ProB-based railway interlocking system formal development and simulation method and device and readable medium

Abstract

The invention discloses a ProB-based railway interlocking system formal development and simulation method and device and a readable medium, and the method comprises the steps: analyzing an interlocking system, and obtaining the structure of the interlocking system; refining and layering the structure of the interlocking system to obtain a layered model of the interlocking system; performing formalized modeling on the hierarchical model of the interlocking system by adopting Event-B to obtain an Event-B model of the interlocking system; and instantiating the Event-B model of the interlocking system to obtain an instantiated Event-B model, and carrying out dynamic simulation on the instantiated Event-B model by adopting a ProB tool to obtain a development result of the interlocking system. According to the invention, the accuracy and safety of the model can be efficiently created and verified, and the reliability and safety of the interlocking system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of system development, and in particular to a formalized development and simulation method, device and readable medium of a railway interlocking system based on ProB. Background Art

[0002] Interlocking system plays a vital role in railway transportation to ensure the safety and efficiency of train operation. As a complex safety-critical system, the interlocking system avoids train derailment and conflicts and collisions between trains by precisely controlling equipment such as signal lights and switches. However, in the design and implementation of the interlocking system, if there are design defects or errors in functional modules, serious safety accidents may occur. Therefore, it is crucial to use formal methods to model and verify the interlocking system in the early stages of system development. Formal methods rigorously describe the structure and function of the system by establishing mathematical models to ensure that the design of each module meets the expected safety and performance requirements.

[0003] The Event-B-based formal method is an ideal choice for the development of high-quality interlocking systems due to its rigorous mathematical reasoning and progressive refinement mechanism. The Event-B method can gradually transition from an abstract model to a specific implementation through gradual refinement, ensuring the consistency and correctness of the system during the development process. At present, there are many successful cases based on Event-B in the field of rail transit. For example, well-known rail signal system suppliers such as Siemens and Bombardier use the Event-B method to design and verify their interlocking systems deployed worldwide to ensure their safety and reliability. However, although the Event-B method performs well in terms of requirement consistency, the correctness of functional implementation still needs further verification. Summary of the invention

[0004] The purpose of this application is to propose a formal development and simulation method, device and readable medium for a railway interlocking system based on ProB in response to the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides a formal development and simulation method for a railway interlocking system based on ProB, comprising the following steps:

[0006] Analyze the interlocking system and obtain the structure of the interlocking system;

[0007] Refine and layer the structure of the interlocking system to obtain a layered model of the interlocking system;

[0008] Event-B is used to formally model the hierarchical model of the interlocking system, and the Event-B model of the interlocking system is obtained;

[0009] The Event-B model of the interlocking system is instantiated to obtain the instantiated Event-B model. The ProB tool is used to dynamically simulate the instantiated Event-B model to obtain the development result of the interlocking system.

[0010] Preferably, the interlocking system includes each section, turnout and signal light in each route; the status of the section includes idle state, requisition state and occupied state, and the status of the turnout includes positive position, reverse position and whether locked; before the train enters, it is necessary to apply for an approach, and the process is as follows: the status of all sections is monitored by the interlocking system. When all sections in the route are in idle state, all sections of the route are reserved and all sections of the route are placed in requisition state. The status of all turnouts is monitored by the interlocking system. After the sections are reserved, the status of the turnouts in the route is placed in the correct position and locked; the signal The signal light is red in the default state. When all sections of the route are in the requisition state, the color of the signal light is set to green. When the train enters the route or the route is cancelled, the color of the signal light changes to red. When the route is cancelled, all switches on the route are unlocked and the status of the section becomes idle. During the process of the train moving forward, the status of the section in progress is changed to occupied, and an actual occupied path is generated. The switch is attached to a section. When the section with the switch is passed by the head and tail of the train, the switch is unlocked first, and then the status of the section is set to idle.

[0011] Preferably, the hierarchical model of the interlocking system includes an SR0_Route model, an SR1_Block model, an SR2_Point model and an SR3_Signal model. The SR0_Route model is used to establish the relationship between routes and paths, and the corresponding context is SR0. The SR1_Block model is used to introduce sections and establish the relationship between routes, paths and sections, and the corresponding context is SR1. The SR2_Point model is used to introduce switches and establish the relationship between routes, paths, sections and switches, and the corresponding context is SR2. The SR3_Signal model is used to introduce traffic lights and establish the relationship between routes, paths, sections, switches and traffic lights, and the corresponding context is SR3. The context is used to define the constants and sets and related axioms required in each hierarchical model, and the related axioms are used to describe the relationship between sets and constants.

[0012] Preferably, Event-B is used to formally model the hierarchical model of the interlocking system to obtain the Event-B model of the interlocking system, which specifically includes:

[0013] Use Event-B to formally model the interlocking system on the Rodin platform. Define sets, constants, and variables in the hierarchical model of the interlocking system. Add events to the hierarchical model of the interlocking system and determine the order of event execution. Events are used to describe the dynamic behavior of the interlocking system.

