# An Attack-Fault Tree Analysis of a Movable Railroad Bridge

Matthew Jablonski, Yongxin Wang, Chaitanya Yavvari, Zezhou Wang, Xiang Liu, Keith Holt, Duminda Wijesekera

► To cite this version:

Matthew Jablonski, Yongxin Wang, Chaitanya Yavvari, Zezhou Wang, Xiang Liu, et al.. An Attack-Fault Tree Analysis of a Movable Railroad Bridge. 13th International Conference on Critical Infrastructure Protection (ICCIP), Mar 2019, Arlington, VA, United States. pp.51-71, 10.1007/978-3-030-34647-8_3. hal-03364561

HAL Id: hal-03364561

https://inria.hal.science/hal-03364561

Submitted on 4 Oct 2021

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# AN ATTACK-FAULT TREE ANALYSIS OF A MOVABLE RAILROAD BRIDGE

Matthew Jablonski, Yongxin Wang, Chaitanya Yavvari, Zezhou Wang, Xiang Liu, Keith Holt and Duminda Wijesekera

**Abstract** Mechanical and electrical components of movable bridges are engineered to move heavy concrete and steel structures in order to allow water traffic and rail and/or vehicular traffic to pass many times a day despite harsh weather conditions, storm surges and earthquakes. The bridge spans must also support varying rail and/or vehicular traffic loads.

This chapter considers known and theoretical risks posed by movable bridge system attacks and faults in a single stochastic model based on attack-fault trees. Risks associated with railroad swing bridges are presented, along with the attack-fault tree model and the analysis results.

**Keywords:** Cyber-physical systems, movable bridges, attack-fault tree analysis

## 1. Introduction

Movable bridges constructed over waterways are specifically designed to allow traffic flows on and over waterways. Most movable bridges, which are called “heavy movable structures,” maneuver many tons of steel and concrete under the control of modern controllers even under difficult weather conditions.

Bridges have been targets of attacks since ancient times. From castle draw-bridges to supply line bridges in Europe during World War II, pitched battles have been fought over bridges. In this post-Stuxnet era, new risks are posed by attacks on programmable logic controllers and networked industrial control systems – the cyber-physical components that control movable bridges. Consequently, securing a modern movable bridge requires the consideration of faults in the physical, mechanical and control aspects of the bridge as well as the cyber security of electro-mechanical components that actuate the movements of physical components.
<figure><img src="image_2.png" /><figcaption>Figure 1. An open BNSF railroad swing bridge [18].</figcaption></figure>

Faults and vulnerabilities in a system are typically studied by collecting and analyzing data about failure modes. Design corrections are then instituted and the resulting reports are shared with the community to mitigate hazards and risks. Unfortunately, a repository of reports pertaining to movable bridges does not exist for three reasons. First, although they may share some common components, no two movable bridge systems are built the same and operate under the same environmental conditions. Second, the faults and the methods for handling outages vary, but this information is not recorded in a centralized public repository. Third, no cyber attacks have as yet been reported against movable bridges, although attacks against other control systems could be re-purposed to target similar components in movable bridges. To address the lack of data, this chapter models the impacts of failures on movable bridges with a focus on railroad swing bridges (Figure 1).

A literature review indicates that intentional attacks and accidental faults cause movable bridge failures; therefore, a comprehensive model of attacks and faults that result in failures is needed. This work employs the combined attack-fault tree model of Kumar and Stoelinga [16]. This model was built on previous work on attack trees and fault trees to support qualitative and quantitative analyses of combined system security and safety properties. The model is leveraged to create an attack-fault tree for a swing bridge, following which each node in the model is translated to a stochastic timed automaton used by the UPPAAL Statistical Model Checker [7]. A qualitative analysis of the attack-fault tree can be used to identify the root causes of swing bridge system failures whereas a quantitative analysis allows for the incorporation of likelihood values, costs and impacts of disruptions; these two types of analyses are important components of a risk analysis. The utility of the attack-fault tree model in movable swing bridge risk assessments is also discussed.
<figure><img src="image_3.png" /><figcaption>*Figure 2.* Finite-state machine model of a movable bridge.</figcaption></figure>

This research has two main contributions. The first contribution is a thorough security and safety analysis of a movable swing bridge using an attack-fault tree model. Although the focus is on cyber attacks, physical attacks are also considered because bridges, by their very nature, have open physical access. The second contribution is the application of the attack-fault tree model to a real-world system.

