Wagner, Florence
To ensure the safety and security of Automated Vehicles (Avs), the interaction between the Functional Safety (FuSa) and the Cybersecurity (CS) domains needs to be managed systematically. There is a demand to develop effective and structured management systems to support the homologation process. From this motivation, identifying the interaction between the Safety Management System (SMS) and the Cybersecurity Management System (CSMS) is a fundamental aspect and needs to be improved for HAD systems. Hence, the classical Decision Making Trial and Evaluation Laboratory (DEMATEL) method and fuzzy DEMATEL are applied to evaluate the influential factors that can impact the safety and security of the HAD systems. This paper proposes a list of influencing factors focusing on the interaction between SMS and CSMS for HAD systems. Additionally, the results of an anonymously conducted survey among experts from industry and research are presented and used as inputs for the methods. This work helps to understand the relationship between influencing factors and provides a simplified, easy-to-visualized, and valuable guide for developing HAD systems. The result of this study shows that the most important influential factor is F13. Moreover, the cause and effect of the factors are illustrated numerically and graphically. The influential factors F1 to F7 are identified as the cause and F8 to F13 are reasoned to effect. Finally, a circular representation of the influential factors and their interaction is presented in this paper.
Functional safety and cybersecurity are essential parts of the development of automated vehicles to ensure vehicle safety. Highly automated driving (HAD) vehicles require safe and secure development and communication processes that have to be monitored, maintained and improved through management processes. Hence, interface management systems are required to confirm HAD vehicle safety. The acceptance level of the interface between functional safety and cybersecurity in management systems is crucial for the development of Highly Automated Driving (HAD) vehicles. The Safety Management System (SMS) needs to consider the aspect of cybersecurity to ensure the overall safety of the vehicles or vice-versa. However, the interface methods of SMS and Cybersecurity Management System (CSMS) is challenging given the complexity of the system development and constraints from the company culture. The objective of this study is to present an interface approach in between management systems with a set of interface specifications including communication adaption processes. The main contributions of the paper are, (i) Illustrating the interface areas of the SMS and CSMS by identifying the management factors, (ii) Presenting the degree of influence of the management factors based on the survey results, and (iii) Providing a support to deal with SMS and CSMS interface for HAD vehicle development. A list of interface-related management factors is presented in this paper based on the literature study and findings from other disciplines. Additionally, the degree of influence of the management factors is presented as a result of this research based on the survey results from functional safety and cybersecurity experts.
To ensure safety and security of highly automated driving systems one shall make sure all risks are reduced to a reasonable level and an all potential cyberattacks are addressed with necessary protection. Because of the complexity of such vehicle systems, systematic and structured management approaches are vital to maintaining safety via cybersecurity (CS). The interface of Safety Management System (SMS) with Cybersecurity Management System (CSMS) is one of the key aspects to ensuring that potential safety issues are addressed. Both management systems include planning, concepts, and process development, with significant areas of overlapping management systems is required. Regarding the management systems interface and distribution, it is still a challenge that Highly Automated Driving (HAD) vehicles needs to overcome by means of effective implementation and strategies with continuous improvement and a reduction of miscommunication. From that motivation, a set of engineering risk management framework are proposed in this paper. Subsequently, introducing the interface areas between the safety and the cybersecurity domain is one of the focus areas of this paper, together with the representation of the interface management activities with exemplary interaction template. Additionally, mapping in between safety and cybersecurity related standards in terms of evidence and management systems is represented partially to support both safety case and security assurance.
In automatisierten Fahrzeugen übernehmen Fahrerassistenzsysteme teilweise die Fahraufgabe, in autonomen Fahrzeugen wird der Fahrer sogar vollständig ersetzt. Wenn kein Verantwortlicher mehr das Fahrzeug führt, wer ist dann für die Sicherheit während des Betriebes zuständig?
Nach mehreren Zwischenfällen bei der Erprobung von automatisierten
Fahrzeugen wird die Anwendung eines Safety Management Systems (SMS) für automatisierte Fahrzeuge vermehrt diskutiert und empfohlen. Beispielsweise hat das National Transportation Safety Board (NTSB) nach der Evaluierung eines tödlichen Unfalls bei der Erprobung eines automatisierten Fahrzeuges der Advanced Technologie Group von Uber Technologies, Inc. die Einführung eines Safety Management Systems empfohlen. In diesem Artikel werden die Möglichkeiten und Vorteile der Anwendung eines Safety Management Systems im Zusammenhang mit dem Betrieb eines automatisierten Fahrzeuges aufgezeigt.
To allow a vehicle with highly automated driving functions to operate on the road the overall safety (safe functionalities, functional insufficiencies including cybersecurity) of the driving system must be guaranteed. Therefore, a generic Safety Management System (SMS), that includes all useful and necessary regulations should be applied. The given specifications regarding the safety of driving systems shall be understood and considered in order to define an acceptable SMS for the Highly Automated Driving Function (HADF). Derived from the generic SMS a specific management system has to be developed to guide the development and deployment of the HADF. The research presented in this paper investigates the currently available SMS in different sectors like aviation, marine, and railway to propose a new set of components and elements that are useful and modified for a HADF’s SMS. Moreover, the paper provides a systematic approach to how the new set of components and elements can be applied for a HADF SMS. Additionally, well established hazard identification methods (scenario-based HARA and STPA) are compared and integrated into the safety concept phase. The complexity of scenarios is unique for a HADF. Since the SMS is going to be complicated for automotive HADFs and a constantly developing process, methods for evaluation and continuous improvement are needed. This paper gives insight into the structure of the SMS and to guarantee its applicability the use of a helpful software tool is considered. Furthermore, the proposed SMS approach can be adjusted as a groundwork for research concerns like validation for homologation and assess the safety of a HADF.
For a safe operation of highly automated driving (HAD) systems on the road, the overall safety (functional safety (FS) and the safety of the intended functionality (SOTIF)) including cybersecurity must be guaranteed. Within these terms, the application of a Safety Management System (SMS) is becoming essential for HAD systems. Meanwhile, the cybersecurity for HAD systems is handled separately, familiar as Cybersecurity Management System (CSMS). To provide seamless safety and cybersecurity for highly automated vehicles on the road the two Management Systems should be linked with each other and therefore the interfaces from the SMS to cybersecurity must be defined. Furthermore, the communication flow from SMS to CSMS shall be specified to ensure that no information is lost in between. However, the development phases (SMS and CSMS) will also seemingly pomp the interface areas to industrial sectors like IEC TR 63069 [1], with UN Regulation No.155 [2] and others. The research aspects presented in this paper focus on:
(1) identifying the management related adaption topics for HAD-Safety and cybersecurity considering ISO 26262 (FS), ISO/PAS 21448 (SOTIF), UL4600 (safety for evaluation), SAE J3061 (cybersecurity guidebook) and upcoming ISO 21434 (cybersecurity) [3], [4] [5], [6] and [7].
(2) the novelty in interfaces of SMS and CSMS in risk management of HAD systems.
Moreover, provides a brief systematic approach to sort the collected data during the SMS processes into safety, cybersecurity, or both domains. Safety considers the functional insufficiencies (SOTIF) for hazard analysis and cybersecurity contemplates the threat analysis which can have the potential to occur a hazardous situation for HAD vehicles. Safety considers the SOTIF aspect which deals with environmental and misuse aspects but cybersecurity covers a vast area of consideration. Derived from the proposed approach a general structure for SMS interfaces to cybersecurity is created.