Example 2
 Compared with the traditional timed automata automaton, a mechanism to increase the time constraints, but also have joined the state transition diagram Notes, the expression of a real-time constraints of the system features that will have very good results. Using finite variables representing time, and annotated with a constraint state transition diagram. Constraints based on transition conditions of the system, wherein, if the time-related constraints, time variables to determine the timing of the state transition occurs, is called the time limit. A real-time system, typically constituted by a plurality of network time automata automata work time.
 UPPAAL by Aalborg University and the University of Uppsala in Sweden, Denmark jointly developed automaton model of time formal tool built on time automata theory. UPPAAL use professional grammar, state space model of the system for safety search, verification system, accessibility and limited activity and other characteristics. UPPAAL use of a BNF grammar, be detected by the system state space traversal. UPPAAL verify three main indicators considered model, namely security, accessibility, restricted activity. The main security for the safety properties of the model validation, such as checking whether the system deadlock and so on. The main function of the accessibility properties to verify the model, such as checking whether a state can migrate correctly. Restricted mainly active functional attributes of the inspection system, the main time constraints verification system is valid.
 A method for the automatic train fire linkage needs to consider not only the drive linkage during the operation result, control linkage required time, the time between the different linkage systems with different requirements. Further, since each system work independently, different systems prone to various problems, consider the instability of the entire interior of the linkage program. Thus, a method to achieve linkage with real-time train fire and concurrency. As a real-time system simulation time introduced by the automatic machine can be a set of parallel, mutually communicating automata time to represent the link between the linkage system of each embodiment of the process and system, the entire system will be described as a network time automatic machine, whereby to meet the requirements of real-time and concurrent linkage program, and therefore, the present invention proposes to employ UPPAAL linkage program modeling analysis to security attributes and functional attributes authentication scheme.
 Linkage Model train fire in the verification method of the present invention comprises: time-based UPPAAL tool automata theory, establishing automaton model, comprising: a time the FAS automaton model, communication detection time automaton model, the TCMS time automaton model and automatic time OCC machine model, including the deployment of the OCC and subsystems therein ISCS; time automaton constituted by the network automata model described and verify the linkage train fire the method of Example 1, the linkage method of the train fire in response to the linkage between the various processes and systems to verify the logic, and the logic flow is determined whether an error occurs in response to the linkage. FAS automaton model time, detection time communications automaton model, and the TCMS time automaton model automaton model OCC time, each time the automaton clock independent variable, a timing of data processing within the various processes, tetrakis time automata automata network time constitute described automatic train fire in the driving linkage.
 Image 6 FAS is a schematic diagram automaton model time, the main channel and the state model, the variables described in Table 1 below.
 Table 1 FAS Timed Automata Model Description
 Combine Image 6 And shown in Table 1, when there is no fire, FAS in an initial idle state. When a smoke alarm conditions are temperature detectors SHD1, transferred to a warning state, this state is detected in the second temperature detectors SHD2 smoke reaches the alarm condition, if only one symbol smoke detector alarm temperature conditions may be considered It is false because environmental problems, as a result of electromagnetic interference, return to the initial state. If the second temperature detectors also smoke reaches the alarm condition is deemed detected fire, FAS alarm to TCMS, alarmed state and alarm. Similarly, when the temperature sensing cable is cut, if the temperature cable alarm address corresponding to the read, FAS will alarm to TCMS, and transferred to the alarm state, if the temperature sensing is not read to the cable corresponding alarm address, then FAS prove abnormal operation, into an abnormal state Error. Further, the passenger car alarm can manual, manual alarm when a passenger, FAS directly alert the system to the TCS, and alarmed state alarm.
 When FAS is in alarm alarm, the train is in the fire on behalf of the state, this time, if an exception occurs and the connection TCMS may cause alarm information is not forwarded success, FAS needs immediately transferred to an abnormal state Error. If the information received TCMS end of the fire, the fire has been completed on behalf of, FAS initial state into idle. If the reset signal is received from the TCMS, it represents TCMS for some reason, is reset by a human operator, and orders that FAS is reset to the initial state idle.
 When an abnormal state FAS Error, the need to manually reset the cabinet of the FAS. All comes to manual operation, whether by hand to confirm the end of the fire and security.
 Figure 7 Is a schematic view of the communication automaton model detection time, the main channel and the state model, the variables described in Table 2 below.
