When you’re tasked with the mission of procuring a new rail control solution, taking time to clearly specify your needs, requirements, and expectations is a critical first step.

Doing so helps you avoid common project roadblocks— like long and unpredictable delivery schedules, tender specification issues, or errors discovered too late in the production process. It also gives suppliers a fair chance to develop the system they need in a time and cost-efficient manner. Furthermore, having clear specifications makes it easier, for infrastructure managers, to evaluate with accuracy how well systems comply with quality, safety, and other important requirements.

However producing specifications can be a challenge in itself. How can you be certain that your specifications actually correspond to your needs? Or that they will be interpreted correctly by all stakeholders? Our recommendation is to take a formal approach to develop a prototype, or a digital twin, that you can use to validate your specifications with simulation and formal verification.

What is a digital twin?

A digital twin is a virtual, interactive replica of an actual physical system, asset, or process. Applied to the railway sector, a digital twin could cover the entire infrastructure – from stations, rolling stock, switches, and signals to supporting IT systems.

It helps infrastructure managers to formulate and evaluate precise requirements for their system, and to ensure that these requirements are verifiable. The result will be precise and clear test and safety specifications for the supplier to deliver against.

Suppliers can then use the digital twin as input for the detailed design, using automation tools for code generation, testing, and verification, further shortening project schedules and reducing costs. The digital twin will be used throughout the lifecycle of the system, reducing costs related to upgrades and adding new features during the maintenance phase.

Ensure you get the system you need at the best price

There are multiple benefits to starting off your next rail control project with a digital twin. With help from automation and stronger verification and validation tools, you reduce risks and resource needs while, ultimately, allowing high-quality software to be delivered in a more predictable way.

Main benefits of a Digital Twin:

• Simplifies rail control solution procurement processes
• Enables an efficient validation and verification process
• Reduces the risk of misunderstandings and project delays
• Allows for more predictable delivery schedules and costs
• Shortens the time needed for costly on-site tests
• Minimizes the risk of error discovery late in the procurement process
• Makes it easier to accurately gauge if systems comply with requirements

How to create a digital twin?

When creating a digital twin, the first step is to specify the requirements for the function and safety of the system, these are then used to define the design specification for the implementation. An object model is also defined, serving as a common interface for the test, safety, and design specifications, so that these can be developed independently. This is done using an iterative, test-driven, and agile process consisting of the following steps:

1. Gather and analyze input
The process starts with an analysis of the needs and available information to define the test and safety requirements on a high level. Tender requirements, use cases, legacy systems, applicable standards, interfaces, rules, regulations, and project scope provide input to this task.

2. Formulate requirements and define the object model
Formulate the test and safety requirements in natural language using an object model that defines the objects in the system and how they interact. The test and safety specifications are then used to define the design specification, for the implementation of the system. The specifications are refined and validated later on in the process.

3. Configure your digital twin
Specify the configuration data that will be used to create instances, or specific applications, of the object model.

4. Validate the design, test, and safety requirements
Define, or implement, the object model and requirements in a formal language that can be used to automatically generate a model for a given system configuration. Validate the requirements with automated simulation-based testing and formal safety verification, using the digital twin configuration. This process will reveal, and help resolve, any ambiguities and missing precision in the formulated requirements.

Learn more about how digital twins can help your railway development project.
Book a meeting with us.

Despite exciting technological advancements, carrying out a successful rail control project today remains a complex burden with a multitude of challenges for both infrastructure managers and suppliers. Here, we’ll take a deeper look at the underlying issues and discuss how implementing Signal Design Automation can help you eliminate inefficiencies and costly errors—and finally gain control over your systems.

What’s standing in the way of your successful rail control project?

There are a number of factors standing in the way of a successful rail control project. Rail control systems are expensive to procure, develop, and maintain. Costs and schedules are routinely exceeded. Errors and shortcomings in procured systems are often discovered late when it’s too difficult to make changes. And attempting to address all these problems causes further delays to the entire process before systems can finally be put into revenue services. All in all, this generates a lot of frustration for all parties involved and contributes to the end customer feeling out of control.

Underlying these challenges is the fact that the railway market is still relatively conservative when it comes to adopting future production processes that are related to these systems. And the relatively small number of dominant suppliers in the market today makes driving the change that’s needed even more difficult.

