JP3246337B2 - Verification device of interlocking device and verification method of interlocking device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a design verification of an interlocking device for realizing a railway security function, and more particularly to a computer utilizing both the interlocking logic of the device and satisfying a real-time constraint on the timing at which the device operates. And verification methods.

[0002]

2. Description of the Related Art There are two types of interlocking devices: a system using a relay device (hereinafter referred to as a "relay interlocking device") and a system using a microcomputer (hereinafter referred to as an "electronic interlocking device"). is there. Conventionally, a manual test was performed using real interlocking devices and field devices to verify that the relay interlocking devices operate as intended without errors, requiring a great deal of labor and time. Met. Also, in order to increase the possibility of finding errors, it was necessary to test as many and as many different operation patterns as possible. In addition, in order to verify that the electronic interlocking device operates without error as intended by the designer, conventionally, a simulation test was performed on a computer.
In this method, the interlocking device needs to be represented by logical data in a format suitable for simulation on a computer.
In the past, this logical data had to be created manually, but usually this logical data was complicated and required a great deal of labor and time. Also, in order to increase the possibility of finding an error, it was necessary to test operation patterns in many different cases. For verification of an interlocking device using a computer, refer to
As shown in the official gazette, the interlocking conditions shown in the interlocking chart
There has been a method of collating interlocked logic data obtained from a connection diagram of a circuit group created based on the interlocked chart by computer simulation. Although this method aims at facilitating the creation of interlocked logical data suitable for simulation on a computer, it does not solve the problem that it is necessary to test the operation patterns of many various cases described above. The purpose of this method is to verify the consistency between the function of the interlocking device represented by the interlocking diagram and the interlocking logic of the circuit group that constitutes the actual interlocking device. However, it is impossible to verify that the design of the interlocking device is correctly performed as intended by the designer. In general, the interlocking device needs to satisfy not only the interlocking condition by logic but also the real-time constraint on the operation timing of the signal and the operation of the switch. The method described above verifies the logical interlocking condition, and cannot verify whether the real-time constraint on the timing is satisfied.

[0003]

As described above, verification by a test using a real interlocking device or a field device of the relay interlocking device requires a great deal of labor and time. On the other hand, in verification of an electronic interlocking device by simulation on a computer, a great deal of labor and time were required to express the interlocking device with logical data in a format suitable for simulation on a computer. In both the tests using real devices and equipment and the verification by computer simulation, even if there is an error in the interlocking device, if the test pattern is not affected by the error location, the error is found. Can not. Therefore, in order to completely guarantee that the interlocking device is free from errors, it is necessary to prepare a test pattern for checking all parts and states of the interlocking device. In general, the number of such test patterns can be enormous, making them impractical. Therefore, the problem is usually dealt with by preparing a test pattern for checking a portion where an error is likely to have a particularly serious effect. For this reason, a portion where the test pattern does not act and a state remain, so that there is a problem that it cannot be guaranteed that there is no error in the interlock device. Also, even if it is found that an error exists in the interlocking device, it is usually not easy to completely identify where the error exists in the device. Therefore, when an error is found as a result of the verification, it is necessary to provide information necessary for specifying the location of the error. In the verification of the interlocking device, it is necessary to verify that the operation correctly operates according to the interlocking logic and that the real-time constraint on the operation timing is satisfied. Further, at this time, if the satisfaction of the real-time constraint condition regarding the operation timing is to be verified, there is a problem that the verification operation is complicated and the labor required for the verification is significantly increased. On the other hand, if there is a design error, the error usually involves only a part of the real-time constraints that appear in the design of the interlocking device. Since there is no need to consider time constraints, it is desirable to perform verification under as few real-time constraints as possible to increase the efficiency of the verification work.

SUMMARY OF THE INVENTION The present invention has been made to solve such a problem, and has as its object to guarantee that an interlocking device is correctly designed as intended by a designer and satisfies required specifications. It is what it was.