[0014] The collections in the SR0_Route model include routes and paths. The constants in the SR0_Route model include conflicting paths, initial paths, subpaths, empty paths, and mapped routes. The variables in the SR0_Route model include requested progress, canceled routes, occupied routes, and requisitioned routes. The events in the SR0_Route model include initialization, route application, path requisition, train entry, train movement, train departure, route release, route cancellation application, and route cancellation.

[0015] The collection in the SR1_Route model includes sections, the constants in the SR1_Route model include route mapping, first section, last section, next section and sub-route, the variables in the SR1_Route model include requisitioned path and occupied path, and the events in the SR1_Block model include initialization, route application, section requisition, route requisition, train entry, train head movement, train tail movement, section release, train departure, route release, route cancellation application, section cancellation and route cancellation;

[0016] The sets in the SR2_Route model include the turnout position set and the turnout locking state set. The constants in the SR2_Route model include turnout, turnout initial position, turnout correct position, turnout locked, turnout unlocked, reverse position and forward position. The variables in the SR2_Route model include turnout position and turnout locking state. The events in the SR2_Block model include initialization, route application, section requisition, turnout pull, turnout lock, route requisition, train entry, train head movement, train tail movement, turnout release, section release, train departure, route release, route cancellation application, all turnout release, section cancellation and route cancellation.

[0017] The collection in the SR3_Route model includes signal lights, the constants in the SR3_Route model include red and green, the variables in the SR3_Route model include the color of the signal lights, and the events in the SR3_Block model include initialization, applying for route, requisitioning section, switching switches, locking switches, requisitioning paths, signal lights turning green, train entering, signal lights turning red, train head moving, train tail moving, releasing switches, releasing sections, train leaving, releasing routes, applying for route cancellation, signal lights turning red, releasing all switches, canceling sections, and canceling routes;

[0018] The plug-in SMT on the Rodin platform is used for proof. After the proof is completed, the Event-B model of the interlocking system is obtained.

[0019] Preferably, the Event-B model of the interlocking system is instantiated to obtain the instantiated Event-B model, which specifically includes:

[0020] Get the track network layout, add the track network layout data to the context, and assign specific values ​​to the collections and constants of the Event-B model of each layer of the interlocking system.

[0021] As a preferred method, the ProB tool is used to dynamically simulate the instantiated Event-B model to obtain the development results of the interlocking system, including:

[0022] In ProB, the events in each instantiated Event-B model are executed sequentially. The changes of variables are observed during the execution of the events, and whether the interlocking system is deadlocked is verified based on the changes of variables. If so, the events are modified in the formal modeling step and the dynamic simulation is repeated until it is verified that the interlocking system does not have a deadlock. Otherwise, the instantiated Event-B model is used as the development result of the interlocking system.

[0023] In a second aspect, the present invention provides a formal development and simulation device for a railway interlocking system based on ProB, comprising:

[0024] A structural analysis module is configured to analyze the interlocking system to obtain the structure of the interlocking system;

[0025] A refinement module is configured to refine and hierarchize the structure of the interlocking system to obtain a hierarchical model of the interlocking system;

[0026] A modeling module is configured to formally model the hierarchical model of the interlocking system using Event-B to obtain an Event-B model of the interlocking system;

[0027] The simulation module is configured to instantiate the Event-B model of the interlocking system to obtain the instantiated Event-B model, and use the ProB tool to dynamically simulate the instantiated Event-B model to obtain the development result of the interlocking system.

[0028] In a third aspect, the present invention provides an electronic device comprising one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0029] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0030] In a fifth aspect, the present invention provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] (1) The ProB-based railway interlocking system formal development and simulation method proposed in this invention uses Event-B to formally model the interlocking system. Event-B provides a systematic and mathematical method to design and verify complex systems, and ensures the reliability and safety of the interlocking system through step-by-step refinement and consistency checking.

[0033] (2) The ProB-based railway interlocking system formal development and simulation method proposed in the present invention performs dynamic simulation and deadlock detection on the formal model of the interlocking system based on ProB, and efficiently creates and verifies the accuracy and security of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0035] Figure 1 A schematic diagram of a process flow of a formal development and simulation method of a railway interlocking system based on ProB according to an embodiment of the present application;

[0036] Figure 2 A flowchart of a formal development and simulation method of a railway interlocking system based on ProB according to an embodiment of the present application;

[0037] Figure 3 A schematic diagram of the structure of an interlocking system of a railway interlocking system formal development and simulation method based on ProB according to an embodiment of the present application;

[0038] Figure 4 A schematic diagram of the execution sequence of the first-layer model events of the ProB-based railway interlocking system formal development and simulation method according to an embodiment of the present application;

