Efficient Design-Flow for Counting Heads

Nowadays railway systems are designed and tested in a conventional way, i.e. the systems are simulated with a manually created test bench. This has the advantage that the designers have a considerable expertise with this kind of work, but there is still a lot of potential for human failure. Furthermore, testing is very cost-intensive and can never reach complete coverage. Hence, an integrated design flow for railway systems is needed, which allows for efficient modeling, validation, simulation-based verification as well as formal verification. A well accepted approach for this is the system level description language SystemC, which is known from the hardware design domain. SystemC supports the designer with a suitable methodology for efficient modeling and validation. With an integrated simulation kernel it facilitates a fast and efficient simulation-based validation and verification. In this paper we present a design flow for a railway specific application based on SystemC. We show the modeling of Counting Heads (CHs) [7] for railways, which are used to determine whether a specified Track Vacancy Detection Section (TVDS) is clear or occupied. Especially for electronic railway interlocking systems as constructed by SIEMENS, which determine automatically, whether a TVDS is clear or occupied, the correct function of CHs is crucial: If they fail to work properly a TVDS would either be falsely indicated as occupied – resulting in a deterioration of availability and reliability – or falsely indicated as clear – possibly introducing a safety hazard. The proof of correctness helps to avoid such situations. Therefore, we present first steps towards a complete formal verification of CHs using Bounded Model Checking (BMC).