Formal methods for railway interlocking

In the early days of railway history there were no interlocking systems. It was considered enough to have personnel at the train stations manually observing trains and operating signals. The need for automatic signalling eventually became evident: human beings tend to make mistakes, which can lead to serious accidents, and the capacity of railroads was reduced by all manual procedures.

The drawback of automatic signalling were however obvious: huge investments were needed, and although automatic systems were not as error–prone as manual processes, reliance on automatic systems led to potentially even more dangerous errors. Therefore, the construction of automatic signalling systems has to be extremely safety conscious.

Today however, there are proof engines that can formally verify the safety requirements for a railway interlocking system in a few minutes using an average laptop computer. Time-consuming and incomplete safety testing can be replaced by mathematical proofs that, for a fraction of the previous cost, can provide 100 percent coverage. This approach requires good quality of the specifications. They must be formalized in a mathematically precise formal language, so that proof engines understand exactly what they are supposed to prove.

In the article ‘Formal Methods for signaling interlockings’, Pete Duggan, chief engineer at Siemens Rail Automation, writes about how Siemens in partnership with Prover Technology, have used Formal methods and ‘Formal Proof of Program’ in different infrastructures in order to reduced engineering effort and duration for system delivery.

You can read the whole article here.