European Train Control System: A Case Study in Formal Verification e - PowerPoint PPT Presentation

European Train Control System: A Case Study in Formal Verification e Platzer 1 Jan-David Quesel 2 Andr´ 1 Carnegie Mellon University, Pittsburgh, PA 2 University of Oldenburg, Department of Computing Science, Germany International Conference on Formal Engineering Methods (ICFEM), Rio de Janeiro, 2009 Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 1 / 19

ETCS Control Verification Problem Hybrid System Continuous evolutions (differential equations) Discrete jumps (control decisions) τ. p τ. v z τ. a v a 6 3.0 2 5 2.5 1 2.0 4 1.5 3 4 t 1 2 3 1.0 2 � 1 0.5 1 4 t 4 t � 2 1 2 3 1 2 3 Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 2 / 19

European Train Control System τ. p m . e ST SB Objectives Overview 1 Collision free 1 No static partitioning of track 2 Radio Block Controller (RBC) 2 Maximise throughput & manages movement authorities velocity (300 km/h) 3 2 . 1 ∗ 10 6 passengers/day dynamically 3 Moving block principle Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 3 / 19

European Train Control System τ. p m . e ST SB Parametric Hybrid Systems continuous evolution along differential equations + discrete change m . e MA z τ. p v t τ. v Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 3 / 19

European Train Control System τ. p m . e ST SB Parametric Hybrid Systems continuous evolution along differential equations + discrete change m . e MA z τ. p v t τ. v Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 3 / 19

European Train Control System τ. p m . e ST SB Parametric Hybrid Systems continuous evolution along differential equations + discrete change m . e MA MA z z τ. p v v t τ. v Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 3 / 19

European Train Control System τ. p m . e ST SB Parametric Hybrid Systems continuous evolution along differential equations + discrete change Parameters have nonlinear influence m . e MA MA Handle SB as free symbolic parameter? z z τ. p Challenge: verification (falsifying is “easy”) Which constraints for SB ? v v t τ. v ∀ m . e ∃ SB “train always safe” Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 3 / 19

Differential Dynamic Logic (d L ) τ. v τ. p m . e Example → [ ]( ) Precondition Operation model Property Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 4 / 19

Differential Dynamic Logic (d L ) τ. v τ. p m . e Example τ. v 2 ≤ 2 b ( m . e − τ. p ) → [ ]( τ. p ≤ m . e ) Precondition Operation model Property Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 4 / 19

Differential Dynamic Logic (d L ) τ. v τ. p m . e Example τ. v 2 ≤ 2 b ( m . e − τ. p ) → [ τ. p ′ = τ. v , τ. v ′ = τ. a ]( τ. p ≤ m . e ) Precondition Operation model Property Continuous evolution: differential equation Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 4 / 19

Differential Dynamic Logic (d L ) τ. v τ. p m . e Example τ. v 2 ≤ 2 b ( m . e − τ. p ) → [ τ. a := ∗ ; τ. p ′ = τ. v , τ. v ′ = τ. a ]( τ. p ≤ m . e ) Precondition Operation model Property Random assignment Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 4 / 19

Differential Dynamic Logic (d L ) τ. v τ. p m . e Example τ. v 2 ≤ 2 b ( m . e − τ. p ) → [ τ. a := ∗ ; ? τ. a ≤ − b ; τ. p ′ = τ. v , τ. v ′ = τ. a ]( τ. p ≤ m . e ) Precondition Operation model Property Test Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 4 / 19

3D Movement Authorities τ. v τ. p Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r τ. p Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r τ. p m 1 . d m 1 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r τ. p m 1 . d m 1 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r m 2 . d τ. p m 2 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r m 2 . d τ. p m 2 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r m 3 . d τ. p m 3 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

3D Movement Authorities τ. v m . r m 3 . d τ. p m 3 . e Vectorial MA m = ( d , e , r ): Beyond point m . e train not faster than m . d . Train should try not to keep recommended speed m . r Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 6 / 19

Separation Principle Lemma (Principle of separation by movement authorities) Each train respects its movement authority and the RBC partitions into disjoint movement authorities ⇒ trains can never collide. τ. p m . e ST SB Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 7 / 19

Parametric Skeleton of ETCS Read from the informal specification. . . ETCS skel : ( train ∪ rbc ) ∗ train : spd ; atp ; drive : (? τ. v ≤ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ A ) spd ∪ (? τ. v ≥ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ 0) : if ( m . e − τ. p ≤ SB ∨ rbc . message = emergency ) τ. a := − b atp : t := 0; ( τ. p ′ = τ. v , τ. v ′ = τ. a , t ′ = 1 ∧ τ. v ≥ 0 ∧ t ≤ ε ) drive : ( rbc . message := emergency ) ∪ ( m := ∗ ; ? m . r > 0) rbc Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 8 / 19

Parametric Skeleton of ETCS As transition system. . . m 0 := m m := ∗ τ. p ′ = τ. v , τ. v ′ = τ. a , t ′ = 1 rbc . message := emergency τ. v ≥ 0 ∧ t ≤ ε t := 0 τ. a := − b ? τ. v ≤ m . r ? − b ≤ τ. a ≤ A τ. a := ∗ ?( m . e − τ. p ≤ SB ∨ rbc . message = emergency ) ? m . e − τ. p ≥ SB ∧ ? τ. v ≥ m . r ?0 > τ. a ≥ − b τ. a := ∗ rbc . message � = emergency ) Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 8 / 19

Parametric Skeleton of ETCS ETCS skel : ( train ∪ rbc ) ∗ : spd ; atp ; drive train spd : (? τ. v ≤ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ A ) ∪ (? τ. v ≥ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ 0) atp : if ( m . e − τ. p ≤ SB ∨ rbc . message = emergency ) τ. a := − b : t := 0; ( τ. p ′ = τ. v , τ. v ′ = τ. a , t ′ = 1 ∧ τ. v ≥ 0 ∧ t ≤ ε ) drive : ( rbc . message := emergency ) ∪ ( m := ∗ ; ? m . r > 0) rbc Task Verify safety Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 8 / 19

Parametric Skeleton of ETCS ETCS skel : ( train ∪ rbc ) ∗ : spd ; atp ; drive train spd : (? τ. v ≤ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ A ) ∪ (? τ. v ≥ m . r ; τ. a := ∗ ; ? − b ≤ τ. a ≤ 0) atp : if ( m . e − τ. p ≤ SB ∨ rbc . message = emergency ) τ. a := − b : t := 0; ( τ. p ′ = τ. v , τ. v ′ = τ. a , t ′ = 1 ∧ τ. v ≥ 0 ∧ t ≤ ε ) drive : ( rbc . message := emergency ) ∪ ( m := ∗ ; ? m . r > 0) rbc Task Verify safety Specification [ ETCS skel ]( τ. p ≥ m . e → τ. v ≤ m . d ) Andr´ e Platzer, Jan-David Quesel ETCS: A Case Study in Formal Verification ICFEM 2009 8 / 19