 Table 2 Time communication detection automaton model described
 Combine Figure 7 And shown in Table 2, when there is no communication request, the communication is detected in an initial state TCMS idle. After receiving the connection request of FAS, FAS starts waiting for reception of the alarm information, if the corresponding information is not received within a predetermined time T_FAS2TCMS, then the communication abnormality occurs. Upon receiving the alarm information, the alarm information is received on behalf of TCMS. Further, for CCTV, ISCS, BAS, PA, PIS systems, when applying the TCMS into interlocking respective wait state corresponding to the communication, if the feedback set in the corresponding time, represents the successful communication, or as a communication abnormality .
 Figure 8 Is a schematic view automaton model TCMS time, the main channel and the state model, the variables described in Table 3 below.
 Table 3 TCMS Timed Automata Model Description
 Combine Figure 8 And shown in Table 3, when the fire alarm is not received, the TCMS is in the idle state. After receiving the fire alarm, TCMS into RecvFireAlarm state. In this state, the TCMS information necessary to forward the fire alarm OCC ISCS to the vehicle by wireless communication, if a forwarding failure, abnormalities may occur ISCS is connected into an abnormal state Error. In addition, the TCMS CCTV cameras also need to be close to the fire screen to the position synchronization ISCS, if the synchronization fails, into an abnormal state Error. When the fire alarm and the screen information to the synchronization ISCS, TCMS OCC dispatcher waits to confirm whether a fire occurs, it is determined if the dispatcher is false, i.e. there is no fire, the fire-free state into NoFire, and immediately forwarded to the fire end of FAS information, then the initial state into idle. If the dispatcher confirmed the fire, the TCMS into joint state LinkageOthers, ready to fire linkage other emergency response systems.
 When TCMS located LinkageOthers state, need to continue joint fire-related emergency response systems, including BAS close linkage fresh air, air conditioning, fire linkage PA and PIS were broadcast and passenger evacuation. If TCMS system linkage and related abnormalities, then transferred to an abnormal state Error, or as a joint success. At the end of each life cycle, check that all the systems were connected and connections are successful, if not met, the representatives of TCMS system is abnormal, the abnormal state into Error. If all satisfied, the clock is reset and the connection state of each device, the connection re-request, in order to achieve the effect of continuous linkage. In this state, TCMS OCC received the information after the fire, no fire into the state NoFire, and forwarded immediately to the fire FAS end message, then transferred to the initial state idle.
 When an abnormal state TCMS Error, need to confirm the cancellation by the staff after a fire, the system of the TCMS manual reset, and resets respectively forward the information to the OCC with FAS, so that both ends of fire-related operations performed to avoid a deadlock state.
 Figure 9 OCC is a schematic diagram automaton model time, the main channel and the state model, the variables described in Table 4 below.
 Table 4 OCC Model Description Timed Automata
 Combine Figure 9 And Table 4, when the fire alarm message is not received, in an initial state of the OCC idle. When receiving the synchronization ISCS picture from the CCTV and forwarded by the message until the TCMS, alarm, alarm state into the OCC WARNING. After the alarmed state, the OCC has been confirmed SelectStation station and released state deduction command status HoldTrain, train position respectively an acknowledgment of the train station and a longitudinal section which deduction command issued to the corresponding station, and proceeds to wait for confirmation state Wait_FireSure, waiting for the fire dispatchers confirm.
 If there is no fire dispatcher confirmed, it sends false signal, to cancel a previously issued command deduction, the initial state into idle. If the dispatcher confirmed the fire, the OCC linkage corresponding to the station PA and PIS and other fire-related emergency response system after the end of the fire into the waiting state Wait_FireOver. When the end of the fire, the OCC dispatcher by remote reset, can be reset manually by the train fire TCMS to the reset, and cancel command corresponding deduction linkage, again into the initial state ilde.
 Models requires authentication security, limited activity as well as various functions for verification, can in turn enter the BNF is required to verify the nature of statements in the list UPPAAL validator, Figure 10 The method of linkage is a train fire schematic model validation results, Table 5 shows the train fire alarm system needs to verify the nature and the corresponding BNF statement verification result.
 Table 5 in conjunction train fire properties verification method UPPAAL
 Combine Figure 10 And as shown in Table 5, the model train fire verification method established linkage FAS automaton model time, detection time communications automaton model, the TCMS OCC time and time automaton model automaton model configured by four time automata model automatic machine network, and described in conjunction train fire method described in Example 1 is verified. By settling time automaton model validation process and avoid the interlocking logic error, resulting in problems such as deadlock system failure, to ensure the safe train operation.