Supporting Railway Infrastructure Managers with Formal Models … · 2020-04-08 · 45 ERTMS HL3 SPECIFICATION VQ1: Does the specification guarantee that EEIG ERTMS Users Group 123-133

Supporting Railway Infrastructure Managers with Formal Models and Analyses

Bas Luttik

Based on joint work with many people (to be mentioned later!)

AlgoUK/BCTCS, April 6, 2020

2

INTRODUCTION

European collaboration

Standardisation

3

RAILWAY SAFETY SYSTEMS

point

INTERLOCKING

free

occupied

level crossing block/section

train detection

signal

4

1. An application of FM in the development of EULYNX

a) EULYNX, FormaSig (general ideas)b) First case study: Pointc) Next steps

2. An application of FM in the development of ERTMS-HL3

a) Principles of ERTMS Hybrid level 3b) Formal analysisc) Next steps

PLAN FOR THIS PRESENTATION

Collaboration with:

Mark Bouwman, Djurre van der Wal

Jaco van de Pol, Arend Rensink, Marielle Stoelinga

5

LEGACY SIGNALLING SYSTEMS

INTERLOCKING

Monolithic inflexible

architecture

Expensivespecial

hardware

VENDOR LOCK-IN

Many different

installations

6

INTERLOCKING

STANDARDISE ARCHITECTURE

electronic → digital

fibreglass network with IP-like protocol

object controller

13 European inframanagers

standardised interface

ERTMS readyVENDOR LOCK-IN

7

QUALITY OF STANDARD IS CRUCIAL

Obviously:

1. Standard should be clear and unambiguous

2. Standard should be complete

3. Standard should guarantee correct system behaviour

4. Compliance to standard should be thoroughly tested

BUT HOW TO ACHIEVE THIS FOR EULYNX?

OBVIOUSLY:

8

• Growing interest in formal methods.

• Funded two 4-year PhD projects to investigate the application of formal methods in their context.

• PhD students spend considerable time at Railway Infrastructure manager’s premises.

FORMASIG PROJECT

9

FORMASIG PROJECT

Standardisedinterface spec

formalmodel

Delivered component

Formal Analysis

Compliance verdict

Model-based Testing

Adapterstimuli

observations

IMPROVE QUALITY OF STANDARD

TEST COMPLIANCE TO STANDARD

10

formalmodel

FORMASIG PROJECT


Delivered component

Formal Analysis

Model-based Testing

Adapterstimuli

observations



Compliance verdict

11

Simple, but expressive, process-algebra based modelling language• Rich data language (sets, lists, functions, integers, …)• Parallel composition of (recursively defined) sequential processes

Analysis• Simulation• Model checking

§ First-order extension of the modal µ-calculus§ Extensive counterexample facility

§ Behavioural equivalence checking§ Connection to model-based test tool JTorX

https://www.mcrl2.org

12

FORMASIG PROJECT

Delivered component

Formal Analysis

Model-based Testing

Adapterstimuli

observations




Compliance verdict

14

FORMASIG PROJECT

Delivered component

Formal Analysis

Model-based Testing

Adapterstimuli

observations

Automatic Translation



Compliance verdict

15

FIRST CASE STUDY: POINT



FORMASIG PROJECT

Delivered component

Formal Analysis

Model-based Testing

Adapterstimuli

observations


Manual

SysMLsimulator

Input from railway engineers needed

Compliance verdict

16

FIRST CASE STUDY: POINT



FORMASIG PROJECT

Delivered component

Formal Analysis

Model-based Testing

Adapterstimuli

observations


Manual

SysMLsimulator

Input from railway engineers needed

Verification results:

• 9 properties checked

• 1 false (deadlock due to overflowing buffer)

• (Interpretation) of SysML models under discussion with DB

Test results:

• Offline testing → generated 82 tests

• All tests passed (24/82 ended prematurely)

Compliance verdict

17

FORMASIG: NEXT STEPS

Point case study showed that FormaSig principle works

Next steps:

• Automate translation SysML→mCRL2Ø Semantics?

• Analyse correctness other object controllersØ Requirements?

• Online model-based testing, coverage-based testing

• Test mutants, test real component

18

1. An application of FM in the development of EULYNX

a) EULYNX, FormaSig (general ideas)b) First case study: Pointc) Next steps

2. An application of FM in the development of ERTMS-HL3

a) Principles of ERTMS Hybrid level 3b) Formal analysisc) Next steps

PLAN FOR THIS PRESENTATION

Collaboration with:

Maarten BartholomeusRick Erkens

Tim Willemse

38

ERTMS/ETCS

TTD 10 TTD 20 TTD 30

free

occupied

L2 L3

3 12

ERTMS LEVEL 3: ELIMINATE TRACKSIDE EQUIPMENT

123

L2 L3

L2 L3

ERTMS LEVEL 3

123

L3

ERTMS LEVEL 3

123

L3 promises considerable cost reduction and capacity increase

SERIOUS DRAWBACKS:• All trains must have TIM• Not very tolerant for radio connection problems

ERTMS Hybrid Level 3

Train Integrity Monitoring

42

ERTMS HYBRID LEVEL 3

VSS 11 VSS 12 VSS 21 VSS 22 VSS 31VSS 23 VSS 32 VSS 33


free

occupied

Main ideas:• Partition TTDs into Virtual Sub-Sections (VSSs)• Multiple TIM-equipped trains can be on

different VSSs of same TTD

12

43

ERTMS HYBRID LEVEL 3



free

occupied

Main ideas:• Trackside maintain info on VSS status, based on

regular train reports and TTD information• Movement authorities issued based on VSS status