[0039] Figure 5A schematic diagram of the execution sequence of events of the second-layer model of the formal development and simulation method of the railway interlocking system based on ProB according to an embodiment of the present application;

[0040] Figure 6 A schematic diagram of the execution sequence of the third-layer model events of the ProB-based railway interlocking system formal development and simulation method according to an embodiment of the present application;

[0041] Figure 7 A schematic diagram of the execution sequence of the fourth-layer model events of the ProB-based railway interlocking system formal development and simulation method according to an embodiment of the present application;

[0042] Figure 8 A schematic diagram of the track network layout of the interlocking system of the ProB-based railway interlocking system formal development and simulation method according to an embodiment of the present application;

[0043] Fig. 9 It is a schematic diagram of representing the data of the first-layer Event-B model of the formal development and simulation method of the railway interlocking system based on ProB in an embodiment of the present application on a track network;

[0044] Fig.10 It is a schematic diagram of data of the second-layer Event-B model of the formal development and simulation method of the railway interlocking system based on ProB in an embodiment of the present application represented on a track network;

[0045] Figure 11-17 A schematic diagram of changes of a train on a track network during a dynamic simulation of an Event-B model of a railway interlocking system formal development and simulation method based on ProB according to an embodiment of the present application;

[0046] Fig.18 A schematic diagram of a formal development and simulation device for a railway interlocking system based on ProB according to an embodiment of the present application;

[0047] Fig.19 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0049] Figure 1The embodiment of the present application provides a ProB-based railway interlocking system formal development and simulation method, including the following steps:

[0050] S1, analyze the interlocking system and obtain the structure of the interlocking system.

[0051] In a specific embodiment, the interlocking system includes each section, turnout and signal light in each route; the status of the section includes idle state, requisition state and occupied state, and the status of the turnout includes positive position, reverse position and whether locked; before the train enters, it is necessary to apply for an approach, and the process is as follows: the status of all sections is monitored through the interlocking system. When all sections in the route are in idle state, all sections of the route are reserved and all sections of the route are placed in the requisition state. The status of all turnouts is monitored through the interlocking system. After the sections are reserved, the status of the turnouts in the route is placed in the correct position and locked. ; The signal light is red in the default state. When all sections of the route are in the requisition state, the color of the signal light is set to green. When the train enters the route or the route is cancelled, the color of the signal light changes to red; when the route is cancelled, all switches on the route are unlocked and the status of the section becomes idle; during the train's advancement, the status of the section in progress is changed to occupied, and an actual occupied path is generated. The switch is attached to a section. When the section with the switch is completed by the head and tail of the train, the switch is unlocked first, and then the status of the section is set to idle.

[0052] Specifically, Figure 2 As shown, the ProB-based railway interlocking system formal development and simulation method proposed in the embodiment of the present application includes structural analysis, refinement, Event-B modeling and simulation. Figure 3 In railway traffic control, the interlocking system effectively controls trains by managing turnouts and signal lights. By default, the signal light is red to indicate that trains are prohibited from entering. When a route is in a requisitioned state, the signal light color will be set to green to allow trains to enter the route. After the train enters the route, the signal light will turn red again to prevent the following vehicle from entering the route to prevent rear-end collisions. A route may include at least one section, and the status of the section includes idle state, requisition state, and occupied state.

[0053] The function of the turnout is to control the direction of the train and make the train run on the correct route. When handling a route, the turnout needs to be placed in the correct position and locked to prevent it from being misoperated or changing its state when the train passes by.

[0054] The main function of the interlocking system is to control the train by controlling the switches and signal lights. Before the train enters, it is necessary to apply for a route. The process of applying for a route includes:

[0055] 1) The interlocking system monitors the occupancy of all sections. When all sections involved in the route are idle, all sections in the route are reserved and put into the requisition state;

[0056] 2) The interlocking system monitors the status of all turnouts, including whether they are in reverse or forward position and whether they are locked. After the reserved section, the turnout in the route is moved to the correct position and locked;

[0057] 3) The route is successfully processed, the route is in requisition status, and the signal light color is changed to green to allow trains to enter.

[0058] After the route is successfully processed, the train can enter the route. However, you can also choose to cancel the route at this time. If the route is cancelled, the signal light will turn back to red, all the switches on the route will be unlocked, and all sections on the route will become idle. During the train's advance, the status of the route will be changed to occupied, and a section of actual occupied path (PATH) will be generated. This occupied path changes dynamically. The status of each section will also change accordingly. When the head and tail of the train pass through a section, the section can be released and put into an idle state. Since the switch is attached to a section, when the section with the switch is completed by the head and tail of the train, the switch needs to be unlocked before releasing the section, and then the section is released. When the train has completed the route, the route can be released and all sections are placed in an idle state. The release of the section does not need to wait until the train has completed the route. The section may also be in other routes. Releasing the section in advance can make other routes successfully processed faster, thereby improving operation efficiency.

