The Verification and Validation activity for a railway control - - PowerPoint PPT Presentation

Ansaldo Segnalamento Ferroviario

The Verification and Validation activity for a railway control system

Davide Alagna, Alessandro Romei

[alagna.davide@asf.ansaldo.it, romei.alessandro@asf.ansaldo.it]

RAMS Department

Geneva, 19th September 2008

Ansaldo Segnalamento Ferroviario

1. Ansaldo signalling systems

• Overview
• Safety Logic
• System Data

2. V&V activities

• Overview
• Code inspection
• Independent generation of System Data
• Typologies of tests

3. Conclusions

• Software Problem Report

Summary

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Purpose of a signalling system

Safe railway traffic requires a signalling system to

• assign and control the route
• support the driver’s behaviour
• avoid collisions

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Architecture of Ansaldo ACC interlocking

Field devices Peripheral Posts ACC Central Interlocking Unit Signaller’s desk ART1 server ART2 server

Ansaldo Segnalamento Ferroviario

Adjacent RBCs

• 1. Ansaldo signalling systems – Overview

Architecture of Ansaldo Radio Block Centre

RBC Central Interlocking Unit Operator’s desk ART1 server ART2 server Train Interlocking Communication Computer

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Products and applications

Generic Product:

• Hardware and Kernel Software (e.g. ACC, RBC)

Generic Application:

• Signalling Safety Logic (e.g. Italy, UK, ERTMS)

Specific Applications:

• Systems (e.g. NVC Milano-Bologna, ACC Roma Termini,

RBC Torino-Novara)

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

CIU design guidelines

Same product for different applications Strict separation between invariant and variant parts of the product

• Invariant: Hardware, Kernel Software
• Variant: Safety Logic, System Data

Variant parts managed through databases, handled by a common software engine

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

CIU software architecture

Hardware Kernel Software Safety Logic System Data

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Safety Logic design

Object-Oriented modelling of Safety Logic starting from safety requirements (principle schemes):

• Entities (classes)
• Attributes (classes specification)
• Linked Entities (relationships among classes)
• Entities state (classes members)
• Commands (classes methods)

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Design example

Requirement: a point machine shall not move if it is engaged by a train.

• Entities (classes):

Point, Track_circuit

• Attributes (classes specification): -
• Linked entities (relationships among classes):

Dead_track_circuit

• Entities state (classes members):

Point.position, Track_circuit.state

• Commands (classes methods):

Point.move()

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Safety Logic implementation

Safety Logic developed in a high-level proprietary language

• Conditional statements
• Assignments
• Exceptions
• No pointers
• No dynamic memory allocation
• Restricted use of error-prone statements

Safety Logic compiled in a symbolic language ready to be interpreted by the Logic Handler Process

• Reflects the strict separation between invariant and

variant parts of the product

• All
• bjects

and their relationships are statically instantiated, therefore they can be analyzed offline

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

From Safety Logic to System Data

Requirements, design and implementation of Safety Logic are abstract (generic application) Systems are configured (specific applications) Databases to be instantiated for:

• entities
• attributes
• linked entities

Ansaldo Segnalamento Ferroviario

• 1. Ansaldo signalling systems – Overview

Configuration example

Entities: PT.01, PT.03, … TC.110, TC.111, … Attributes: PT.01 is Oleodynamic, PT.07 is Electromechanic Linked entities: PT.01 → TC.161, …

Ansaldo Segnalamento Ferroviario

• 2. V&V activities

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Overview

V&V activities

Generic Product:

• Hardware testing
• Kernel Software testing

Generic and Specific Application:

• Code inspection of Safety Logic code
• Coverage analysis
• Independent generation of System Data
• Automatic and manual testing in simulated environment
• Field testing on target system

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Code inspection

Code inspection

Automatic analysis provides:

• Context diagrams
• Used vs not used variables
• Used vs not used attributes and linked entities

Manual analysis focuses on:

• UML modelling of safety logic code
• Check lists for good programming style
• Functional analysis, search for critical complex scenarios

Tools under development for:

• Automatic UML modelling of safety logic code through its

translation in C++ or Java, thus allowing off-the-shelf environments to be positively used

