Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Chapter 1. Introduction
ERTMS Formal Specs The ERTMS Formal Specs [25] is an application for modelling parts
of the ETCS specification [83]. The motivation is similar as for parts of this dissertation project
since the transfer of the textual specification to a formal model provides better methods during
the system development 3 and supports direct testing on the model for V&V. The ERTMS
Formal Specs is developed by the company ERTMS Solutions, which addresses their product
to costumers in the area of ETCS hardware / system suppliers.
Since only very few publications exist about the DSL, which only present small parts, a
comparison with the in this dissertation developed DSL or rather meta model is hardly possible.
It can be only determined that the ERTMS Formal Specs formalisms are strongly aligned to the
textual formalisms used in the ETCS specification while parts have a graphical representation.
The focus lays mainly on the execution of the model in a simulation environment instead of
generating code for an executable binary. At the end of October 2012 an open source version of
the ERTMS Formal Specs application was released, but the tool chain and DSL development in
this dissertation was already finished at this point. Thus, possible contributions by the ERTMS
Formal Specs application could not been taken into account for the case study development.
In contrast to the DSL developed for this dissertation the ERTMS Formal Specs is distributed
as one single application and accordingly focuses and the tool development, similar to the
openETCS project. Thus, no extendible tool chain is provided, no public meta meta model
is employed, and neither a full definition of the concrete and abstract syntax and the static
semantics of the meta model is available. Another difference is that the contributed case
study is a pure graphical DSL because this approach in general provides the maximal possible
abstraction.
In general, the ERTMS Formal Specs is a specialised, commercial software product for ETCS
component suppliers, which source code is now published under an open source license. On the
other hand, the case study in this work was used to investigate the potential of developing
train control applications as open source software and not only distributing them under an
open source software license. This takes the complete development process into account and
is not especially focussed on the tool development. Accordingly, ETCS was only used as an
example for a train control application.
1.4. Structure of this Document
This document is divided in four major parts. Part I provides background information needed
for understanding the following parts. It introduces concepts for safe railway operation by
means of the European Train Control System. Also, a brief introduction to Domain-Specific
Modelling is given. This part concludes with the choice of a meta meta model and modelling
application for this work. The last chapter in this part deals with the new developed extension
for the selected meta model, which is needed for the integration of safety-critical software.
Part II explains mechanisms of verification and validation for safety-critical systems by using
examples of applicable standards and how they might be used for the development of safetycritical
open source software. The next chapter in this part elaborates security problems arose
by the development of open source software and provides a solution by hardware virtualisation.
3 by modelling
6