Dependability in open proof software with hardware virtualization—The railway control systems perspective

Safety is a concerned point in today’s railway control system. Historical evidence on railway control system failure makes a matter of concern on safe control system. In this paper, we present a use/misuse case based safety framework for a railway control system with integrated safety analysis. The framework comprises of two major processes i.e. use/misuse case based requirements modelling and application of integrated safety analysis techniques. First, the use case and misuse case specification analyze all the system function and identify possible failures. Second, integrated safety analysis techniques evaluate the specification, identify hazards and propose the mitigations. This paper analyses the railway control system reliability using Unified Modeling Language (UML) and followed by integrated safety analysis techniques such as Hazard and Operability Study (HAZOP) and Fault Tree Analysis (FTA). This approach has been systematically applied to study two different domain in system reliability and system control based on human interaction. We demonstrate how an applicability of UML specification is integrated with safety analysis techniques for the development of safe railway control system.

Requirements-based testing is one of the most commonly used ways to ensure the correctness of software, especially for embedded control software in safety-critical domains such as spacecraft and railway systems. Many industrial standards such as the DO-333 and EN50128 also request rigorous requirements-based software testing. To test embedded control software effectively and efficiently, generating high-quality test cases automatically is extremely important. However, existing methods for generating test cases from requirements require intensive manual efforts and expertise. To address this problem, we proposed an automatic requirements-based software testing method for embedded control software. To obtain automatic test case generation and precise test oracles derivation, requirements specification should be precise and readable for the industrial practitioners. Therefore, we use the light-weight domain-specific formal description language, CASDL (Casco Accurate Specification Description Language) for the industrial practitioners to define software requirements into formal specifications at the first step. Based on the formal specification, we propose an algorithm to automatically generate test inputs that satisfy the MC/DC criteria suggested by typical industrial standards and precise test oracles can be derived by "running" the specification with such test inputs. To this end, we proposed an algorithm for simulating the formal specification to generate the test oracles, i.e., the expected outputs corresponding to the test inputs. To facilitate the application of this method in the industry, we have built a tool that can automatically perform the overall testing process. To validate and evaluate its effectiveness in real industrial projects, we have applied it in testing a real Automatic Train Protection (ATP) system provided by our industrial partner, the Casco Signal Co., Ltd (one of the largest railway control system companies in China). In the case study on ATP requirements, our approach generated test cases for 129 requirement items following MC/DC criteria and caught 40 inconsistencies between Casco's requirements and implementation.

Railway control systems are based on on-board and trackside subsystems for signaling purposes. Several factors demand for new design and implementation solutions for such railway control systems. These factors are related to the design of interoperable railway networks in Europe, the introduction of new technologies and equipment, and the competition in the market of railway products. The safety of such new design and implementation solutions should still be proved in accordance with the CENELEC recommendations. SFDA, safe message freshness detection algorithm among trackside subsystems, is deeply described. SFDA is included in a new message passing safety protocol stack and it allows the detection of messages and the meeting of real time and safety requirements of trackside railway systems. It is demonstrated that the SFDA can detect all the old messages. Moreover a preliminary analysis of its availability characteristics to check whether it is suitable for railways systems is performed through simulation.

The article presents the issue of digital standard interfaces of railway traffic control systems. The digitization and standardization of interfaces are digital rail elements, an essential feature of integrating various devices, facilities, and processes in one coherent system. The authors described the problems of connecting computer systems, starting from the interface's definition, including technical and functional aspects. Examples of interface types selected problems resulting from connecting incompatible devices and attempts to solve them are presented. It then provides background information on the project to develop a digital interface standard for selected rail traffic control systems. The project described in this article, under the name of "Standardization of selected interfaces of railway traffic control equipment and systems" POIR.04.01.01-00-0005/17, has been created as part of the BRIK (Research and Development in Railway Infrastructure) program and has been cofinanced both by the NCBiR (The National Centre for Research and Development), as well as the PKP Polskie Linie Kolejowe S.A. (PKP PLK - Polish State Railways). The project's goal is to develop, through research, specifications, and requirements for interfaces used in railway traffic control systems, which will become a standard enabling linking of systems from different manufacturers. The project results will be dedicated to using on the railway network managed by PKP PLK (and potentially also by other infrastructure managers) and documentation containing descriptions of standards, guidelines for the application and design of these interfaces.

