Design for Testability of ERMTS Applications The European Rail Traffic Management System (ERTMS) represents a class of embedded softwareintensive systems of systems for the management of the European rail traffic, in a scenario where interoperability between different European rail traffic infrastructures must be maintained. Due to the intrinsically safetycritical nature of ERTMS, software testing must meet the strict prescriptions imposed by the certification authorities, which often require the availability of the entire system. This potentially leads to perform the tests at a late stage of development, even though the best practices suggest that it would be more convenient to test the system incrementally since the early stages of development. This paper deals with the solution we devised to address this issue in a recent ERTMS project. We adopted a designfortestability pattern which purposely enhances the observability and the controllability of the software under test to make it testable at any stage of development, allowing the exploitation of system tests even during component and integration testing.

Virtual Gateway in TCMS Execution Environment based on an Integrated Architecture In the railway domain, the development trend is evolving from federated to integrated architectures, which promise massive cost reduction through higher functional integration of Train Control and Monitoring Systems (TCMS). An integrated architecture means that components are integrated on a computing node, which formerly were allocated to separate computing nodes. Therefore, the execution environment needs to support communication between these components on a computing node. Based on an integrated architecture, a virtual switch supporting timespace isolation and dynamic configuration has been proposed in previous work to address the mixed criticality of TCMS applications and dynamic coupling of vehicles. However, controlled information import and export between different data flows is not addressed in the state of the art.In this paper, we propose a virtual gateway residing in the TCMS execution environment to resolve property mismatches between different data flows and prevent fault propagation between applications of different safety critical levels. We capture the properties of data flows in the gateway specification and realise the gateway services by leveraging a database in the gateway. The experimental results show the isolation and the controlled information transportation between data flows.