Hierarchical safety analysis and formal verification for safety-critical systems using STAMP and Event-B

Abstract

As safety-critical systems become increasingly complex, ensuring the safety of systems that govern critical functions affecting human activities and the environment is paramount. The inherent complexities of developing such systems necessitate a rigorous approach, as demanded by industrial standards, yet the process for ensuring safety remains inadequately defined. This paper presents a novel integration of System-Theoretic Process Analysis (STPA) with Event-B, employing a hierarchical and “middle-out” systems engineering strategy to manage complexity and improve safety verification. By applying STPA to derive and allocate safety requirements throughout a hierarchical Systems-Theoretic Accident Model and Processes (STAMP) model, and synchronizing these requirements with the formal verification steps of Event-B, our method effectively closes the gap between system development and safety engineering. The effectiveness of this approach is showcased through its application to the safety-critical Automatic Train Protection (ATP) subsystem in the Communication-Based Train Control (CBTC) system.