Towards a Contract-Based Definition of Update-Compatibility – Modelling Safety Integration Criteria

Over-The-Air Software Updates (OTASU) provide huge benefits in terms of user experience, security, and efficiency. In fact, in the railway domain the ability of remotely updating railway equipment considerably reduces maintenance costs and time, improving system availability. However, the adoption of OTASU in the critical domains is challenged by their associated risks. Therefore, this paper identifies the acceptance criteria that an update shall satisfy in order to preserve system safety. This criteria, which is defined in the form of non-functional safety properties that characterise the update component and its integration on the system, will serve to evaluate the suitability of the updates during different phases of the update execution process (i.e., design time checks, virtual compatibility and integration checks, update verification and online as well as offline monitoring). The defined contract-based compatibility and integration approach is then evaluated in safety-critical railway signalling case study.