Common challenges in rail control projects

• Systems are costly to procure, develop, and maintain
• Costs and schedules are routinely exceeded
• Proprietary solutions, reducing competition and creating vendor lock-in
• Errors and omissions are discovered late
• End customer not in control
• Conservative attitude to future production processes (slow and inefficient production)
• Supplier landscape “oligopoly” (few dominant suppliers)
• Status quo being preserved

Rail control project stakeholders

In rail control projects, the main stakeholders are the Infrastructure Managers (IM), who own the rail control systems, and the Suppliers who develop these systems. There are also a number of system consultants and vendors involved.

Addressing the root causes

By digging down to the root of the common challenges in rail control projects, we can more easily identify what kinds of solutions are needed in order to move past them. There are three main root causes that need to be addressed.

Root cause #1: Tender requirements tend to be imprecise
The first root cause is related to what the customer actually needs. Tender requirements for rail control systems tend to be imprecise, with a lack of clarity regarding what the requirements actually are for the system standard. This can lead to suboptimal design choices, with drawbacks that might not be discovered until it’s too late and too expensive to make changes. It can also lead to a system being delivered based on proprietary choices, resulting in vendor lock-in.

Root cause #2: Verifications are based on traditional methods
Another root cause is the fact that the verification activities, which are used during development and before commissioning, are very much based on outdated methods. For instance, the time-consuming and error-prone review and testing processes. While reviews and testing are useful and important, the verification coverage is poor. That is, you can detect the issues but you cannot prove that there are no issues remaining. So, together with the first root cause, vague and imprecise requirements make it really difficult to perform verifications well because relying only on human judgement usually causes a bottleneck.

Root cause #3: Lack of standard architecture and interfaces
The third root cause is a lack of standard architecture and interfaces. Of course, standards and standard interfaces do exist, but when it comes to the actual systems, there are many parts of those systems or subsystems that don’t really belong to a standard architecture or have standard interfaces. This makes it a little more difficult to reuse requirements and know-how about systems. And if you have multiple suppliers, you may have to duplicate the effort for each system. This also makes it harder to use commercial, off-the-shelf components and prevents you from going as far as you may want to when it comes to plug-and-play concepts.

Our solution: Signaling Design Automation (SDA)

All of the challenges infrastructure managers and suppliers run up against during rail control projects can be solved by adopting a better production process. At Prover, our mission is to supply the industry with tools and processes that meet the requirements and expectations of the end customers. We do this by focusing on the requirement specifications, using automation to develop the systems, and applying formal and automated methods to prove that the requirements are fulfilled.

So what does a better production process look like? Our solution is something we call Signaling Design Automation (SDA).

What is SDA?

SDA is a set of automation tools and processes, based on generic, formal specification principles, that is used to develop the software for rail control projects. The idea is that SDA instantiates these generic principles for a particular configuration and produces the design and software code for a particular system. SDA also performs safety verification to produce safety evidence, as well as automated testing to create a test report. These point tools are highly automated and based on the principles, the configuration, and the actual code. Of course, it’s also possible to use different code generation back-ends to generate the code.

4 steps to a successful rail control project

Here is a summary of the actions needed to address the most common challenges and, finally, run a successful rail control project using SDA.

1. Structure your configuration data and system requirements
The key to success in any rail control project is creating a proper specification of the project’s needs, requirements, and expectations. The infrastructure manager needs to specify their own knowledge of both the solutions that they already have and of the solutions that they want to be delivered in the future.

2. Create a Digital Twin before tender
With this in mind, infrastructure managers can do a better job with tender specifications. Creating a Digital Twin before a tender is made is a practical way to get to a point where requirements are more precise and systems can be verified. Of course, this is also a critical action when it comes to procuring systems at a reasonable price, because it gives suppliers a better chance of meeting expectations

3. Use SDA tools to improve approval-related V&V
Both infrastructure managers and suppliers can use SDA tools to improve the verification and validation (V&V) that needs to take place before software systems can be approved for revenue service. This can include both simulation (standard test suites) and formal verification (verifying requirements on configuration data and safety as well as testing). This also gives improved coverage in V&V and reduces the effort and time required for safety assessment. Especially if you replace more traditional approaches.