## 2. Functionality and Failures

This section presents a model of swing bridge functionality and potential system failures. The discussion clarifies the risks of attacks and faults that impact railroad swing bridge operations.

### 2.1 Functionality Model and Usage Scenarios

A swing bridge is considered to be open when the bridge is rotated parallel to the navigable water traffic direction, enabling water traffic to flow and halting overland traffic. The bridge is considered to be closed when it is aligned with the overland tracks, halting water traffic while enabling overland traffic to flow. These operational states and their transitions are modeled as a finite-state machine shown in Figure 2. It is assumed that a railroad swing bridge is open by default to favor water traffic, and is closed when needed to accommodate passing trains.

When a bridge in the open state needs to transition to the closed state, an operator signals a close request to the bridge control system. At this point, marine craft are alerted via radio, lighting and/or alarms and given time to steer clear of the bridge. Gates may be lowered to prevent the flow of overland traffic. The control system also checks overland traffic control sensors to avoid
unsafe operations. After all the sensor checks are completed, the drive system mechanically walks the pinions around the curved rack, rotating the pivot pier and bridge span 90 degrees. End lifts are then secured, wedges are pushed into place (in the case of center bearing systems), the centering device is engaged and the track is locked on both ends of the bridge [15].

The bridge is now closed, and lights and signals are used to inform operators to permit overland traffic to flow. After overland traffic has passed over the bridge for some time, the process is reversed to move the bridge back to the default open state.

The functional use cases of a swing bridge are modeled as a Moore finite state machine with four states – open, closing, closed and opening – as shown in Figure 2. Failure states are introduced when the bridge is in these states or transitioning between the states.

## 2.2 Classification of Failures

A movable swing bridge is a “binary dynamic and repairable system” [5]. It is binary because its failures are modeled using Boolean variables, dynamic because the order of component failures impacts the system failures and repairable because faulty, degraded and failed components can be replaced. According to this classification, a swing bridge may also be in a failure state, which is defined as a stopped and dysfunctional state, where it remains for a period of period until repairs have occurred and normal functionality can resume. If the bridge fails in the open or closed states, then the passage of overland or water traffic, respectively, is halted.

## 3. Attack-Fault Tree for a Movable Swing Bridge

Attacks and faults can result in failure states. The swing bridge attack-fault tree segments in Figures 3 and 4 show both types of failures in a single model. As a top-down failure analysis formalism, an attack-fault tree is a directed acyclic graph that analyzes the top-level safety or security goal and refines it into smaller sub-goals. In the case of the bridge model, the top-level goal [$G_0$] is “prevent bridge movement,” which corresponds to the definition of failure.

An attack-fault tree comprises gates and leaves. Figure 5 shows the five standard, dynamic fault tree gates: (i) AND. (ii) OR; (iii) FDEP (functional dependency); (iv) SAND (sequential AND); and (v) SPARE (spare inputs). The leaves in an attack-fault tree are either basic attack steps or basic component failures, corresponding to attacks and faults, respectively. The leaves are represented as stochastic timed automata (described later in this chapter). Interested readers are referred to [16] for details about attack-fault trees and their use in quantitative security and safety analyses.

It is assumed that a generic swing bridge uses programmable logic controllers for control automation; wireless networks and manual overrides for interconnections and operator control, respectively; an AC-powered electric motor and
<figure><img src="image_4.png" /><figcaption>Figure 3. Attack-fault tree for the mechanical and electrical subsystems.</figcaption></figure>
<figure><img src="image_5.png" /><figcaption>Figure 4. Attack-fault tree for the superstructure and substructure subsystems.</figcaption></figure>
<figure><img src="image_6.png" /><figcaption>Figure 5. Attack-fault tree gates.</figcaption></figure>

motor brake; a simple mechanical miter rail system that does not require separate electronic controls; and modern power systems.