[0059] S2, refine and layer the structure of the interlocking system to obtain a layered model of the interlocking system.

[0060] In a specific embodiment, the hierarchical model of the interlocking system includes an SR0_Route model, an SR1_Block model, an SR2_Point model and an SR3_Signal model. The SR0_Route model is used to establish the relationship between the route and the path, and the corresponding context is SR0. The SR1_Block model is used to introduce sections and establish the relationship between the route, the path and the section, and the corresponding context is SR1. The SR2_Point model is used to introduce switches and establish the relationship between the route, the path, the section and the switch, and the corresponding context is SR2. The SR3_Signal model is used to introduce traffic lights and establish the relationship between the route, the path, the section, the switch and the traffic light, and the corresponding context is SR3. The context is used to define the constants and sets and related axioms required in each hierarchical model, and the related axioms are used to describe the relationship between sets and constants.

[0061] Specifically, before Event-B modeling of the interlocking system, it is necessary to refine and layer the interlocking system. According to the analysis of the interlocking system in step S1, the interlocking system can be divided into four layers. Each layer of the model needs to have a corresponding context. The role of the context is mainly to define the constants and sets needed in the model and the related axioms used to describe the relationship between the sets and constants. Therefore, four hierarchical models are obtained, as shown in Table 1.

[0062] Table 1 Description of the hierarchical model of the interlocking system

[0063]

[0064] S3, Event-B is used to formally model the hierarchical model of the interlocking system to obtain the Event-B model of the interlocking system.

[0065] In a specific embodiment, step S3 specifically includes:

[0066] Use Event-B to formally model the interlocking system on the Rodin platform. Define sets, constants, and variables in the hierarchical model of the interlocking system. Add events to the hierarchical model of the interlocking system and determine the order of event execution. Events are used to describe the dynamic behavior of the interlocking system.

[0067] The collections in the SR0_Route model include routes and paths. The constants in the SR0_Route model include conflicting paths, initial paths, subpaths, empty paths, and mapped routes. The variables in the SR0_Route model include requested progress, canceled routes, occupied routes, and requisitioned routes. The events in the SR0_Route model include initialization, route application, path requisition, train entry, train movement, train departure, route release, route cancellation application, and route cancellation.

[0068] The collection in the SR1_Route model includes sections, the constants in the SR1_Route model include route mapping, first section, last section, next section and sub-route, the variables in the SR1_Route model include requisitioned path and occupied path, and the events in the SR1_Block model include initialization, route application, section requisition, route requisition, train entry, train head movement, train tail movement, section release, train departure, route release, route cancellation application, section cancellation and route cancellation;

[0069] The sets in the SR2_Route model include the turnout position set and the turnout locking state set. The constants in the SR2_Route model include turnout, turnout initial position, turnout correct position, turnout locked, turnout unlocked, reverse position and forward position. The variables in the SR2_Route model include turnout position and turnout locking state. The events in the SR2_Block model include initialization, route application, section requisition, turnout pull, turnout lock, route requisition, train entry, train head movement, train tail movement, turnout release, section release, train departure, route release, route cancellation application, all turnout release, section cancellation and route cancellation.

[0070] The collection in the SR3_Route model includes signal lights, the constants in the SR3_Route model include red and green, the variables in the SR3_Route model include the color of the signal lights, and the events in the SR3_Block model include initialization, applying for route, requisitioning section, switching switches, locking switches, requisitioning paths, signal lights turning green, train entering, signal lights turning red, train head moving, train tail moving, releasing switches, releasing sections, train leaving, releasing routes, applying for route cancellation, signal lights turning red, releasing all switches, canceling sections, and canceling routes;

[0071] The plug-in SMT on the Rodin platform is used for proof. After the proof is completed, the Event-B model of the interlocking system is obtained.

[0072] Specifically, according to the refined hierarchical steps in step S2, the formal modeling of the interlocking system is completed on the Rodin platform using Event-B.

[0073] The first-level model mainly considers the status of the route. When the route is idle, it can be processed. During the movement of the train, the occupied part is represented as the path (PATH). When the path is empty, the route can be released. Table 2 shows the sets in the first-level Event-B model, Table 3 shows the constants in the first-level Event-B model, and Table 4 shows the variables in the first-level Event-B model.

[0074] Table 2 Collections in the first-layer Event-B model

[0075]

[0076]

[0077] Table 3 Constants in the first-layer Event-B model

[0078]

[0079] Table 4 Variables in the first-level Event-B model

[0080]

[0081] After defining relevant collections, constants, and variables in the hierarchical model and context, events need to be added to the hierarchical model to describe the dynamic behavior of the interlocking system. Figure 4 This is the execution sequence diagram of events in the first-level Event-B model. During the movement of the train, the requisitioned path will gradually shorten until it is reduced from the initial path to the null path (NullPath). Before the train enters, you can apply to cancel the route. If the route is canceled, the route status will be changed to idle.

