Modélisation et Vérification Formelles de Systèmes de Contrôle de Trains. (Formal Modeling and Verification of Train Control Systems)

interpretation is a theory of sound approximation of the system semantics. It allows obtaining some information about the system semantics via a formal static calculation other than performing a full execution. An example could be the invariant methods of Petri nets. This method extracts some abstract values to analyze the system behaviors other than the concrete values via an exhaustive study of all the system states. It can thus alleviate the combinatorial explosion. However, the abstract interpretation method can only analyze very limited system properties that are able to be presented by the abstract values. It does not offer much help for the analysis of concrete behaviors of systems. 3.2. 5.7 Quantitative Analysis The operation of train control systems in the real environment is complex as there exist different kinds of uncertainty such as the communication loss. In order to verify the nonfunctional requirements (e.g., usability, real-time performance, see §5.2.3), quantitative analysis methods are applied via two different analysis techniques: probability analysis and statistical analysis. Probability Analysis Probability analysis is applied on formal models. In (Zhou and Zhang 2015), security analysis based on a Bayesian network is conducted on a train control center (TCC) model. In (Xu et al. 2009) and (Hongli Zhao et al. 2009), stochastic reward net (SRN) and stochastic automation networks (SANs) are used, respectively, to analyze the reliability and availability for the data communication system (DCS) between trains and trackside equipment in CBTC system. Statistical Analysis Besides the probability analysis based on the mathematical and formal models, statistical model checking (SMC) (Bu et al. 2011) can also be used together with hypothesis testing to quantitively evaluate the system behavior. For example, in (Gu et al. 2016), the UML activity diagrams are extended to accurately capture and quantify the overall timing behaviors of the complex systems. An onboard subsystem of CBTC is modeled as a case study and the quantitative reasoning can be performed by statistical model checker UPPAAL-SMC, which demonstrates the effectiveness of this analysis methods. The statistical analysis can also be performed with simulation, which needs relatively less memory cost and is easy to be applied on the large-scale and complex systems. 3.2. 5.8 Comparison of Verification and Validation Methods Table 3-3 compares several verification ad validation methods. Chapter 3 State-of-the-Art for the Train Control System Development 55 3.2. 6 Whole lifecycle tools Many formal methods that we have introduced can contribute to different phases in the train control system development to support their requirements specification, system design, verification and validation. However, most of these methods are suited to a particular phase in the system development lifecycle. Since the different formal methods are based on different theories, the transition between the formal models in different phases could sometimes be an obstacle. For example, even though that the requirements specification can be modeled and verified by some formal methods, the transformation into the system design model is usually conducted manually, which needs a lot of human labor by the experts with a good understanding of both the domain knowledge and the modeling techniques. There might not exist a particular method which can cover all the modeling and verification in all the phases, but we have found some tools that could apply some formal methods to cover the most the phases and can thus be called “whole lifecycle tools”. 3.2. 6.1 Rodin Based on Event-B As the B method was proven to be useful in the maturity assessment of railway control domain (Behm et al. 1999), there are many studies about using B method and its successor Event-B to assist the system development of railway control. The use of B method / Event-B is extended from requirements specification modeling to other system development phases. Meanwhile, there are also tentative results of using model checking methods to verify its models besides the inherent theorem proving approach. The toolset Rodin offers a basis of a User Interface (UI) and a proving engine for modeling and verification with Event-B. It is also compatible with several plug-ins for visualization, modeling and verification purposes. For all these reasons we regard Rodin as a whole lifecycle development tool based on Event-B. More examples of the system development using Event-B and Rodin can be found in (Romanovsky and Thomas 2013). The limit of these methods is that the B method is more appropriate to model the requirements specification. Even though there are methods to extend its applicable scope, the development needs to begin from a well-written formal requirements specification in Event-B. As for the verification, the model checking method is less well supported compared to the theorem proving, even though the former is more applicable in the industrial domain. 