Attacks or faults can take any one of the following five paths to realize the top-level goal [$G_0$]:

[G₂]: Communications failures prevent local or remote operators from moving the bridge.

[G₃₂]: Stuck electric motor brake prevents bridge movement.

[G₆₈]: Support system failure prevents the motion system from functioning.

[G₅₄]: Substructure failure causes a major bridge outage.

[G₆₄]: Pivot pier failure causes a major bridge outage.

Figure 3 shows paths [$G_2$], [$G_{32}$] and [$G_{68}$]. Figure 4 shows paths [$G_{54}$] and [$G_{64}$]. All five paths could result in [$G_0$].

# 4. Movable Swing Bridge Components

This section describes the basic components and subsystems of a movable swing bridge [15]. An overview of swing bridge subsystems is provided in order to discuss the attacks and faults in the attack-fault tree. Certain basic attack steps and basic component failures are highlighted during the discussion. Note that swing bridges are falling out of style in favor of lift bridges because their central piers cut waterways in half, which can prevent the passage of large ships.

## 4.1 Superstructure and Substructure

A swing bridge superstructure consists of a pivot pier [$G_{64}$], which is centered in a navigable water channel (Figure 1). The pivot pier is typically fixed in the middle of the rotating span, enabling it to remain balanced as it rotates. Fires [$G_{70}$], vehicular collisions [$G_{74}$] and environmental forces [$G_{66}$, $G_{67}$] are some of the primary causes of failures in a bridge superstructure system [6]. Additionally, between World War I and the Vietnam War, bridge destruction [$G_{76}$, $G_{77}$] was an effective measure used by local populations to limit large armed force movements into their territories [10].

A swing bridge substructure [$G_{54}$], which includes the foundation for the pivot pier (a round or square concrete base that vertically stretches above
the water line), is designed to withstand horizontal loads and keep the bridge centered. Hydraulics issues, such as bridge scour [G<sub>55</sub>] resulting from water scooping out the soil and sediment that support the bridge pier, caused 60% of complete bridge failures in the United States between 1950 and 1990 [6]. A timber or crib fendering system [G<sub>57</sub>] is often installed to prevent ships from striking the center pier or to guide them away from the pier. Allisions [G<sub>58</sub>] that result from marine vessels striking the pier base are the second greatest risk to the substructure and foundation of the bridge [6]. Concrete stress [G<sub>60</sub>] causes cracks that could be further weakened by chloride from sea water [G<sub>62</sub>] or by spills [G<sub>63</sub>].

## 4.2 Mechanical and Electrical Systems

This subsection describes the mechanical and electrical systems that work together in modern swing bridge systems to control bridge movement. Potential attacks and faults are also identified.

**Support Systems.** Modern swing bridges use mechanical bearing designs from the mid-nineteenth century, such as the center bearing, rim bearing and combined bearing designs. This research focuses on bearing systems because they are the most common. A system that uses a center bearing [G<sub>53</sub>] has a circular disk with a convex spherical surface fixed to the bottom of the pivot pier, which supports the weight of the bridge while sitting on top of a fixed convex disk on which the bridge rotates. When the bridge is rotated on top of the disk, it moves along a circular track around the inside base of the pivot pier that distributes the weight and balances the structure when the bridge turns; this requires regular lubrication. Wedges [G<sub>69</sub>] or some other support system are used to prop up the bridge when supporting live traffic loads; these often require additional electro-mechanical components.

