Using Symbolic Model Checking to Verify the Railway Stations of Hoorn-Kersenboogerd and Heerhugowaard

Stalmarck's proof procedure is a method of tautology checking that has been used to verify railway interlocking software. Recently, it has been proposed [SS98] that the method has potential to increase the capacity of formal verification tools for hardware. In this paper, we examine this potential in light of an experiment in the opposite direction: the application of symbolic model checking to railway interlocking software previously verified with Stalmarck's method. We show that these railway systems share important characteristics which distinguish them from most hardware designs, and that these differences raise some doubts about the applicability of Stalmarck's method to hardware verification.