Search

In this work, the containment control problem for a quadrotor team is addressed in the presence of multiple dynamic leaders with unknown bounded time-varying inputs. Both safety-critical constraints and input constraints are considered. Specifically, a linear extended state observer (ESO) is employed to handle the uncertainty and disturbance. A distributed fixed-time observer is designed to estimate the reference signal requiring no global information. The proposed nominal controller can guarantee the formation geometric constraint in steady states. Moreover, safety certificates for collision-free in transient states is enforced by using exponential control barrier functions (ECBFs). A real-time quadratic programming (QP) problem is constructed to modify the nominal controller such that both safety constraint and input constraint can be satisfied. Finally, simulations and experiments illustrate the effectiveness of the algorithm. [ABSTRACT FROM AUTHOR]

This paper introduces a motion planning and cooperative formation control approach for quadruped robots and multi-agent systems. First, in order to improve the efficiency and safety of quadruped robots navigating in complex environments, this paper proposes a new planning method that combines the dynamic model of quadruped robots and a gradient-optimized obstacle avoidance strategy without Euclidean Signed Distance Field. The framework is suitable for both static and slow dynamic obstacle environments, aiming to achieve multiple goals of obstacle avoidance, minimizing energy consumption, reducing impact, satisfying dynamic constraints, and ensuring trajectory smoothness. This approach differs in that it reduces energy consumption throughout the movement from a new perspective. Meanwhile, this method effectively reduces the impact of the ground on the robot, thus mitigating the damage to its structure. Second, we combine the dynamic control barrier function and the virtual leader-follower model to achieve efficient and safe formation control through model predictive control. Finally, the proposed algorithm is validated through both simulations and real-world scenarios testing. [ABSTRACT FROM AUTHOR]

Abstract This paper introduces a motion planning and cooperative formation control approach for quadruped robots and multi-agent systems. First, in order to improve the efficiency and safety of quadruped robots navigating in complex environments, this paper proposes a new planning method that combines the dynamic model of quadruped robots and a gradient-optimized obstacle avoidance strategy without Euclidean Signed Distance Field. The framework is suitable for both static and slow dynamic obstacle environments, aiming to achieve multiple goals of obstacle avoidance, minimizing energy consumption, reducing impact, satisfying dynamic constraints, and ensuring trajectory smoothness. This approach differs in that it reduces energy consumption throughout the movement from a new perspective. Meanwhile, this method effectively reduces the impact of the ground on the robot, thus mitigating the damage to its structure. Second, we combine the dynamic control barrier function and the virtual leader-follower model to achieve efficient and safe formation control through model predictive control. Finally, the proposed algorithm is validated through both simulations and real-world scenarios testing.

Augmented Reality (AR) could improve maritime collaboration by facilitating human factors like situation awareness and decision-making. However, it is not clear in which ways AR can be beneficial and for which maritime operations. This paper addresses the need for a systematic literature review of state-of-the-art ways AR can facilitate maritime collaboration. Following the PRISMA statement, we searched for the constructs "AR," "maritime operation," and "collaboration" in the Web of Science and IEEE Xplore databases. Out of 691 search results, we retained 32 publications for analysis. Ten publications from other sources were included. Our results provide a review of AR applications for the maritime operations of ship navigation, personal navigation, maritime construction, maritime maintenance and inspection, and other. We suggest that research focuses on bringing promising AR applications to higher technology readiness levels, learning from other industries, applying robust evaluation methods, and grounding more on human factors like decision-making, situation awareness, and communication. [ABSTRACT FROM AUTHOR]

This qualitative case study explores the reasons behind disconnects between United States Army (Army) aviation safety and cybersecurity groups' processes. The disconnects were defined as dissimilarities between Army aviation systems and inadvertent overlap of system implementation requirements. The disconnects cause an absence of explicit means to verify systems' reresiliency to cybersecurity attacks that increase the risk to flight safety and mission readiness. Literature review revealed the absence of explicit guidance and the increase of cybersecurity issues affecting interconnected aviation systems. This study sought to discover the reasons behind the disconnects and explore how the disconnects could be improved to increase resiliency to cybersecurity attacks and decrease the risk to flight safety and mission readiness. The researcher used the organizational discontinuity theory (ODT) as the framework for determining the reason behind the lack of explicit guidance. Additionally, the researcher conducted interviews with knowledgeable safety and cybersecurity professionals and conducted data source triangulation using the safety and cybersecurity groups' respective process documentation to justify key research findings and accomplish data analysis activities. Data analysis identified three themes: awareness, process critique, and logical and complementary improvement. This study concluded that one primary reason behind the disconnects between safety and cybersecurity groups' processes is that both processes are isolated in terms of execution across the systems' lifecycles. The isolation causes conflicting process requirements and inadvertent overlap where requirements could be improved if cross-functional group coordination occurred. This study also confirmed the necessity for leadership guidance to implement cross-functional group coordination and comprehensive processes to address the disconnects. [ABSTRACT FROM AUTHOR]