56 Table 3-3 Comparison of verification and Validation Methods Type Method Phase(s) Principle Reliability Automation Expressivity C. E. Traditional Inspection R. / D. Reading Low Low High Low Testing All phases General Middle Middle Simulation D. / I. Execution Middle High Formal Model checking D. / I. Traversal High High High High Theorem Proving R. / D. Reasoning High Low Low Middle Abstract Interpretation R. / D. Calculation High Low Low LowInterpretation R. / D. Calculation High Low Low Low Equivalence checking D. / I. Logical analysis High High High High Quantitative Analysis Probability Analysis R. / D. Stochastic analysis High Middle Middle High Statistical Analysis D. / I. Execution Middle High High Low Abbreviations: R. – Requirements Specification; D. – System Design; I. – Implementation; C.E. Combinatorial Explosion Chapter 3 State-of-the-Art for the Train Control System Development 57 3.2. 6.2 SCADE Suite SCADE Suite (Safety-Critical Application Development Environment) is a whole lifecycle and high-quality system design solution of a model-based development environment for critical embedded software. With the native integration of the well-defined SCADE language based on the formal language Lustre, SCADE Suite supports different representations of the target system, e.g., a graphical and hierarchical Safe State Machine (SSM) which can be mixed with the data flow, arrays and iterators. SCADE Suite offers a complete toolchain to undertake the prototyping, modeling, simulation, verification, optimization, and certified code generation for embedded systems controls, logic and algorithm designs. In (Cho et al. 2011), ATP and ATO functions for CBTC onboard systems are designed with SCADE. Some functions are then tested using the SCADE simulator. As for implementation, C code is generated by KCG, a C-code generator certified by the EN 50128 standard. However, as a commercial software developed by Esterel Technologie, a subsidiary of Ansys, Inc., SCADE Suite is very expensive and needs to be paid each year. As an academic research, the focus of this thesis is more oriented to the free or open source tools which can guarantee a reliable support for the long-term system development such as that of railway systems. 3.2. 6.3 CPN Tools based on Petri nets Compared to the B-Method which is appropriate for sequential software, Petri nets have been successfully applied for concurrent systems (Choppy and Petrucci 2004) thanks to its combination of a graphic representation and a formal and mathematical base. The expressivity of Petri nets is dramatically increased by the use of high-level Petri nets or colored Petri nets. CPN Tools (Ratzer, A. et al., 2003) is a free software and a powerful tool based on colored Petri nets theory. It is especially useful for industrial application as its graphical representation allows the data flow and the control flow to be visualized, making it much easier for domain experts to understand system behavior. CPN Tools combines the colored Petri nets theory with several extensions, e.g., the programming language ML (Jensen 1998), to gain an enhanced expressivity. CPN theory offers: Petri net primitives of parallelism useful for the synchronization of concurrent processes, which is always a drawback of automata-based methods; high-level abstraction and hierarchy, which makes it possible to model large-scale and complex DES; the well-developed Petri net theory, which is supported by many tools and methods and is still being enriched. Chapter 3 State-of-the-Art for the Train Control System Development 58 ML programming language provides: a definition of complex data types; the manipulation of data values via sophisticated functions and algorithm; the access to the integrated model checker and other CPN Tools functions. As a whole lifecycle development tool, CPN Tools offers: a graphical environment to construct CPN models; a simulator with debugging (e.g., stop conditions) for the testing and validation; the generation of full state space, partial state space and condensed state space the standard analysis and ASK-CTL (Cheng A. et al., 1996) based model checking, which can be conducted to achieve a functional verification (She et al. 2014); the support of PNML (Petri Net Markup Language), which makes it possible to reuse the models in other tools; All these features make CPN Tools a powerful tool with which we can design, simulate and analyze the models based on colored Petri nets during the whole development lifecycle for distributed and parallel systems where concurrency is an important characteristic. In the requirements specification phase, the system requirements represented in CPN models is subjected to analysis methods to prove properties (ISO/IEC 2004). In the system design phase, the execution of CPN models allows the testing, simulation, and performance analysis on prototypes or design models before implementation. Meanwhile, in the