12

44

ERTMS HL3 SPECIFICATION

EEIG ERTMS Users Group 123-133 Rue Froissart, 1040 Brussels, Belgium Tel: +32 (0)2 673.99.33 - TVA BE0455.935.830 Website: www.ertms.be E-mail: [email protected]

16E042 1A 14/07/2017

Hybrid ERTMS/ETCS Level 3 Page 1/48

Principles

Hybrid ERTMS/ETCS Level 3

Ref: Version: Date:

16E042 1A 14/07/2017

Purpose of the specification is:

• to describe how the trackside system should determine the status of each individual VSS (based observed events)…

• …such that safe movement authorities can be issued…

• …without unnecessarily restricting implementation freedom.

45


EEIG ERTMS Users Group 123-133 Rue Froissart, 1040 Brussels, Belgium Tel: +32 (0)2 673.99.33 - TVA BE0455.935.830 Website: www.ertms.be E-mail: [email protected]

16E042 1A 14/07/2017

Hybrid ERTMS/ETCS Level 3 Page 1/48

Principles

Hybrid ERTMS/ETCS Level 3

Ref: Version: Date:

16E042 1A 14/07/2017

Purpose of the specification is:

• to describe how the trackside system should determine the status of each individual VSS (based observed events)…

• …such that safe movement authorities can be issued…

• …without unnecessarily restricting implementation freedom.

VQ1: Does the specification guarantee that issued movement authorities are safe?

(no collisions)

VQ 2: Does it matter how the specification is implemented?(robustness of specification)

46


47

• Relevant data is easily modelled using mCRL2’s data language

• Transition conditions can then be modelled as predicates.


