Mostafa Salman · Hamburg
Building automation, observability, and secure systems.
NXP DevOps working student and M.Sc. Microelectronic Systems student in Hamburg, with a background in embedded systems and robotics.
SELECTED WORK / 01
Automation, secure firmware and robotics: a closer look at the work.
NXP / WORKING STUDENT · DEVELOPMENT OPERATIONS
I maintain and extend Jenkins build and test pipelines, automate environments with Ansible, and develop observability with Grafana and Prometheus. I also co-develop a PostgreSQL-backed engineering KPI platform.
Explore an illustrative delivery pipeline, from build and test to release.MORE SELECTED WORK
Security, robotics and systems in practice.
Firmware authentication on NXP i.MX93, with a desktop application for signing and key handling.
Implemented SPHINCS+ firmware-signature authentication and benchmarked SPHINCS+ and LMS on the NXP i.MX93. Built a Python / PySide6 application with SQLite for key handling and firmware signing.
Oct 2024 – Jan 2025 · Bachelor thesis
RELATED BROWSER EXPERIMENT
Play a complete update, then compare tampering and recovery. Real ECDSA verification; modeled boot behavior.
Back to the project ↑Read the thesis case study ↗Release signer → device verification → safe boot
Press Play to follow the complete update. Choose another scenario to compare the outcome.
Illustrative hardware. A and B represent logical firmware slots, not separate physical chips. Cryptography runs in your browser; boot and recovery are modeled.
| Scenario | Decisive check | Final modeled state |
|---|---|---|
| Successful updatePlay successful update → | Signature, policy and payload pass. The modeled health check confirms B. |
|
| Tampered firmwarePlay tampering scenario → | The manifest signature passes. One changed payload byte causes a digest mismatch; B never boots. |
|
| Boot recoveryPlay boot recovery → | Cryptographic checks pass. B fails the modeled health check; reset restores confirmed A. |
|
Expected demo outcomes, not thesis benchmark results. Every run starts with A active and confirmed, and a sequence floor of 7.
SHA-256 and ECDSA P-256 signing/verification run locally through Web Crypto on a 4 KiB demonstration payload. Signing authenticates the data; it does not encrypt it. The private key is non-exportable. Each reset starts a fresh experiment; no files or keys are uploaded.
The issuer and device are logical roles inside one browser, not isolated hardware. A/B storage, trusted counters, reset and health confirmation are modeled. This is an educational protocol, not deployable firmware or an AHAB, MCUboot or SUIT implementation.
NXP’s AHAB flow authenticates boot containers through its ROM/EdgeLock Enclave chain. SPL and DDR initialization precede later boot components. This generic update experiment does not emulate that hardware or its container format.
This experiment uses classical ECDSA. SLH-DSA is the standardized hash-based scheme derived from SPHINCS+. LMS is stateful and requires careful signing-state management. Neither PQC scheme is executed here.
Run a scenario to inspect its generated public key fingerprint, manifest, signature and payload hashes.
At MIT, I designed, programmed and tested autonomous robots for sample collection and communication. Our international team won first place at IDC ROBOCON.
I later led a student robotics team at Menoufia University, coordinating mechanical, electrical and software work.
A live community website, from automated releases to day-to-day production operations.
Production application · Ongoing
Next.js / React · GitHub Actions · Docker / Compose · Nginx
Connected containers combining sensor data, location tracking and embedded security.
Smart containers using sensors, GPS and IoT nodes for real-time tracking. Explored secure storage, provisioning and key management in a distributed embedded environment using RIOT OS concepts.
2023 · University project
Comparing embedded communication protocols and documenting the right fit for each system.
Analyzed Ethernet, CAN, SPI, USB and RS485 for embedded systems. Compared protocol characteristics and documented communication requirements and selection criteria.
2020 – 2021 · University project
02 — EXPERIENCE
At NXP since February 2022, across trust provisioning and secure-element development operations.