**Drive Systems.** The support system is rotated using a drive system [G<sub>52</sub>, FDEP], which is engineered to reduce friction, limit the impact of resistance during movement and reduce the amount of torque output generated by the motor. A shaft [G<sub>50</sub>] is used to connect the support system to the drive system; it is generally connected to the rack and pinion system via a grid-type coupler [G<sub>50</sub>]. Additional force on the bridge span caused by overweight vehicles could result in damage to a worn shaft or rack and pinion system [G<sub>79</sub>, G<sub>80</sub>]. Gear drives [G<sub>40</sub>] may have open or enclosed gearing for rotating the shaft [G<sub>47</sub>, FDEP]. Possible gearbox faults are water seepage [G<sub>42</sub>] and poor lubrication [G<sub>43</sub>]. The drive system [G<sub>31</sub>, FDEP] is powered by an electric motor [G<sub>27</sub>] that produces the torque needed to drive the system. Motor brakes [G<sub>32</sub>, G<sub>38</sub>] are spring set and electrically released.

The electric motor and electric brakes, which connect mechanical and electric components [G<sub>18</sub>, G<sub>33</sub>] in the bridge system, could be exploited via logical or physical attacks [G<sub>29</sub>, G<sub>30</sub>, G<sub>36</sub>, G<sub>37</sub>]. The electrical drive control system in a modern movable bridge is designed to handle the sequencing of all the moving
components to ensure proper bridge control. Programmable logic controllers (PLCs) are connected to a control network that gives local and/or remote operators the ability to instruct the bridge to open or close. Each electric motor typically has a dedicated drive controller that controls variables such as speed and torque for bridge rotation. The sequencing involves instructing the networked drive controllers used to manage the electric motor(s) and motor brake(s), controlling the bridge lighting and instructing interlocking system actuators.

Local operators may open and close the bridge using radios [$G_{15}$, $G_{16}$] or a control panel [$G_{17}$] in the bridge operator's house, which is generally located in the middle of the swing bridge span. Remote network access is typically provided via a wide-area network to a back office controlled by the transportation authority. A bridge without remote access is considered to be in “dark territory.” Networked components [$G_2$] in the bridge system could be attacked logically [$G_8$, $G_9$, $G_{11}$, $G_{12}$] or physically [$G_5$, $G_6$] and should, therefore, be carefully designed and installed with security in mind.

**Interlocking Systems.** The rotational movement requires a separate interlocking system that aligns the swing span with the connecting spans in order to fully close the bridge. The interlocking system has three functions: (i) ensure that the opening bridge does not become unbalanced and remains stable; (ii) ensure that the closed bridge does not become unbalanced due to a live load; and (iii) center the bridge and ensure that it does not over-rotate. The first two functions are performed by an end lift system, which relieves the dynamic stresses caused when the bridge begins to move and helps withstand the static stresses caused by passing traffic when the bridge is closed. The third function is performed by centering devices that ensure that the bridge does not over-rotate in the horizontal plane.

After the bridge is in the proper horizontal position, the railroad tracks are closed to enable a train to pass. Miter rails are most commonly used to lock the tracks; they are lowered at the end of each side of the span via a joint when the bridge is being locked into place and they are lifted when the bridge begins to open. Depending on the bridge design, the interlocking system may have electrical requirements similar to the drive control system.

**Electrical Power System.** Modern movable bridges are controlled by solid-state electrical power systems that incorporate silicon-controlled rectifier (SCR) technology made up of power distribution panels, switches, circuit breakers, fuses, ground fault relays, over-current protection relays, cabling, etc. Specialized submarine cables run underwater to the center pier to bring power to the operator's house located in the swing span. Modern bridges use AC and DC motors. Due to their complexity, power systems have the highest failure rates [$G_{20}$] of any swing bridge system [11]. Consequently, the American Railway Engineering and Maintenance-of-Way Association (AREMA) mandates an emergency auxiliary power supply such as a generator [$G_{21}$].
# 5. Quantitative Analysis Methodology

The quantitative analysis employed the UPPAAL Statistical Model Checker (64-bit v4.1.19) [7] to transform the leaves of the attack-fault tree to stochastic automata that simulate failures [16]. This section describes the automaton parameters for the basic attack steps (BAS) and basic component failures (BCF) used in the simulation.

