Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Chapter 12. Conclusion and Outlook
static semantics can have an erroneous impact to all lower instances. Accordingly, the concrete
syntax – especially the graph bindings – and the static semantic were extensively documented.
Furthermore, mathematical models were developed and introduced to also formalise the dynamic
semantics of the openETCS meta model.
All static source code that does not have to be generated from a concrete model was designed
and implemented as domain framework for the openETCS meta model. An object-oriented
design was chosen because this could be aligned to the object-oriented meta model syntax,
which simplified the later generator development. Hence, the openETCS domain framework
provides classes, which only have to be instantiated from the concrete openETCS model by
the generator. All implementations of the dynamic semantics were transferred accordingly
to the domain framework libraries. Additionally, functional tests were provided to verify the
correctness of the openETCS domain framework implementation.
The openETCS generator, as link between the concrete openETCS model as formal specification
and the source code, was developed and its software design was discussed. Additionally, the
developed strategies for the verification of the used model transformation for the generation of
the openETCS source code for the EVC were described: Assert statements are generated from
the GOPRR instance, which can be executed on the transformed GOPPRR model to ensure
that all model elements for the model-to-model transformation from GOPRR to GOPPRR
model are correctly converted. The final model-to-text transformation from GOPPRR model
to the instantiation of the openETCS domain framework is verified by tests for the existence of
certain domain framework objects in the generated source code. Furthermore, the openETCS
generator provides the possibility to generate the build configuration needed for creating the
EVC binary from the generated source code and the configuration for executing the PIM and
PSM of the openETCS model in separated virtual machines under a Xen hypervisor.
The ETCS SRS or rather Subset-026 [83] was partly 1 modelled and discussed by exemplary
diagrams of the corresponding openETCS model for all developed graph types. Additionally,
the possibility of tracing the modification of safety properties due to model extensions was
illuminated.
A simulation for the model or rather the generated openETCS EVC binary was developed
under the MDA principle to validate the complete openETCS case study. Hence, a special
simulative PSM had to be realised to provide the interconnection between EVC binary and
simulation. The successful execution of the simulation shows that the proposed and developed
concepts for developing safety-critical software for train control applications as open model
software can be seen as a proof-of-concept. The reduction of model size and complexity is
no limitation to this statement because the influence of further model extensions was also
illuminated and the case study is a valid sub-subset of the ETCS SRS.
The concepts for dependability were only exemplary realised by generating configurations for
VMs, which was also applied in the simulation execution. The certification of the developed
openETCS case study software for the EN 50128 and SWSIL 4 is obviously out of the scope of
this work because this always has to be done by an external party. Since neither a concrete
hardware target platform was available during this work nor the proposed minimal host
operating system, all tests (including the simulation) are pure software tests and no system
1 according to the scope of the openETCS case study
238