Domain-specific standards and documents heavily regulate safety-critical systems. One example is the DO-178C standard for aerospace, which guides organizations to achieve system safety and evidence for their certification. Under such regulated contexts, most organizations use traditional development processes, in contrast to the massive adoption of Agile in the software industry. Among other benefits, Agile methods promise faster delivery and better flexibility to address customer needs. Adopting Agile methods and practices are possible in aerospace because the DO-178C standard does not prescribe concrete software development methods. In spite of that, Agile development is not used in DO-178C contexts. To help change that, our research aims to understand whether and how organizations engineering safety-critical software systems for aerospace may benefit from Agile methods and practices. We analyzed the DO-178C standard and confirm that it is compatible with Agile methods. Then, we present a systematic literature mapping of adopting Agile in software development for aerospace, where we identified significant concerns, recurrent issues, and several challenges. Some real industry aerospace projects provided us with important data and the perspective of domain experts about the pros and cons of Agile methods in this context. We conclude by proposing an agenda of research opportunities to improve safety-critical software development towards agility that we consider worthy of further research, application and confirmation in wider contexts.

Ensuring quality human-AI interaction (HAII) in safety-critical industries is essential. Failure to do so can lead to catastrophic and deadly consequences. Despite this urgency, existing research on HAII is limited, fragmented, and inconsistent. We present here a survey of that literature and recommendations for research best practices that should improve the field. We divided our investigation into the following areas: 1) terms used to describe HAII, 2) primary roles of AI-enabled systems, 3) factors that influence HAII, and 4) how HAII is measured. Additionally, we described the capabilities and maturity of the AI-enabled systems used in safety-critical industries discussed in these articles. We found that no single term is used across the literature to describe HAII and some terms have multiple meanings. According to our literature, seven factors influence HAII: user characteristics (e.g., user personality), user perceptions and attitudes (e.g., user biases), user expectations and experience (e.g., mismatched user expectations and experience), AI interface and features (e.g., interactive design), AI output (e.g., perceived accuracy), explainability and interpretability (e.g., level of detail, user understanding), and usage of AI (e.g., heterogeneity of environments). HAII is most measured with user-related subjective metrics (e.g., user perceptions, trust, and attitudes), and AI-assisted decision-making is the most common primary role of AI-enabled systems. Based on this review, we conclude that there are substantial research gaps in HAII. Researchers and developers need to codify HAII terminology, involve users throughout the AI lifecycle (especially during development), and tailor HAII in safety-critical industries to the users and environments.

Safety-critical systems used in applications that demand high levels of dependability, efficiency, and fault-tolerance often use sequential logic circuits in its design and implementation. The safety-critical digital system typically uses latches, flip-flops, and other memory elements, which are prone to the effects of natural faults and single event upsets (SEUs) caused by radiation-induced effects. The faults can lead to subsystem failures due to the continuous advancement in the realization of the small size transistor. To design a reliable digital-based system, it is essential to develop new faulttolerance approaches that are integrated into the design of sequential logic circuits. This work proposes a novel fault-tolerant approach based on the redundancy of sequential logic circuit, which consists of a variety of design components, D flip-flop storage elements linked to a fault injection unit, a duplicate modular redundancy, and data monitoring units with a switching circuit. The experimental simulation results using a five-state Markov chain analysis model prove that the proposed fault-tolerant system can achieve 0.99999998 for reliability of the fault detection coverage (C) which equal to 0.99999. Finally, we believe that using this new approach of fault-tolerance and redundancy would improve the dependability and reliability of next generation safety-critical applications. [ABSTRACT FROM AUTHOR]

