Checking the European Railways Traffic Management System (ERTMS) operating rules using UML and the B method

Interoperability is a critical factor for cost cutting and to increase performance in European railway exchanges. The European Railways Traffic Management System (ERTMS), which is both a specification and a technological framework, aimed at providing an answer to the above interoperability needs. Considering the implementation of ERTMS in a particular national context, operating rules must be compliant with the ERTMS specification, whereas the whole system has to provide some safety properties. Moreover, the management of railway signalling in ERTMS is based on “not on board rules” pertaining to each country and not on global rules. In consequence, it is difficult to evaluate the system in terms of safety. Thus, one of the main purposes of this study is to supply methodological tools for the evaluation of the global consistency between the specification and the operating rules, with regard to safety. This issue is crucial and yet it has scarcely been covered by scientific literature.