The major trends characterising the development of e-business platforms include increasing the performance-to-price ratio of hardware components (e.g., servers and chips), as well as the declining costs of operating systems and middleware software as organisations switch from expensive proprietary software (e.g., Microsoft Windows) to open source software (e.g., Linux). The unique origins of Linux and open source software require the adoption of new business models to allow key players to sustain themselves long-term. Using a historical review of the open software movement and a value chain analysis for the open software industry, we examine, using primary data from interviews, the business models of five Linux players (Red Hat, Novell, Navica, Open Country and SohoLaunch). Case analyses enable us to identify four open source business models that should be sustainable in the long run.

Runtime verification of train control systems with parameterized modal live sequence charts

Model driven engineering is widely used in the development of complex and safety critical systems. Systems’ designs are specified and validated in domain specific modeling languages and software code is often produced by autocoding. Thus the correctness of the final systems depend on the correctness of those tools. We propose an approach for the formal verification of code generation from dataflow languages, such as Simulink, based on translation validation. It relies on the BlockLibrary DSL for the formal specification and verification of the structure, semantics and variability of the complex block libraries found in these languages. These specifications are then used here for deriving model and block-specific semantic contracts that will be woven into the generated C code. We present two different approaches for performing the block matching and weaving step. Finally, we rely on the Frama-C toolset and state-of-the-art SMT solvers for verifying the annotated code.

This book is a practical guide for the development and qualification of safety-critical systems, standards compliance, and use of formal methods and tools.

Basically, aircraft engines can be divided into a control embedded system and a controlled system with its environment. The behaviour of the controlled system is given a priori, while the control system still needs to be designed in a way guaranteeing the correct overall behaviour under all operational conditions depending on the flight domain. A large quantity of functions in control systems can be described by a formal system expressed in block diagrams and state-based representations. These representations can be translated to formal based tools relying on the synchronous languages Signal and Statecharts. SACRES is a tool set supporting the design of safety-critical embedded control systems. It integrates the tools and specification techniques Statemate, Sildex, and Timing Diagrams with tool components for automatic code generation, formal verification based on model checking techniques, and an innovative approach for automatic code validation for target code generated from DC+. Technical achievements are The main benefits of the SACRES approach are reduced risks for design errors and decreased design times and costs for the development of dependable (safety critical) embedded systems. SACRES is an attempt to avoid unpredictability (particularly that arising from late feedback from testing) associated with development of safety critical systems, through the use of the maximum degree of automation, especially in respect of code generation and verification. An outstanding property of SACRES is the combination of specification styles and specification tools being applied in practice with automatic tools to establish provable correctness with respect to required properties. Both dependability and productivity are increased by automatic code generation from high-level specifications such that the generated code can be validated against higher levels by rigorous proofs. These techniques allow traditional tests by sampling to be replaced by rigorous checking techniques which correspond to 100% coverage of test cases. In order to address a global innovative approach in the near future which match the whole software configuration, the SACRES tool set should be interfaced with asynchronous techniques matching the operating system development. This raises an open question in the software development future new process.

This paper provides a novel method of identifying a set of design faults in Simulink\TargetLink models and production code generation well before generating the test cases. These models can be used for development of safety critical systems. We have developed stand-alone application which transforms TargetLink model to EA compatible UML (Unified Modeling Language) model represented as packages and composite structure diagrams. The entire process makes use of dSPACE and MathWorks tools.

With the rapid development of technology and advance of society, requirements for China railway control and management (CRCM) system have already reached a higher degree. Railway needs to improve its own competition ability by means of technical innovation, improvement of management and perfect service. Constituted by a series of subsystems, CRCM system is unwieldy and very complex. At present, these subsystems are independent each other and can not share information with each other efficiently, which affect the improvement of the CRCM system's efficiency, so it becomes very important to integrate these subsystems so as to improve railway's level of management and quality of service. This paper analyzes some technical problems that the integration CRCM system faced and present solutions for these problems, and put forward a heterogeneous system Qos communication solution based on structure of issue and order.

