The objective of X2Rail-3 (Grant Agreement No. 826141) Task 7.5 is an analysis of the businessmodel for the Virtually Coupled Train Sets (VCTS) concept. The VCTS concept was developed inX2Rail-3 Work Packages 6 and 7. The MOVINGRAIL project, which was the only project fundedunder the IP2 open call S2R-OC-IP2-01-2018, provided inputs concerning the cost effectiveness,application roadmap as well as business risks and overall market potential of VCTS. Thisdeliverable (D7.5) is the outcome of Task 7.5. First, it provides an analysis of the inputs providedby MOVINGRAIL, putting them in context with previous X2Rail-3 work. Then, taking theconclusions of the analysis into account, two different application cases for VCTS are presented.Strategies to implement the application cases are detailed, including a vision for implementingVCTS within the RCA and OCORA reference architectures. Finally, the business case of VCTS iscompared against business objectives identified within the LinX4Rail project.

The application cases for VCTS presented in this deliverable are standalone VCTS and ETCS-based VCTS. Standalone VCTS is an application of VCTS that focuses on low-traffic lines thatare today using Class B signalling systems that cannot be upgraded to ETCS in a cost-effectiveway. In summary, it is a low-cost onboard train protection system which has the objectives ofproviding an economically interesting upgrade path for Class B systems and raising the maturityof the underlying technology required for VCTS, thus, fostering the wide-scale introduction. ETCS-based VCTS is an application of VCTS that focuses on high-traffic lines and bases on ETCS Level2 or Level 3. ETCS-based VCTS is the actual goal of the VCTS concept and has the mainobjectives of reducing headway and improving flexibility of operation in order to increase linecapacity and provide the technical basis for innovative business models.

For each application case, a migration strategy is presented, detailing the non-technical andtechnical steps required for implementing and on-site testing a first complete demonstrator withina period of three to five years. The migration strategies provide details for train protection, trafficmanagement, automatic train operation, on-board train integrity, communication and VCTS (on-board and trackside, if applicable) sub-systems. As detailed in Deliverable 7.4 “Impact Analysis”which was prepared in parallel to this deliverable, the introduction of VCTS does not change thefundamental principles of any of the existing sub-systems, i.e., a full rework is not required.

Beyond the migration strategies, the vision of implementing ETCS-based VCTS within the RCAand OCORA reference architectures is presented, which would imply software changes only and,thus, simplify the migration considerably. Finally, the impact of VCTS is compared against thebusiness objectives identified in the LinX4Rail project. Taking the presented migration strategiesand MOVINGRAIL input into account, it is shown that VCTS is in line with the RUs’, IMs’ andsuppliers’ business objectives.

Ultimately, VCTS is an innovative concept that can raise scepticism by operators and the generalpublic. Its safety can be achieved within the near future, but this needs to be communicated clearlyto foster the acceptance of VCTS. Only then, VCTS cannot only improve current railway operationwith increased capacity, reliability and lower operational costs, but even provide the basis for novelbusiness models that benefit from the increased flexibility.

Embedded electronic systems need to be equipped with different types of security mechanisms to protect themselves and to mitigate the effects of cybersecurity attacks. These mechanisms should be evaluated with respect to their impacts on dependability and security attributes such as availability, reliability, safety, etc. The evaluation is of great importance as, e.g., a security mechanism should never violate the system safety. Therefore, in this paper, we evaluate a comprehensive set of security mechanisms consisting of 17 different types of mechanisms with respect to their impact on dependability and security attributes. The results show that, in general, the use of these mechanisms have positive effect on system dependability and security. However, there are at least three mechanisms that could have negative impacts on system dependability by violating safety and availability requirements. The results support our claim that the analyses such as the ones conducted in this paper are necessary when selecting and implementing an optimal set of safety and security mechanisms.

Autonomous vehicles need accurate and dependable positioning, and these systems need to be tested extensively. We have evaluated positioning based on ultrawideband (UWB) ranging with our self-driving model car using a highly automated approach. Random drivable trajectories were generated, while the UWB position was compared against the Real-Time Kinematic Satellite Navigation (RTK-SN) positioning system which our model car also is equipped with. Fault injection was used to study the fault tolerance of the UWB positioning system. Addressed challenges are automatically generating test cases for real-time hardware, restoring the state between tests, and maintaining safety by preventing collisions. We were able to automatically generate and carry out hundreds of experiments on the model car in real time and rerun them consistently with and without fault injection enabled. Thereby, we demonstrate one novel approach to perform automated testing on complex real-time hardware.

Safety-critical systems are required to comply with safety standards. These systems are increasingly digitized and networked to an extent where they need to also comply with security and privacy standards. This paper aims to pro-vide insights into how practitioners apply the standards on safety, security or pri-vacy (Sa/Se/Pr), as well as how they employ Sa/Se/Pr analysis methodologies and software tools to meet such criteria. To this end, we conducted a question-naire-based survey within the participants of an EU project SECREDAS and ob-tained 21 responses. The results of our survey indicate that safety standards are widely applied by product and service providers, driven by the requirements from clients or regulators/authorities. When it comes to security standards, practition-ers face a wider range of standards while few target specific industrial sectors. Some standards linking safety and security engineering are not widely used at the moment, or practitioners are not aware of this feature. For privacy engineering, the availability and usage of standards, analysis methodologies and software tools are relatively weaker than safety and security, reflecting the fact that privacy en-gineering is an emerging concern for practitioners.

