n interlocking-which is designed to guarantee the safety of train movements-is an extremely complex distributed system. The behavior of such a system-and thus its correctness-is hard to understand and even more difficult to A analyze. Recoffnizing that verification of safety requirements This study evaluates the ability of EjcSpect, a in such a system would not be possible without a way to formally describe system behavior, the Dutch railway company, Nederlandse Spoorwegen, designed a set of formal languages, called the Interlocking Specification Language,' also known as Euris.2 Engineers at NS envisioned that ISL would let them describe and simulate interlocking behavior, verify safety requirements, and optimize interlocking behavior. This in turn could lead to the creation of an infrastructure that would allow more flexible train schedules. However, although ISL is an important step toward a more formal approach to building and maintaining interlockings, it is not suitable for verifymg safety requirements because it lacks a firm mathematical basis. The study described here, conducted by the Eindhoven University of Technology in cooperation with NS, is a first step toward the simulation and verification of ISL specifications that is grounded in mathematical theory. As part of the study, we translated a small part of an ISL specification into the graphical and functional language used by the ExSpect t o~l k i t .~ ExSpect, which is short for Executable Specification tool, is a graphical specification and simulation package developed at the university and commercially available from Bakkenist Management Consultants. It is a
Basten REF simulated and analysed railway interlocking specification using ExSpect which is a software tool based on high level Petri Nets.
Simulating and analyzing railway interlockings in ExSpect
IEEE Parallel & Distributed Technology: Systems & Applications
IEEE Parallel & Distributed Technology: Systems & Applications
Computer Science