We introduce a goal-aware extension of responsibility-sensitive safety (RSS), a recent methodology for rule-based safety guarantee for automated driving systems (ADS). Making RSS rules guarantee goal achievement—in addition to collision avoidance as in the original RSS—requires complex planning over long sequences of manoeuvres. To deal with the complexity, we introduce a compositional reasoning framework based on program logic, in which one can systematically develop RSS rules for smaller subscenarios and combine them to obtain RSS rules for bigger scenarios. As the basis of the framework, we introduce a program logic dFHL that accommodates continuous dynamics and safety conditions. Our framework presents a dFHL-based workflow for deriving goal-aware RSS rules; we discuss its software support, too. We conducted experimental evaluation using RSS rules in a safety architecture. Its results show that goal-aware RSS is indeed effective in realising both collision avoidance and goal achievement.

Abstract The decentralised railway signalling systems have a potential to increase capacity, availability and reduce maintenance costs of railway networks. However, given the safety-critical nature of railway signalling and the complexity of novel distributed signalling solutions, their safety should be guaranteed by using thorough system validation methods. To achieve such a high-level of safety assurance of these complex signalling systems, scenario-based testing methods are far from being sufficient despite that they are still widely used in the industry. Formal verification is an alternative approach which provides a rigorous approach to verifying complex systems and has been successfully used in the railway domain. Despite the successes, little work has been done in applying formal methods for distributed railway systems. In our research we are working towards a multifaceted formal development methodology of complex railway signalling systems. The methodology is based on the Event-B modelling language which provides an expressive modelling language, a stepwise development and a proof-based model verification. In this paper, we present the application of the methodology for the development and verification of a distributed protocol for reservation of railway sections. The main challenge of this work is developing a distributed protocol which ensures safety and liveness of the distributed railway system when message delays are allowed in the model.

Abstract Event-B has been attracting much interest because it supports a flexible refinement mechanism that reduces the complexity of constructing and verifying models of complicated target systems by taking into account multiple abstraction layers of the models. Although most previous studies on Event-B focused on model construction, the constructed models need to be maintained. Moreover, parts of existing models are often reused to construct other models. In this paper, a method is introduced that improves the maintainability and reusability of existing Event-B models. It automatically reconstructs the refinement structure of existing models by constructing models about different sets of variables than that used in the original models, while maintaining the consistencies checked in the original models. The method automatically decomposes each refinement step into multiple steps by taking certain predicates from existing models and deriving additional predicates from the consistency conditions of existing models to create new models consistent with the original ones. By combining the decomposing of refinement steps with the composing of refinement steps, this method automatically restructures a refinement step in accordance with given sets of variables to be taken into account in refinement steps of the refactored models. The results of case studies in which large refinement steps in existing models were decomposed and existing models were restructured to extract reusable parts for constructing other models demonstrated that the proposed method facilitates effective use of the refinement mechanism of Event-B.

Event-B requires engineers to satisfy proof obligations and inherit all predicates from abstract models while constructing concrete ones. Engineers typically derive predicates from abstract models through transformation with the intention of gradually refining the models. These kinds of intentions for refinement are essential for other engineers to understand the refinements. However, these are implicit and not directly specified in the models. Therefore, it is difficult to understand how each predicate in concrete models is obtained from the predicates in abstract models. This paper proposes an effective method of extracting these relationships. Our approach uses heuristics to avoid exhaustive matching between predicates. It tries to find a set of related predicates by tracing elements, such as variables and constants in predicates, and excluding predicates that use common variables, but differently. Our method facilitates understanding of the intentions of refinements and can be used to help reverse engineering by clarifying the relationships between predicates through refinements.

An advanced silicon compilation system called HARP is described that creates a register-transfer language (RTL) description from a FORTRAN program. HARP contains three main processing parts: a data path synthesizer; a sequence controller synthesizer; and an RTL translator. The first synthesizer generates data paths by solving three subproblems: allocation of function units, storage elements, and interconnection units. The second synthesizer generates a microprogrammed controller and microinstructions. Since the RTL translator transforms the synthesized LSI structures into RTL descriptions which are input for a VLSI synthesizer, LSI mask patterns can be directly generated. HARP produces acceptable LSI ICs which exactly execute the input FORTRAN program. HARP's target is to construct a top-down LSI design methodology starting with fewer hardware images.>

A brand-new floating-point Digital Speech Signal Processor VLSI (DSSP), intended for a wide range of applications in speech processing, is developed. For speech applications, a wide dynamic range vector operation that includes FFT and complex arithmetic is necessary in executing a highly-complicated coding algorithm that treats a large amount of windowed data collectively. To meet this requirement, the floating-point data format and hardware architecture is extensively studied. The DSSP, which is fabricated using 2.5um CMOS technology, completes almost all the floating-point operations within a 150ns machine-cycle.