Software engineering has devised several project management metrics to optimize implementation and obtain a product with high efficiency, at less time and cost. Inventors faced many challenges to find measurements that able to anticipate accurate results that help avoid errors and risks in the advanced stages of the project. The systems most affected by any errors during the development process are Safety-Critical systems (SCS), as 60% of failures during operation are due to errors during development. This paper proposes a metric that uses weight and milestones to predict implementation in advanced stages of a project. The proposed metric is called Weighted Test Metric (WTM). WTM enhance the reliability assessment and reduce failures during project development by predicting Standards Achievement (SA) in the next test. WTM results showed that faults can be reduced during the development of a petroleum drilling project to 0.67% and enhance the overall reliability to 99.16% while actual results (98.30%). This paper focuses on “How to enhance reliability assessment and reduce failures during project development activities?”. This research raises the question through the application of WTM in the stages of development of the Petroleum Drilling Project.KeywordsSafety-Critical System (SCS)Safety-Critical System Development (SCSD)Area: software project management metricsDevelopment metrics

The article presents examples of transport applications in which simulation experimental research is of great importance and particularly useful. The first part presents examples of important railway transport areas where computer simulations have been used. In the second part of the study, more reference is made to the study of the exploitation process of railway traffic control devices using a so-called simulation experiment. As railway control systems are complex systems, it is practically impossible to carry out direct studies or carry out diagnostics without disconnecting a component from the complete system. This is when simulation research becomes helpful. In the simulation of the exploitation process, the initially known theoretical cumulative distribution functions of times between failures and times of repair of the objects distinguished in the model of the railway control system and the distributions of the number of their failures were assumed. The exploitation and reliability parameters of these objects were then determined based on real data, using statistical analysis and on the basis of simulations of future exploitation states of this system. A parametric and non-parametric verification of empirical distributions of reliability parameters determined for selected system components was also carried out.

Batteryless embedded devices rely only on ambient energy harvesting that enables stand-alone and sustainable applications for the Internet of Things. These devices perform computation, sensing, and communication when the harvested ambient energy in their energy reservoir is sufficient; they die abruptly when the energy drains out completely. This kind of operation, the so-called intermittent execution, dictates a task-based programming model for the development and implementation of intermittent applications. However, today's task-based intermittent programs are tightly-coupled to the underlying run-time environments. This makes their debugging and testing difficult before deploying them into the target platform. To remedy this, we present Taskify, a tool that enables engineers to write and debug task-based intermittent programs in TaskDSL, i.e., a domain-specific language we designed for the development of intermittent programs on any general-purpose computer. Taskify automatically transforms these programs into C programs that can be linked to the underlying run-time environment and deployed into the target platform. Taskify is implemented as an Eclipse plugin. It has been evaluated on three intermittent applications.

Condition monitoring or safety monitor is a cost-effective safety protection technique which is widely used in safety-critical industries, such as nuclear plants and aerospace operation. The adoption of safety monitor offers continuous or real-time safety protection at a high level of diversity and its implementation is relatively simple and thus cost-effective for safety verification and validation. In practice, the safety monitors are practical to improve the overall system safety because: 1) Safety monitors are generally small and do not normally have complex algorithms; 2) Safety monitors normally involve checking the essential safety features/properties of the large safety-critical railway systems during their operations; 3) Safety monitors are often independent of existing systems. It can be taken as an add-on safety feature and it is physically and functionally separated from the existing systems, which boosts the reliability of the system. In general, the safety monitors of safety-critical railway systems must achieve the same level or higher level of the integrity and safety required by the monitored systems. Formal method approach provides a traceable and accountable approach to understand, plan and manage safety of safety-critical railway systems, and is an effective technique to improve the overall system safety and reliability. Safety monitors normally have many safety properties in logic condition forms need to be satisfied, and it is the domain that formal methods are good at and should be applied to. This paper discusses a development process to utilise the formal methods to improve the safety and quality of safety critical railway systems. A simple example on railway signalling is then given to demonstrate the application of formal methods in safety-critical transport system.