SEP 2026 — PRESENT
Working student · Secure Connected Edge · JCOP / Java Card
FEB 2022 — AUG 2026
Engineering operations & DevOps · Working student, intern and thesis student
Research, robotics & collaboration
JUN — OCT 2023
Undergraduate research assistant in the International Economics Program: data analysis, literature review and interactive learning materials.
JUL — AUG 2019
Robotics engineering intern: autonomous robots for sample collection and communication tasks.
1st place · IDC ROBOCON · International teamINTERACTIVE ENGINEERING / START HERE
Five browser experiences connect concepts from my work and studies. Choose what interests you.
Browser-based illustrations and calculations—not live device telemetry or trained AI.
DEVOPS / INTERACTIVE DELIVERY LAB
Step inside a delivery pipeline. Follow the change in 3D, introduce a failure and explore how systems respond.
The work behind the demoPIPELINE / CHANGE → RELEASE
DEVOPS / INTERACTIVE 3D
A change travels through six connected systems.
Run the simulation or step through it. Select any stage to inspect it.
STAGE INSPECTOR
A change enters version control. A pipeline can start from a commit or pull request.
RUN ACTIVITY
Simulated events · no connection to NXP systems
POST-DEPLOY FEEDBACK
A synthetic health index illustrates how monitoring can inform a rollback. Values are examples, not actual measurements.
Health feedback appears after a deployment.
No release has been deployed in this run.
Select a scenario to see how delivery gates and feedback work together.
COMPARE THE OUTCOMES
Up to four simulated runs · select one to load its scenario again.
At NXP, I work with Jenkins build and test automation, Ansible and observability tools. This lab is a simplified educational illustration, not an NXP pipeline or a representation of production data.
Motion is paused · controls still work
Choose an area to explore the engineering world. Drag to rotate; use ± for zoom and field settings.
The interactive 3D view is unavailable or data saving is enabled. Use the project links below to keep exploring.
Explore the engineering
EMBEDDED SYSTEMS · CURRENT STUDY
From electronics to embedded software, with FPGA and CNN concepts part of my current M.Sc. studies.
The bars show samples from the experiment: height is magnitude, teal is non-negative and amber is negative. A ring marks the selected sample. These are not device readings.
The 24 violet outer bars show relative FFT band peaks from 0–256 Hz in the selected frame. A light dot marks the strongest band. The data is synthetic.
The filter experiment is an illustration, not a trained network or FPGA implementation.
BACHELOR THESIS · NXP i.MX93
Research into post-quantum firmware authentication using SPHINCS+ on an NXP i.MX93.
The linked browser demo uses ECDSA and modeled device behavior.
IDC ROBOCON · INTERNATIONAL TEAM
Building and competing with an international robotics team that won first place at IDC ROBOCON.
NXP · DEVOPS & CI/CD
Jenkins build and test pipelines, automation and observability support secure-element engineering at NXP.
ENGINEERING WORLD / FIELD LENSES
Choose a lens to reveal motion, structure or calculated spectrum bands around the model.
Animated paths change character with each engineering station. They are illustrative, not telemetry.
A topographic grid reveals the surface around the model. Its shape is illustrative.
Open the spectrum studio to project calculated synthetic FFT bands into this field.
Each sector combines three FFT bands from a synthetic signal. The ranges are approximate; this is not device telemetry.
Select a range to highlight its sector. Values use a display scale: −72 dB = 0%, 0 dB or above = 100%. Bin boundaries are approximate.
A procedural WebGL shader shapes the field on the GPU inside the existing 3D scene. Flow and contours are visual metaphors. In spectrum mode, eight sectors group the 24 calculated FFT bands; each shows its strongest band on a clipped dB display scale.
Move from the visual model to the ideas and work behind it.
Explore a mathematical signal, then see the FPGA and CNN topics in my current studies.
Read the thesis, or try a browser illustration of update, tampering and recovery.
Follow the engineering and teamwork behind an international robotics competition.
See how build, test and observability work supports engineering teams at NXP.
03 — TOOLKIT
DevOps, software, electronics, robotics and secure delivery, developed through work, projects and ongoing study.
