An Event-B Model of the Hybrid ERTMS/ETCS Level 3 Standard

  • Amel Mammar
  • Marc Frappier
  • Steve Jeffrey Tueno FotsoEmail author
  • Régine Laleau
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10817)


This paper presents an Event-B model of the ABZ2018 case study on the European Rail Traffic Management System (ERTMS) standard. The case study focusses on the management of fixed virtual sub-sections (VSS). We model the hybrid level 3 of the standard, which assumes that trains may be either equipped with an on-board train integrity monitoring system (TIMS) and that they report their position and integrity, ERTMS trains not fitted with TIMS that report only their front position or non-ERTMS trains that do not report any information about their position. We take into account most of the main features of the case study. Our model is decomposed into four refinements. All proof obligations have been discharged using the Rodin provers, except those related to the computation of the VSS state machine, which was found to be ambiguous (nondeterministic). Our model has been validated using ProB. The main safety property, which is that ERTMS trains do not collide, is proved.


Hybrid ERTMS/ETCS level 3 Event-B ProControl system 



This research was supported in part by NSERC (Natural Sciences and Engineering Research Council of Canada) and the FORMOSE project funded by the French National Research Agency (ANR).


  1. 1.
    Abrial, J.: Modeling in Event-B. Cambridge University Press, Cambridge (2010)CrossRefGoogle Scholar
  2. 2.
    EEIG Ertms Users Group: Hybrid ERTMS/ETCS Level 3: Principles. Technical report, Brussels, Belgium, July 2007Google Scholar
  3. 3.
    Fathabadi, A.S., Butler, M.J., Rezazadeh, A.: Language and tool support for event refinement structures in Event-B. Formal Asp. Comput. 27(3), 499–523 (2015)MathSciNetCrossRefGoogle Scholar
  4. 4.
    Fotso, S.J.T., Frappier, M., Laleau, R., Mammar, A.: Modeling the Hybrid ERTMS/ETCS Level 3 Implementation through Goal Diagrams and Ontologies Using the FORMOSE Approach, February 2018.
  5. 5.
    Hoang, T.S., Butler, M., Reichl, K.: The hybrid ERTMS/ETCS level 3 case study. Technical report, ECS, University of Southampton, U.K. (2007)Google Scholar
  6. 6.
    Leuschel, M., Butler, M.: ProB: a model checker for B. In: Araki, K., Gnesi, S., Mandrioli, D. (eds.) FME 2003. LNCS, vol. 2805, pp. 855–874. Springer, Heidelberg (2003). Scholar
  7. 7.
    Mammar, A., Frappier, M., Fotso, S.J.T., Laleau, R.: An Event-B Model of the Hybrid ERTMS/ETCS Level 3 Standard, February 2018.
  8. 8.
    Parnas, D.L., Madey, J.: Functional documents for computer systems. Sci. Comput. Program. 25(1), 41–61 (1995)CrossRefGoogle Scholar
  9. 9.
    Said, M.Y., Butler, M.J., Snook, C.F.: A method of refinement in UML-B. Softw. Syst. Model. 14(4), 1557–1580 (2015)CrossRefGoogle Scholar

Copyright information

© Springer International Publishing AG, part of Springer Nature 2018

Authors and Affiliations

  • Amel Mammar
    • 1
  • Marc Frappier
    • 2
  • Steve Jeffrey Tueno Fotso
    • 2
    • 3
    Email author
  • Régine Laleau
    • 3
  1. 1.Télécom SudParis, SAMOVAR-CNRSÉvryFrance
  2. 2.Laboratoire GRIL, Département d’informatique, Faculté des sciencesUniversité de SherbrookeQuébecCanada
  3. 3.LACLUniversité Paris-Est CréteilCréteilFrance

Personalised recommendations