48

TRAIN

TRACKSIDE SYSTEM

ERTMS HL3 BEHAVIOUR



free

occupied

12

ambiguous

unknown

lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�

<latexit sha1_base64="BVFpiLmrFrVQbKaVm20xWPA0leM=">AAASE3icvVfdjttEFE5LgRIWaOCSmxGril3JCbGT7G6BlNLSlgq1XQppK8XRajIex0PssTUz2eyu8WPwADwHNwghcYUEl7wFj8AZO3HsJLRoS+PVJuMz55v5zs+czBlGPpOq2fzrwsVXLr362uuX36i+ufXW2+9cqb37WIYTQWiPhH4ong6xpD7jtKeY8unTSFAcDH36ZDi+peefHFMhWci/VacRHQR4xJnLCFYgOqptfWxzOiVhEGDuxPadR7dvJ7Gt6ImSbpy+2ScywoQm1ZLiw1u3eof3bn+xUM4l6wG9B189ePjkwUJ/Lliv/vn9m/fu9h72vlkAFqIcUsbcP31EicJ85NOk3x7EVdsReIp2tlu7SMxn4LW9+0nVdkNwE/GQzRhiPG4aptFoNIxtMwFcNHIDrDxJVYCJCGM7CiUQYewjmIdpmMuWrdf1d/17WBORMBQO41jRPqh3NWaws20dQayUB1i9a4pMKdTrzwVSLFWGu5oDM4gG/yfgnGobYHO6zwDyUJSplpGtf0dO6XzLBP7sIR2BUxUbn0WMqImAgPDQociBjMac0O4BDQYQPZD1dZAM6eGIdvMoGQHjLJgEaMoc5XX3aZBLPMpGnuq2YAG0M+FjHk75LlpJqwRMKCREbDaTeKadDxppaJDmvpClPkDahXqJF2NoCD1CodudrW6cSI+5KjUf7cAxZaNJOJEF/ossX2dBjigMS1YspP+rHUPqh9OCHUDeFZQWeKe1Yh1lrZd9loimgpfja7102dEhIZOIUafANy9X6zjP9RejEvdcWOKflZv+9a5UFPvK+3CArqK0AimPIiUwl0wXXVlFmfey42btIuqMaL9+fYBSD2TGEyYIWA61iVOBJI26zUgZaGY3LJH5wgTDkct8vzv1mKIGHC4vFF1CuaJiAOZKIlikJDujyEzyA5MVJWtXUymJ2udhcw4u7aTog/ZutchEO7SzISKdpHAO0zLWSb1Slp0rSOcJUTMpu8HKPLNgs9EomTpl5tmehwoty/Y2ROcgWfHEXuafnE8WwM3Q2ZvncJav+bHWrwcb4mAlS8YfrB6l/ZfFxdBXgGbD7CynjbWSNq3dlTC1Nk1rf7n+7We+yoO2cUat1YRurak+Gw/gtVJ11m6qwq8khUt28Up3dGW72WimD1odmLPB9md/V9Ln8Kh26WfbCckkgM2Jj6Xsm8B4EGOhGFgC98YJWIHJGIOxMOQ4oHIQp11Ogq6CxEFwb4d/rlAqLSLg7iPlaTAEzfTyvjynhevm+hPlHgxixqOJopxkG7kTH6kQ6ZYJLq36JuKfwgC6AfgNJ4h4WGACHpTV0jbaPUlZMj6rjwSOvEysFXw2FFicgtkinEoj+2oEVGHoaEpgCXeGlHbVng9LCnCprmvhINYukRElWlN3LYxrSXz/VDDsoEMR6mbJoS60ianjYkx0CiTxo7s3k7hlGnsdw2zuJeuUrJmW1YIuqdk2Wgdr1Xx9/5qpmtdahmVahtVqLekqMclGM81rsO+eaXQ6S3ou9mVJsbh7yUlZKvNQLfeDTB5jH9o2yiWkq/ZTbOtPQf3YDnVXTNVMEsRaNYm79nch46DQTeBZWo8/c8Gcxnzj1QVG4hn4MYDrDYue2AFzZm8deDsH0bH/IoYX9l4wAV6r+2DfT/rmoH8yWN0L+5GHY91mg9ZRDH2zxi/F53loegL9oszRpdRn3CcBJD3kvo9HDhXsOD0+xR2OzxzmukueGMICEqqPt8znjk65dW4L4mwKAFDzzOUKtzp4bDVMKKtfW9s3Ps2KX+Vy5f3KB5WdilnZr9yofFk5rPQqZOvHrd+2/tj6s/ZD7afaL7VfM9WLF2aY9yqlp/b7PyV8d3U=</latexit><latexit sha1_base64="BVFpiLmrFrVQbKaVm20xWPA0leM=">AAASE3icvVfdjttEFE5LgRIWaOCSmxGril3JCbGT7G6BlNLSlgq1XQppK8XRajIex0PssTUz2eyu8WPwADwHNwghcYUEl7wFj8AZO3HsJLRoS+PVJuMz55v5zs+czBlGPpOq2fzrwsVXLr362uuX36i+ufXW2+9cqb37WIYTQWiPhH4ong6xpD7jtKeY8unTSFAcDH36ZDi+peefHFMhWci/VacRHQR4xJnLCFYgOqptfWxzOiVhEGDuxPadR7dvJ7Gt6ImSbpy+2ScywoQm1ZLiw1u3eof3bn+xUM4l6wG9B189ePjkwUJ/Lliv/vn9m/fu9h72vlkAFqIcUsbcP31EicJ85NOk3x7EVdsReIp2tlu7SMxn4LW9+0nVdkNwE/GQzRhiPG4aptFoNIxtMwFcNHIDrDxJVYCJCGM7CiUQYewjmIdpmMuWrdf1d/17WBORMBQO41jRPqh3NWaws20dQayUB1i9a4pMKdTrzwVSLFWGu5oDM4gG/yfgnGobYHO6zwDyUJSplpGtf0dO6XzLBP7sIR2BUxUbn0WMqImAgPDQociBjMac0O4BDQYQPZD1dZAM6eGIdvMoGQHjLJgEaMoc5XX3aZBLPMpGnuq2YAG0M+FjHk75LlpJqwRMKCREbDaTeKadDxppaJDmvpClPkDahXqJF2NoCD1CodudrW6cSI+5KjUf7cAxZaNJOJEF/ossX2dBjigMS1YspP+rHUPqh9OCHUDeFZQWeKe1Yh1lrZd9loimgpfja7102dEhIZOIUafANy9X6zjP9RejEvdcWOKflZv+9a5UFPvK+3CArqK0AimPIiUwl0wXXVlFmfey42btIuqMaL9+fYBSD2TGEyYIWA61iVOBJI26zUgZaGY3LJH5wgTDkct8vzv1mKIGHC4vFF1CuaJiAOZKIlikJDujyEzyA5MVJWtXUymJ2udhcw4u7aTog/ZutchEO7SzISKdpHAO0zLWSb1Slp0rSOcJUTMpu8HKPLNgs9EomTpl5tmehwoty/Y2ROcgWfHEXuafnE8WwM3Q2ZvncJav+bHWrwcb4mAlS8YfrB6l/ZfFxdBXgGbD7CynjbWSNq3dlTC1Nk1rf7n+7We+yoO2cUat1YRurak+Gw/gtVJ11m6qwq8khUt28Up3dGW72WimD1odmLPB9md/V9Ln8Kh26WfbCckkgM2Jj6Xsm8B4EGOhGFgC98YJWIHJGIOxMOQ4oHIQp11Ogq6CxEFwb4d/rlAqLSLg7iPlaTAEzfTyvjynhevm+hPlHgxixqOJopxkG7kTH6kQ6ZYJLq36JuKfwgC6AfgNJ4h4WGACHpTV0jbaPUlZMj6rjwSOvEysFXw2FFicgtkinEoj+2oEVGHoaEpgCXeGlHbVng9LCnCprmvhINYukRElWlN3LYxrSXz/VDDsoEMR6mbJoS60ianjYkx0CiTxo7s3k7hlGnsdw2zuJeuUrJmW1YIuqdk2Wgdr1Xx9/5qpmtdahmVahtVqLekqMclGM81rsO+eaXQ6S3ou9mVJsbh7yUlZKvNQLfeDTB5jH9o2yiWkq/ZTbOtPQf3YDnVXTNVMEsRaNYm79nch46DQTeBZWo8/c8Gcxnzj1QVG4hn4MYDrDYue2AFzZm8deDsH0bH/IoYX9l4wAV6r+2DfT/rmoH8yWN0L+5GHY91mg9ZRDH2zxi/F53loegL9oszRpdRn3CcBJD3kvo9HDhXsOD0+xR2OzxzmukueGMICEqqPt8znjk65dW4L4mwKAFDzzOUKtzp4bDVMKKtfW9s3Ps2KX+Vy5f3KB5WdilnZr9yofFk5rPQqZOvHrd+2/tj6s/ZD7afaL7VfM9WLF2aY9yqlp/b7PyV8d3U=</latexit><latexit sha1_base64="BVFpiLmrFrVQbKaVm20xWPA0leM=">AAASE3icvVfdjttEFE5LgRIWaOCSmxGril3JCbGT7G6BlNLSlgq1XQppK8XRajIex0PssTUz2eyu8WPwADwHNwghcYUEl7wFj8AZO3HsJLRoS+PVJuMz55v5zs+czBlGPpOq2fzrwsVXLr362uuX36i+ufXW2+9cqb37WIYTQWiPhH4ong6xpD7jtKeY8unTSFAcDH36ZDi+peefHFMhWci/VacRHQR4xJnLCFYgOqptfWxzOiVhEGDuxPadR7dvJ7Gt6ImSbpy+2ScywoQm1ZLiw1u3eof3bn+xUM4l6wG9B189ePjkwUJ/Lliv/vn9m/fu9h72vlkAFqIcUsbcP31EicJ85NOk3x7EVdsReIp2tlu7SMxn4LW9+0nVdkNwE/GQzRhiPG4aptFoNIxtMwFcNHIDrDxJVYCJCGM7CiUQYewjmIdpmMuWrdf1d/17WBORMBQO41jRPqh3NWaws20dQayUB1i9a4pMKdTrzwVSLFWGu5oDM4gG/yfgnGobYHO6zwDyUJSplpGtf0dO6XzLBP7sIR2BUxUbn0WMqImAgPDQociBjMac0O4BDQYQPZD1dZAM6eGIdvMoGQHjLJgEaMoc5XX3aZBLPMpGnuq2YAG0M+FjHk75LlpJqwRMKCREbDaTeKadDxppaJDmvpClPkDahXqJF2NoCD1CodudrW6cSI+5KjUf7cAxZaNJOJEF/ossX2dBjigMS1YspP+rHUPqh9OCHUDeFZQWeKe1Yh1lrZd9loimgpfja7102dEhIZOIUafANy9X6zjP9RejEvdcWOKflZv+9a5UFPvK+3CArqK0AimPIiUwl0wXXVlFmfey42btIuqMaL9+fYBSD2TGEyYIWA61iVOBJI26zUgZaGY3LJH5wgTDkct8vzv1mKIGHC4vFF1CuaJiAOZKIlikJDujyEzyA5MVJWtXUymJ2udhcw4u7aTog/ZutchEO7SzISKdpHAO0zLWSb1Slp0rSOcJUTMpu8HKPLNgs9EomTpl5tmehwoty/Y2ROcgWfHEXuafnE8WwM3Q2ZvncJav+bHWrwcb4mAlS8YfrB6l/ZfFxdBXgGbD7CynjbWSNq3dlTC1Nk1rf7n+7We+yoO2cUat1YRurak+Gw/gtVJ11m6qwq8khUt28Up3dGW72WimD1odmLPB9md/V9Ln8Kh26WfbCckkgM2Jj6Xsm8B4EGOhGFgC98YJWIHJGIOxMOQ4oHIQp11Ogq6CxEFwb4d/rlAqLSLg7iPlaTAEzfTyvjynhevm+hPlHgxixqOJopxkG7kTH6kQ6ZYJLq36JuKfwgC6AfgNJ4h4WGACHpTV0jbaPUlZMj6rjwSOvEysFXw2FFicgtkinEoj+2oEVGHoaEpgCXeGlHbVng9LCnCprmvhINYukRElWlN3LYxrSXz/VDDsoEMR6mbJoS60ianjYkx0CiTxo7s3k7hlGnsdw2zuJeuUrJmW1YIuqdk2Wgdr1Xx9/5qpmtdahmVahtVqLekqMclGM81rsO+eaXQ6S3ou9mVJsbh7yUlZKvNQLfeDTB5jH9o2yiWkq/ZTbOtPQf3YDnVXTNVMEsRaNYm79nch46DQTeBZWo8/c8Gcxnzj1QVG4hn4MYDrDYue2AFzZm8deDsH0bH/IoYX9l4wAV6r+2DfT/rmoH8yWN0L+5GHY91mg9ZRDH2zxi/F53loegL9oszRpdRn3CcBJD3kvo9HDhXsOD0+xR2OzxzmukueGMICEqqPt8znjk65dW4L4mwKAFDzzOUKtzp4bDVMKKtfW9s3Ps2KX+Vy5f3KB5WdilnZr9yofFk5rPQqZOvHrd+2/tj6s/ZD7afaL7VfM9WLF2aY9yqlp/b7PyV8d3U=</latexit><latexit sha1_base64="0rZ6T+YG5xLCuVjxZPRxkgHDOOw=">AAASE3icvVfdjttEFE5LgRIWaOCSmxGrio3khNhJdrdAqtLSlgq1XQrbrRRHq8l4HA+xx9bMZLO7xo/BA/Ac3CCExBUSXPI2nLETx05Ci7Y0Xm0yPnO+me/8zMmcYeQzqVqtvy9dfu3K62+8efWt6ttb77z73rXa+09lOBGEHpLQD8WzIZbUZ5weKqZ8+iwSFAdDnx4Nx3f0/NEJFZKF/Dt1FtFBgEecuYxgBaLj2tanNqdTEgYB5k5s33ty924S24qeKunG6Zt9KiNMaFItKT6+c+fw4MHdLxfKuWQ94PDR148eHz1a6M8F69W/eHj7wf3Dx4ffLgALUQ4pYx6ePaFEYT7yadLvDOKq7Qg8RTvb7ToS8xl47dQ/q9puCG4iHrIZQ4zHLcM0ms2msW0mgItGboCVJ6kKMBFhbEehBCKMfQLzMA1z2bKNhv5u/ABrIhKGwmEcK9oH9Z7GDHa2rWOIlfIAq3dNkSmFRuOFQIqlynDXc2AG0eD/BJxT7QBsTvc5QB6KMtUysv3vyCmdb5nAnz2kI3CqYuPziBE1ERAQHjoUOZDRmBPa26fBAKIHsr4OkiE9HNFeHiUjYJwFkwBNmaO83h4NcolH2chTvTYsgHYmfMzDKa+jlbRKwIRCQsRmK4ln2vmgmYYGae4LWeoDpF2ol3g5hobQIxS6vdnqxqn0mKtS89EOHFM2moQTWeC/yPJ1FuSIwrBkxUL6v9oxpH44LdgB5F1BaYF3WivWUdZ62WeJaCp4Nb7WS5cdHRIyiRh1CnzzcrWO81x/MSpxz4Ul/lm56d/sSUWxr7yPB+g6SiuQ8ihSAnPJdNGVVZR5LztuVh1RZ0T7jZsDlHogM54wQcByqE2cCiRp1GtFykAzu2GJzBcmGI5c5vu9qccUNeBweaHoEcoVFQMwVxLBIiXZOUVmkh+YrChZdU2lJOpchM0FuHSSog869WqRiXZod0NEuknhHKZlrJt6pSy7UJAuEqJWUnaDlXlmwWajUTJ1ysyzPQ8VWpbtbojOfrLiid3MPzmfLICbobM7z+EsX/NjrV/3N8TBSpaM3189SnuviouhrwCtptldThtrJW3a9ZUwtTdNa2+5/u1lvsqDtnFG7dWEbq+pPhsP4I1SddZuqsKvJIVLdvFKd3xtu9VspQ9aHZizwXZl9hwc1678YjshmQSwOfGxlH0TGA9iLBQDS+DeOAErMBljMBaGHAdUDuK0y0nQdZA4CO7t8M8VSqVFBNx9pDwLhqCZXt6X57Rw3Vx/otz9Qcx4NFGUk2wjd+IjFSLdMsGlVd9E/DMYQDcAv+EEEQ8LTMCDslraRrsnKUvG542RwJGXibWCz4YCizMwW4RTaWRfzYAqDB1NCSzhzpDSrtrzYUkBLtUNLRzE2iUyokRr6q6FcS2JH54Jhh10IELdLDnUhTYxdVyMiU6BJH5y/3YSt01jt2uYrd1knZI107La0CW1OkZ7f62ar+9fM1XzRtuwTMuw2u0lXSUm2WimeQP23TWNbndJz8W+LCkWdy85KUtlHqrlfpDJE+xD20a5hHTVfopt/SmoH9uh7oqpmkmCWKsmcc/+PmQcFHoJPEvr8ecumNOYb7y6wEg8Bz8GcKNp0VM7YM7srQtvFyA69l/G8MLeCybAa3Uf7PtJ3xz0Twere2E/8nCs22zQOo6hb9b4pfi8CE1PoV+UObqU+oz7JICkh9z38cihgp2kx6e4w8m5w1x3yRNDWEBC9fGW+dzTKbfObUGcTQEAap65XOFWB0+tpgll9Rtr+9bns+p3tfJh5aPKTsWs7FVuVb6qHFQOK2Trp63ft/7c+qv2Y+3n2q+13zLVy5dmmA8qpaf2xz/iPnZG</latexit>

lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


Receive position reports from train

Issue movement authority to train

Monitor TTD status

Compute VSS status

bad weather behaviour

Move, break, disconnect, connectSend position report to trackside systemReceive movement authority from trackside system

49

COMPUTE VSS STATUS

Immediate Update strategy:Non-deterministically choose a VSS with an enabled transition and update its status.

Repeat until stable.

TRACKSIDE SYSTEM

lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�




Monitor TTD status

Compute VSS status

Event-handling assumption:After each event a stable VSS status must be reached before considering the next event.

Simultaneous Update strategy:First compute VSSs with transition enabled and apply updates simultaneously.


50

COMPUTE VSS STATUS

Immediate Update strategy:Non-deterministically choose a VSS with an enabled transition and update its status.


TRACKSIDE SYSTEM

lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�


lLELPqL �J"A:lPla

6_11 P**lSA1.

� �

��

��

��

��

��

�




Monitor TTD status

Compute VSS status

Event-handling assumption:After each event a stable VSS status must be reached before considering the next event.

Simultaneous Update strategy:First compute VSSs with transition enabled and apply updates simultaneously.


VQ3: Is a stable VSS status always reached? (termination of stabilisation)

Rephrase VQ2: Are these two strategies behaviourally equivalent?

VQ4: Is the stable VSS status reached after an event unique?

(deterministic stabilisation)

51

ERTMS HL3: NEXT STEPS

HL3 version 1A did not satisfy VQ1– VQ4

We revised our model such that it does satisfy VQ1 – VQ4

HL3 version 1D seems very much in line with our revision

ProRail has asked us to upgrade our model to 1D because they want a simulator for the principles

52

NO COLLISIONS?

[true�]¬

�

��

�t, t � : TRAIN@id, v : VSS@id.�ExtendEoA(t, v)�true

��l , l � : List(VSS@id).(v = rear(l �) � in@between(rear(l �), front(l), v))

� �report@location(t, l)�true � �report@location(t �, l �)�true

�

��

<latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="rjdvV7/ZcEOBPOSEjJBt4eCvmLg=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBsaw7KZrB3ho07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+m92lOTEctwO7QQkJu+ee+Hd8Y5Bypk23e6bS5e3Pvr4k0+vfOZ8vv3Fl19dvfb1My0zFdKnoeRSvQiIppwJ+tQww+mLVFGSBJw+DyZ3Lf/5lCrNpHhiFin1EzISLGYhMUA6vbZ15Ak6C2WSEBHlnpbKFEPXzz0qdKZoQsw49+x/Hec7blEUTgNPQqvmfSQSkr4P3KiMFhvBJWcdHhOu34KvWFZgiIal3pff+yA88jiNTdsL6IiJnChFFkXOAUbnEH6NDDZ7P5aByZ+c3HnwyDtlUYGnNenZ48cloeN5jvfqVUYix+NEjDhFdXDye3NDRXRP3inaBk/3kadqvvWhFAMpb0ajEdA8Z3dpmGO+t2rlwc8PgV500BR5Fpow0eZ7++gnWJJ5m4PmMyWVKxs0WRXt2un9ouMg+NrTgU1LDnWjCqvSm1KrH0hMeKcBNTNKRdFugnC5jZUUBvb7cLL9Fcsr/5HjJYGc50Xl3np4FE3BMe+Uy6ombZT4fiNIoKEUvRDaDbJ72B5gVRoi+iFiVS7SMRFGJrktlGIfigKqrKoRT7HR2ADJP7260+10yw9dXLj1YqdVf8en16488SIZZgkVJuRE66HbTY0Pig0LOYXayzRNSTghIzqEpSAJ1X5e3vYC7QIlQrFU8CcMKqmrEjlJtF4kASDL0l/nWeIm3jAz8U0fUp5mULBhZSjOODIS2daBIqZoaPgCFiRUDHxF4ZgoCCo0GKdhxrDJ66JJmbw+GCmSjiuyBXAWKKIWNp5ypnH100moIYXTVKeJqNx2vOWyARgKeWCJfm5DolMaWiQ1CWHCUvLfFopBJR4rCaq9iMbQLsvA5SQMIQtFfvLLUZH3XXzjELvdG8UmUK9G9fpdwFzH/ZsbYdzWRQ11b/Vxz+3hXr+/hrUlViW0Qt4CuzdcfHi4hivb1ipw1XojSNY2VUIaS19tikxPCd/QFBXluSftdKCmpiS5hRb5wPtTMgGAQWFbZlOfeKfCMzeWhi8qGKl3yE9A+KDTo3NocFG9O4TdBzg64f/n4Cu2zz0Bvy7aIZzbmTacbxhrhEMLgcEkFaBOqxFXrOfnv6SrPn4m3Sh9JniYQNFD7XMyiqhi0/L6rFqYvo5YHK9FIgAFGrrPeN2f+28ZohCk+8sh2qg8+05hYqQtGULKqRiVBiiXs5CktsXqCUuL/MA9TE2B0O4uyoS1B7WCWIxmFM2gzyIzpkgbcIKoCGlQD1oRUTITEVoqapgwdG5iLokBZ+BqQBeFs3Btqhtk235mHUzunjzsFU6+i06opmoK/XMmVaQdNKGLcjWAywvTmSgcgg0MbR7TVwKPuAwwE8yyOJ6NFbZTFMPkw2lANU6VDLGGuxyaAjtoF90FaTiAWVU97PnldcflXcYR5YZgQ7JK4ljRyls4MehuCPb9/EhKjh8Rg08oeHAsNX4gDH5MDT4iI2zHuSX0LAKY5a/dWyA8EMDTuXPBDrif2nwhiDSSKVXESNUwfN3PxyyimMVYleMH6yzBVl+GRYarasZVWeJERhi2coYDmKgTbBNbRyPTMDzP9K5aOPRzQbWhURleBmeDuBlq5USWBHA3zYLTgVd1wYBnJauumcGQ+97u+b7Gaq7HJKX43E5Jh8vlBTHknUHG1nk932OmEkPrvP45b511/e2sw3NrKxh4pLOw9tOYmCSMLzyYZBBGB8UcQglPdjhslgg9KAvFKZzhUjNeHtR3yvq2jWtZ3YO6uh14h7jrr46Li2e9jtvtuL/3dm7frF8kV1rftr5rtVtu64fW7davrePW01a49dfW31v/bL3Zdrefb7/c/qOCXr5Uy3zTanzb7F8tiZzn</latexit>

GLOBALLY IT IS NOT THE CASE THAT

TRAIN t GETS A MOVEMENT AUTHORITY

FOR A VSS THAT BELONGS TO THE LOCATION OF TRAIN t’

53

General procedure in mCRL2:1. Apply appropriate abstraction2. Generate state space3. Minimise modulo behavioural equivalence4. Generate PBES from formula and state space5. Solve PBES6. If false: obtain counterexample

VSS 11 VSS 21 VSS 22 VSS 23

TTD 10 TTD 20

3 2 1

NO COLLISIONS?