[0082] In the second-layer model, segments are introduced to map the path into a set of ordered segments. The occupation and release of the route and path are modeled as the occupation and release of the segments. When the segments in the route are all idle, the route can be processed. Similar to the first layer, related sets, constants and variables are defined, and corresponding events are added in the second-layer model. Table 5 shows the sets in the second-layer Event-B model, Table 6 shows the constants in the second-layer Event-B model, and Table 7 shows the variables in the second-layer Event-B model. Figure 5 This is the execution order of events in the second-layer Event-B model. The movement of the train is more detailed. The movement of the head train describes the process of the train from occupying the empty path (NullPath) to occupying the longest path, and the movement of the tail train describes the process of the train occupying the longest path to the empty path (NullPath). If the requisition of the section has been completed and the route is cancelled, all sections will be released first, and the status of all sections will be changed to idle.

[0083] Table 5 Collections in the second layer Event-B model

[0084] Collection Name Symbolic representation meaning Section BLOCK Sections that make up the route

[0085] Table 6 Constants in the second-layer Event-B model

[0086]

[0087] Table 7 Variables in the second-level Event-B model

[0088]

[0089] In the third-layer model, turnouts are introduced. Turnouts are attached to the sections. The second-layer model is refined to the point where the turnouts need to be moved to the correct position and locked when handling the route. The process of releasing the section is refined to first unlock the turnouts and then release them. Similarly, sets, constants, and variables are defined, and events are defined in the third-layer model. Table 8 shows the sets in the third-layer Event-B model, Table 9 shows the constants in the third-layer Event-B model, and Table 10 shows the variables in the third-layer Event-B model. Figure 6 This is the execution order of events in the third-layer Event-B model. Before requisitioning the route, if the switch is not in the correct position, it is necessary to first move the switch to the correct position and lock it. When canceling the route, if the switch is already locked, all switches must be unlocked before all sections can be released.

[0090] Table 8 shows the set of Event-B models in the third layer.

[0091] Collection Name Symbolic representation meaning Constants in a collection Turnout location collection POS Turnout location Minus, Plus Turnout lock status collection MODE Locking status of turnout Lock,Unlock

[0092] Table 9 Constants in the third-layer Event-B model

[0093]

[0094]

[0095] Table 10 Variables in the third-level Event-B model

[0096]

[0097] The signal light is introduced into the fourth-level model, and the above model is refined to turn the signal light green when handling the route, and turn the signal light back to red after the train enters to prevent subsequent trains from entering. Table 11 shows the sets and constants in the fourth-level Event-B model, and Table 12 shows the variables in the fourth-level Event-B model. Figure 7 This is the execution order of events in the fourth-layer Event-B model. After the route is requisitioned, the color of the signal light will change to green, and after the train enters, it will change back to red. When the route is cancelled, if the color of the signal light has changed to green, it is necessary to change the color of the signal light back to red to release the turnout.

[0098] Table 11 Collections and constants in the fourth layer Event-B model

[0099]

[0100] Table 12 Variables in the fourth-level Event-B model

[0101]

[0102] S4, instantiate the Event-B model of the interlocking system to obtain the instantiated Event-B model, use the ProB tool to dynamically simulate the instantiated Event-B model to obtain the development result of the interlocking system.

[0103] In a specific embodiment, the Event-B model of the interlocking system is instantiated to obtain the instantiated Event-B model, which specifically includes:

[0104] Get the track network layout, add the track network layout data to the context, and assign specific values ​​to the collections and constants of the Event-B model of each layer of the interlocking system.

[0105] In a specific embodiment, the ProB tool is used to dynamically simulate the instantiated Event-B model to obtain the development results of the interlocking system, which specifically include:

[0106] In ProB, the events in each instantiated Event-B model are executed sequentially. The changes of variables are observed during the execution of the events, and whether the interlocking system is deadlocked is verified based on the changes of variables. If so, the events are modified in the formal modeling step and the dynamic simulation is repeated until it is verified that the interlocking system does not have a deadlock. Otherwise, the instantiated Event-B model is used as the development result of the interlocking system.

[0107] Specifically, Figure 8 It is a schematic diagram of the track network layout of the interlocking system. The Event-B model at each layer instantiates the schematic diagram. Instantiation is to concretize the abstract Event-B model established in step S3. For example, the set ROUTE is only defined as a set in step S3, and the elements contained in this set are not defined. Instantiation is to define the elements in this set. Figure 8 Based on the track network layout in , each layer of Event-B model is instantiated, and specific values ​​are assigned to the sets and constants defined in step S3. The first layer of Event-B model has routes (ROUTE) and paths (PATH). The process of instantiation is mainly to concretize the sets and constants, add the track network layout data to the context, and obtain the instantiation results as shown in Table 13. In the first layer of instantiated Event-B model, axm1 indicates that there are two routes, R1 and R2, axm2 indicates that it can be abstractly represented as 7 paths during the movement of the train, axm3 indicates the conflict relationship between the paths, axm4 and axm5 indicate that the initial path of R1 is P13, the initial path of R2 is P23, and axm6 indicates the sub-path relationship between the paths. Fig. 9 It is the representation of data on the track network layout.

