Formal Safety Analysis of Transportation Control Systems

From a safety point of view different transportation systems share many properties and requirements. They are all supposed to function correctly, to be failure tolerant and to be associated with only minimal risk. To ensure these requirements formal methods are a great help. The ForMoSA approach provides an integrated methodology for formally analyzing safety-critical transportation systems. One important and difficult part of all formal analysis methods is the building of precise and correct models of the system. In the domain of safety analysis this task is even more complex, because not only intended behavior must be modeled but unintended (faulty) behavior as well. In this paper we show how functionally correct models of systems can be extended such that they not only model the system’s functional behavior but possible failures as well. We give construction rules which assure, that the extended model is a conservative extension of the intended behavior. We demonstrate the method with a railroad example: the autonomous control of a radio-based level crossing.