transf. 12(6), 447–466 (2010)CrossRefGoogle Scholar
  3. 3.
    Butler, M., Leuschel, M.: Combining CSP and B for specification and property verification. In: Fitzgerald, J., Hayes, I.J., Tarlecki, A. (eds.) FM 2005. LNCS, vol. 3582, pp. 221–236. Springer, Heidelberg (2005). doi: 10.1007/11526841_16 CrossRefGoogle Scholar
  4. 4.
    The Enable-S3 Consortium. Enable-S3 European project (2016).
  5. 5.
    Dghaym, D., Trindade, M.G., Butler, M., Fathabadi, A.S.: A graphical tool for event refinement structures in event-B. In: Butler, M., Schewe, K.-D., Mashkoor, A., Biro, M. (eds.) ABZ 2016. LNCS, vol. 9675, pp. 269–274. Springer, Cham (2016). doi: 10.1007/978-3-319-33600-8_20 CrossRefGoogle Scholar
  6. 6.
    Fathabadi, A.S., Butler, M., Rezazadeh, A.: Language and tool support for event refinement structures in Event-B. Formal Aspects Comput. 27(3), 499–523 (2015)CrossRefMathSciNetGoogle Scholar
  7. 7.
    Fürst, A., Hoang, T.S., Basin, D.A., Sato, N., Miyazaki, K.: Large-scale system development using abstract data types and refinement. Sci. Comput. Program. 131, 59–75 (2016)CrossRefGoogle Scholar
  8. 8.
    Hoang, T.S.: An introduction to the Event-B modelling method. In: Romanovsky, A., Thomas, M. (eds.) Industrial Deployment of System Engineering Methods, pp. 211–236. Springer, Heidelberg (2013)Google Scholar
  9. 9.
    Hoang, T.S., Snook, C., Dghaym, D., Butler, M.: Class-diagrams for abstract data types. In: Van Hung, D., Deepak, K. (eds.) International Colloquium on Theoretical Aspects of Computing–ICTAC 2017. LNCS, pp. 100–117. Springer, Cham (2017). doi: 10.1007/978-3-319-67729-3_7 CrossRefGoogle Scholar
  10. 10.
    Jackson, M.A.: System Development. Prentice-Hall, Englewood Cliffs (1983)zbMATHGoogle Scholar
  11. 11.
    James, P., Moller, F., Nguyen, H.N., Roggenbach, M., Schneider, S.A., Treharne, H.: On modelling and verifying railway interlockings: Tracking train lengths. Sci. Comput. Program 96, 315–336 (2014)CrossRefGoogle Scholar
  12. 12.
    Leuschel, M., Butler, M.: ProB: An automated analysis toolset for the B method. Softw. Tools Technol. Transf. (STTT) 10(2), 185–203 (2008)CrossRefGoogle Scholar
  13. 13.
    Oliveira, M., Cavalcanti, A., Woodcock, J.: A UTP semantics for circus. Formal Aspects Comput. 21(1–2), 3–32 (2009)CrossRefzbMATHGoogle Scholar
  14. 14.
    Reichl, K.: RailGround model on github (2016). Accessed 20 Apr 2017
  15. 15.
    Said, M.Y., Butler, M., Snook, C.: A method of refinement in UML-B. Softw. Syst. Model 14(4), 1557–1580 (2015)CrossRefGoogle Scholar
  16. 16.
    Schneider, S., Treharne, H.: CSP theorems for communicating B machines. Formal Aspects Comput. 17(4), 390–422 (2005)CrossRefzbMATHGoogle Scholar
  17. 17.
    Schneider, S., Treharne, H., Wehrheim, H.: A CSP approach to control in event-B. In: Méry, D., Merz, S. (eds.) IFM 2010. LNCS, vol. 6396, pp. 260–274. Springer, Heidelberg (2010). doi: 10.1007/978-3-642-16265-7_19 CrossRefGoogle Scholar
  18. 18.
    Snook, C.: iUML-B state-machines. In: Proceedings of the Rodin Workshop 2014, Toulouse, France, pp. 29–30 (2014).
  19. 19.
    Snook, C., Butler, M.: UML-B: Formal modeling and design aided by UML. ACM Trans. Softw. Eng. Methodol. 15(1), 92–122 (2006)CrossRefGoogle Scholar
  20. 20.
    Vu, L.H., Haxthausen, A.E., Peleska, J.: Formal modelling and verification of interlocking systems featuring sequential release. Sci. Comput. Program. 133, 91–115 (2017)CrossRefGoogle Scholar
  21. 21.
    Woodcock, J., Cavalcanti, A.: The semantics of Circus. In: Bert, D., Bowen, J.P., Henson, M.C., Robinson, K. (eds.) ZB 2002. LNCS, vol. 2272, pp. 184–203. Springer, Heidelberg (2002). doi: 10.1007/3-540-45648-1_10 CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  • M. Butler
    • 1
  • D. Dghaym
    • 1
  • T. Fischer
    • 2
  • T. S. Hoang
    • 1
  • K. Reichl
    • 2
  • C. Snook
    • 1
  • P. Tummeltshammer
    • 2
  1. 1.ECSUniversity of SouthamptonSouthamptonUK
  2. 2.Thales Austria GmbHViennaAustria

Personalised recommendations