[true�]¬

�

��

�t, t � : TRAIN@id, v : VSS@id.�ExtendEoA(t, v)�true

��l , l � : List(VSS@id).(v = rear(l �) � in@between(rear(l �), front(l), v))

� �report@location(t, l)�true � �report@location(t �, l �)�true

�

��

<latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="sremQu43o6pSqcE0gx2iAZLw76c=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBtaw7KZrB3hr07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+i/2E3aU5MRy3A7tBCQm75574d3xjkHKmTbd7usLF7c++PCjjy994ny6/dnnX1y+8uVTLTMV0ieh5FI9D4imnAn6xDDD6fNUUZIEnD4LJncs/9mUKs2keGwWKfUTMhIsZiExQDq5snXoCToLZZIQEeWelsoUQ9fPPSp0pmhCzDj37H8d5ztuURROA09Cq+ZdJBKSvgvcqIwWG8ElZx0eE67fgK9YVmCIhqXeF9/6IDzyOI1N2wvoiImcKEUWRc4BRucQfo0MNnvfl4HJHx/fvv/QO2FRgac16emjRyWh43mO9/JlRiLH40SMOEV1cPK7c0NFdFfeLtoGT/eRp2q+9aEUAylvRqMR0Dxnd2mYY763auX+Tw+AXnTQFHkWmjDR5nv76AdYknmbg+ZTJZUrGzRZFe3a6f2i4yD42tOBTUsOdaMKq9KbUqsfSEx4JwE1M0pF0W6CcLmNlRQG9vtwsv0Vyyv/keMlgZznReXeengUTcEx74TLqiZtlPh+I0igoRQ9F9oNsnvYHmBVGiL6PmJVLtIxEUYmuS2UYh+KAqqsqhFPsdHYAMk/ubzT7XTLD51fuPVi58d/WuV3dHLl0mMvkmGWUGFCTrQeut3U+KDYsJBTqL1M05SEEzKiQ1gKklDt5+VtL9AuUCIUSwV/wqCSuiqRk0TrRRIAsiz9dZ4lbuINMxPf8CHlaQYFG1aG4owjI5FtHShiioaGL2BBQsXAVxSOiYKgQoNxGmYMm7wqmpTJq6sjRdJxRbYAzgJF1MLGU840rn46CTWkcJrqNBGV2463XDYAQyGvWqKf25DolIYWSU1CmLCU/NeFYlCJR0qCai+iMbTLMnA5CUPIQpEf/3xY5H0XXz/Abvd6sQnUq1G9fhcw13D/xkYYt3VRQ92bfdxze7jX769hbYlVCa2QN8HudRcfHKzhyra1Cly13giStU2VkMbSV5si01PCNzRFRXnuSTsdqKkpSW6hRT7w/pBMAGBQ2JbZ1CfeqvDUjaXh8wpG6i3yExC+2unROTS4qN4dwO49HJ3w/3PwFdtnnoBf5+0Qzu1MG843jDXCoYXAYJIKUCfViCvW8/Nf0lUfP5VulD4TPEyg6KH2ORlFVLFpeX1WLUxfRSyO1yIRgAIN3We87s+9NwxRCNK95RBtVJ59pzAx0pYMIeVUjEoDlMtZSFLbYvWEpUV+1T1ITYHQ7i7KhLUHtYJYjGYUzaDPIjOmSBtwgqgIaVAPWhFRMhMRWipqmDB0bmIuiQFn4GpAF4WzcG2qG2TbfmYdTO4cP+gVTr6Ljqmmagr9cyZVpB00oYtyNYDLC9OZKByCDQxtHtOXAo+4DDATzLI4no0VtlMUw+TDaUA1TpUMsYa7HJoCO2gX3QFpOIBZVT3s+eV1x+VdxhHlhmBDskriSNHKWzgx6G4I9v38UEqOHxKDjyl4cCQ1vi8MfkQNPiQjbMe5JfQsApjlr91bIDwQwNO5c84OuJ/afCGINJIpVcRI1TB8zc/HLKKYxViV4wfrLMFWX4ZFhqtqxlVZ4kRGGLZyhgOYqBNsE1tHI9MwPE/1rlo48HNBtaFRGV4GZ4O4GWrlRJYEcDfNgtOBV3XBgGclq66ZwZD73u7ZvsZqrsckpfjMTkmHy+UFMeSdQcbWeT3fY6YSQ+u8/hlvnXXtzayDM2srGHiks7D205iYJIwvPJhkEEYHxRxCCU92OGyWCD0oC8UpnOFSM14e1HfK+raNa1ndg7q6HXiHuOuvjvOLp72O2+24v/V2bt2oHiStS62vW9+02i239V3rVuuX1lHrSSvc+nPrr62/t15vu9vPtl9s/15BL16oZb5qNb5t9i+tIJ4W</latexit><latexit