Safety-critical systems are required to comply withsafety standards as well as security and privacy standards.In order to provide insights into how practitioners apply thestandards on safety, security or privacy (Sa/Se/Pr), as well ashow they employ Sa/Se/Pr analysis methodologies and softwaretools to meet such criteria, we conducted a questionnaire-basedsurvey. This paper summarizes our major analysis results of thereceived responses.

Accurate positioning is a requirement for many applications, including safety-critical autonomous vehicles. To reduce cost and at the same time improving accuracy for positioning of autonomous vehicles, new methods, tools, and research platforms are needed. We have created a low-cost testbed consisting of electronics and software that can be fitted on model vehicles allowing them to follow trajectories autonomously with a position accuracy of around 3 cm outdoors. The position of the vehicles is derived from sensor fusion between Real-Time Kinematic Satellite Navigation (RTK-SN), odometry, and inertial measurement and performs well within a 10 km radius from a base station. Trajectories to be followed can be edited with a custom GUI, where also several model vehicles can be controlled and visualized in real time. All software and Printed Circuit Boards (PCBs) for our testbed are available as open source to make customization and development possible. Our testbed can be used for research within autonomous driving, for carrying test equipment, and other applications where low cost and accurate positioning and navigation are required.

The combination of high mobility and wireless communication in many safety-critical systems have increased their exposure to malicious security threats. Consequently, many works in the past have proposed solutions to ensure safety and security of these systems. However, not much attention has been given to the interplay between these two groups of nonfunctional requirements. This is a concern as safety solutions may negatively impact system security and vice versa. This paper addresses the interplay between safety and security by proposing an attack injection framework, based on model-implemented fault injection, suitable for model-based design. The framework enables us to study and evaluate the impact of cybersecurity attacks on system safety early in the development process. To this end, we have implemented six attack injection models and conducted experiments on Simulink models of a CAN bus and a brake-by-wire controller. The results show that the security attacks modeled could successfully impact the system safety by violating our defined safety requirements.

Cyclists are not well protected in accidents with other road users, and there are few active safety systems available for bicycles. In this study we have evaluated the use of inexpensive Real-Time Kinematic Satellite Navigation (RTK-SN) receivers with multiple satellite constellations together with dead reckoning for accurate positioning of bicycles to enable active safety functions such as collision warnings. This is a continuation of previous work were we concluded that RTK-SN alone is not sufficient in moderately dense urban areas as buildings and other obstructions degrade the performance of RTK-SN significantly. In this work we have added odometry to the positioning system as well as extending RTK-SN with multiple satellite constellations to deal with situations where the view of the sky is poor and thus fewer satellites are in view. To verify the performance of the positioning system we have used Ultra-Wideband radios as an independent positioning system to compare against while testing during poor conditions for RTK-SN. We were able to verify that adding dead reckoning and multiple satellite constellations improves the performance significantly under poor conditions and makes the positioning system more useful for active safety systems.

Today, embedded systems across industrial domains (e.g., avionics,automotive) are representatives of software-intensive systems with increasingreliance on software and growing complexity. It has become critically importantto verify software in a time, resource and cost effective manner. Furthermore,industrial domains are striving to comply with the requirements of relevantsafety standards. This paper proposes a novel workflow along with tool supportto evaluate robustness of software in model-based development environment,assuming different abstraction levels of representing software. We then showthe effectiveness of our technique, on a brake-by-wire application, byperforming back-to-back fault injection testing between two differentabstraction levels using MODIFI for the Simulink model and GOOFI-2 for thegenerated code running on the target microcontroller. Our proposed method andtool support facilitates not only verifying software during early phases of thedevelopment lifecycle but also fulfilling back-to-back testing requirements of ISO 26262 [1] when using model-based development.

We present a quadcopter platform built with commodity hardware that is able to do localization in GNSS-denied areas and avoid collisions by using a novel easy-to-setup and inexpensive ultrasound-localization system. We address the challenge to accurately estimate the copter's position and not hit any obstacles, including other, moving, quadcopters. The quadcopters avoid collisions by placing contours that represent risk around static and dynamic objects and acting if the risk contours overlap with ones own comfort zone. Position and velocity information is communicated between the copters to make them aware of each other. The shape and size of the risk contours are continuously updated based on the relative speed and distance to the obstacles and the current estimated localization accuracy. Thus, the collision-avoidance system is autonomous and only interferes with human or machine control of the quadcopter if the situation is hazardous. In the development of this platform we used our own simulation system using fault-injection (sensor faults, communication faults) together with automatically-generated tests to identify problematic scenarios for which the localization and risk contour parameters had to be adjusted. In the end, we were able to run thousands of simulations without any collisions, giving us confidence that also many real quadcopters can manoeuvre collision free in space-constrained GNSS-denied areas.