Open Source Software for Train Control Applications and Its Architectural Implications
Total Page:16
File Type:pdf, Size:1020Kb
Open Source Software for Train Control Applications and its Architectural Implications Dissertation zur Erlangung des Grades eines Doktors der Ingenieurwissenschaften – Dr.-Ing. – Vorgelegt im Fachbereich 3 (Mathematik/Informatik) der Universität Bremen von Dipl.-Ing. Johannes Feuser im Dezember 2012 Datum des Promotionskolloquiums: 21.02.2013 Gutachter: Prof. Dr. Jan Peleska (Universität Bremen) Prof. Dr. Martin Gogolla (Universität Bremen) To my father Matthias Feuser Acknowledgments I would like to thank the following persons and institutions for their support during the preparation of this work: The Siemens AG for supporting me during this work through a research grant of the Graduate School on Embedded Systems GESy1 at the University of Bremen. My supervisor Prof. Jan Peleska for his scientific guidance and support. My friends and former colleagues Erwin Wendland, Lothar Renner, and Dr. Oleg Ivlev, who supported me to form my interest for scientific research during my student years. My colleague Blagoy Genov for the inspiring, scientific discussions. My colleagues Dr. Uwe Schulze and Dr. Cecile Braunstein for their support during the finalisation of this document. My wife Diana Valbuena for her permanent support and help. Johannes Feuser Bremen, 18th March 2013 1http://www.informatik.uni-bremen.de/gesy v Zusammenfassung In dieser Arbeit werden die Forschungsergebnisse der Entwicklung sicherheitskritischer Soft- ware mittels den Prinzipien von Open-Source2-Software beschrieben. Es wurden verschiedene modellbasierte Entwürfe und Architekturen für das Gebiet des Schienenverkehrs, inklusive wiederverwendbare Formalismen zur Verifikation & Validation, untersucht. Außerdem wurden die Eindämmung von möglichen Sicherheitsbedrohungen3 durch plattform- oder hersteller- speziefische Anpassung der modellierten und offenen Kern-Software analysiert, und als Lösung der Einsatz von Hardware-Virtualisierung im Gegensatz zu traditionellen Speicherverwaltung entwickelt. Der Hauptteil dieser Arbeit besteht aus der Entwicklung einer Domänen-spezifischer Sprache (DSL), um Teile des europäischen Zug-Kontrollsystems (ETCS) zu modellieren, welche aus dem Spezifikationsdokument speziell abgeleitete Daten-, Kontrollflussformalismen und Sprachelemente verwendet. Das neue GOPPRR Meta-Metamodell wurde als Erweiterung des bereits existierenden GOPRR Meta-Metamodell entwickelt, um den Anforderungen an die Syntax-Definition für die Modellierung für sicherheitskritische Systeme zu genügen. GOPPRR bietet Methoden für die Definitionen von Randbedingungen4 mittels der Objekt-Randbedingung- Sprache (OCL), sodass eine statische Semantik definiert werden kann, um die Korrektheit von Modellen sicherzustellen. Teile der ETCS Spezifikation für die Kontrolleinheit in Zügen wurden mittels eines neuen Metamodells modelliert. Ein Domänen-Rahmenwerk5 und ein entsprechender Code-Generator mit integrierter Unterstützung für Verifikation & Validation wurden entworfen und entwickelt, um die Transformation des Modells in eine ausführbare Anwendung zu ermöglichen. Um zu demonstrieren, dass das Modell der Spezifikation kor- rekt ist, wurde die so generierte Anwendung in einer Simulationsumgebung ausgeführt und entsprechende Simulationsprotokolle erstellt. Die Übereinstimmung dieser Protokolle mit dem erwartetem Verhalten aus dem Spezifikationsdokument bestätigten die verwendeten Methoden und Strategien als mögliches Konzept. 2dt. offene Quellen 3eng. security threats 4eng. constraints 5eng. domain framework vi Abstract This document describes the research results that were obtained from the development of safety-critical software under the principles of open source. Different model-based designs and architectures within the railway control system application domain, including re-usable formalisms for verification & validation, were investigated. The reduction of possible security threats caused by platform or supplier specific adaptations of modelled open-core software was analysed, and a possible solution by the usage of hardware virtualisation, instead of traditional memory management, was elaborated. At core of this work, the development of a graphical domain-specific language for modelling parts of the European Train Control System (ETCS) is presented, which is based on specialised data, control flow formalisms, and language elements derived from the specification document. For a more precise and therefore more appropriate syntax definition for safety-critical systems, the already existing GOPRR meta meta model was extended to the newly developed GOPPRR meta meta model. GOPPRR includes methods for defining constraints by the object constraint language, which supports the definition of static semantics to ensure correct