TAS Control Platform « TransVitalIEC 62443-4-1 Secure product development lifecycle requirements-4 2 Technical security requirements for IACS components 18 2021-12-21 Thales Austria

www.thalesgroup.comOPEN

TAS Control Platform« TransVital »

Dr. Stefan Resch2021-12-21

2 2021-12-21 Thales Austria GmbH

OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

People we rely on – they rely on Thales

AEROSPACE SPACE

DEFENCE & SECURITY

DIGITAL IDENTITY & SECURITY

GROUND TRANSPORTATION


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Thales Ground Transportation Systems

METRO AND URBAN

Algeria: Algiers

Australia: Sydney

Belgium: Brussels

Canada: Ottawa, Toronto,

Vancouver

Chile: Santiago

China: Nangchang

Dominican Republic:

Santo Domingo

Italy: Brescia

Hong Kong

Malaysia: Kuala Lumpur

New Zealand: Auckland

MAIN LINE

Austria

Denmark

Egypt

Finland

France

Germany

Mexico

Morocco

Netherlands

Nigeria

Norway

Portugal

Saudi Arabia

Spain

Switzerland

Turkey

UK

Norway: Oslo

Panama: Panama City

Portugal: Lisbon

Qatar: Doha

Saudi Arabia: Mecca

Singapore

Taiwan: Ankeng

UAE: Dubai

UK: London, Manchester

USA: Detroit, Jacksonville, Newark,

New York, San Francisco, Tampa


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Railway Domain – Main Line Systems

Interlocking

Operation Control Centre

Signal

Point machine

Axle counter

Local Operation Position

Field Element Controller

On-boardUnits

Radio Block Centre


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Common Needs

▌Railway standards

CENELEC EN50126, EN50128, EN50129, EN50159

▌Safe computation

▌Safe communication

▌Real-time

▌Security

▌Long life-time


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

EULYNX General Strategy

Thales supports EULYNX

Our products will support EULYNX! Already in progress

We harmonise interfaces to reduce differences!As far as possible, influencing the standards is not easy

We actively support the standardisation of the interfaces! IXL core <-> field element control

IXL core <-> adjacent IXL

IXL core <-> RBC

Collaborative approachwith our customers to identify the best solutions

with our competitors since we are in the same boat


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

EULYNX Activities & Implementation

▌Activities (excerpt)

NeuPro pre-series implementation projects (pilots)

Tailored EULYNX SCI-TDS (Axle Counter) demonstrator (Innotrans / ProRail)

Consultation work regarding SCI-LEU (Luxembourg, Finland)

Proof of Concept AzLM Object Controller (SBB)

Implementation EULYNX SCI-CC with BaneNor

Implementation Neupro/EULYNX object controllers for DB (DCA)

▌Implementation

RASTA is part of TAS Control Platform: Addon OCS

SNMP/OPC-UA is part of TAS Platform: Addon MNT 3.x


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Fail Safety Example: European Train Control System (ETCS)


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Safety in Railway – Fail Safe Example Based on ETCS Level 2


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.



OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.



OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.



OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.



OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Platform safe, secure and proven in use

Assessments: CENELEC EN50126, EN50128, EN50129, EN50159

SIL4 approval

Lightweight application assessment (if SACs are fulfilled)

Security IEC 62443 certified

SL 3 (Security Level)

Also in-line with NIST

Certified by TÜV Süd and EZU

Already runs on thousands of boards!

Around the globe

Since decades

In >90% of safety-critical MLS/URS Thales products


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Safety Standards: CENELEC EN


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Potential Structure of a Safety Critical Railway Application

TAS Control Platform

Generic Interlocking

Specific Interlocking Installation

CENELEC EN 50129:2018

Specific Application

Generic Application

Generic Product


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Security Standards: IEC 62443 Series

▌Security Working Group CENELEC WG26

“Technical Specification of TS 50701 - Railway applications – Cybersecurity Applications”

General

Policies and Procedures

System

Component

IEC 62443-1-1

Terminology, concepts and

models

IEC TR 62443-1-2

Master glossary of terms and

abbreviations

IEC TS 62443-1-3

System security compliance

metrics

IEC TR 62443-1-4

IACS security life-cycle and

use-cases

IEC 62443-2-1

Establishing an industrial

automation and control

system security program

IEC TR 62443-2-2

Implementation guidance for

and IACS security

management system

IEC 62443-2-3

Patch management in the

IACS environment

IEC 62443-2-4

Security program requirements

for IACS service providers

IEC 62443-3-1

Security technologies for

industrial automation and

control systems

IEC 62443-3-2

Security risk assessment for

system design

IEC 62443-3-3

System security requirements

and security levels

IEC 62443-4-1

Secure product development

lifecycle requirements

IEC 62443-4-2

Technical security

requirements for IACS

components


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Control Platform: Basic Architecture

Hardware(small, medium, large)

Kernel

Filemng

NetworkProtocols

SecurityUsermng

Shell

Fault Tolerance Services

Online TestsSafe Protocols

(Rasta, …)

App1

App2

App3

CN (computing node)

SW-API

Operating System(COTS Linux)

Application

Safety Layer

Assessed TAS Platform(+ methods & toolchain)

„TAS Control Platform is a Safe

and Secure Software and

Hardware base with a well

defined Programming Model

and SW-API including fault

tolerance and safe

communication services.“


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Control Platform: Component Overview

Component „Core“This is the inner part of TAS-Plf.

