A formal approach to safety verification of railway signaling systems

This paper proposes a new tool based on formal methods to validate track topologies and train movements conditions. Its distinguishing features are (1) the graphical simulation of railways specifications, (2) the automatic generation and (3) the validation of train movement properties. The tool is called VeRaSiS (Verification of Railway Signaling Systems), and uses Event-B [1] to formalize, prove and verify the generated properties. Further, it is designed for industrial use, where we face the challenge that mainstream users are not familiar with formal modeling and where the specification is presented in the user's domain, shielding them from the formalism. This tool is under development, and it's current status is presented in this paper. A preliminary analysis using an industrial case study provided by a Brazilian transportation company showed the efficiently use of formal methods for validating train movement properties of a railway signaling system. The properties were formalized and verified automatically using ProB [2]. The outcome was an error in the first validation which was performed manually by a domain expert. The risk of missing critical faults in analysis is a risk that upset industrial management and this is the reason why they have given the green light to start this project. In summary, we believe that the formal approach and especially the VeRaSiS approach proposed in this paper is an important step towards guaranteeing the safety and reliability of signaling systems. Additional industrial case studies would help to validate and improve the VeRaSiS approach. Our main goal is to develop a fully functional first version of the VeRaSiS tool in order to prove its usefulness.