CURRENT STUDY · M.SC.
My current Microelectronic Systems studies include FPGA-based work and convolutional neural networks (CNNs).
Try an illustrative convolution ↗View hardware in the 3D world →C / C++ · Python · PySide6 · i.MX93 · S32K3
PCB design · Eagle · LTspice · Sensors · Microcontrollers
SPHINCS+ · LMS · PKI · HSM · Secure provisioning
Robot design · Programming · Testing · Team coordination
Jenkins · Ansible · GitHub Actions · Docker · Git · Bash
Grafana · Prometheus · PostgreSQL · SQL · SQLite
Kubernetes · Helm · OpenShift · Argo CD · Terraform · Azure DevOps · Alertmanager · ELK · Nginx
INTERACTIVE STUDY / 01
Draw a pattern. Change the filter. Watch the numbers become a 3D feature map.
Enable JavaScript to explore this interactive calculation.
Tap pixels to draw. Use arrow keys to move and Space to toggle. The gold outline marks the selected filter window.
Drag to fill cells. Turn this mode off to scroll over the grid or tap a cell to erase.
Select an output value
Enable motion to play the scan.A browser calculation inspired by CNNs: one 3 × 3 filter, stride 1, no padding. Height shows magnitude; color shows the sign. This is not an FPGA implementation or a trained neural network.
INTERACTIVE ENGINEERING / 01
Change a signal and its sampling rate. Watch how the same samples can suggest a different frequency.
This browser experiment needs JavaScript. Sampling too slowly can make a signal appear to have a different frequency.
TRY A SCENARIO
Presets start at 0° phase. Try the boundary, then adjust the phase.
The sampling rate is more than twice the signal frequency.
Fold the signal frequency into the interval from zero to half the sampling rate.
3 mod 20 = 3 · min(3, 20 − 3) = 3 Hz
The folded value is a frequency magnitude. Samples alone do not uniquely determine the original signal.
Enable JavaScript to calculate and explore the spectrum. No audio, microphone or device connection is used.
SPECTRUM STUDIO / 01
Build a synthetic signal, then compare how the FFT separates its components. The waterfall shows a sequence of calculated frames.
Graph range: −72 to +6 dB. Numerical values reach −96 dB.
Other window at this bin: —
The waterfall is unavailable, but the spectrum and numeric results remain available.
Frames run top to bottom; brighter means a stronger FFT magnitude. Tap a frame or use the slider. Sweep varies the tone; one- and two-tone modes repeat the same frame. These are not recorded sensor data.
BUILD A SIGNAL
A single synthetic sine makes leakage easy to see.
Try both positions to see spectral leakage change.
The second sine has 55% of the first tone’s amplitude and the selected frequency separation.
A Hann window reduces spectral leakage, but widens peaks. Increase FFT size to reduce bin spacing. Peak level is relative to a unit-amplitude sine and is not a calibrated measurement.
Synthetic demonstration at 1,024 samples per second. The sweep is a sequence of independent stationary tones. It is not live telemetry, audio, a trained network, or an FPGA implementation.
The same frequency and phase are synthesized at 1,024 samples per second.
An ideal mathematical example, not live sensor data. The original is an ideal sine with adjustable phase; the displayed value is the folded frequency magnitude.
04 — ABOUT ME
I’m an Information Engineering graduate and Microelectronic Systems master’s student in Hamburg. My experience spans DevOps, embedded software, robotics, electronics and semiconductor security.
At NXP, I also work on the automation, build and observability systems that support secure software engineering.
ONGOING STUDIES
HAW Hamburg / FH Westküste
Enrolled since 2025BACHELOR’S DEGREE
HAW Hamburg · 2020 – 2025
PROFESSIONAL TRAINING
Hamburg · 2024
LANGUAGES
Arabic · Native
English · C1 / Fluent
German · A2 / Continuing to learn
05 — GET IN TOUCH
Interested in DevOps, embedded software, hardware, robotics or secure systems? I’d be happy to talk.
mostafa.salman.de@gmail.com