## 5.1 Attack Leaf Automata

Each basic attack step leaf in an attack chain is modeled as a stochastic timed automaton. When an attack is activated, the attacker waits until (s)he is able to afford a cost $f$ to proceed. After the attacker proceeds, the attack is undetected with probability $w_1/(w_1+w_2)$ or detected with probability $w_2/(w_1+w_2)$. The attack stops if it is detected; otherwise, the attack is either ongoing or activated. An ongoing attack is detected over time with an exponential probability rate $\lambda_1$ at a cost $v$ per day to the attacker. An activated attack is detected over time with an exponential probability rate $\lambda$ at a cost $v$ per day to the attacker.

After an attack is executed, it succeeds with probability $p/(p+q)$ and causes damage $d$ to the bridge or the attack fails with probability $q/(p+q)$. These probabilities are based on the attacker's skills, which are specified in an attacker profile. The advantage of this approach is that it is possible to determine the ratio of cost to the attacker against the damage done to the bridge.

Table 1 provides information about each basic attack step leaf in the attack-fault tree segments in Figures 3 and 4. The $w_1$ and $w_2$ detection rates in the table are configured to be high (discussed later in the What-If scenario). The configuration assumes that detection occurs at a higher rate when an attacker is attempting to gain access but at a lower rate after access is gained. The attack labels and their categorizations as logical and physical attacks are relevant to the attack profiles.

The security analysis modeled the attacks in UPPAAL using the As-Is and What-If scenarios [16]. In the As-Is scenario, detection capabilities were eliminated to establish a baseline for a successful attack based on an attacker profile. In the What-If scenario, the $w_1$ and $w_2$ detection rates were set to high. This enabled the determination of the effectiveness of the detection mechanisms at preventing attacks.

## 5.2 Fault Leaf Automata

Exponential probability distributions with means $\lambda$ are used to model the failure rates, where the probability of a failure at time $t$ is $P(t) = 1 - e^{-\lambda t}$. A stochastic automaton is employed to simulate each basic component failure as described in [16]. Each automaton has a $\lambda$-value that expresses the exponential failure rate of the failing node (component). After a period of time, damage $d$ occurs to the system, which transitions to the failed state and sends a message to a higher attack-fault tree gate that the component has failed. Each fault leaf in
<table><caption>Table 1. Basic attack step leaf information.</caption><thead><tr><th>Attack</th><th>Label</th><th>Path</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>Cut<br>Network</td><td>A<sub>1</sub></td><td>[G<sub>5</sub>] →<br>[G<sub>6</sub>]</td><td>Physical</td><td>[G<sub>5</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 20, v = 2,<br>d = 5, λ = 0.0011, λ<sub>1</sub> = 0.0011<br>[G<sub>6</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 5, v = 1,<br>d = 50, λ = 0.00301, λ<sub>1</sub> = 0</td></tr><tr><td>Jam<br>Network<br>Comms.</td><td>A<sub>2</sub></td><td>[G<sub>8</sub>] →<br>[G<sub>9</sub>] →<br>[G<sub>11</sub>]</td><td>Logical</td><td>[G<sub>8</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 20, v = 2,<br>d = 5, λ = 0.001188, λ<sub>1</sub> = 0.001188<br>[G<sub>9</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 10, v = 1,<br>d = 50, λ = 0.0011, λ<sub>1</sub> = 0.0011<br>[G<sub>11</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 10, v = 1,<br>d = 100, λ = 0.001, λ<sub>1</sub> = 0</td></tr><tr><td>Inject<br>Packets</td><td>A<sub>3</sub></td><td>[G<sub>8</sub>] →<br>[G<sub>9</sub>] →<br>[G<sub>12</sub>]</td><td>Logical</td><td>[G<sub>12</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 30, v = 2,<br>d = 250, λ = 0.001, λ<sub>1</sub> = 0</td></tr><tr><td>Cut<br>Power</td><td>A<sub>4</sub></td><td>[G<sub>23</sub>] →<br>[G<sub>24</sub>]</td><td>Physical</td><td>[G<sub>23</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 50, v = 3,<br>d = 100, λ = 0.00092, λ<sub>1</sub> = 0.00092<br>[G<sub>24</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 10, v = 2,<br>d = 350, λ = 0.001, λ<sub>1</sub> = 0</td></tr><tr><td>Stop<br>Drive</td><td>A<sub>5</sub></td><td>[G<sub>29</sub>] →<br>[G<sub>30</sub>]</td><td>Logical</td><td>[G<sub>29</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 40, v = 3,<br>d = 100, λ = 0.000596, λ<sub>1</sub> = 0.000596<br>[G<sub>30</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 30, v = 2,<br>d = 500, λ = 0.0005, λ<sub>1</sub> = 0</td></tr><tr><td>Tamper<br>with Brake</td><td>A<sub>6</sub></td><td>[G<sub>29</sub>] →<br>[G<sub>36</sub>]</td><td>Logical</td><td>[G<sub>36</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 40, v = 4,<br>d = 500, λ = 0.0005, λ<sub>1</sub> = 0</td></tr><tr><td>Stop<br>Brake</td><td>A<sub>7</sub></td><td>[G<sub>29</sub>] →<br>[G<sub>37</sub>]</td><td>Logical</td><td>[G<sub>37</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 25, v = 2,<br>d = 500, λ = 0.0005, λ<sub>1</sub> = 0</td></tr><tr><td>Break<br>Gear</td><td>A<sub>8</sub></td><td>[G<sub>45</sub>] →<br>[G<sub>46</sub>]</td><td>Physical</td><td>[G<sub>45</sub>]: w<sub>1</sub> = 60, w<sub>2</sub> = 40, f = 20, v = 4,<br>d = 5, λ = 0.0011, λ<sub>1</sub> = 0.0011<br>[G<sub>46</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 40, v = 8,<br>d = 200, λ = 0.001092, λ<sub>1</sub> = 0</td></tr><tr><td>Cause<br>Explosion</td><td>A<sub>9</sub></td><td>[G<sub>76</sub>] →<br>[G<sub>77</sub>]</td><td>Physical</td><td>[G<sub>76</sub>]: w<sub>1</sub> = 65, w<sub>2</sub> = 35, f = 50, v = 4,<br>d = 5, λ = 0.00037, λ<sub>1</sub> = 0.00037<br>[G<sub>77</sub>]: w<sub>1</sub> = 80, w<sub>2</sub> = 20, f = 100, v = 10,<br>d = 5000, λ = 0.000178, λ<sub>1</sub> = 0</td></tr></tbody></table>