4. Use SDA to deliver software based on the Digital Twin
Finally, SDA can be used in its full context to develop and deliver software based on the Digital Twin. This is a way to adopt future production processes, including more automation and stronger V&V tools, and—as a result— reduce risks and resource needs, and allow high-quality software to be delivered in a more predictable way.

Learn more about how Signaling Design Automation can help you run a more successful railway development project here.

Signaling Design Automation Forum is an event gathering signaling professionals from the railway industry to share and discuss the latest evolutions on design automation – software technologies to automate design and verification of railway signaling systems. This year focus was on Digital Twins.

SDA forum is a forum for sharing experiences and best practices as well as for networking. We are proud and happy by the interest and the engagement shown during the day by the participants online and onsite.

What happened during SDA Forum 2022?

This is the fourth SDAF conference and in many ways, it turned out to be the most successful one to date, with over 100 participants online and onsite from all over the world. It was a full hybrid event.

During the day we had several very interesting presentations by e.g. Alstom, Stockholm Metro, RATP, SafeRiver, and GCRE to name a few. Some take aways from the day were:

• Formal methods together with digital twins, is a powerful and promising way to manage the digitalization of rail control systems.
• Formal verification is now being broadly applied to more complex systems and system of systems. More and more system suppliers apply Formal Verification as standard procedure to ensure quality and safety of their solutions.
• There is work to be done in combining formal methods for rail control with BIM to create more comprehensive digital twins for the complete rail infrastructure.

The conference was an opportunity for Alstom to share their current work on system of systems verification, how higher system requirements can be refined and allocated to several subsystems/functionalities.

We also got to hear from Stockholm Metro on their experience with formal verification and digitalization. The battle that was fought to improve their process from manual and time-consuming methods to a more automated and effective way of working. Stockholm Metro have now made formal verification mandatory on all projects and all changes. Their formally written safety and functional requirements are even included as part of tenders, thus guaranteeing the unambiguity and consistency of their requirements.

Veronique Delebarre from SafeRiver shared her experience from the automotive industry and methodology for defining high level safety properties.

Andy Doherty from GCRE presented their work on a unique purpose-built rail research, testing & innovation facility in Wales. The aim is to create a realistic infrastructure and rolling stock testing environment. Digital models, such as BIM, is a key part of this project; the plan is to build a digital twin of the site to enable easy integration of monitoring and sensor system technology.

Trafikverket then moved on to share their formal methods experience, dating back to the early nineties, demonstrating the strength of formal verification. Moving forward, they are counting on the work being conducted in Shift2Rail to guide the way.

On behalf of the Paris metro (RATP), Yoann Fonteneau presented the work on higher level requirements for CBTC safety verification. The project was motivated by certain missed bugs due to the gap between system-level requirement and subsystem requirements. The verification focused on one of the most critical functions for the CBTC, the Tracking Function. By modelling a realistic environment (clocks, physical trains, wayside objects, …), they defined a generic model. The proof of the safety requirements (resulting from a Hazard Analysis) is then conducted on instantiated models. The project led to the reproduction of the known issues and discovery of new complex unsafe scenarios.

New York City Transit (NYCT), as one of the oldest, largest, and busiest subways, are also using formal methods. Their use of Prover iLock to formally verify the safety of (vital) interlocking applications was briefly explained and demonstrated. The Generic Safety Specification captures the safety aspect of the 733s (NYCT design process for interlocking logic based on template/typical relay drawings). In a next step they are looking to use formal methods to build a complete model of the interlocking systems, including simulation and formal requirement specifications.

In all, it was a day full of new insights, networking and discussions. A day leaving us with a positive feeling about our industry!

Founded in 1989, after more than 30 years of development, Prover is now an international company, with branches in Sweden, France, China, and the US. The company has participated in railway projects all over the world and with customers such as ALSTOM, Siemens, CASCO, RATP, NYCT etc.

In Prover, there are employees who have worked for the company for more than 10 years, some have even been with the company for over 20 years. Besides the seniors with a lot of experience, the company also has new employees who have been working for the company for a few years or even a few months. It is the combination of the experience from experienced employees and the enthusiasm of the young employees that have created a driving force to contribute to the development of the company.

To attract talented people for the company, Prover has recruited personnel from all over the world. Prover’s staff is highly qualified with a large portion having a doctorate degree, from many countries including Sweden, France, Germany, China, Algeria, Morocco, and Vietnam. In addition, the company also allows experts to work remotely full-time.