Precise point positioning (PPP) and real-time kinematic techniques are interesting in several sectors, especially for autonomous applications. These users have high accuracy needs coupled with stringent requirements on continuity, availability, integrity, and convergence time, whose satisfaction can be challenging in harsh environments. Galileo launched on January 2023 the initial high accuracy service (HAS), a European free-of-charge PPP service with a worldwide coverage transmitted on E6 signals and provided through an internet connection. This paper characterizes the Galileo HAS product performance, including orbital errors, clock errors, code biases, and overall signal in space error (SISE), with live signals transmitted since HAS service declaration. The paper also presents the behavior of HAS SIS in the case of four satellite anomalies between September 2021 and August 2022, occurring for Galileo and GPS. Finally, the paper presents the results of HAS performance in both static open sky and road scenarios, showing a few-decimeter accuracy even in environments with degraded visibility. The paper shows the improvements in terms of robustness to satellite anomaly thanks to the Galileo HAS characteristics. [ABSTRACT FROM AUTHOR]

In this paper, we present an analysis of the properties of the prototype three-phase Multichannel Permanent Magnet Synchronous Generator (MCPMSG) prototype designed and constructed by the authors. Each channel of the generator has electrically separated windings, which allows us to create an island system of electricity generation. The analyzed MCPMSG is intended for critical applications, and it is designed for four-channel operation. The purpose of this work is to analyze various configurations of the generator channels to improve the redundancy of the electricity generation system. The MCPMSG operation with one or two independent sources of energy consumption in the case of a dual-channel or double dual-channel operation was investigated. For the analyzed cases, the original mathematical models of the three-phase MCPMSG were developed. On the basis of numerical and laboratory tests, the influence of individual configurations on the MCPMSG output parameters was determined. An original method for diagnosing the operation of the MCPMSG channels was developed. Numerical and laboratory tests of the proposed diagnostic method based on a single voltage signal were carried out. As part of the laboratory tests, selected operating states under conditions of full winding symmetry and internal asymmetry were analyzed. The advantage of the proposed diagnostic method is the control of the operating state of the channels both under load and in the de-energized state. The proposed diagnostic method for control of the individual channel requires measurement of only one voltage signal. [ABSTRACT FROM AUTHOR]

Considering the growing prominence of production-level AI and the threat of adversarial attacks that can poison a machine learning model against a certain label, evade classification, or reveal sensitive data about the model and training data to an attacker, adversaries pose fundamental problems to machine learning systems. Furthermore, much research has focused on the inverse relationship between robustness and accuracy, raising problems for real-time and safety-critical systems particularly since they are governed by legal constraints in which software changes must be explainable and every change must be thoroughly tested. While many defenses have been proposed, they are often computationally expensive and tend to reduce model accuracy. We have therefore conducted a large survey of attacks and defenses and present a simple and practical framework for analyzing any machine-learning system from a safety-critical perspective using adversarial noise to find the upper bound of the failure rate. Using this method, we conclude that all tested configurations of the ResNet architecture fail to meet any reasonable definition of 'safety-critical' when tested on even small-scale benchmark data. We examine state of the art defenses and attacks against computer vision systems with a focus on safety-critical applications in autonomous driving, industrial control, and healthcare. By testing a combination of attacks and defenses, their efficacy, and their run-time requirements, we provide substantial empirical evidence that modern neural networks consistently fail to meet established safety-critical standards by a wide margin. [ABSTRACT FROM AUTHOR]

The emergence of Industry 4.0 has transformed modern-day factories into high-tech industrial sites through rapid automation and increased access to real-time data. Deep learning approaches possessing superior capabilities for intelligent, data-driven fault diagnosis have become critical in ensuring process safety and reliability in these industrial sites. However, such applications trained exclusively on in-distribution process data face challenges in the wake of previously unseen out-of-distribution (OOD) data in the real world. This paper addresses the challenge of out-of-distribution data detection for deep learning-based fault diagnosis models by generating synthetic data to simulate real-world anomalies not present in the training set. We propose Manifold Guided Sampling (MGS), a data-driven method for generating synthetic OOD samples from the in-distribution data-supporting manifold estimated through a deep generative model. Synthetic data from MGS enhances the model capacity for prediction uncertainty quantification, resulting in safe and reliable models for real-world industrial process monitoring. Furthermore, the MGS algorithm maintains the in-distribution data feature space as a reference point during data generation to ensure the resulting synthetic OOD data is realistic. We analyze the effectiveness of MGS through experiments conducted on the steel plates faults dataset and demonstrate that augmenting training data with synthetic data from MGS enhances the model performance in OOD detection tasks and provides robustness against dataset distributional shifts. The findings underscore the effectiveness of utilizing synthetic MGS-generated OOD data in scenarios where real-world OOD data is limited, enabling better generalization and more reliable fault detection in practical applications.

