Hierarchical modelling of complex control systems: dependability analysis of a railway interlocking
Andrea Bondavalli, Manuela Nelli, Luca Simoncini, Giorgio Mongardi · CINECA IRIS Institutial research information system (University of Pisa) · 2001
Today critical systems like railway station interlocking sys-tems employed in all technologically advanced countries arecontrolled by computers, mainly to cope with the increasingcomplexity of the control operations which is a source offailures. Several systems have been built [e.g.1–6], and havebeen used since a few years by those Railway Authoritieswishing to have a good cost/benefit ratio. To ensure an ade-quate dependability of the systems coming to operation,many standards exists (like the new ERTMS [7–9]) whichestablish targets on the dependability attributes, like safety,reliability and availability, and prescribe methodologies forsystem specification, design, verification and validation.As a consequence, evaluations are necessary for the sys-tem assessment and the fault forecasting. These evaluationsmay be performed both during the design phase, in order totest if the behaviour of the architecture under study is asexpected, or to compare different solutions, and during theverification phase, to assess whether the developed systemsatisfies the assigned targets. System assessment can be per-formed using several approaches like testing, fault injectionoften combined with analytical models. The modellingapproach is generally cheap for manufacturers and hasproven to be useful in all the phases of the system life cycle.During the design phase, models allow us to compare differ-ent solutions and to select the most suitable one (amongthose obeying other design constraints), and to highlightproblems within the design. In assessing an already built sys-tem, models allow to characterise specific aspects, to detectdependability bottlenecks and to suggest solutions to beadopted in future releases. In the literature several papersexist in the field of dependability analysis [e.g. 10–15]. Inaddition, many of the existing modelling techniques likevol 16 no 4 july 2001 249