Formal verification of active-standby switchingon safety computer in next generation train control system

The next generation of train-control safety computer is designed as double-redundant systems as safety-critical system. Due to the complexity of the safety computer logic, the active-standby switching between the two subsystems involves multiple state transition under several different conditions. The correctness of the switching process needs to be confirmed by formal verification. In this paper, the UML is used to establish the model and the NuSMV is used to formalize the model. An analysis of multiple-faults situation and the dual-hoststate is carried out. According to the result of model checking, an improvement was proposed to optimize the switching process.