What’s the point of formal methods?

Railway signaling systems are surprisingly expensive to produce. Why did this happen?

In the early days of railway history, there were no interlocking systems. It was considered enough to have personnel at the train stations manually observing trains and operating signals. The need for automatic signaling eventually became evident: human beings tend to make mistakes, which can lead to serious accidents, and the capacity of railroads was reduced by all manual procedures.

The drawbacks of automatic signaling were however obvious: huge investments were needed, and although automatic systems were not as error-prone as manual processes, reliance on automatic systems led to potentially even more dangerous errors. Therefore, the construction of automatic signaling systems had to be extremely safety-conscious.

A tradition of strict development processes with thorough reviewing was introduced, requiring even reviews of the reviewing process, thus resulting in the production of an enormous amount of documents. Needless to say, this made automatic signaling even more expensive and hard to maintain. But there seemed to be no alternative.

Formal methods have however emerged as a way to cut costs and increase safety at the same time. Huge amounts of requirements can be maintained and automatically checked using formal methods.

Interested in how formal methods are revolutionizing railway signaling? Read our in-depth article for more insights: Formal Methods in Software Development for Rail Control Systems