A Domain-Specific Language for Generic Interlocking Models and Their Properties

  • Linh H. Vu
  • Anne E. Haxthausen
  • Jan PeleskaEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10598)


State-of-the-art railway interlocking systems typically adhere to the product line paradigm, where each individual system is obtained by instantiating a generic system with configuration data. In this paper, we present a domain-specific language, IDL, for specifying generic behavioural models and generic properties of interlocking systems. An IDL specification of a generic model consists of generic variable declarations and generic transition rules, and generic properties are generic state invariants. Generic models and generic properties can be instantiated with configuration data. This results in concrete models and concrete properties that can be used as input for a model checker to formally verify that the system model satisfies desired state invariants. The language and a configuration data instantiator based on the semantics have been implemented as components of the RobustRailS tool set for formal specification and verification of interlocking systems. They have successfully been applied to (1) define a generic model and generic safety properties for the new Danish interlocking systems and to (2) instantiate these generic artefacts for real-world stations and lines in Denmark. A novelty of this work is to provide a domain-specific language for generic models and an instantiator tool taking not only configuration data but also a generic model as input instead of using a hard-coded generator for instantiating only one fixed generic model and its properties with configuration data.


Railway interlocking systems Domain-specific languages Formal methods Formal models Formal verification 



The authors would like to thank Ross Edwin Gammon and Nikhil Mohan Pande from Banedanmark (Railnet Denmark) and Jan Bertelsen from Thales for helping us with their expertise about Danish interlocking systems; and Dr.-Ing. Uwe Schulze and Florian Lapschies from University of Bremen for their help with the implementation in the RT-Tester tool-chain.


  1. 1.
    Cao, Y., Xu, T., Tang, T., Wang, H., Zhao, L.: Automatic generation and verification of interlocking tables based on domain specific language for computer based interlocking systems (dsl-cbi). In: Proceedings of the IEEE International Conference on Computer Science and Automation Engineering (CSAE 2011), pp. 511–515. IEEE (2011)Google Scholar
  2. 2.
    CENELEC European Committee for Electrotechnical Standardization: EN 50128: 2011 - Railway applications - Communications, signalling and processing systems - Software for railway control and protection systems (2011)Google Scholar
  3. 3.
    European Railway Agency: Annex A for ETCS Baseline 3 and GSM-R Baseline 0, April 2012.
  4. 4.
    Hansen, H.H., Ketema, J., Luttik, B., Mousavi, M.R., van de Pol, J.: Towards model checking executable UML specifications in mCRL2. Innovations Syst. Softw. Eng. 6(1), 83–90 (2010)CrossRefGoogle Scholar
  5. 5.
    Hansen, J.B.: A formal specification language for generic railway control systems. Master’s thesis, Technical University of Denmark, DTU Compute (2015)Google Scholar
  6. 6.
    Haxthausen, A.E.: Automated generation of formal safety conditions from railway interlocking tables. Int. J. Softw. Tools Technol. Transfer (STTT) 16(6), 713–726 (2014). Special Issue on Formal Methods for Railway Control SystemsCrossRefGoogle Scholar
  7. 7.
    Haxthausen, A.E., Østergaard, P.H.: On the use of static checking in the verification of interlocking systems. In: Margaria, T., Steffen, B. (eds.) ISoLA 2016. LNCS, vol. 9953, pp. 266–278. Springer, Cham (2016). doi: 10.1007/978-3-319-47169-3_19 CrossRefGoogle Scholar
  8. 8.
    James, P., Roggenbach, M.: Encapsulating formal methods within domain specific languages: a solution for verifying railway scheme plans. Math. Comput. Sci. 8(1), 11–38 (2014)CrossRefzbMATHMathSciNetGoogle Scholar
  9. 9.
    Luteberget, B., Johansen, C., Feyling, C., Steffen, M.: Rule-based incremental verification tools applied to railway designs and regulations. In: Fitzgerald, J., Heitmeyer, C., Gnesi, S., Philippou, A. (eds.) FM 2016. LNCS, vol. 9995, pp. 772–778. Springer, Cham (2016). doi: 10.1007/978-3-319-48989-6_49 CrossRefGoogle Scholar
  10. 10.
    Mewes, K.: Domain-specific Modelling of Railway Control Systems with Integrated Verification and Validation. Verlag Dr. Hut, München (2010)Google Scholar
  11. 11.
    Peleska, J.: Industrial-strength model-based testing - state of the art and current challenges. In: Petrenko, A.K., Schlingloff, H. (eds.) Proceedings 8th Workshop on Model-Based Testing, Rome, Italy. Electronic Proceedings in Theoretical Computer Science, vol. 111, pp. 3–28. Open Publishing Association (2013)Google Scholar
  12. 12.
    Peleska, J., Baer, A., Haxthausen, A.E.: Towards domain-specific formal specification languages for railway control systems. In: Schnieder, E., Becker, U. (eds.) Proceedings of the 9th IFAC Symposium on Control in Transportation Systems 2000, 13–15 June 2000, Braunschweig, Germany, pp. 147–152 (2000)Google Scholar
  13. 13.
    Verified Systems International GmbH: RT-Tester Model-Based Test Case and Test Data Generator - RTT-MBT - User Manual (2013).
  14. 14.
    Vu, L.H., Haxthausen, A.E., Peleska, J.: A domain-specific language for railway interlocking systems. In: Schnieder, E., Tarnai, G. (eds.) FORMS/FORMAT 2014 – 10th Symposium on Formal Methods for Automation and Safety in Railway and Automotive Systems, pp. 200–209. Technische Universität Braunschweig, Institute for Traffic Safety and Automation Engineering (2014)Google Scholar
  15. 15.
    Vu, L.H., Haxthausen, A.E., Peleska, J.: Formal modeling and verification of interlocking systems featuring sequential release. In: Artho, C., Ölveczky, P.C. (eds.) FTSCS 2014. CCIS, vol. 476, pp. 223–238. Springer, Cham (2015). doi: 10.1007/978-3-319-17581-2_15 Google Scholar
  16. 16.
    Vu, L.H.: Formal development and verification of railway control systems - in the context of ERTMS/ETCS Level 2. Ph.D. thesis, Technical University of Denmark, DTU Compute (2015)Google Scholar
  17. 17.
    Vu, L.H., Haxthausen, A.E., Peleska, J.: Formal modelling and verification of interlocking systems featuring sequential release. Sci. Comput. Program. 133(Part 2), 91–115 (2017). CrossRefGoogle Scholar
  18. 18.
    Winter, K., Robinson, N.J.: Modelling large railway interlockings and model checking small ones. In: Proceedings of the 26th Australasian Computer Science Conference, ACSC 2003, vol. 16, pp. 309–316. Australian Computer Society, Inc., Darlinghurst (2003)Google Scholar

Copyright information

© Springer International Publishing AG 2017

Authors and Affiliations

  1. 1.DTU ComputeTechnical University of DenmarkKongens LyngbyDenmark
  2. 2.Department of Mathematics and Computer ScienceUniversity of BremenBremenGermany

Personalised recommendations