model instances. Parts of the ETCS specification related to the train on-board unit were modelled in a new meta model. To transform the developed model of the ETCS specification into an executable application, a domain framework, according to the new meta model and the corresponding code generator, were designed and implemented, which have implicitly an integrated support for the verification & validation process. To proof the correctness of the modelled specification, the resulting application was executed in a simulative environment to obtain simulation traces. The correspondence of traces to the expected data from the specification document supported the used methods and strategies in this dissertation as proof of concept. vii Contents Acknowledgments v Zusammenfassung vi Abstract vii Contents ix List of Figures xi 1. Introduction 1 1.1. Objectives ....................................... 1 1.2. Main Contributions .................................. 2 1.3. Related Work ..................................... 3 1.4. Structure of this Document . .......................... 6 I. Background 9 2. Concepts for Safe Railway Operation and Control 11 2.1. Requirements for a Train Control System as Open Source Software ....... 12 2.2. European Train Control System ........................... 13 2.2.1. General Purpose ............................... 13 2.2.2. Application Levels .............................. 15 2.2.3. Operational States .............................. 16 2.2.4. Mode Transitions . ............................ 19 2.3. openETCS ....................................... 19 2.4. Conclusion ....................................... 20 3. Domain-Specific Modelling 21 3.1. Meta Meta Models .................................. 23 3.1.1. Meta Object Facility ............................. 23 3.1.2. Ecore ..................................... 28 3.1.3. Extensible Markup Language with Schema Definition . ......... 28 3.1.4. Backus-Naur Form .............................. 30 3.1.5. Graph, Object, Property, Role, and Relationship ............. 31 3.2. Meta Meta Model Comparison ........................... 35 3.3. Domain-Specific Modelling Development Applications .............. 36 3.3.1. Xtext . ................................... 36 3.3.2. Graphical Modelling Framework ...................... 36 ix Contents 3.3.3. Rascal . ................................... 36 3.3.4. MetaEdit+ .................................. 37 3.4. Conclusion ....................................... 37 4. The GOPPRR Meta Meta Model – An Extension of GOPRR 39 4.1. Concrete Syntax Description Formalism . .................... 40 4.2. GOPPRR C++ Abstract Syntax Model ...................... 43 4.3. GOPPRR XML Schema Definition ......................... 46 4.4. MERL GOPPRR Generator ............................. 46 4.5. The Object Constraint Language for Static Semantics .............. 47 4.5.1. OCL Example: Global, Numerical Criteria ................. 48 4.5.2. OCL Example: Numerical Criteria within a Graph ............ 48 4.5.3. OCL Example: Boolean Criteria within a Graph by further Type Speci- fication .................................... 48 4.5.4. OCL Example: Port Connection Specification . ............. 49 4.5.5. OCL Example: Graphical Containment . ............... 49 4.5.6. Limitations .................................. 50 4.5.7. Conclusion . ................................ 50 4.6. Tool Chain ...................................... 50 4.7. Conclusion ....................................... 53 II. Dependability 55 5. Verification and Validation 57 5.1. Applicable and Related Standards ......................... 58 5.1.1. DIN EN 61508 ................................ 59 5.1.2. EN 50128, EN 50129, and EN 50126 .................... 59 5.1.3. DO-178B ................................... 60 5.2. Verification and Validation as Open Source Software ............... 60 5.3. Software Life Cycle with Domain-Specific Modelling ............... 61 5.4. Conclusion ....................................... 62 6. Security in Open Source Software 65 6.1. Memory Management ................................ 66 6.1.1. Partitioning .................................. 67 6.1.2. Paging ..................................... 68 6.1.3. Segmentation ................................. 68 6.1.4. Segmentation combined with Paging .................... 68 6.2. Hardware Virtualisation ............................... 69 6.2.1. Bandwidth Protection ............................ 71 6.2.2. Minimal Host Operating System . ................... 73 6.2.3. Hardware Assisted Virtualisation ...................... 73 6.2.4. Process Communication . .......................... 74 x Contents 6.2.5. Hardware Device Access ........................... 75 6.2.6. Hardware Virtualisation on Certified Supplier Hardware ......... 75 6.2.7. Hypervisor Requirements .......................... 76 6.3. Conclusion