[0005]

According to a first aspect of the present invention, there is provided an interlocking apparatus verification apparatus for converting a design description of an interlocking apparatus and a description of a required specification for the interlocking apparatus into a formal language expressing constraint conditions. And a formal verifier for proving the equivalence of the two formal language descriptions converted by the converter, and a verification result output means for outputting the result of the proof.

In the verification device for an interlocking device according to the second configuration of the present invention, the formal verifier outputs a case caused by this contradiction as a counter example when the two descriptions are not equivalent. .

The verification device for an interlocking device according to the third configuration of the present invention uses a language capable of expressing both logical conditions and real-time constraints as the formal language.

In a first aspect of the present invention, a method for verifying an interlocking device uses the interlocking device verification device having the above-described first configuration to determine whether or not there is a contradiction between the two descriptions and whether the design of the interlocking device is correct. To verify.

A verification method of an interlocking device according to a second method of the present invention uses the interlocking device verification device according to the second configuration, and specifies a portion having a design error using the output of the counterexample. It is.

A third aspect of the present invention relates to a method for verifying an interlocking device, wherein the verification device for an interlocking device according to the third configuration is used for verifying equivalence among real-time constraints appearing in an input description. The real-time constraints that do not affect the proof of the above are excluded, and the verification load is reduced.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1 FIG. FIG. 1 is a diagram illustrating a configuration of an apparatus that executes an interlocking apparatus verification method according to a first embodiment of the present invention. The arrows in the figure represent the flow of data. The present invention comprises a converter 2, a formal verifier 3, and a verification result output means 4. The converter 2 is a kind of translator, and is used to convert an expression that describes a design of an interlocking device in a fixed format like an interlocking diagram into a description of a formal language that can be handled by the formal verifier 3. It is. The formal verifier 3 is for inputting two descriptions in a formal language and proving their equivalence.

Next, a general flow of verification of an interlocking device according to the present invention will be described with reference to FIG. The designer describes the design of the interlocking device using a familiar expression means, and uses the description as the description (1) of the input description 1. This description (1) corresponds to the converter 2
Automatically converts it into a description (1 ^* ) in a formal language. Further, when there is another description related to this interlocking device, this is used as the description (2) of the input description 1. This description (2) is automatically converted by the converter 2 into a description (2 ^* ) in a formal language. At this time, if the description (2) is directly described in a formal language, the converter 2 does nothing, and the description (2) and the description (2 ^* ) have the same contents. Description (1 ^* )
And the description (2 ^* ) are input to the formal verifier 3, and an attempt is made to formally prove the equivalence of the contents of the two. here,
If the description (1 ^* ) describes the design of the interlocking device, and the description (2 ^* ) is a function to be realized by the interlocking device, that is, a required specification for the interlocking device, the 2 input by the verification result output means 4 By verifying whether or not the two descriptions are equivalent, it can be determined whether or not the design of the interlocking device is correct. The formal verifier 3 has a function of outputting an inconsistent case between the description 1 ^* and the description 2 ^* when the equivalence is not established.