[0108] Table 13 Instantiation results of the first-layer instantiated Event-B model

[0109]

[0110] By introducing segments into the second-layer Event-B model, the train movement process will also be refined, and the instantiation results are shown in Table 14. Specifically, route R1 consists of three segments A, B, and C, and route R2 consists of three segments A, B, and D. More paths are introduced in axm1 to make the train movement process more detailed, and the sub-path relationship and conflict relationship of the newly added paths are defined in axm8 and axm9. axm3 indicates that paths P11, P21, P14, and P24 are composed of only one segment. axm4 defines the segment set corresponding to each path. axm5 and axm6 define the first segment and the last segment of the path respectively. axm7 defines the order relationship of the segments corresponding to the path. Fig. 9 It is the representation of data on the track network layout.

[0111] Table 14 Instantiation results of the second-layer instantiated Event-B model

[0112]

[0113] After the turnout is introduced into the third-layer Event-B model, the instantiation results shown in Table 15 are obtained. axm1 defines that section B has a turnout, axm2 defines that when R1 is requisitioned, the turnout should be in the positive position, and when R2 is requisitioned, the turnout should be in the reverse position, and axm3 defines that the initial position of the turnout is the positive position.

[0114] Table 15 Instantiation results of the Event-B model instantiated at the third layer

[0115]

[0116] In the fourth-layer Event-B model, the colors of the traffic light are defined to include red and green, and the instantiation results shown in Table 16 are obtained.

[0117] Table 16 Instantiation results of the Event-B model instantiated at the fourth layer

[0118] partition(SIGNAL,{Red},{Green}).

[0119] After the model instantiation is completed, the first-level instantiated Event-B model is dynamically simulated in ProB. Dynamic simulation executes events in sequence. The execution of events requires the use of instantiated data. After the event is executed, the changes in the variables can be seen. In the embodiment of the present application, the requisition path variable is used as an example. After requisitioning route R1, the train is allowed to enter. At this time, the requisitioned path is P13. As the train moves forward, the requisitioned path (Route2Path) gradually changes to P12, P11 and NullPath. The requisitioned path becomes NullPath, and the train leaves the route. Table 17 shows the status of the requisition path (Route2Path) variable after executing the event. The path for requisitioning is P13, and other variables will also change after the execution event, which will not be repeated here.

[0120] Table 17 Variable states in the first-level instantiation Event-B model after event execution

[0121]

[0122] In the second-level instantiation Event-B model, route R1 is requisitioned. After the train enters, the occupied path will gradually change from NullPath to P14, P15, P13, P12, and P11. Finally, the segment in the route is no longer occupied, and the occupied path is NullPath. Table 12 shows the status of the three variables Route2Path, Block2Route, and Route2OccPath after the event is executed. The R1 route has sections A, B, and C requisitioned, and the occupied path (Route2OccPath) Path P14 in the R1 route is occupied.

[0123] Table 18 Variable states in the second-layer instantiated Event-B model after event execution

[0124]

[0125]

[0126] In the third instantiation of the Event-B model and the fourth instantiation of the Event-B model, the turnout and the signal light are introduced respectively, and dynamic simulation is performed on them. Table 19 shows the status of the three variables of the turnout locking state (Point2Mode), turnout position (Point2Pos) and signal light color (Route2Signal) after the execution of the event. The turnout is initially unlocked and initially in the reverse position (Minus), and the signal light is initially red.

[0127] Table 19 Variable states of the third instantiated Event-B model and the fourth instantiated Event-B model after event execution

[0128]

[0129] Figure 11-17 represents the changes of the train in the track network layout. 11 represents before the train enters. At this time, the occupied path is the null path (NullPath), the requisitioned path is (Route2Path) P13, the requisitioned sections are A, B, and C, the switch (B) is in the correct position and locked, and the signal light is green; 12 represents after the train enters. The occupied path is P14, the requisitioned path is P13, the requisitioned sections are A, B, and C, the switch (B) is in the correct position and locked, and the signal light is red; 13 represents after the train enters. The occupied path is P15, the requisitioned path is P13, the requisitioned sections are A, B, and C, and the switch (B) is in the correct position and locked. The signal light is red; 14 means after the train enters, the occupied path is P13, the requisitioned path is P13, the requisitioned sections are A, B, and C, the switch (B) is in the correct position and locked, and the signal light is red; 15 means after the train enters, the occupied path is P12, the requisitioned path is P12, the requisitioned sections are B and C, the switch (B) is in the correct position and locked, and the signal light is red; 16 means after the train enters, the occupied path is P11, the requisitioned path is P11, the requisitioned section is C, the switch (B) is in the correct position and not locked, and the signal light is red; 17 means the train has left the route, releasing the route, and all sections are idle.

