Towards the verification of a generic interlocking logic: Dafny meets parameterized model checking

TL;DR

This paper considers a generic interlocking logic, which can be instantiated to control a wide class of stations, and shows how to automate the proof of an important safety requirement, by integrating simple, template-based invariants and more complex invariants obtained from a model checker for parameterized systems.

Abstract

Interlocking logics are at the core of critical systems controlling the traffic within stations. In this paper, we consider a generic interlocking logic, which can be instantiated to control a wide class of stations. We tackle the problem of parameterized verification, i.e. prove that the logic satisfies the required properties for all the relevant stations. We present a simplified case study, where the interlocking logic is directly encoded in Dafny. Then, we show how to automate the proof of an important safety requirement, by integrating simple, template-based invariants and more complex invariants obtained from a model checker for parameterized systems. Based on these positive preliminary results, we outline how we intend to integrate the approach by extending the IDE for the design of the interlocking logic.

Figures (3)

• Figure 1: Dafny encoding of the track class
• Figure 2: Dafny encoding of the route class
• Figure 3: Dafny encoding of the station