Next, one of the input descriptions is an interlocking chart,
The present invention will be described in further detail by taking as an example a case where a formal language is a formal language that can express both logical conditions and real-time constraints. Many programming languages, such as the C language, can express both of the above conditions, but for most programming languages, there is no general way to prove the equivalence of descriptions in that language. Languages that can express the above conditions and can prove equivalence (languages that can express constraint conditions, hereinafter referred to as constraint description languages) include:
Timed Computational Tree Logic "R. Alur, C. Courco
ubetis and D.Dill: “Model-checking for real-time
systems ”, Proceedings of Fifth Annual IEEE Sympos
ium on Logic in Computer Science, pages 414-425, I
EEE Computer Society Press (1990) "(hereinafter TCTL
Real-Time Logic "F. Jahanian and AK Mo
k: “Safety Analysis of Timing Properties in Real-
Time Systems ”, IEEE Transactions on Software Engi
neering, pages 890-904, Vol. 12, No. 9 (1986) "(hereinafter referred to as RTL) and TNL" T. Yoneda, A. Shibayam.
a, B.-H. Schlingloff and EM Clarke: “Efficient
Verification of Parallel Real-Time Systems ”, Proc
eedings of the 5th International Conference on Com
puter Aided Verification, pages 321-332, LNCS 697,
Springer-Verlag (1993) ". Although the proof ability is limited, the constraint logic program "Jaffar, J. a
nd J.- L. Lassez: “Constraint Logic Programmin
g ”, Proceedings of the 14th ACM Symposium on Prin
ciples of Programming Languages, pages 111-119, AC
M (1987) "can also be used as a constraint description language. In the following example, TCTL and a TCTL state transition graph expression will be used as the constraint description language.

As an object to be verified, (part of) an interlocking device represented by an interlocking diagram composed of the interlocking diagram of FIG. 2 and the interlocking table of FIG. 3 is taken, and the properties thereof are verified. The interlocking diagram of FIG. 2 shows the configuration of the equipment of the interlocking device. Bold lines represent tracks. Arrow 5 indicates the approach direction of the vehicle. That is, in FIG. 2, the vehicle travels from left to right. A track circuit is installed in each section separated by a vertical line, and the presence or absence of a vehicle in the section is detected.
The lower 1T, 21T, and 1RT represent the names of track circuits in each section. Symbol 6 represents a traffic light, and 1R represents the name of the traffic light. The traffic light 1R controls the progress from the direction 1T below the track circuit to the direction of the track circuit 1RT, and usually indicates a progress signal. Thus, the signal that the traffic signal usually shows
Here, the localization (or heading) of the traffic light
). A point machine is installed at the intersection 7 of the tracks, and 21 indicates the name of the point machine. The point machine is usually fixed so as to take a course in the direction of three oblique lines 8. In this way, the direction in which the point is fixed during normal times is referred to as localization of the point. That is, in FIG. 2, the pointing machine 21 normally determines the direction of the track circuit 1RT as the localization.

The interlocking table of FIG. 3 shows the interlocking conditions of each facility of the interlocking device. The name entered in the number column indicates which facility in this linkage table describes the linkage condition for which equipment. That is, FIG. 3 describes the interlocking condition regarding the traffic light 1R. In the lock column, the names of the facilities in which the facilities in the number fields operate in conjunction are written. FIG. 3 shows that the traffic light 1R and the switch 21 operate in conjunction with each other. The name of the equipment that controls the operation of the equipment in the number column is written in the signal control or lock column (hereinafter, signal control column). FIG.
Indicates that the traffic light 1R can show the traveling signal only when there is no vehicle in the section where the track circuit 21T is installed. The name of the track circuit and the time (hereinafter, unlocking time) are written in the approach lock or hold lock column (hereinafter referred to as the approach lock column), and the vehicle is located within the section where this track circuit is installed. When present, it indicates that the equipment in the number column must hold its state for the time indicated by the unlocking element entered in the corresponding column. FIG. 3 shows that when a vehicle is present in the section where the track circuit below 1T is installed, the traffic light 1R cannot change its indication for 60 seconds. This constraint guarantees that the switch will not be switched until the vehicle has passed.

The interlocking charts of FIGS. 2 and 3 are converted by the converter 2 into a state transition graph expression of the constraint description language TCTL shown in FIG. The converter 2 extracts the state transition condition of the operation state of each facility from the interlocking chart. That is, the converter 2 reads the positional relationship between each facility and the track circuit from the link diagram, the link logic of each facility from the link table, sets the operation state of each facility to the state of the state transition graph, and links with the positional relationship of the track circuit. Construct state transition conditions from logic. The unlock time entered in the approach lock or hold lock column is described as a real-time constraint on the timing at which the state transition occurs. Here, in the case of the interlocking device, the operation state of each facility is limited, and the state transition condition includes a real-time constraint.
Therefore, it is desirable that the constraint description language can easily describe a finite state transition graph in which state transition conditions include real-time constraints. The above TCTL, RTL, and TNL satisfy the above requirements. In addition, as will be described later, in these languages, equivalence can be proved by a finite number of operation states. (However, there may be cases where a proof can be obtained even if it is not a finite number.)