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Code inspection

Coverage analysis

Performed after the completion of automatic and manual test sets Focuses on either Code or Data Automatic analysis provides:

• Coverage statistics
• Reports and databases

Manual analysis focuses on:

• Non covered branches, attributes and linked entities
• Feedback to test specifications

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Code inspection

Tools for Coverage analysis

Entities Commands Safety Logic code Statistics

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Independent generation of System Data

Independent generation of System Data

Aims at verifying the correctness and completeness of System Data

• Independent generation of:
• entities
• attributes
• linked entities

according to the design model of Safety Logic

• Comparison

with System Data produced by the Development Team

• Evaluation of differences

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Independent generation of System Data

Independent generation of System Data

Design model

• f Safety Logic

Configuration Rules (Development)

System Data

Scheme Scheme

CT SP Ansaldo Proprietary Query Processor Query Processor Off-the-shelf (Microsoft Access)

=

Configuration Rules (V&V)

System Data

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Typologies of tests

Functional tests: all functional requirements are correctly implemented by Safety Logic code

• Scope: generic application

Configuration tests: all System Data required by the Safety Logic are correctly configured, and no spurious data are present

• Scope: specific application

Stress tests: critical functions of the system are stressed introducing a set of random inputs

• Scope: both generic and specific application (in particular

RBC)

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Functional tests

A Test Case is specified for each Safety Logic requirement, according to a black-box approach Abstract Test Scripts are implemented

• Level of abstraction ≡ classes of equivalence

Test Scripts are executed in a fully or partially simulated environment Both positive and negative results are analysed, leading to Code Coverage Analysis

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Configuration tests

A Test Case can be defined:

• for each attribute and for each linked entity, according to a

white-box approach based on the Safety Logic design model

• for each relationship among data, according to a black-

box approach based on System Data requirements Abstract Test Scripts are implemented

• Level of abstraction ≡ entity

Test Scripts are executed in a fully or partially simulated environment Both positive and negative results are analysed, leading to Data Coverage Analysis

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Stress tests

Identification of a set of critical functions with references both to safety and complexity issues System stressed with a set of random inputs System behaviour analysed searching for:

• compliance with pre-defined properties of state variables
• unforeseen evolutions of state variables

based on Chronological Events Recording (RCE) Suitable for reactive systems such as RBC

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Testing approach and development

The white-box approach requires a detailed knowledge of the Safety Logic

• Applied to Italian ACC interlocking

The black-box approach is independent from the system implementation

• Applied to projects developed incrementally, such as UK

ACC interlocking and RBC Tools under development for:

• Specifying black-box test cases with UML class and

sequence diagrams

• Automatic generations of test scripts from UML model

Ansaldo Segnalamento Ferroviario

Signaller Tester CIU CIU Simulator Station Station Simulator

• 2. V&V activities – Typologies of tests

Simulated Testing Environment (ACC)

Peripheral Posts ART1 ART2 Peripheral Posts Simulator

Ansaldo Segnalamento Ferroviario

Train Adjacent RBCs

• 2. V&V activities – Typologies of tests

Simulated Testing Environment (RBC)

CIU Operator ART1 ART2 Interlocking RBC Simulator IXL Simulator Tester CIU Simulator Communication computer Protocol stack Train Simulator

Ansaldo Segnalamento Ferroviario

• 2. V&V activities – Typologies of tests

Field testing on target system

Functional tests which cannot be completed in a simulated environment, e.g.

• Integration with adjacent systems
• Interfacing with target field devices
• Diagnostic issues and fault tolerance

Tests on the correct set-up of field devices (track circuits, point machines, signal heads) and peripheral posts Tests with real trains

Ansaldo Segnalamento Ferroviario

• 3. Conclusions

Ansaldo Segnalamento Ferroviario

• 3. Conclusions – Software Problem Report

Management of non-compliances

Production of Software Problem Reports (SPR)

• Causes
• Safety issues
• Impacts

Problem Resolution by the Development Team New V&V cycle

• Evaluation of the impact of changes
• Regression tests
• SPR closure (if possible)
• New SPR production (if any)

Ansaldo Segnalamento Ferroviario

Thank you for your kind attention