Safety assurance of configuration data for railway signal interlockings

The safety of railway signalling systems depends on the correctness of the programming of a logical controller known as an interlocking. Assurance of correctness is usually achieved by a combination of testing, both on simulation systems and on the target hardware, and manual or tool-assisted checking of the data, with use being made in some cases of techniques of static analysis and formal methods. The paper proposes a common model for assessing disparate techniques used as part of various proprietary systems.