Testing Railway Interlockings with N. Ioustinova, J. van de Pol, N. Goga Centrum voor Wiskunde en Informatica Amsterdam, The Netherlands TT-Medal Review Berlin, Germany September 28, 2005 This work is done in cooperation with ProRail

TT-Medal Review, September 2005 Goal Provide a framework for testing railway interlockings with TTCN-3 Railway Control System Apply the framework for testing interlocking software for Hoorn- Kersenboogerd station

TT-Medal Review, September 2005 Infrastructure of Hoorn-Kersenboogerd 66C66B66A74B 74A 69A73B 52D62A62B62C 70A69B73A 70B70C Road Platform 1 Platform tracks signals two-coupled point level crossing

TT-Medal Review, September 2005 Vital Processor Interlocking (VPI) Vital Processor Interlocking is a hardware that runs  hardware checks and  a program Program defines the control cycle:  update inputs that represent state of infrastructure objects and logistic  calculate the outputs  stay idle  set the outputs controlling the infrastructure objects VPI can handle about 320 inputs/outputs VPI is timed system

TT-Medal Review, September Development of Test Cases test suite for interlocking of Hoorn-Kersenboogerd standards on railway safety

TT-Medal Review, September C66B66A74B 74A 69A73B 52D62A62B62C 70A69B73A 70B70C Road Platform 1 Platform Mapping from general scenario to a particular scenario:  Physical objects  Input values  Output values Development of Test Cases (cont.)

TT-Medal Review, September 2005 Development of Test System TTCN-3 Test System for railway Special feature: time control simulated time interlockings SUT Interlocking Simulator Interlocking Program Simulated time solution is based on Dijkstra’s distributed termination detection algorithm

TT-Medal Review, September C 66B66A 74B Expected trace Observed trace 66C 66B66A 74B FAIL Initial situation: train on 66C Setting the initial situation costs 21 cycles. Failure is detected in 1 cycle. Test Execution: Normal Train Departure Final situation: train at 66B and 68 remains yellow

TT-Medal Review, September 2005 Market Relevance  In the European railway sector, the current target is to increase the proportion of railway transportation by % within a short period (  European integration ( requires new standards for specification (UML) and testing (TTCN-3)  TTCN-3 enables to bring together  Vendors  Standardization  Certification  Operators in EU

TT-Medal Review, September 2005 TTCN-3 for the Railway Domain Advantages  Standardization: a standard language to specify test suites for railway applications  Reusability: one test suite can be used to test software from different vendors  Independency from implementation details of simulators for railway software  Automation of test execution for railway domain Benefits  High-quality test suites → reliable railway control systems  Reduction of costs for testing on the long run

TT-Medal Review, September 2005  We translated a subset of CENELEC safety requirements into TTCN-3 test cases.  TTCN-3 is suitable to specify test cases for railway control systems  According to ProRail, TTCN-3 is a significant step towards automation and standardization of testing process in the railway domain  TTCN-3 test system is extended by time simulation option  We have covered whole test-process starting from developing test cases, proceeding with implementing the test system and finally executing tests and interpreting results  Using this approach we found violations of general safety requirements Conclusions

TT-Medal Review, September 2005 Dissemination  Change request for TTCN-3 standard (TCI)  5th International Workshop on Formal Approaches to Testing of Software FATES 2005, July 2005, LNCS  TTCN-3 User Conference, Sophia-Antipolis, June 2005, outstanding presentation award  CWI in bedrijf (CWI for industry) symposium, Amsterdam, October 2005  6 th ITEA Symposium, Helsinki, October 2005  11 th Dutch Testing Day, Twente, November 2005