The automation of railroad operations is a rapidly growing industry. In 2023, a new European standard for the automated Grade of Automation (GoA) 2 over European Train Control System (ETCS) driving is anticipated. Meanwhile, railway stakeholders are already planning their research initiatives for driverless and unattended autonomous driving systems. As a result, the industry is particularly active in research regarding perception technologies based on Computer Vision (CV) and Artificial Intelligence (AI), with outstanding results at the application level. However, executing high-performance and safety-critical applications on embedded systems and in real-time is a challenge. There are not many commercially available solutions, since High-Performance Computing (HPC) platforms are typically seen as being beyond the business of safety-critical systems. This work proposes a novel safety-critical and high-performance computing platform for CV- and AI-enhanced technology execution used for automatic accurate stopping and safe passenger transfer railway functionalities. The resulting computing platform is compatible with the majority of widely-used AI inference methodologies, AI model architectures, and AI model formats thanks to its design, which enables process separation, redundant execution, and HW acceleration in a transparent manner. The proposed technology increases the portability of railway applications into embedded systems, isolates crucial operations, and effectively and securely maintains system resources. [ABSTRACT FROM AUTHOR]

Methods for fault diagnosis based on metric learning, in which a query sample is classified by picking the closest prototype from the support set based on their feature similarities, have been the subject of many studies. In real-world applications of in-orbit products, such as circulating pumps, the computation of similarity between different pairs is prone to different degrees of inaccuracy, especially epistemic uncertainty. Knowing and considering the uncertainty of similarity may improve fault detection accuracy. This article provides a unique approach to fault diagnosis based on Prototypical Network (Pro-Net) and Uncertainty Theory. In particular, we use epistemic uncertainty by altering the representation of prototypes from a deterministic scalar to an uncertain representation. To assess the similarity between a query and the prototypes in a support set, we calculate the uncertain distance between the pairs using cross-entropy. Experiments with symmetrical structures reveal that our proposed method significantly enhances classification precision and achieves state-of-the-art performance. It improves the reliability of fault diagnosis and reduces the risk of making erroneous judgments in safety-critical systems, decreasing the possibility of adverse consequences. [ABSTRACT FROM AUTHOR]

The automation of railroad operations is a rapidly growing industry. In 2023, a new European standard for the automated Grade of Automation (GoA) 2 over European Train Control System (ETCS) driving is anticipated. Meanwhile, railway stakeholders are already planning their research initiatives for driverless and unattended autonomous driving systems. As a result, the industry is particularly active in research regarding perception technologies based on Computer Vision (CV) and Artificial Intelligence (AI), with outstanding results at the application level. However, executing high-performance and safety-critical applications on embedded systems and in real-time is a challenge. There are not many commercially available solutions, since High-Performance Computing (HPC) platforms are typically seen as being beyond the business of safety-critical systems. This work proposes a novel safety-critical and high-performance computing platform for CV- and AI-enhanced technology execution used for automatic accurate stopping and safe passenger transfer railway functionalities. The resulting computing platform is compatible with the majority of widely-used AI inference methodologies, AI model architectures, and AI model formats thanks to its design, which enables process separation, redundant execution, and HW acceleration in a transparent manner. The proposed technology increases the portability of railway applications into embedded systems, isolates crucial operations, and effectively and securely maintains system resources.

Ever-shorter product lifecycles and more frequently changing customer demands challenge manufacturing companies to change their products and the components these products are composed of in ever-shorter periods. As a result, the existing manufacturing process and inspection sequences (MPISs) of the corresponding components must be adapted. Particularly in the production of safety–critical components, such as in the medical industries, component changes represent a major challenge, as very high quality requirements are placed on the components and a costly re-certification of the adapted processes is necessary. Due to the high quality requirements, not only the manufacturing process but also the inspection processes must be adapted for the realization of a component change. Furthermore, a high degree of planning reliability is necessary when deriving adaptations of MPISs for component changes to keep the re-certification effort and adaptation costs for safety–critical components as low as possible. Therefore, a methodology is introduced for the integrative derivation of adaptation options of MPISs due to component changes that supports users in identifying suitable adaptations in a systematic and time-efficient way. The methodology is successfully applied to a use case from the medical industry and supports users in identifying adaptations in established MPISs to implement a component change. [ABSTRACT FROM AUTHOR]