sha1_base64="rjdvV7/ZcEOBPOSEjJBt4eCvmLg=">AAAMr3icpVZtb9s2EHabvXRatrXbx30hFgRxBsaw7KZrB3ho07Vbga7I0lfAUjNKomzOFKmSlF8q6Aft1+zr+m92lOTEctwO7QQkJu+ee+Hd8Y5Bypk23e6bS5e3Pvr4k0+vfOZ8vv3Fl19dvfb1My0zFdKnoeRSvQiIppwJ+tQww+mLVFGSBJw+DyZ3Lf/5lCrNpHhiFin1EzISLGYhMUA6vbZ15Ak6C2WSEBHlnpbKFEPXzz0qdKZoQsw49+x/Hec7blEUTgNPQqvmfSQSkr4P3KiMFhvBJWcdHhOu34KvWFZgiIal3pff+yA88jiNTdsL6IiJnChFFkXOAUbnEH6NDDZ7P5aByZ+c3HnwyDtlUYGnNenZ48cloeN5jvfqVUYix+NEjDhFdXDye3NDRXRP3inaBk/3kadqvvWhFAMpb0ajEdA8Z3dpmGO+t2rlwc8PgV500BR5Fpow0eZ7++gnWJJ5m4PmMyWVKxs0WRXt2un9ouMg+NrTgU1LDnWjCqvSm1KrH0hMeKcBNTNKRdFugnC5jZUUBvb7cLL9Fcsr/5HjJYGc50Xl3np4FE3BMe+Uy6ombZT4fiNIoKEUvRDaDbJ72B5gVRoi+iFiVS7SMRFGJrktlGIfigKqrKoRT7HR2ADJP7260+10yw9dXLj1YqdVf8en16488SIZZgkVJuRE66HbTY0Pig0LOYXayzRNSTghIzqEpSAJ1X5e3vYC7QIlQrFU8CcMKqmrEjlJtF4kASDL0l/nWeIm3jAz8U0fUp5mULBhZSjOODIS2daBIqZoaPgCFiRUDHxF4ZgoCCo0GKdhxrDJ66JJmbw+GCmSjiuyBXAWKKIWNp5ypnH100moIYXTVKeJqNx2vOWyARgKeWCJfm5DolMaWiQ1CWHCUvLfFopBJR4rCaq9iMbQLsvA5SQMIQtFfvLLUZH3XXzjELvdG8UmUK9G9fpdwFzH/ZsbYdzWRQ11b/Vxz+3hXr+/hrUlViW0Qt4CuzdcfHi4hivb1ipw1XojSNY2VUIaS19tikxPCd/QFBXluSftdKCmpiS5hRb5wPtTMgGAQWFbZlOfeKfCMzeWhi8qGKl3yE9A+KDTo3NocFG9O4TdBzg64f/n4Cu2zz0Bvy7aIZzbmTacbxhrhEMLgcEkFaBOqxFXrOfnv6SrPn4m3Sh9JniYQNFD7XMyiqhi0/L6rFqYvo5YHK9FIgAFGrrPeN2f+28ZohCk+8sh2qg8+05hYqQtGULKqRiVBiiXs5CktsXqCUuL/MA9TE2B0O4uyoS1B7WCWIxmFM2gzyIzpkgbcIKoCGlQD1oRUTITEVoqapgwdG5iLokBZ+BqQBeFs3Btqhtk235mHUzunjzsFU6+i06opmoK/XMmVaQdNKGLcjWAywvTmSgcgg0MbR7TVwKPuAwwE8yyOJ6NFbZTFMPkw2lANU6VDLGGuxyaAjtoF90FaTiAWVU97PnldcflXcYR5YZgQ7JK4ljRyls4MehuCPb9/EhKjh8Rg08oeHAsNX4gDH5MDT4iI2zHuSX0LAKY5a/dWyA8EMDTuXPBDrif2nwhiDSSKVXESNUwfN3PxyyimMVYleMH6yzBVl+GRYarasZVWeJERhi2coYDmKgTbBNbRyPTMDzP9K5aOPRzQbWhURleBmeDuBlq5USWBHA3zYLTgVd1wYBnJauumcGQ+97u+b7Gaq7HJKX43E5Jh8vlBTHknUHG1nk932OmEkPrvP45b511/e2sw3NrKxh4pLOw9tOYmCSMLzyYZBBGB8UcQglPdjhslgg9KAvFKZzhUjNeHtR3yvq2jWtZ3YO6uh14h7jrr46Li2e9jtvtuL/3dm7frF8kV1rftr5rtVtu64fW7davrePW01a49dfW31v/bL3Zdrefb7/c/qOCXr5Uy3zTanzb7F8tiZzn</latexit>

54

NO COLLISIONS: COUNTEREXAMPLE


TTD 10 TTD 20

3 2 1

55



TTD 10 TTD 20

3 2 1

56



TTD 10 TTD 20

3 2 1

57



TTD 10 TTD 20

3 2 1

integrity confirmed

58



TTD 10 TTD 20

3 2 1

integrity confirmed

59



TTD 10 TTD 20

3 2 1

FSMA VSS21

60



TTD 10 TTD 20

3 2 1

61

Documents

Supporting Railway Infrastructure Managers with Formal Models … · 2020-04-08 · 45 ERTMS HL3 SPECIFICATION VQ1: Does the specification guarantee that EEIG ERTMS Users Group 123-133