FIG. 5 is a flowchart showing a part relating to the state of the signal 1R in the TCTL state transition graph expression (FIG. 4) obtained by the converter 2 from the interlocking charts of FIGS. In FIG. 5, 9, 13, 15, and 19 represent states of the state transition graph, and 10, 11, 14, 1
6, 17, and 20 represent conditions for state transition. Also, 1
Reference numerals 2 and 18 denote activation of a clock function introduced to express real-time constraints, and a state transition condition 1
Reference numerals 4 and 20 express the checking of the real-time constraint condition using the timing function.

In general, a signal is localized, maintains localization, inverted,
Takes four states of holding the inversion. These four states correspond to states 9, 13, 15, and 19 in FIG. 5, respectively. FIG.
The signal 1R is controlled in accordance with the state of the track circuit 21T according to the description in the signal control column. That is, the signal 1R is located at the localization 9
At this time, the state of the track circuit 21T is inspected (10), and if there is a train in that section, the signal 1R is inverted.
When there is no train in this section, the signal 1R is controlled according to the state of 1T below the track circuit according to the description in the approach lock column of FIG. That is, as a result of the state inspection 11 under the track circuit 1T, when there is no train in the section, the signal 1R is in the localization 9 state. When there is a train in this section, the signal 1R keeps the state immediately before for 60 seconds according to the unlocking time described in the approach lock column (13). That is, after the inspection 11 under the track circuit 1T is completed, time measurement is started (12), and the state transits to the holding state 13. This state is released after the elapse of 60 seconds (14), and the state changes to the normal localization 9 or the localization holding 13 or the inversion 15 through the inspections 10 and 11 of the track circuit again. The same applies to the case where the signal 1R is inverted.

The switch 21 detects the signal 1 from the lock column of FIG.
Since it is known that the signal is interlocked with R, the same state transition as the signal 1R is made. Further, from the traveling direction 5 of the train and the order in which the track circuits are arranged in FIG. 2, it can be seen that the train is always detected in the order of 1T, 21T, and 1RT under the track circuit when the train passes. Accordingly, a state transition expression representing this is also created by the converter 2.

On the other hand, it is assumed that another description of the interlocking device is given by expressing the proposition of FIG. 6 in the constraint description language TCTL. TCTL is a language provided with an expression form that describes real-time constraints on the timing at which an event occurs, in addition to ordinary logical relationships such as conjunction, declaration, implication, and negation. Therefore, the proposition shown in FIG. 6 can be easily described in TCTL. FIG. 10 shows the TCTL expression of the proposition of FIG.
Shown in When the description of the interlocking device is made in the constraint description language, the converter 2 does not need to do anything.

The description of the proposition by the TCTL and the state transition graph representation of the TCTL obtained by converting the interlocking chart first are input to the formal verifier 3 to prove the equivalence of the two. This proof method will be described. First, let us consider a case where no real-time constraint appears for simplicity. As described above, the state transition graph representation of TCTL obtained from the interlocking chart has only a finite number of states. Therefore, it is possible to mechanically enumerate a series of possible state transitions. Proof can be made by comparing the enumerated state transition sequence with the description of the proposition by TCTL and determining whether or not both are equivalent. Next, consider the case where a real-time constraint appears. For example, in FIG.
Thus, whether or not 60 seconds have elapsed (14) becomes a problem. At this time, the state 13 is divided into cases according to the elapsed time, and two states of “a state in which the signal 1R holds the localization and 60 seconds have not elapsed” and “a state in which the signal 1R holds the localization and 60 seconds have elapsed” Can be proved in the same way as when there is no real-time constraint. The same applies to the state 19 and the real-time constraint 20.

