Philippe Bon’s research while affiliated with Gustave Eiffel University and other places

Le système européen de surveillance du trafic ferroviaire (en anglais, European Rail Traffic Management System, ERTMS) est un système complexe de contrôle/commande et de signalisation ferroviaire mettant en ½uvre des règles européennes d'exploitation ferroviaires. Cet article propose une étude de cas basée sur deux scénarios extraits de ces règles, un scénario nominal d'autorisation de mouvement et un scénario exceptionnel de franchissement d'un arrêt. En effet, on trouve dans ces scénarios des aspects fonctionnels et de sécurité. Ces aspects nécessitent, d'une part, une modélisation fonctionnelle enrichie par des modèles décrivant la politique de sécurité et les autorisations données aux agents agissant sur le système, et d'autre part, une validation formelle. Pour ce faire, nous avons utilisé la plate-forme B4MSecure, fondée sur l'approche IDM (Ingénierie Dirigée par les Modèles), produisant à partir des modèles UML des spécifications formelles B. L'objectif de ces spécifications résultantes est de valider ces scénarios à l'aide d'outils d'animation et de preuve de spécifications B afin de garantir une analyse rigoureuse de la fonctionnalité et de la politique de sécurité.

The B method is a formal specification method and a means of formal verification and validation of safety-critical systems such as railway systems. In this short paper, we use the B4MSecure tool to transform the UML models, fulfilling requirements of European Railway Traffic Management System (ERTMS) operating rules, into B specifications in order to formally validate them.

La modélisation est un processus dédié à l'analyse des exigences dans le but de formaliser les représentations informelles des exigences système. La vérification, en revanche, est un processus de qualification qui permet de détecter et prévenir les défaillances dans les modèles. Ces deux approches sont de plus en plus utilisées dans l'industrie pour maîtriser la complexité croissante des systèmes conçus. Le papier propose une méthodologie générale de modélisation et de vérification pour les systèmes de contrôle à temps réel en se basant sur la ré-utilisabilité des connaissances des experts du domaine pour favoriser les échanges entre les projets similaires. Le papier présente une architecture d'une plate-forme dédiée à l'évaluation des systèmes basée sur un modèle générique de référence des systèmes de contrôle à temps-réel.

L’interopérabilité est un paramètre clef pour la compétitivité des systèmes ferroviaires européens. Elle est la condition à l’ouverture de nouveaux marchés et à la mise à disposition de nouveaux services. Un des points critique et la faculté de délivrer un service performant et sûr, sans avoir recours à des transbordements de passagers ou de matériels. Une des étapes est le respect d’un ensemble de règlements techniques opérationnels qui garantissent que les exigences essentielles sont vérifiées. Le projet Perfect veut contribuer à la validation d’une implantation des spécifications européennes d’interopérabilité sur le sol français. Concrètement, ERTMS " European Rail Traffic Management System ", ne définit que l’environnent technique et opérationnel des matériel à bord des trains. Le comportement des matériels au sol est pour sa part essentiellement régi par les lois nationales. Ce dernier aspect produit une certaine complexité dans l’analyse de sécurité du système global. La proposition principale du projet est d’étudier la consistance des différentes spécifications entre elles en utilisant des outils formels et en choisissant l’angle de la sécurité. Ce problème, critique au regard des enjeux, n’est abordé dans la littérature que de manière très parcellaire.

ERTMS implementation in France =>ERTMS for on board + national trackside). Problem: hard to evaluate the whole system regarding safety requirements. Ordinary method of railway standards comparison => Experienced experts to compare the detail entries of each rule. Weakness: Low-productivity. Solution: Set up formal specifications of ERTMS and local system to assess the safety of an ERTMS solution on a given french system. Railway interlocking system is a crucial link of local system. The methodology of establishing the formal petri net model of French railway interlocking is the main focus of the work.