[0130] After using Event-B to formally model the interlocking system, the Event-B model is instantiated, that is, the track network layout data is added, and the dynamic simulation is completed using ProB. If it is verified that the interlocking system does not have a deadlock, the instantiated Event-B model can be used as the development result of the interlocking system. If it is verified that the interlocking system has a deadlock, the event in step S3 is modified and steps S3-S4 are repeated until the interlocking system does not have a deadlock. In the absence of a deadlock, the interlocking system can execute events in sequence. In the presence of a deadlock, the interlocking system has at least one event that cannot be executed in sequence.

[0131] Further references Fig.18 As an implementation of the methods shown in the above figures, the present application provides an embodiment of a railway interlocking system formal development and simulation device based on ProB. Figure 1 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0132] The embodiment of the present application provides a railway interlocking system formal development and simulation device based on ProB, including:

[0133] The structural analysis module 1 is configured to analyze the interlocking system to obtain the structure of the interlocking system;

[0134] A refinement module 2 is configured to refine and hierarchize the structure of the interlocking system to obtain a hierarchical model of the interlocking system;

[0135] A modeling module 3 is configured to formally model the hierarchical model of the interlocking system using Event-B to obtain an Event-B model of the interlocking system;

[0136] The simulation module 4 is configured to instantiate the Event-B model of the interlocking system to obtain the instantiated Event-B model, and use the ProB tool to dynamically simulate the instantiated Event-B model to obtain the development result of the interlocking system.

[0137] Fig.19 Schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present invention. Fig.19 As shown, the electronic device of this embodiment includes: a processor 1901 and a memory 1902; wherein the memory 1902 is used to store computer-executable instructions; the processor 1901 is used to execute the computer-executable instructions stored in the memory to implement the various steps performed by the electronic device in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0138] Optionally, the memory 1902 may be independent or integrated with the processor 1901 .

[0139] When the memory 1902 is independently provided, the electronic device further includes a bus 1903 for connecting the memory 1902 and the processor 1901 .

[0140] The embodiment of the present invention further provides a computer storage medium, in which computer execution instructions are stored. When the processor 1901 executes the computer execution instructions, the above method is implemented.

[0141] An embodiment of the present invention further provides a computer program product, including a computer program. When the computer program is executed by the processor 1901, the above method is implemented.

[0142] In the embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0143] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0144] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The unit formed by the above modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0145] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor 1901 to perform some steps of the methods of various embodiments of the present application.

[0146] It should be understood that the processor 1901 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor 1901 may be any conventional processor 1901, etc. The steps of the method disclosed in the invention may be directly embodied in the hardware processor 1901 for execution, or may be executed by a combination of hardware and software modules in the processor 1901.

[0147] The memory 1902 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0148] The bus 1903 may be an Industry Standard Architecture (ISA), a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 1903 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 1903 in the drawings of the present application is not limited to only one bus 1903 or one type of bus 1903.

[0149] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0150] An exemplary storage medium is coupled to the processor 1901, so that the processor 1901 can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor 1901. The processor 1901 and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor 1901 and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0151] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0152] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A formal development and simulation method for railway interlocking system based on ProB, characterized in that: The following steps are involved: Analyzing the interlocking system to obtain the structure of the interlocking system; Refining and layering the structure of the interlocking system to obtain a layered model of the interlocking system; Using Event-B to formally model the hierarchical model of the interlocking system, and obtaining the Event-B model of the interlocking system; The Event-B model of the interlocking system is instantiated to obtain the instantiated Event-B model, and the instantiated Event-B model is dynamically simulated using the ProB tool to obtain the development result of the interlocking system.

2. The ProB-based railway interlocking system formal development and simulation method according to claim 1 is characterized in that: The interlocking system includes each section, turnout and signal light in each route; the status of the section includes idle state, requisition state and occupied state, and the status of the turnout includes positive position, reverse position and whether locked; before the train enters, it is necessary to apply for an approach, and the process is as follows: the status of all sections is monitored by the interlocking system, and when all sections in the route are in idle state, all sections of the route are reserved and all sections of the route are put in requisition state, and the status of all turnouts is monitored by the interlocking system, and after the sections are reserved, the status of the turnouts in the route is put in the correct position and locked; the signal light is red in the default state, and the color of the signal light is green when all sections of the route are in requisition state, and the color of the signal light changes to red after the train enters the route or the route is cancelled; when the route is cancelled, all turnouts on the route are unlocked and the status of the section changes to idle state; During the process of the train moving forward, the state of the progress section is changed to an occupied state, and an actually occupied path is generated. The switch is attached to a section. When the section with the switch is completed by the head and tail of the train, the switch is first unlocked and then the state of the section is set to an idle state.

