Companion to Capella-Setup-Guide.dox and model_spec.json. Lists what to model in each Capella project. Names of modules, stages and files come from the repository; missions and capabilities are modelling judgements (they cannot be extracted from code), so treat them as a draft to review.

Where each item lives in Arcadia:

Item	Layer	Capella location
Mission	System Analysis	Missions & Capabilities > Missions
Capability	System Analysis	Missions & Capabilities > Capabilities
System function	System Analysis	System Functions (black box: what the system does for its actors)
Logical function	Logical Architecture	Logical Functions, allocated to a Logical Component

Rule used below: a system function is stated from the actor's point of view. A logical function is one internal step, and it is allocated to exactly one logical component from model_spec.json.

Status legend: [code] exists and is tested; [stub] exists as a stub; [planned] skeleton or not started. Do not model planned items as if they were implemented.

1. Platform_RTE (Platform_RTE, Platform_OS_POSIX, safeAPIFlowBackendDDS)

System of interest: Safe Computing Platform. Actors: Functional Actor (the application), Integrator (supplies OSAdapters and capability/state declarations), Peer Channel (the other redundant channel), Operating System / Hardware.

Missions

M1 Host a safety application behind a stable PI-API so it does not depend on OS or transport.
M2 Make the application redundancy-agnostic: voting, comparison, checkpointing and site negotiation are Platform duties.
M3 React to faults safely: the Platform, not the application, decides the safe state.
M4 Stay portable: any OS or transport is reached only through OSAdapter vtables (ADR-005).

Capabilities

Id	Capability	Serves	Status
C1	Run a cyclic application in ordered stages	M1	[code]
C2	Exchange data over named Flows	M1, M4	[code] POSIX/netlink, [stub] DDS
C3	Vote or cross-compare replica outputs	M2, M3	[code] 2-way, N-way voter without mesh
C4	Commit or discard staged output at a checkpoint	M2, M3	[code]
C5	Negotiate site role and transfer state on promotion	M2	[code]
C6	Load a redundancy topology and check the application supports it	M2	[code]
C7	Enter the safe state	M3	[code]
C8	Provide OS services through the OAL	M4	[code]
C9	Protect data and timing integrity (checksum, safe channel, watchdog, clock sync)	M3	[code]

System functions

Execute application stages cyclically (C1)
Open, send, receive, close and configure a Flow (C2)
Compare two replica outputs and report agree or disagree (C3)
Vote among N replica outputs against a quorum (C3)
Rendezvous both channels each cycle and commit or discard staged output (C4)
Determine ONLINE or STANDBY role for this site (C5)
Encode, transfer and decode registered application state (C5)
Load and validate the redundancy configuration (topology, replicas, quorum, standby_mode) (C6)
Ask the application whether it supports a topology (C6)
Enter SAFE or REBOOT and run the application cleanup handler (C7)
Supply timer, NVM, memory, task, mutex, IPC, netlink, platform, reboot, log services (C8)
Compute and verify checksums; supervise the watchdog; synchronise clocks (C9)

Logical functions, by logical component

Logical component	Logical functions
App Manager	Run stage list in order; run on_checkpoint_result hook; schedule cycle period
Safe-state Manager	Register cleanup handler; latch transition request; execute SAFE/REBOOT
Channel Link	Track link health; count consecutive failures; expose up/down
Channel Service	Resolve channel name to OSAdapter; set up channel; read; send; close
Voter	Collect N inputs; compute majority; compare against quorum; report result
Cross-Comparator	Compare two channels or two buffers; return result and agreed output
Checkpoint	Exchange checkpoint request and reply; commit staged sends; discard staged sends
Dual Negotiator	Send negotiation frame; decide role; detect peer loss; promote on failure
Flow	Bind name to OSAdapter route; open endpoint by flags; move messages
Redundancy Config	Parse JSON; validate topology and quorum; call capability callback; apply to voter
State Transfer	Register field; compute encoded size; encode all fields; decode all fields
OAL Services	One function per service seam (timer, nvm, memory, task, netlink, ipc, reboot, platform, log, watchdog, mutex, clocksync)
POSIX OSAdapter	Implement each OAL vtable on POSIX
Flow DDS OSAdapter (stub)	Implement the Flow vtable over netlink; no DDS wire protocol

Not yet real (do not model as capabilities): platform-controlled invocation cadence needed for true hot standby; N-way mesh channel registration; real DDS.