Emerging and future applications rely heavily upon systems consisting of Internet of Things (IoT), edges, data centers, and humans-in-the-loop. Significantly different from warehouse-scale computers that serve independent concurrent user requests, this new class of computer systems directly interacts with the physical world, considering humans an essential part and performing safety-critical and mission-critical operations; their computations have intertwined dependencies between not only adjacent execution loops but also actions or decisions triggered by IoTs, edge, datacenters, or humans-in-the-loop; the systems must first satisfy the accuracy metric in predicting, interpreting, or taking action before meeting the performance goal under different cases. This article argues we need a paradigm shift to reconstruct the IoTs, edges, data centers, and humans-in-the-loop as a computer rather than a distributed system. We coin a new term, high fusion computers (HFCs), to describe this class of systems. The fusion in the term has two implications: fusing IoTs, edges, data centers, and humans-in-the-loop as a computer, fusing the physical and digital worlds through HFC systems. HFC is a pivotal case of the open-source computer systems initiative. We laid out the challenges, plan, and call for uniting our community's wisdom and actions to address the HFC challenges. Everything, including the source code, will be publicly available from the project homepage: https://www.computercouncil.org/HFC/. [ABSTRACT FROM AUTHOR]

Designing process is inseparable from software development. Like other software development processes, designing process faces many problems, such as improper and ambiguous specifications. These problems may be overcome by applying formal engineering methods. One of which is Structured Object-Oriented Formal Language (SOFL). The analysis and formation of the design and implementation of SOFL are carried out as a solution to the problem. The application of SOFL is divided into three parts according to SOFL rules, namely informal specification, semi-formal specification, and formal specification. The design and implementation are measured and tested using rigorous review and maintainability index. This research uses a warehouse management system, a safety-critical system, as a case study. Rigorous analysis shows that SOFL in warehouse management system increases the maintainability index of 56.94%. It means that it is easier to develop.

As a crucial part of the communication-based train control (CBTC) system, the wireless communication subsystem is responsible for transmitting safety-critical information, which directly affects the safe and efficient operation of the urban rail transit. The dependability analysis method for wireless communication in CBTC is critical and necessary to ensure the stable transmission of safety-critical information. However, most of the existing researches in CBTC lack a unified evaluation index to analyze the wireless communication dependability. In this paper, the dependability of wireless communication system in CBTC is established. To be specific, timeliness, integrity, security, and safety are used to describe the dependability of CBTC wireless communication system in our definition. The age of information (AoI) is used to quantitatively analyze the dependability in the CBTC wireless communication system. To verify the effectiveness of the proposed dependability analysis method, we quantitatively introduce the dependability of wireless communication system in CBTC with different scenarios, including packet-drop, re-transmission, handoff, and cyber-attack. Simulation results show that the designed dependability analysis method with quantized AoI can efficiently describe the dependability of CBTC wireless communication system in different scenarios. [ABSTRACT FROM AUTHOR]

This work presents an online decentralized allocation algorithm of a safety-critical application on parallel computing architectures, where individual Computational Units can be affected by faults. The described method includes representing the architecture by an abstract graph where each node represents a Computational Unit. Applications are also represented by the graph of Computational Units they require for execution. The problem is then to decide how to allocate Computational Units to applications to guarantee execution of a safety-critical application. The problem is formulated as an optimization problem with the form of an Integer Linear Program. A state-of-the-art solver is then used to solve the problem. Decentralizing the allocation process is achieved through redundancy of the allocator executed on the architecture. No centralized element decides on the allocation of the entire architecture, thus improving the reliability of the system. Inspired by multi-core architectures in avionics systems, an experimental illustration of the work is also presented. It is used to demonstrate the capabilities of the proposed allocation process to maintain the operation of a physical system in a decentralized way while individual components fail. [ABSTRACT FROM AUTHOR]