3. The ProB-based railway interlocking system formal development and simulation method according to claim 2 is characterized in that: The hierarchical model of the interlocking system includes an SR0_Route model, an SR1_Block model, an SR2_Point model and an SR3_Signal model. The SR0_Route model is used to establish the relationship between the route and the path, and the corresponding context is SR0. The SR1_Block model is used to introduce sections and establish the relationship between routes, paths and sections, and the corresponding context is SR1. The SR2_Point model is used to introduce switches and establish the relationship between routes, paths, sections and switches, and the corresponding context is SR2. The SR3_Signal model is used to introduce traffic lights and establish the relationship between routes, paths, sections, switches and traffic lights, and the corresponding context is SR3. The context is used to define constants and sets and related axioms required in each hierarchical model, and the related axioms are used to describe the relationship between sets and constants.

4. The ProB-based railway interlocking system formal development and simulation method according to claim 3 is characterized in that: Event-B is used to formally model the hierarchical model of the interlocking system to obtain the Event-B model of the interlocking system, which specifically includes: The interlocking system is formally modeled on the Rodin platform using Event-B, sets, constants and variables are defined in the hierarchical model of the interlocking system, and events are added to the hierarchical model of the interlocking system and the order of execution of the events is determined, wherein the events are used to describe the dynamic behavior of the interlocking system; The set in the SR0_Route model includes routes and paths, the constants in the SR0_Route model include conflicting paths, initial paths, subpaths, empty paths, and mapped routes, the variables in the SR0_Route model include requested progress, canceled routes, occupied routes, and requisitioned routes, and the events in the SR0_Route model include initialization, application for routes, requisition of paths, train entry, train movement, train departure, release of routes, application for cancellation of routes, and cancellation of routes; The set in the SR1_Route model includes sections, the constants in the SR1_Route model include path mapping, first section, last section, next section and sub-path, the variables in the SR1_Route model include requisitioned paths and occupied paths, and the events in the SR1_Block model include initialization, application for route, requisition of section, requisition of path, train entry, head movement, tail movement, release of section, train departure, release of route, application for route cancellation, cancellation of section and cancellation of route; The set in the SR2_Route model includes a turnout position set and a turnout locking state set, the constants in the SR2_Route model include turnout, turnout initial position, turnout correct position, turnout locked, turnout unlocked, reverse position and forward position, the variables in the SR2_Route model include turnout position and turnout locking state, the events in the SR2_Block model include initialization, application for route, requisition section, turning turnout, locking turnout, requisition path, train entry, train head movement, train tail movement, release turnout, release section, train departure, release route, application for route cancellation, release all turnouts, cancel section and cancel route; The set in the SR3_Route model includes a signal light, the constants in the SR3_Route model include red and green, the variables in the SR3_Route model include the color of the signal light, and the events in the SR3_Block model include initialization, applying for a route, requisitioning a section, pulling a switch, locking a switch, requisitioning a path, the signal light turns green, a train enters, the signal light turns red, the head of the train moves, the tail of the train moves, the switch is released, the section is released, the train leaves, the route is released, the route is canceled, the signal light turns red, all switches are released, the section is canceled, and the route is canceled; The plug-in SMT on the Rodin platform is used for proof. After the proof is completed, the Event-B model of the interlocking system is obtained.

5. The ProB-based railway interlocking system formal development and simulation method according to claim 3 is characterized in that: The Event-B model of the interlocking system is instantiated to obtain the instantiated Event-B model, which specifically includes: The track network layout is obtained, the data of the track network layout is added to the context, and specific values ​​are assigned to the set and constants of the Event-B model of each layer of the interlocking system.

6. The ProB-based railway interlocking system formal development and simulation method according to claim 4 is characterized in that: The instantiated Event-B model is dynamically simulated using the ProB tool to obtain the development results of the interlocking system, including: In ProB, the events in each layer of the instantiated Event-B model are executed in sequence, and the changes of the variables are observed during the execution of the events. Based on the changes of the variables, it is verified whether the interlocking system is deadlocked. If so, the events are modified in the formal modeling step and the dynamic simulation is repeated until it is verified that the interlocking system is not deadlocked. Otherwise, the instantiated Event-B model is used as the development result of the interlocking system.

7. A formal development and simulation device for railway interlocking system based on ProB, characterized in that: include: A structural analysis module is configured to analyze the interlocking system to obtain the structure of the interlocking system; A refinement module, configured to refine and hierarchize the structure of the interlocking system to obtain a hierarchical model of the interlocking system; A modeling module is configured to use Event-B to formally model the hierarchical model of the interlocking system to obtain an Event-B model of the interlocking system; The simulation module is configured to instantiate the Event-B model of the interlocking system to obtain the instantiated Event-B model, and use the ProB tool to dynamically simulate the instantiated Event-B model to obtain the development result of the interlocking system.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images