In the present embodiment, the state in which "the signal 1R is located and the vehicle is in the section where the track circuit 1T is located" described in FIG. 6 is described from FIG.
It can only occur on the path going to state 13 via 0,11. At this time, it is understood from the state 13 and the inspection 14 that the signal 1R is not inverted within 60 seconds. Further, since the switch 21 is linked with the signal 1R as described above, it is proved that the switch 21 does not turn over within 60 seconds. Due to the success of this proof, FIGS. 2 and 3
It can be seen that the interlocking device represented by the interlocking diagram satisfies the required specifications expressed by the proposition of FIG. This also verifies that the design intention of the interlocking device is realized.

Embodiment 2 FIG. As a second embodiment of the present invention, the function of the verification method of the present invention for a case where there is an error in the design of the interlocking device will be described. Here, a case will be described in which an interlocking chart composed of FIGS. 2 and 3 and an expression in which the proposition of FIG. 7 is described in TCTL are input. The proposition of FIG. 7 means that when there is a vehicle in the section where the track circuits 21T and 1RT are installed, the signal 1R is inverted, that is, a stop sign is displayed, and the entry of the following vehicle is prohibited, and a rear-end collision is avoided. ing. FIG. 11 shows a TCTL expression of the proposition of FIG. As in the first embodiment, the state transition graph of FIG. 5 and the description of TCTL of FIG. 7 obtained by the converter 2 from FIGS. 2 and 3 are input to the formal verifier 3. The formal verifier 3 proves the equivalence of the two, but the proof fails, and as a counterexample indicating that the two are not equivalent, the formal verifier T of FIG.
The CTL description (FIG. 12) is output.

The counterexample can be used by the designer as information for estimating where in the interlocking apparatus the cause of the failure to satisfy the specifications in FIG. Specifically, when the counter example of FIG. 8 is realized, that is, when there is a train in the section of the track circuit 1RT and there is no train in the section of the track circuit 21T, the signal 1
In order for R to be localized, in FIG. 5, (a) when the signal 1R is in the localization 9, as a result of the inspection of the transition conditions 10 and 11, if the signal 1R is in the localization again, (b) There are only two cases, as a result of the inspection of the conditions 16 and 17, when the localization 9 is obtained. Therefore, it can be limited that there is an error in either of the two cases. In practice, the inspection of the track circuit 1RT is added to the transition conditions in both cases, ie, FIG.
It is correct to add 1RT to the signal control column of.

As described above, when there is an error in the design of the interlocking device, the formal verifier 3 points out that the equivalence is not established in the form of a case contrary to the design intention, and the user uses this case. Can identify the cause of the error. This helps identify design errors and correct them.
It becomes remarkably easy.

Embodiment 3 FIG. Next, the formal verifier excludes the real-time constraints that do not affect the proof of equivalence among the real-time constraints that appear in the input description, reduce the verification load, and perform verification. A description will be given of a verification method in the case of having the property to perform. When the design of the interlocking device has real-time constraints on the operation timing, as described in the first embodiment, when performing the proof by the formal verifier 3, the cases are classified according to the constraints. There is a need. In general, when the real-time constraints are complicated, the number of cases is explosively increased, and enormous time is required for proof. On the other hand, in the case of the interlocking device, the real-time restriction affects only the portion related to the approach lock column of the interlocking chart, and this influence does not necessarily affect the entire interlocking device. Therefore, by using the formal verifier of the present invention, it is possible to reduce the time required for verification under limited real-time constraints.

