Updating safety-critical applications, e.g. to adapt to a changed interface specification, is expensive due to the required recertification. We describe a concept based on the Simplex architecture for trusted systems to update the implementation of a backwardcompatible interface with unchanged safety properties. We show that safety can be inherited from an existing trusted controller at the cost of reducing the overall system's availability. The applicability is shown via a case study in the railway sector, where we see a shift toward standardized interfaces. EULYNX is the European railway interface standardization initiative. Due to the long lifetimes of railway systems, vendors are building EULYNX-compatible products while the standard is still under active development. In our case study, we build a EULYNX-compatible object controller for train-detecting axle counting modules, relying on the proven safety of an object controller implementing the older NeuPro protocol.

In the context of fast systems and software development, combining model-based systems engineering with automated code generation is essential for managing complexity while enhancing efficiency and adaptability. This paper presents a model-based approach, where a composite RDF model is created, which serves as a flexible basis for the subsequent generation of various artifacts. The artifacts include not only source code but also technical configuration files (e.g. Dockerfiles, Kubernetes objects), CI/CD pipeline configurations, and documentation. The approach has been successfully applied to the Train Dispatcher in the Cloud (ZLiC), a cloud-based approach to digitalize the German Zugleitbetrieb. An iterative development process enabled continuous system expansion and adaptation to specific project requirements. The generated prototype has been validated through simulations and field tests, confirming the robustness and practical applicability of the approach.

Specifications for safety-critical railway signalling systems have traditionally been expressed in natural language. Due to a lack of traceability features, these requirements are difficult to reason about and thus very resistant to change. Validation and verification processes of cyber-physical components based on such specifications require extensive manual review and are prone to inefficiencies. This paper describes our work towards a comprehensive methodology for deriving formal specifications for railway signalling and generating verified software for it. Our method focuses on accessibility for domain experts and industrial applicability. To this effect, we integrate established techniques into a unified tool chain comprising (1) fault tree analysis, (2) the goal-oriented requirements engineering method KAOS, and (3) formal modeling with AdaCore SPARK. We aim to facilitate end-to-end traceability of requirements through all artifacts. Currently, we are applying our methodology to a case study that involves the specification of a new ETCS-based moving block signalling system.

With the increasing reach and applicability of software systems in railway infrastructure, their complexity and the demand for constant change increases. Main factors include the use of unreliable COTS components, technical obsolescence, increasing centralization, international harmonization of technical and operational standards as well as IT-security concerns. Statically assessing the functional safety of a software-based railway system (offline assurance) is thus insufficient to maintain continued operation.Applying simplex architectures on multiple layers of the system architecture can alleviate this problem: Using a simple decision logic component, simplex controls the complexity of an evolving and multi-faceted system while maintaining the level of dependability that is required for safe passenger transport. We argue that the introduction of online assurance marks a paradigm shift in the railway domain, where the system safety today is guaranteed by expert assessments.

In modern trains, a juridical recording unit logs events that occur during operation. This data is used to reconstruct the exact chain of events in case of failures and crashes. To ensure data recovery after an accident, the recorder is hardened against physical damage and secured against tampering; however, it is a single proprietary device and by no means indestructible.This paper presents ZugChain, a distributed, blockchain-based juridical recording unit that opportunistically utilizes on-train hardware. ZugChain offers high reliability via replication and tamper-resistance due to the nature of blockchains. It implements a permissioned blockchain based on a Byzantine fault-tolerant agreement protocol suitable for diverse communication systems. To utilize the logged data for advanced services, e. g., predictive maintenance, ZugChain securely and continuously exports traces to private data centers. We demonstrate ZugChain's feasibility with an implementation running on real train hardware, where we show that ZugChain orders data within 14 ms using at maximum 15 % of the total available shared CPU resources, thus fulfilling requirements of juridical recorders.

Cardiovascular diseases and heart failures in particular are the main cause of non-communicable disease mortality in the world. Constant patient monitoring enables better medical treatment as it allows practitioners to react on time and provide the appropriate treatment. Telemedicine can provide constant remote monitoring so patients can stay in their homes, only requiring medical sensing equipment and network connections. A limiting factor for telemedical centers is the amount of patients that can be monitored simultaneously. We aim to increase this amount by implementing a decision support system. This paper investigates a machine learning model to estimate a risk score based on patient vital parameters that allows sorting all cases every day to help practitioners focus their limited capacities on the most severe cases. The model we propose reaches an AUCROC of 0.84, whereas the baseline rule-based model reaches an AUCROC of 0.73. Our results indicate that the usage of deep learning to improve the efficiency of telemedical centers is feasible. This way more patients could benefit from better health-care through remote monitoring.

