Conceptions of safety and security for cyber physical systems (CPS) in context of interaction with environment are analysed. Models and interconnection of safety and security and its attributes (functional safety, Internet safety, labor and occupational safety; cyber security, confidentiality, integrity, accessibility and physical security) for CPS functioning in conditions of information and physical environment are discussed considering common cause and time failures issue. Independent verification and validation (IV&V) and D3 (Defence-inDepth and Diversity) approach are two echelons for protection of CPSs against cyber and physical attacks and failures caused by physical and design faults. The techniques of IV&V (XMECA, XBD, XTA, XIT etc.) are analysed in point of view different safety and security attributes. Multi-FIT technique is described as an example for CPS safety assessment. Application of diversity for safety and security assurance is discussed.
to research the independent verification and validation techniques (XMECA, XBD, XTA, XIT etc.) and D3 (Defence-in-Depth and Diversity) approach as two barriers against attacks and failures caused by physical and design faults.
Structure of the paper corresponds to objectives. Section 2 describes conceptions of CPS safety and security in context of CCF. Sections 3 and 4 discuss two echelons of CPS protection such as independent verification and validation and D3 principle. Section 5 concludes and formulates future research directions.
Interconnection between functional safety and information (cyber) security as attributes of big
safety is described by Figure 1. According with [
There are two types of attacks on CPS integrity (and accessibility or availability) and
confidentiality. First of them causes failures and can be reason of unsafe impact of CSP on IE and PE.
Second one causes receiving confidential data and can be reason more successful attacks on integrity
and accessibility. Influence of PE can cause fatal failures and corresponding influence of CPS on PE
and IE. If CPS safety depends on cyber security as a part of information security it’s justifiable using
of concept “cyber safety” as a part of safety [
More detailed analysis of different attributes of safety including functional, Internet and labour safety, and security including information security (confidentiality, integrity and accessibility), and physical security is given in Table 1. It describes influence of physical and information environment for all types of safety and security, and influence of attributes of safety and security on physical and information environment. Besides, it is analysed level of potential effects (local, for controlled object only, and global similar NPP accidents). Influence of attributes is marked by “+”.
One of the key problem of CPS safety (and security as well) assurance is minimization or exclusion in general of common cause failure (CCF) risks. CCF is event when ef (two or more) channels (versions) of redundant e-channel (e-version) system fail one by one or simultaneously and there is common reason causing this event. In any case, CCF is a multiple failure (MF) of CPS unlike single failure (SF) one of the redundant channels.
It should be emphasized that MF occur as a result of not only one (common) cause. It may be
caused by a few different reasons concurring or spreading of failure time value does not exceed the
response time of on-line testing and reconfiguration. Such type of multiple failures is called as a
common time failure (CTF) which is common event failure (CEF) as CCF [
- matching of output channel data in case of failures, i.e. matching (MCCFs, MCTFs) and different (DCCFs, DCTFs) failures.
Two preliminary conclusions which are important for safety critical CPSs. Firstly, CTFs are important objective of research because there are examples of serial failures caused by attacks on vulnerabilities of redundant channels and combined reasons. Secondly, very important tasks is analysis and assurance, if it’s possible, of distinguishability of failure effects (output data of failed channels) to fix fact of partial or full common cause and time failures. 2.3.
Problem of CCF decreasing risks can be solved by use of two approaches (Figure 3):
minimizing of latent faults, first of all, design faults and vulnerabilities. For that techniques of
verification and validation (V&V) of developed or modernized CPSs (hardware, software, FPGA
components, platforms etc.) have to be applied. There is rigorous requirements to V&V including
requirement to independence of verification and validation teams, process, techniques and tools for
safety critical CPSs such as NPP I&C systems. V&V which are performed by an organizational
and/or financially independent team is called independent V&V (IV&V). Implementing IV&V
allows detecting faults which haven’t been detected by developers or QA specialists of company;
application of diversity as a part of more general so-called principle D3
(Defense-inDepth&Diversity) [
Stages of V&V
n HW, SW and tio FPGA icacomponents, irf I&C e V
These approaches are two echelons of CCF/CTF protection implementing DET principle “to detect – to eliminate (detected faults during V&V) – to tolerate (residual/undetected faults during operation)”.
