Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Chapter 1. Introduction
MontiCore MontiCore [50, 51] is a framework that is specialised for the development of
text-based domain-specific languages [35]. A typical task during the development of these is
the definition of the concrete and abstract syntax. In textual languages, the concrete syntax is
also called grammar. While the definition of the grammar is mostly related to the development
of the available textual constructs and elements, the abstract syntax is needed for parsing
concrete text instances that conform to the grammar.
Therefore, both syntax types must be held synchronised or rather must be modified together.
Normally, the concrete syntax / grammar is in the main focus during the development of the
textual language. Thus, modifications in the grammar render necessary adaptations of the
abstract syntax. To avoid this often recurring task, MontiCore provides an own grammar
format for the ANTLR [69] parser generator, from which an abstract syntax (tree) can be
generated automatically. Accordingly, the manual update and development of the abstract
syntax can be omitted.
Although MontiCore seems to be an excellent starting point for the development of textual
languages, the case study in Part III developed in this work uses a graphical modelling formalism,
which is motivated in Chapter 3.
Open Proofs The development of safety-critical software as re-usable open source is one of
the basic ideas that supports this dissertation. A similar concept called Open Proofs [65] also
addresses this idea because the term “open proofs” refers to the public proofs of correctness of
a certain software. Open Proofs requires
• the entire implementation,
• automatically-verifiable proof(s) of at least one key property, and
• required tools (for use and modification)
to be free/libre open source software (FLOSS) [95]. Open Proofs demands that in such a
publicly developed tool-chain faults can be found more easily and eliminated due to a big
community using them. Nevertheless, currently there exist only few examples of software that
implement the Open Proofs principle.
In contrast to the contributions of this dissertation, Open Proofs is only a concept that can
be applied to the software development for safety-critical systems.
openETCS The openETCS [38, 37] initiative of German Railways (Deutsche Bahn) is based
on the Open Proofs idea [40, 39]. Reviewing evidence, where security threats have been
purposefully integrated into closed-source commercial software products, the initiators argued
that open source software could be useful – perhaps even mandatory in the future – to ensure
safety and security of railway control systems. Even though the standards applicable for
safety-critical systems software development in the railway domain [11, 10] require independentthird-party
verification and validation, the complexity of the source code on the one hand
and the limited budget available for V&V on the other hand can only mitigate the threat of
safety and security vulnerabilities. A guarantee to uncover all compromising code fragments
inadvertently or purposefully injected into the code cannot be given. As a consequence, in
4