Here, a description will be given of a case where the interlocking chart composed of FIGS. 2 and 3 and the description of the proposition of FIG. 9 by TCTL (FIG. 13) are input. The proposition of FIG.
When it is at T, it indicates a specification that the point machine 21 takes a reverse position to prevent a rear-end collision of the following train. Embodiments 1 and 2
As in the case of (1), the state transition graph of FIG. 5 obtained by the converter 2 from FIGS. 2 and 3 and the description of the proposition of FIG. 9 by TCTL are input to the formal verifier 3. Formal Verifier 3
Attempts to prove their equivalence. At this time, it is assumed that the real-time constraints are not necessary for the proof, and are removed. That is, in FIG. 5, 12, 13, 14, 18, 1
By removing 9 and 20, a state transition graph is obtained in which the arrow toward 13 points to 9 and the arrow toward 19 points to 15. The proof is successful when this state transition graph is used. It can be seen from the success of this proof that the interlocking device shown in the interlocking diagrams of FIGS. 2 and 3 satisfies the specifications of FIG.

Further, the TCTL description of the proposition of FIG. 6 is input instead of the TCTL description of the proposition of FIG. As above, the formal verifier 3 attempts a proof. At this time, as in the previous case, the proof is first performed by removing the real-time constraints appearing in the state transition graph, but this proof clearly fails because the proposition of FIG. 6 includes the real-time constraints. Next, the formal verifier 3 determines that the previously removed real-time constraints are necessary for proof. Therefore, when this real-time constraint is newly added to the state transition graph and the proof is performed, the proof is successfully performed as in the first embodiment, and the interlocking device represented by the interlocking charts of FIGS. 6 is satisfied.

As described above, in the verification of the design of the interlocking device, it is possible to extract only the constraints that require verification of the individual required specifications from the real-time constraints on the design, and to reduce the relaxed real-time constraints. Verification can be performed in a short time by using the method.

[0030]

As described above, according to the first configuration of the present invention, a converter for converting a design description of an interlocking device and a description of required specifications for the interlocking device into a formal language expressing constraint conditions, respectively. A formal verifier that certifies the equivalence of the two formal language descriptions converted by the converter, and a verification result output unit that outputs the result of the proof.
Verification can be performed without using a real interlocking device or on-site equipment, thereby greatly reducing the labor and time required for verification.
In addition, since the design of the interlocking device is automatically converted to a format that is compatible with computer processing, it is easy to create data that is compatible with computer processing, and it is possible to perform strict verification without omission, It is possible to compensate for the incompleteness of the verification, which is a drawback of the simulation, and to increase the reliability of the verification.
Further, since the equivalence between the design description of the interlocking device and the description of the required specification for the interlocking device is proved, it is possible to verify whether the design of the interlocking device conforms to the required specification. .

Further, according to the second configuration of the present invention, the formal verifier determines whether the two descriptions are not equivalent.
Since a case caused by this contradiction is output as a counterexample, it is possible to provide information for specifying where the error is in the interlocking device.

According to the third configuration of the present invention, a language capable of expressing both logical conditions and real-time constraints is used as the formal language. Linkage is achieved by enabling both real-time constraints on conditions and timing to be described, and by using a formal verifier that has the ability to prove the equivalence of two descriptions in the formal language described above. It is possible to perform strict verification without omission for both the logical conditions and the real-time constraints on timing.

Further, according to the first method of the present invention, the presence or absence of inconsistency between the two descriptions and the correctness of the design of the interlocking device are verified by using the interlocking device verification device having the first configuration. Therefore, the verification can be performed without using a real interlocking device or on-site equipment, so that labor and time required for the verification can be greatly reduced. In addition, since the design of the interlocking device is automatically converted to a format that is compatible with computer processing, it is easy to create data that is compatible with computer processing, and it is possible to perform strict verification without omission, It is possible to compensate for the incompleteness of the verification, which is a drawback of the simulation, and to increase the reliability of the verification. Further, since the equivalence between the design description of the interlocking device and the description of the required specification for the interlocking device is proved, it is possible to verify whether the design of the interlocking device conforms to the required specification. .

