Lessons Learned in Designing and Evaluating Railway Control Systems

Demonstrating the safety of modern Railway Control Systems based on microprocessors is more complicated than showing that of traditional relay systems, because the behaviour of microprocessors when faults occur is unpredictable. This paper presents an overview of the main Verification and Validation (V&V) methods used by the Reliability, Availability, Maintainability and Safety (RAMS) team at Ansaldo Segnalamento Ferroviario: how we specify and demonstrate that the system under testing is Reliable, Available, Maintainable and Safe in compliance with the European Railway Standard CENELEC. Tests are executed on a system prototype with an environment simulator and consist of Code Inspection, monitoring I/O Variables, measuring performances by means of a Logic Analyzer, and exercising the diagnostics via a proprietary Fault Injection Board. For critical parts, formal specifications are used (e.g., in SDL).