The modeling process aims to define and analyse requirements for testing physical scale systems such as robotic surgery machines, railway signalling and control systems, nuclear reactor control systems, etc... These safety-critical systems whose failure may result in severe human or physical damage, are designed to be testable and verifiable before their implementation. To understand the system specifications and its functionalities, different types of models are used and each one reflects a viewpoint of a particular scope. Furthermore, its aim is to risk analysis and performance testing. Our approach is based on goal-oriented requirements elicitation, structuring and analysis. To automate the latter requirements engineering processes it is crucial that we involve expert knowledge. This process needs to be split into several steps. This work is limited to present techniques to obtain specifications dependency graphs from a set of requirements to determine the global goal model. This paper presents a domain independent framework for operational requirements modeling beside of specifications structuring technique based on Guidance Ontology. The present work focuses on improving the performance of structuring techniques through a pattern recognition based on a guidance ontology. This approach is shown to enable the structuring process automation by making use of domain ontologies as an expert knowledge base and capitalization.

Interoperability of the rail system within Europe is a key to its competitiveness. It aims at creating a rail network allowing a transport that is safe, compliant with the required performance level of the lines, and which does not necessitate train transfers. This requires the compliance with a set of rules, of technical and operational conditions which ensure that all the safety requirements are met. The main proposition is to contribute to the implementation of a European system for railway signalling called ”European Rail Traffic Management System” (ERTMS) using a methodology based on B framework tools. The idea is to assist the writer of the national operating rules. The national operating rules are expected to define the precise implementation of the high level ERTMS Specification Requirement System (SRS). They fulfils the national rule and refines the ERTMS specification in the context of a particular infrastructure. Some parts of the specification may be considered as irrelevant in the context of some particular infrastructures. A second step consists in refining the needed behaviour so that the national safety conditions and the ERTMS can be proved to be fulfilled. The methodology proposes to represent all the needed information using the B formalism in a three stepped methodology: The first step models the useful part of ERTMS specification in the context of the considered infrastructure. A requirements model is obtained. The second step consists in enriching the existing model with a precise description of the functioning of the infrastructure. More precisely, the interlocking implementation and the Automatic Train Protection (ATP) is taken into account and a process model is obtained. The third step consists in consistency checking between the two first models. The second model should be a refinement of the first one, because it is a particular instantiation of the ERTMS requirements. When it is not the case, some proof obligations will not be validated by the proof assistant included in the B framework. Then, the writer of the operating rules can try to introduce new logical propositions so that the proof obligations are fulfilled. When these three tasks are achieved, the writer of the rule has the logical proof that his operation rule is a national instance of the ERTMS SRS. The focus of the paper will be mainly on the second step.

Simulation is the imitation of a system or a process in order to manage the complexity of simulated system or to optimize its performance. This paper presents a agent-based strategy of modeling and simulation.We introduce some modelling methodologies in order to determine the most adequate technique to deal with embedded control systems. We also introduce the Tropos and Agentology methodologies by describing used concepts and how they are integrated with the current stages of Tropos and Multi-agent System methodology. The above is illustrated using an embedded real-time control system as a case study.

In the context of safety requirement engineering, model transformation is a task of interest. Indeed, it allows us to keep all the requirements while switching from one point of view to another. The presented work assumes that a valid solution has been found and proposes an approach in order to build a valid implementation. As some fine dynamic properties are integrated into the specification, high-level Petri nets are used to specify and verify the solution. Then, considering an industrial railway context, the transformation of the Petri net model in order to provide an input to a B process is considered. This last consideration leads to a proposition of a systematic direct transformation of the Petri net model into abstract B machines. The approach is illustrated by a theoretical railway example. The limitations of this approach are discussed at the end of the paper and some prospects are detailed.

The adequacy of the B method to produce a valid software implementation is well known, particularly in the guided transport domain. However, there is an important work to be performed using the informal specification before entering the B process. A lot of requirements are difficult to express and to assess using formal methods. The use of a human expertise cannot be avoided. The upstream requirements analysis may be assist with some graphical tool using UML notations. Nevertheless the main problem to be solved may be the choice of the adequate tool.