All employees from Prover meet regularly and work together during our One Team Work Weeks. We at Prover see this as a way to promote unity and team spirit at our company, no matter where in the world you are based. Let’s find out what is interesting about working for Prover via the words of some employees.

———

MEET OUR COLLEAGUES

Lets’ start off with Gunnar, our VP Sales that has been with us for more than 20 years!

Can you tell us a little bit about yourself, like where you are from and about your current position?

– I joined Prover directly after completing my computer science studies at Gothenburg University. I started out as a product/software developer, part of the team working on the development of our proof engine product suite. I gradually moved onto the application side, applying our automation solutions in the rail control domain, and I’m currently heading up our sales team.

What made you choose Prover in the beginning?

– The opportunity to be part of a small, agile company with an interesting technology, where the contribution of each individual really matters in reaching the goals. I also enjoyed the prospect of working in an international environment, with both customers and colleagues from around the world.

What made you stick with the company for so long?

– The opportunity to keep on learning new things and take on new challenges.———

Moving forward to our second colleague, originally from Vietnam.

– Hello, I’m Pham The Anh, and I’ve worked for the company for 7 months as a formal verification engineer in the solution team.

What made you come to Sweden, a country far from Vietnam, to work?

– Before coming to Sweden, I studied for a doctorate in France and then did postdoctoral research in Germany. I have a background in formal methods. After doing research-related work for a while, I wanted to apply what I have learned to practice, as well as to know how formal methods have been applied in the industry. Prover is one of the few companies that use formal methods to solve real-world problems. Therefore, I have decided to choose Prover.

After 7 months of working, can you share your feelings about the working environment at Prover.

– I am very happy to work at Prover, I get to work with talented co-workers who have many years of experience in rail, metro, and interlocking systems. They are very friendly and have helped me a lot. I have learned a lot from them. Everyone is happy to get along, respect each other, and always do their best for the work. Besides, I also get involved in real projects. Although I have only been with the company for 7 months, I have been involved in 3 different projects, namely Shift2Rail, NYCT Verification, and Metroselskabet*. In each project we solve different customer problems, they are interesting.

* Editors note: Shift2Rail (EC project), NYCT (New York City Transit) verification, and Metroselskabet (Copenhagen metro)

A small question, how do you feel about Stockholm and Sweden?

– In winter, the weather is a bit cold but not as bad as people say! But in summer the weather is great. I like the city as well as the life here.

———

Last but not least, we take the opportunity to speak to Sara, that joined us about a year ago!

– I am still quite new at the company, and was looking for some new challenges and to further my knowledge of formal methods. I actually have a degree in Electronics, integrated circuits and embedded software. I started my career in avionics, working as a software engineer then moved on to formal proof within the same branch. It was a great introduction to the formal world, and in my quest to know more about it, Prover felt like a natural choice. Since I have joined, I have worked with customers such as NYCT and Alstom France. I have been working on the formal verification of interlockings using Prover iLock and PSL. I have even briefly worked on a safety project. It was quite enjoyable so far, and I am looking forward to the rest of the journey.

Can you please tell us a little bit about working for Prover in France – and how it is coordinating the different teams’ work when we are placed at different locations.

– One of the appealing assets of working at Prover is working with an international team. I wanted to improve my English and it is a great opportunity. Working with Prover in France is very enriching; the French railway market has been using formal methods for quite some time. There are different customers and projects to learn from, and the French team is full of experienced people. But, we still make a tight team with our Swedish colleagues. We do meet on a regular basis online, it is nice to hear what everybody is working on. How our different projects and customers use formal methods and to learn from each other. At least once a week, we all meet and discuss our work or the company’s updates. And as often as we can, we try to physically meet. And it has been feeling like one team since I started working at Prover. Even at times that we have been working remotely, there was no feeling of isolation.

———

Are you also interested in joining our team? Find out more here

SDA Forum has been a success in the past and our goal is to exceed your expectations this autumn.

The first conference was hosted by Prover in Stockholm 2018. After the success, we’ve been to Shanghai 2019 and Paris 2021. Now it is time to close the circle in Stockholm again, on the 18th of October.

