Runtime Verification (RV) and Anomaly Detection (AD) are crucial for ensuring the reliability of cyber-physical systems, but existing methods often suffer from high computational costs and lack of explainability. This paper presents a novel approach that integrates formal methods into anomaly detection, transforming complex system models into efficient classification tasks. By combining the strengths of RV and AD, our method significantly improves detection efficiency while providing explainability for failure causes. Our approach offers a promising solution for enhancing the safety and reliability of critical systems.

Deep Neural Networks (DNNs) are increasingly used in safety-critical Cyber-Physical Systems (CPS), requiring rigorous verification. Existing methods struggle with scalability and over-approximation. We introduce Affine Arithmetic Decision Diagrams (AADDs) for DNN reachability analysis, leveraging affine arithmetic to preserve variable correlations and improve precision. Our approach provides a structured symbolic representation of network decisions, enabling efficient and accurate verification. Additionally, AADDs unify verification for DNNs and Analog-Mixed-Signal (AMS) systems, supporting holistic safety analysis.

System security requires a solid foundation in both development and operation. During development, performance trade-offs result in security infrastructures that are more or less effective, but usually imperfect. Hence, during operation, runtime monitoring and anomaly detection continuously check for security issues.In this paper, we show how development and operation can be linked. We demonstrate how information and data from development and operation can be aggregated in a digital twin and/or digital thread which is used as the basis for runtime monitoring and anomaly detection. In particular, we address the trade-off between system security and performance in a concrete smart grid system.

We describe a SysMLv2-based framework for development-operation integration (DevOps) based on a digital twin. The main feature of the framework is its ability to automatically generate digital twin data models to capture and persist data from deployed, operating instances. These data models are generated from and linked with the SysMLv2 models used during model-based development.