2. Platform_Protocol_SafeComm (Platform_Protocol_SafeComm)

System of interest: Safe Communication stack (Subset-037 EuroRadio, Subset-098 RBC-RBC). Actors: Train EVC, Peer RBC, RBC application, Transport/Bearer, Key/Config provider. Status (2026-09): partly implemented. config, mac (3DES CBC-MAC with test vectors), saf (SaF handshake), ale and the protocol adapter binding exist and pass their tests (5/5 ctest); cfm, euroradio, rbc_rbc and transport are still skeletons returning SAFECOMM_STATUS_NOT_IMPLEMENTED. Tag modelled items status = implemented or status = planned accordingly.

Missions

M1 Deliver authenticated, sequence-protected messages between EVC and RBC (SS-037).
M2 Deliver the same between two RBCs (SS-098).
M3 Keep the vital and non-vital parts separate (ADR-002): the vital target links no non-vital code.

Capabilities

Id	Capability	Status
C1	Establish an authenticated session (AU1/AU2/AU3)	[code] SaF handshake, tested
C2	Protect each message (3DES CBC-MAC) and detect replay/loss by sequence number	[code] MAC vectors tested
C3	Supervise the session	[planned]
C4	Manage the bearer and present whole PDUs upward	[planned]
C5	Relay raw traffic to both channels A and B	[code] ALE tested
C6	Load per-node configuration and refuse to start on a bad value	[code]

System functions

Establish and terminate a safe session (C1)
Send and receive an authenticated PDU (C2)
Detect MAC failure, sequence gap, timeout (C2, C3)
Connect and disconnect the bearer; deliver whole PDUs (C4)
Relay a received frame to channel A and channel B; route by peer map (C5)
Load and range-check configuration; read KMAC from a file, never inline (C6)

Logical functions, by logical component

Logical component	Logical functions
Safety Functional Module (SFM)	Run AU1/AU2/AU3 handshake; compute and verify MAC; number and check sequence; supervise timers
Communication Functional Module (CFM)	Manage bearer connection; frame and deframe PDUs; hide bearer jitter from the cross-compare
Application Layer Entity (ALE)	Listen externally; map peer to route; relay raw bytes to A and B
Config	Parse key = value; validate syntax; hand values to components

3. RBC_GP (RBC_GP)

System of interest: RBC Generic Platform (the executable that hosts the RBC logic). Actors: Train (through the role-C gateway), Interlocking (IL), CTC, GA (Generic Application), Peer channel and Peer site, Safe Computing Platform.

Missions

M1 Provide the vital ERTMS/ETCS RBC procedures (Subset-026) on a redundant 2oo2 pair.
M2 Stay available across a site loss through WEST/EAST failover.
M3 Grant Movement Authority only through the route-to-train connect gate.

Capabilities

Id	Capability	Serves	Status
C1	Manage train sessions and train data	M1	[code]
C2	Grant, extend and shrink Movement Authority	M1, M3	[code]
C3	Track train position	M1	[code]
C4	Handle emergency stop, end of mission, TSR, shunting, handover, text message	M1	[code]
C5	Cross-compare channels A and B every online cycle	M1	[code]
C6	Commit or discard staged outputs at checkpoint (ADR-034)	M1	[code]
C7	Negotiate site role and transfer sessions and database on promotion	M2	[code]
C8	Relay to and from the gateway (train, IL, CTC, util)	M1	[code]
C9	Expose route and train context to GA and accept validated setters	M3	[code]

System functions

Open, keep and close a train session (C1)
Accept train data and position reports (C1, C3)
Grant, extend or shrink Movement Authority when route and train connect (C2)
Command emergency stop; end mission; apply temporary speed restriction; handle shunting (C4)
Hand a train over to or from a neighbour RBC (C4)
Send text messages to a train (C4)
Compare A and B session tables and enter safe state on disagreement (C5)
Release or drop this cycle's outputs depending on checkpoint result (C6)
Decide ONLINE/STANDBY per site; carry sessions and database to the promoted site (C7)
Relay frames to and from the gateway (C8)
Provide route and train snapshots to GA; accept GA setters after validation (C9)