This year’s forum will circle around Digital Twins as a means to get in control of your signaling systems, now and for the future. The use of Digital Twins complements our SDA solution and leverages the use of Formal Methods. Manual methods and document based descriptions will not reveal the unknown relation nor behavior in your systems. Signaling systems are too complicated to describe in text, flowcharts or pictures. The capability to reach common understanding and share knowledge of the system as a whole is key to overcoming today’s increasing demands in the railways.

Our strive to address these challenges are pointing us in the direction of new solutions and collaborations. Railway’s is a shared responsibility and our hope is that we in this forum can share expectations and experience among each other.

Amongst our attendees, we have had leading infrastructure managers, suppliers, and engineering firms from all over the world, sharing experiences, being inspired, and networking. We are truly happy by the interest and the engagement shown during previous conferences and again, let us exceed our expectations!

We are really looking forward to discussing these subjects with all of you, the 18th of October 2022 in Stockholm.

Click here to learn more about SDA Forum 2022

Anders Lindén
CEO at Prover

November 16 Prover hosted Signaling Design Automation Forum 2021 in Paris.

The Signaling Design Automation Forum is an event gathering signaling professionals from the railway industry to share and discuss the latest evolutions on design automation – software technologies to automate design and verification of railway signaling systems.

It is a forum for sharing experiences and best practices as well as for networking. We are happy and honored by the interest and the engagement shown during the conference. The conference was fully booked and the day was filled with a multitude of engaged discussions.

What happened during SDAF 2021?

This is the third SDAF conference and it was inspiring to see the strong increase in adoption of Formal Methods and Signaling Design Automation to automate and digitize the development of railway signaling systems. At Prover we are convinced about the benefits of a process with formalized specifications enabling automated development and automated formal verification of safety. It gives the end customers control of their systems, cut time and costs significantly and ensures safety with 100% coverage.

During the day several interesting presentations were held and at the end of the day we carried out an on-line survey on key issues covering formal verification and design automation.

• We learned about how CASCO is using Formal Verification and now taking next steps to formal development, gaining a competitive edge with ensured safety and shorter deployment times.
• RATP a pioneer in the use of Formal Verification to ensure safety presented their way of working and their ambitious next steps towards a system oriented process.
• Alstom presented their work and commitment to work with Formal Verification as well as their plans to expand the use of Formal Verification covering more and more systems.
• The metro´s of Stockholm and Copenhagen gave insights into the benefits of formalizing specifications via a Digital Twin to give them control over the system reducing vendor dependencies and enabling efficient testing, verification and simulation of the systems.

We ended the day with an online survey covering key topics within SDA and Formal Verification.

It was a day full of discussions and a positive outlook for the future. The railway industry has an important role to play for us all to meet the climate goals ahead. This is reflected in the increased investments around the world in new rail capacity. Being part of developing this industry to shorten time for new railway capacity and ensuring safety, feels important and rewarding!

We at Prover are very grateful to all attendees and speakers for joining us and making this day a truly inspiring and rewarding day!

A few years back we got the idea of creating a forum for sharing experiences, best practices, and for networking. Our intention was to gather leading signaling management peers from all over the world to discuss the latest evolutions of design automation and formal verification technologies to automate design and verification of railway signaling systems.

We established the SDA Forum. The first conference was hosted by Prover in Stockholm 2018. After the success in Stockholm, we decided to do it again, this time in Shanghai, in 2019.

We are truly happy by the interest and the engagement shown during these conferences. It exceeded all our expectations. Amongst our attendees, we have had leading infrastructure managers, suppliers, and engineering firms from all over the world, sharing experiences, being inspired, and networking.

Due to the pandemic, we did not host the event 2020, but now it is time again!

We have seen a significant increased interest in technologies and solutions that automates and digitizes rail control systems. Ranging from formally specifying systems, creating digital twins enabling simulation and verification, to automate the design process and verification. Not only does it save time and costs, but it also increases quality and safety. Reducing manual tasks and on-site testing.

Rail transportation needs to be the backbone of a truly multimodal transportation eco system in the future to meet the climate goals! So, it is up to us in the industry to innovate and commit to support the increased capacity needed in the years to come.

I am really looking forward to discussing these subjects with all of you, on 16 November 2021 in Paris.

Click here to learn more about SDA Forum 2021

Anders Lindén
CEO at Prover