Verifying Real-Time Aspects of the European Train Control System ∗

In this real-time case study, we formally specify a part of the European Train Control System (ETCS) [ERT02, ECS99] with the specification language CSPOZ-DC treating the handling of emergency messages. We apply the methods from [HM05] to enable the formal verification of the model. In addition, we pick up the idea of using Fault Tree Analysis as a decomposition technique [Sch03] to simplify the verification tasks of this profoundly parallel case study model and adapt it to the usage with CSP-OZ-DC. We present the first real-world application of CSPOZ-DC and give a realistic, object-oriented, and holistic model of a ETCS subsystem, considering the communication, processing, and real-time behaviour. We explicitly take infinite data types and messages with potential infinite parameters into account. Other work on ETCS case studies like [ZH05, HJU05] focus on the stochastic examination of the communication reliability and model components like the train and the RBC in a rather abstract way without considering the internal behaviour.