Logical functions, by logical component

Logical component	Logical functions
Communication Layer	Send and receive on ab-peer; run ab-negotiate; relay on ab-relay-train/il/ctc/util; demultiplex peer frames by kind (sample, site state, checkpoint request/reply); stage peer and relay sends
Cross-Compare Stage	Encode local and peer payload; run comparison; on disagreement run fault cleanup and enter safe state
Checkpoint Stage	Request and reply checkpoint; commit or discard staged sends; cache samples drained during the reply
ERTMS Procedures Engine	Dispatch message to procedure; run session FSM; train data; MA; position; shunting; emergency stop; end of mission; TSR; handover; text message
Route/Train Database	Store and look up routes; store and look up per-train sessions; snapshot for state transfer
MA Logic Gate	Match route to train by reported position; permit or refuse MA; notify GA of context change

The GP-to-GA seam is the interface GA Interface (ga_interface.h), not a function: model it as an interface between two components, with the GP side providing and the GA side requiring.

Known limit: GP is still redundancy-aware in its cross-compare and staging (Phase 2b partial). Model the cross-compare and checkpoint stages as GP logical functions, not as Platform functions, so the model does not claim more than the code does.

4. RBC_GA_Template (RBC_GA)

System of interest: RBC Generic Application (IL and CTC adaptation logic). Actors: GP, Interlocking, CTC. Everything tagged project_specific is replaced in each project.

Missions

M1 Turn interlocking route state into Movement Authority decisions for GP.
M2 Tell CTC what is happening to trains and authorities.
M3 Be replaceable per project without touching GP.

Capabilities

Id	Capability	Serves	Status
C1	Track route add and release from the interlocking	M1	[code]
C2	Grant or shrink MA when GP connects or disconnects a train to a route	M1	[code]
C3	Report train connected, MA granted/extended, and train info to CTC	M2	[code]
C4	Register callbacks with GP through one init call	M3	[code]
C5	Provide a route-only projection of the site data	M1, M3	[code], project-specific

System functions

Accept a route-add or route-release indication from IL (C1)
Decide and request MA grant, extension or shrink (C2)
Emit indications to CTC, including CTC_TRAIN_INFO (C3)
Register with GP at start (C4)
Look up route data for the current site (C5)

Logical functions, by logical component

Logical component	Logical functions
IL Adapter	Track route set/release; on GP context change compute MA; request grant or shrink
CTC Adapter	Build train-connected, MA-granted, MA-extended and CTC_TRAIN_INFO indications
MA Logic Adaptation	Provide ab_ga_ma_adaptation_init; store the GP interface pointer; register GA callbacks with GP
Site Projection	Answer route queries from the route-only projection (project_specific)

Note: the source tree also has src/C/il and src/C/ctc; these are the role-C stand-ins for the rest of the ERTMS system, not part of the vital GA. Keep them out of the template model or model them as a separate "test environment" component.

5. RBC_PKP (project model, created from the template)

System of interest: RBC for the Polish market, one system built from the library products. This project owns almost no functions of its own. It references the four libraries and allocates their functions to project components.

Missions (project level)

M1 Provide a SIL 4 Radio Block Centre for PKP that meets the project requirements.
M2 Meet availability targets through 2oo2 with redundancy on Kontron.
M3 Show compliance evidence for the composed product (EN 50126/50128/50129).

Capabilities

Reference, do not copy, the capabilities of the four libraries. Add only project capabilities:

Operate two sites with failover on the Kontron platform
Serve trains over EuroRadio (needs safeComm [planned] items)
Interface with the PKP interlocking and CTC through the project GA

System and logical functions

System functions: the union of GP and GA system functions as seen by the train, IL and CTC. Create them in PKP System Analysis by realising or refining the library functions; do not retype them.
Logical functions: reference the library logical functions. Allocate each to a PKP component (Channel A, Channel B, Gateway) so the Physical Architecture can deploy them (Setup Guide §6).
Project-only functions to add: load site data (ab_site.railml.xml and the SA site libraries), load project redundancy configuration (topology = 2oo2_redundant, replicas, standby_mode), packaging and installation (SA).

Traceability to keep

From	To
PKP mission M2	Framework C3, C4, C5, C6 and GP C5, C6, C7
PKP mission M1	GP C1..C4 and GA C1..C3
PKP mission M3	Compatibility table in compatibility.md and CCF notes in Setup Guide §6

6. What is not automated

p4c_build_model.py creates only Logical Components and Interfaces. It does not create missions, capabilities, functions, exchanges or diagrams. I have not verified that the simplified Python4Capella API exposes creation of those elements; if you want them scripted, add them to model_spec.json first and I will check the API against upstream before writing code.