A formal analysis of Dutch Generic Integral Tunnel Design models

Abstract

The Generic Integral Tunnel Design (GITO) contains generic models for the tunnel control systems of Rijkswaterstaat, part of the Dutch Ministry of Infrastructure and Water Management. A formal verification of these models advances the safety and reliability of GITO derived tunnel control systems. In this paper, the first known large-scale formalisation of tunnel control systems is presented which transforms GITO models to the formal specification language mCRL2. This transformation is applied to two sub-systems of the GITO to analyse the correctness of the supplied models. In this formal analysis, several deficiencies in the specifications and faults in the existing models are revealed and verified solutions are proposed. Some of the presented faults even find their origin in the legally required standards.