A Safety-Critical Object Controller With Inherited Trust

Updating safety-critical applications, e.g. to adapt to a changed interface specification, is expensive due to the required recertification. We describe a concept based on the Simplex architecture for trusted systems to update the implementation of a backwardcompatible interface with unchanged safety properties. We show that safety can be inherited from an existing trusted controller at the cost of reducing the overall system's availability. The applicability is shown via a case study in the railway sector, where we see a shift toward standardized interfaces. EULYNX is the European railway interface standardization initiative. Due to the long lifetimes of railway systems, vendors are building EULYNX-compatible products while the standard is still under active development. In our case study, we build a EULYNX-compatible object controller for train-detecting axle counting modules, relying on the proven safety of an object controller implementing the older NeuPro protocol.