There are a lot of methods of CPS safety and security assessment and V&V techniques which are
used by developers/QA engineers of companies and independent verifiers as well such as [
The V&V techniques include more software and documentation based procedures as review of documents (static analysis, verification and validation plans and reports review, check-list based analysis and so on). Table 2 summarizes the results of analysis of these techniques applicability for assessment of different safety and security attributes. The following marks are used: applicable technique, + ; can be applicable, (+); can’t be applicable, x.
Two preliminary conclusions are the following:
- in fact, all methods and techniques which were initially developed and are used to assess
functional safety have analogues to assess security and cyber security. For example, FME(C)A
technique (Failure ME(C)A) was modified for security assessment as IME(C)A (Intrusion Modes and
Effects (Criticality) Analysis). Feature of IMECA is considering failure as a pair
“vulnerabilityattack” or as a combination of threats, vulnerabilities and attacks/intrusions [
Fault (and vulnerability) injection testing is one of the techniques applied for IV&V according with standards requirements to safety critical CPS. The goals of FIT are to assess the test quality considering test coverage/trustworthiness issues, efficiency of online testing, analyse fault- and intrusion-tolerance (to design and physical faults). “Natural” failures for complex SW and HW, CPS are multiple ones caused by physical and design faults, attacks with different scenarios.
Main challenges of multiple fault injection (multi-FIT): complexity and time of verification (in general number of faults equals 2kmn, n – number of faults, k – number of fault types, m – number of CPS levels), mutation/masking of faults and blockage of verifiable performance. The standard NUREG/CR-7151 recommends employing a multi-FIT, but it does not describe procedures of injection. To tolerate these challenges two approaches can be applied [12]: development of injectable projects, i.e. assurance of ability to inject faults regarding to actual/specified physical scheme or code (FITability) to optimize points and means of injection; implementing technique of multi-FIT based on application of modified t-wise procedure and operations of de-masking and de-blockage of injected fault subsets (Figure 4).
The future steps are important from research and practical point of view: development of techniques and tools that take into account the possibilities of injecting different fault/vulnerability types for different CPS components and system levels. For FPGAbased systems it may be physical faults injecting at the module and chip levels, design faults and vulnerabilities injecting into VHDL code and top-level software code); development of methods assuring ability to multi-fault injections, i.e. multi-FIT-ability.
Diversity is a basic principle of multi-version computing. Main concepts of multi-version computing are the following: version is an option of different product or/and process realization of CPS function(s); version redundancy (VR) is a type of redundancy when different versions are used; diversity or multiversity (MV) is the principle providing use of several versions; multi-version system (MVS) is a system in which a few versions are used; multi-version technology (MVT) is set of the interconnected rules and design actions in which a few versions-processes leading to development of two or more intermediate or end-products are used; multi-version project (MVP) is a project in which the MVT is applied to create one- or multiversion system; strategy of diversity (MV) is a collection of general criteria and rules defining principles of formation and selection of version redundancy types and volume or MVTs; diversity metric is indicator to assess level of diversity of versions.
To assess CPS safety measures especially a probability of common cause failure it is necessary to
evaluate the diversity metrics [
The metrics of two-version system (Figure 5,b,c) can be evaluated as following: = NCCF / N, NCCF = Card (SF1 ∩ SF2); N = (N1 + N2) / 2, Ni = Card SFi; i = 1 - ; d = NMCCF / N; d = NDCCF / N; = d + d . Metrics of relative number of MCCFs and DCCFs (see Figure 2): *d = d / , *d = d /. For three-version system (Figure 5,d) = 1 - - 2, where is metric determining part of CCFs of any two versions (PCCF), = 2NPCCF / N). If = 0 (Figure 5,e), = 1 - .