The digitalization of railway systems should increase the efficiency of the train operation to achieve future mobility challenges and climate goals. But this digitalization also comes with several new challenges in providing a secure and reliable train operation. The work resulting in this paper tackles two major challenges. First, there is no single university curriculum combining computer science, railway operation, and certification processes. Second, many railway processes are still manual and without the usage of digital tools and result in static implementations and configurations of the railway infrastructure devices. This case study occurred as part of the Digital Rail Summer School 2021, a university course combining the three mentioned aspects as cooperation of several German universities with partners from the railway industry. It passes through all steps from a digital Control-Command and Signalling (CCS) planning in ProSig 7.3, the transfer, and validation of the planning in the PlanPro data format and toolbox, to the generation of code of an interlocking for the digital CCS planning to contribute to the vision of test automation. This paper contributes the experiences of the case study and a proof-of-concept of the whole lifecycle for the Digital Testfield of Deutsche Bahn in Scheibenberg. This proof-of-concept will be continued in ongoing and following projects to fulfill the vision of test automation and automated launching of new devices.

Federated learning allows a group of distributed clients to train a common machine learning model on private data. The exchange of model updates is managed either by a central entity or in a decentralized way, e.g. by a blockchain. However, the strong generalization across all clients makes these approaches unsuited for non-independent and identically distributed (non-IID) data. We propose a unified approach to decentralization and personalization in federated learning that is based on a directed acyclic graph (DAG) of model updates. Instead of training a single global model, clients specialize on their local data while using the model updates from other clients dependent on the similarity of their respective data. This specialization implicitly emerges from the DAG-based communication and selection of model updates. Thus, we enable the evolution of specialized models, which focus on a subset of the data and therefore cover non-IID data better than federated learning in a centralized or blockchain-based setup. To the best of our knowledge, the proposed solution is the first to unite personalization and poisoning robustness in fully decentralized federated learning. Our evaluation shows that the specialization of models emerges directly from the DAG-based communication of model updates on three different datasets. Furthermore, we show stable model accuracy and less variance across clients when compared to federated averaging.

Internet of Things (IoT) applications promise to make many aspects of our lives more efficient and adaptive through the use of distributed sensing and computing nodes. A central aspect of such applications is their complex communication behavior that is heavily influenced by the physical environment of the system. To continuously improve IoT applications, a staging environment is needed that can provide operating conditions representative of deployments in the actual production environments - similar to what is common practice in cloud application development today. Towards such a staging environment, we present Marvis, a framework that orchestrates hybrid testbeds, co-simulated domain environments, and a central network simulation for testing distributed IoT applications. Our preliminary results include an open source prototype and a demonstration of a Vehicle-to-everything (V2X) communication scenario.

Data transfers impose a major bottleneck in heterogenous system architectures. As a mitigation strategy, compute resources can be introduced in places where data occurs naturally. The increased diversity of compute resources in turn affects programming models and practicalities of software development for near-data compute kernels and raises the question of how those resources can be made accessible to users and applications. We introduce the Metal FS framework to improve the accessibility of FPGA-based near-storage accelerators: Firstly, we present a near-storage-compute-aware file system that enables self-contained, reusable compute kernels to operate on the granularity of file data streams. Secondly, we provide an integrated build process for FPGA overlay images that starts with the acquisition of compute kernels through a package manager and finally allows to dynamically configure near-storage compute pipelines consisting of them. Thirdly, we integrate the framework into Linux as a file system driver and repurpose Unix Pipes as a well-known operating system primitive to orchestrate near-storage compute pipelines.

Federated learning has the potential to make machine learning applicable to highly privacy-sensitive domains and distributed datasets. In some scenarios, however, a central server for aggregating the partial learning results is not available. In fully decentralized learning, a network of peer-to-peer nodes collaborates to form a consensus on a global model without a trusted aggregating party. Often, the network consists of Internet of Things (IoT) and Edge computing nodes.Previous approaches for decentralized learning map the gradient batching and averaging algorithm from traditional federated learning to blockchain architectures. In an open network of participating nodes, the threat of adversarial nodes introducing poisoned models into the network increases compared to a federated learning scenario which is controlled by a single authority. Hence, the decentralized architecture must additionally include a machine learning-aware fault tolerance mechanism to address the increased attack surface.We propose a tangle architecture for decentralized learning, where the validity of model updates is checked as part of the basic consensus. We provide an experimental evaluation of the proposed architecture, showing that it performs well in both model convergence and model poisoning protection.

Near-data accelerators play an important role in satisfying the ever growing demand for compute resources. However, for an efficient integration of near-data computing resources into applications, a flexible programming model and suitable abstractions on the operating system level are required. This paper presents Metal FS, a framework that enables users and applications to orchestrate computations on a NVMe+FPGA near-data computing device through standard shell syntax, including the pipe operator. A user-space NVMe file system interface exposes the storage resources of the NVMe+FPGA accelerator. Computation pipelines expressed on the shell are mapped to pre-defined functional elements of a coarse-grained FPGA overlay, enabling data transformations to be performed in proximity to the data source. Overall, Metal FS greatly increases developer productivity for applications targeting near-data computing accelerators.

To alleviate development of FPGA-based accelerator function units for software engineers, the OpenPOWER Accelerator Work Group has recently introduced the CAPI Storage, Network, and Analytics Programming (SNAP) framework. However, we found that software engineers are still overwhelmed with many aspects of the novel hardware development framework. This paper provides background and instructions for mastering the first steps of hardware development using the CAPI SNAP framework. The insights reported in this paper are based on the experiences of software engineering students with little to no prior knowledge about hardware development.