It contains the SW-kernel, safety and availability

modules, the Safety-Case and also the HW

(boards or servers).

Component „OCS“OCS is responsible for safe external communication. It contains protocols like RASTA,

SAHARA, SubSet98 and more.

Component „MNT“MNT helps with standard maintenance task like

SW up/download, diagnosis download and

inventory services.

Component „J4S“This is a module supporting safe applications in

Java programming language.

Component „POST“This adds tools and support modules to help

development of safe applications.

“Hardware”(D6, D10, SC33, CIQ3, CIQ6, LFC10, …)

Meth

od

olo

gy &

To

ol-

Ch

ain

Safety Layer

“OCS”Safe Protocols

”MNT” Maintenance

Upload/Download

“J4S”Java for Signalling

“P

OS

T”

Pla

tform

Off

line S

upport

& T

ools

Operating System

Linux Kernel, Libraries, Drivers, …

TAS Platform “Core”

Core Software

Fault Tolerance, Communication, Online-Tests

Safe

ty-C

ase


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Control Platform: Safety Architectures

2oo2

1x2oo2

1oo1

2x1oo1

3x2oo2

2oo3

2x2oo2

4x2oo2


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Control Platform: Hardware

CIQ6

CIQ3

CU3

CRIB D10

SC33

LFC10

Industrial Server

Lower: Performance &

Power Consumption

Higher: Performance &

Power Consumption


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Control Platform: Handling Legacy

▌Solve HW and OS dependency with middleware

▌Still spare part management

Hardware(small, medium, large)

Kernel

Filemng

NetworkProtocols

SecurityUsermng

Shell

Fault Tolerance Services

Online TestsSafe Protocols

(Rasta, …)

App1App2

App3

CN (computing node)

SW-API

Operating System(COTS Linux)

Application

Safety Layer

Pro

du

ct

life

tim

e


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

EN 50128:2011: Software Development Phases

System Development Phase

Software Requirements Phase

Software Architecture and Design Phase

Software Component Design Phase

Software Component Implementation Phase

Software Component Testing Phase

Software Validation Phase

Software Maintenance Phase

Software Integration Phase

SoftwarePlanning

Phase

Software Assessment Phase


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

EN 50128:2011: Tool Classification

• E.g. text editor

Tool class T1: generates no outputs which can directly or indirectlycontribute to the executable code […]

• E.g. static analysis tool

• justification of use

• specification/manual

• configuration management

Tool class T2: […] the tool can fail to reveal defects but cannot directlycreate errors in the executable software

• E.g. compiler

• justification of use

• specification/manual

• configuration managment

• evidence of conformance (e.g. validation)

Tool class T3: generates outputs which can directly or indirectlycontribute to the executable code […]


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Software Development with Support by TAS Control Platform

▌Programming Model

▌Coding Rules

▌C, C++ and Ada

▌Validated compilers and tools

▌Diagnosis Tools

▌Safety Related Application Conditions

▌TAS Control Platform enables focus on “Business Logic”

2oo32x2oo2

App1


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Safety Layer

▌Composite fail-safety

Computing Elements

Computing Node

▌Synchronization services

Time, message order

▌Fault detection and isolation

Voting and membership

▌Recovery

▌Core algorithms are checked with formal methods

CE0

CE2CE1


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

ComputeComputeInput Compute Output

▌POSIX

Defined subset

▌TaskSets

Safe and non-safe computation

▌Replica determinism

Necessary for composite fail safety

▌Solves multi-processing issues on application level

Deterministic scheduling

▌Pre-emptive fixed priority scheduling on CE level

Linux Kernel

Programming Model


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

Formal Methods for Distributed Algorithms

Formal model in TLA+ and PlusCal▪ C-like language

▪ Linear temporal logic▪ Model checking with TLC▪ Tool class T2

Selected modules▪ Core functions

Iteratively increase of design complexity▪ State space▪ Counter examples

C code generation from model▪ Close gap▪ Verified as “hand written”


OPEN

This

do

cu

me

nt

ma

y n

ot

be

re

pro

du

ce

d, m

od

ifie

d,

ad

ap

ted

, p

ub

lish

ed

, tr

an

sla

ted

, in

an

y w

ay, in

wh

ole

or

in

pa

rt o

r d

isc

lose

d t

o a

th

ird

pa

rty w

ith

ou

t th

e p

rior

writt

en

co

nse

nt

of

Tha

les

-©

Th

ale

s2

02

1 A

ll rig

hts

re

serv

ed

.

TAS Platform safe, secure and proven in use

Assessments: CENELEC EN50126, EN50128, EN50129, EN50159

SIL4 approval

Lightweight application assessment (if SACs are fulfilled)

Security IEC 62443 certified

SL 3 (Security Level)

Also in-line with NIST

Certified by TÜV Süd and EZU

Already runs on thousands of boards!

Around the globe

Since decades

Documents

TAS Control Platform « TransVitalIEC 62443-4-1 Secure product development lifecycle requirements-4 2 Technical security requirements for IACS components 18 2021-12-21 Thales Austria