These types of faults and vulnerabilities and metrics can be used to add a profile of injected faults for FIT based verification of multi-version CPSs. Values of metrics and are determined using statistics of testing and operation failures and expert methods [9].
a) b) c) d) e)
Classification of different diversity types and D3 in general is described in [
Let’s analyse two examples of application of diversity to assess and improve safety and security.
In the first case CPS has hardware and software diversity. Dependencies of up-state probabilities on
time for the two-version structures are illustrated by Figure 6 [
Influence of DiD + (+) + + + + + + x + + + + + x x + + + (+) + x + + + + (+) + x + + + + +
The second case describes security assessment of FPGA-based MVS. Table 4 summarizes some
attacks and the results of assessment using IMECA-analysis. The table contains countermeasures
strategies which could be applied as a requirements from Regulatory Guide 5.71:2010 (Cyber
Security Programs For Nuclear Facilities, U.S. NRC) to eliminate the attack causes and, moreover,
FPGA-based MVS diversity type and its attributes as a countermeasures [
M
H
iiisecognnnexopLDDscfcemeaotorecaeerrepraautvvmtrerkttiieioeccaocomeettnaifontlieosnifnt itaccvodamiraeepCDMrmenrvepcleinaiorpulftcaekoyecdeiettmiitkcreis;nniotfaengigtinoofnngsfntee;dasfdcruettoithtroemeoatancshtfnutewdapglioellgtivrrhatlvdociitsltinehletcstarveaohtttseghhereolyeeessf, DtssdEEmecpiiCDDDEEcavhvehnssoeiiieecfff;nrurmimpfffsfsofeeerieibaelcrrrotoceeeiyaCdntgnnntuuoaAiitttocretfSiSentsoirSEoons(sSnfo;o;Sff) tools and SSs
The problem of the “last faults” is one of the most challengeable for critical cyber physical systems and reputational for commercial applications. There are two key approaches to minimizing risk of failures caused by design (SW/FPGA) faults and attacks on vulnerabilities using independent V&V and diversity.
X (fault, vulnerability, anomaly) injection based techniques (X/FIT) are one of the efficient V&V techniques. Important tasks are fault profiling; FIT coverage and FIT-ability; multi-FIT and tools. Systematization and aggregating of V&V techniques allow achieving higher accuracy and trustworthiness.
Diversity assures minimizing common cause failure (CCF) risk. Key problems are assessment CCF risk and implementation of new types of internal/external diversity, formal choice and combining of different types of version redundancy, multi-fault/vulnerabilities injection for multiversion systems and so on.
[9] V. Kharchenko, A. Siora, E. Bakhmach, Diversity-Scalable Decisions for FPGA-Based SafetyCritical I&Cs: from Theory to Implementation, in: Proceedings of the 6th ANS International Topical Meeting on Nuclear Plant Instrumentation, Controls, and Human Machine Interface Technology, NPIC&HMIT2009, Knoxville, TN, USA: American Nuclear Society, 2009, pp.1118. [10] IEC 60812:2018. Failure modes and effects analysis (FMEA and FMECA), 2018. URL: https://webstore.iec.ch/publication/26359 [11] E. Babeshko, V. Kharchenko and A. Gorbenko, Applying F(I)MEA-technique for SCADABased Industrial Control Systems Dependability Assessment and Ensuring, in: 2008 Third International Conference on Dependability of Computer Systems DepCoS-RELCOMEX, Szklarska Poreba, Poland, 2008. [12] O. Odarushchenko, V. Kharchenko, Sklyar, V. Multi-Fault Injection Testing: Cases for FPGABased NPP I&C Systems, in: Proceedings of ICONE-23 23rd International Conference on Nuclear Engineering, May 17-21, Chiba, Japan, 2015, pp.31-38.