Further, according to the second method of the present invention, a portion having a design error is specified by using the output of the counterexample using the verification device for the interlocking device according to the second configuration. It is possible to greatly reduce the labor and time required for the verification of the device and the design correction based on it.

Further, according to the third method of the present invention, the verification of equivalence among the real-time constraints appearing in the input description is performed using the interworking device verification device having the third configuration. Since the real-time constraint condition that does not affect the verification is excluded and the verification load is reduced, the labor and time required for the verification can be significantly reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing a verification device of an interlocking device according to a first embodiment of the present invention.

FIG. 2 is a diagram for explaining an interlocking diagram showing the configuration of the equipment of the interlocking device according to the first embodiment of the present invention.

FIG. 3 is a diagram illustrating an interlocking table indicating interlocking conditions of each facility of the interlocking device according to the first embodiment of the present invention.

FIG. 4 is a diagram showing a TCTL state transition graph expression according to the first embodiment of the present invention.

FIG. 5 is a flowchart showing a part related to the state of the signal 1R in the TCTL state transition graph representation according to the first embodiment of the present invention.

FIG. 6 is a diagram showing an example of specifications of an interlocking device represented by the interlocking charts of FIGS. 2 and 3;

FIG. 7 is a diagram showing an example of specifications of an interlocking device represented by the interlocking charts of FIGS. 2 and 3;

FIG. 8 is a diagram showing a counter example obtained when the interlocking device shown in the interlocking diagrams of FIGS. 2 and 3 attempts to prove whether or not the specification of FIG. 7 satisfies the specification of FIG. 7 and fails.

FIG. 9 is a diagram showing an example of specifications of an interlocking device represented by the interlocking charts of FIGS. 2 and 3;

FIG. 10 is a diagram showing an example of a description by TCTL of the specification of the interlocking device represented by the interlocking diagrams of FIGS. 2 and 3;

FIG. 11 is a diagram illustrating an example of a description by TCTL of the specification of the interlocking device represented by the interlocking diagrams of FIGS. 2 and 3;

FIG. 12 is a diagram illustrating an example of a description in TCTL of the specification of the interlocking device represented by the interlocking diagrams of FIGS. 2 and 3;

FIG. 13 is a diagram illustrating an example of a description by TCTL of the specification of the interlocking device represented by the interlocking diagrams of FIGS. 2 and 3;

[Explanation of symbols]

1 input description, 2 converter, 3 formal verifier, 4 verification result output means, 5 approach direction of vehicle, 6 traffic light, 7
Pointer, 8 Positioning of the pointer.

──────────────────────────────────────────────────の Continued on front page (58) Field surveyed (Int.Cl. ⁷ , DB name) B61L 19/06

Claims (6)

(57) [Claims] 1. A converter for converting a design description of an interlocking device and a description of a required specification for the interlocking device into a formal language expressing constraint conditions, and two formal language descriptions converted by the converter. A verification device for an interlocking device, comprising: a formal verifier for proving equivalence; and verification result output means for outputting a result of the above proof. 2. The apparatus according to claim 1, wherein the formal verifier outputs a case caused by the contradiction as a counter example when the two descriptions are not equivalent. 3. The apparatus according to claim 1, wherein a language capable of expressing both a logical condition and a real-time constraint condition is used as the formal language. 4. A method of verifying an interlocking device, comprising using the interlocking device verification device according to claim 1 to check whether there is a contradiction between the two descriptions and whether the design of the interlocking device is correct. 5. A method of verifying an interlocking device, wherein the verification device of the interlocking device according to claim 2 is used to specify a part having a design error using the output of the counterexample. 6. A real-time constraint condition which does not affect proof of equivalence among real-time constraint conditions appearing in an input description, using the verification device for an interlocking device according to claim 3. And a verification method for an interlocking device that performs verification while reducing the verification load.