Stationary motorized cycling assisted by functional electrical stimulation (FES) is a popular therapy for people with movement impairments. Maximizing volitional contributions from the rider of the cycle can lead to long-term benefits like increased muscular strength and cardiovascular endurance. This paper develops a combined motor and FES control system that tasks the rider with maintaining their cadence near a target point using their own volition, while assistance or resistance is applied gradually as their cadence approaches the lower or upper boundary, respectively, of a user-defined safe range. Safety-ensuring barrier functions are used to guarantee that the rider’s cadence is constrained to the safe range, while minimal assistance is provided within the range to maximize effort by the rider. FES stimulation is applied before electric motor assistance to further increase power output from the rider. To account for uncertain dynamics, barrier function methods are combined with robust control tools from Lyapunov theory to develop controllers that guarantee safety in the worst-case. Because of the intermittent nature of FES stimulation, the closed-loop system is modeled as a hybrid system to certify that the set of states for which the cadence is in the safe range is asymptotically stable. The performance of the developed control method is demonstrated experimentally on five participants. The barrier function controller constrained the riders’ cadence in a range of 50 ± 5 RPM with an average cadence standard deviation of 1.4 RPM for a protocol where cadence with minimal variance was prioritized and used minimal assistance from the motor (4.1% of trial duration) in a separate protocol where power output from the rider was prioritized.

EdgeAI is an emerging artificial intelligence (AI) accelerator technology, which is capable of delivering improved AI performance at both a lower cost and a lower power level. With the aim of implementation in large quantities and in safety-critical environments, it is imperative to understand how single-event effects (SEEs) affect the reliability of this new family of devices and to propose efficient hardening solutions. Through neutron beam experiments and fault-injection analysis of a commercial-off-the-shelf (COTS) EdgeAI device, we are able to identify the device’s SEE failure-modes, separate the error rate contributions of the device’s different resources, and characterize the device’s SEE reliability. During this analysis, we discovered that the vast majority of single-bit flips have no appreciable effect on the output. After this analysis, we propose a hardening solution that implements triple-modular redundancy (TMR) in the device without changing its physical architecture. We experimentally validate this solution and show that we are able to correct 96% of the misclassifications (critical errors) with nearly zero overhead. [ABSTRACT FROM AUTHOR]

A variety of factors are forcing companies to change their products and the components these products are composed of. Examples of current factors are changing customer requirements, product optimizations or ever-shorter product lifecycles. These component changes, particularly in safety–critical components in the medical and aerospace industry, pose great challenges and are limited in scope. The challenges and limitations arise from the high costs and the amount of time involved in component recertification as required by law, as well as revalidations of the manufacturing after a change has been implemented. Some component changes are even mandatory. In this case there are no options for reducing recertification efforts by choosing between different design changes. In contrast, there are alternative manufacturing options with which to implement the prescribed component changes that can reduce the amount of revalidation required on the manufacturing side. Due to the fact that changes to the manufacture of safety–critical components require validation, the existence of alternative manufacturing changes offers the potential to save time and money by selecting the best-suited alternative. In order to be able to select the best-suited alternative, all alternative manufacturing changes must be known, which poses a challenge for technology planners dealing with the complex manufacture of safety–critical components. Therefore, a methodology is introduced to support technology planners in identify alternative manufacturing changes with which to implement scope-restricted changes to safety–critical components. The methodology is validated by applying it to a case study from the medical industry. [ABSTRACT FROM AUTHOR]

Being the main driver of innovation in the automotive industry, vehicle software calls for more efficient tools for its development. Safety-critical applications are predominantly written respecting the AUTOSAR standard, where tasks comprise code-fragments called runnables, and deployed on multi-core architectures. However, task parallelization introduces a substantial number of idle intervals, as runnables have to be mapped and scheduled at design-time without violating data dependencies. In parallelized event-triggered tasks, these intervals are utilized by migrating runnables from the interrupted time-triggered tasks. We propose to also migrate runnables from consecutively scheduled tasks and additionally, to maximize their number using DPM-aware application scheduling. [ABSTRACT FROM AUTHOR]

The use of formal modeling has seen an increasing interest in the development of safety-critical, embedded microcomputer-controlled railway interlocking systems, due to its ability to specify the behavior of the systems using mathematically precise rules. The research goal is to prepare a specification-verification environment, which supports the developer of the railway interlocking systems in the creation of a formally-proven correct design and at the same time hides the inherent mathematical-computer since related background knowledge. The case study is presented with the aim to summarize the process of formalizing a domain specification, and to show further application possibilities (e.g. verification methods). [ABSTRACT FROM AUTHOR]