Figures 3 and 4 has its own automaton and the gates are stepped through during the UPPAAL simulation. Table 2 lists the sources of the λ-values corresponding to the basic component failures. All the failure rates are eventually expressed in terms of days so that the faults and attacks in the simulation have consistent time units. Note that the MTBF acronym in Table 2 denotes the mean time between failures.
<table><caption>Table 2. Basic component failure leaf sources and computation notes.</caption><thead><tr><th>Failures</th><th>Source</th><th>Computation Notes</th></tr></thead><tbody><tr><td>[G<sub>15</sub>], [G<sub>16</sub>], [G<sub>17</sub>]</td><td>—</td><td>Assume MTBF is 20,000 hours based on a product review</td></tr><tr><td>[G<sub>20</sub>], [G<sub>33</sub>]</td><td>[11]</td><td>Assume annual failure rate is 0.4</td></tr><tr><td>[G<sub>21</sub>]</td><td>[14]</td><td>Assume MTBF is 500 hours</td></tr><tr><td>[G<sub>27</sub>], [G<sub>38</sub>]</td><td>[20]</td><td>Assume failure rate is ten per million hours</td></tr><tr><td>[G<sub>40</sub>], [G<sub>42</sub>], [G<sub>43</sub>]</td><td>[1]</td><td>Assume MTBF is 40,000 hours based on L10 life at the rated torque</td></tr><tr><td>[G<sub>50</sub>]</td><td>[20]</td><td>Assume failure rate is eight per million hours at a 15-year renewal interval</td></tr><tr><td>[G<sub>51</sub>]</td><td>[20]</td><td>Assume failure rate is 14 per million hours at a 15-year renewal interval</td></tr><tr><td>[G<sub>53</sub>]</td><td>[20]</td><td>Assume failure rate is 20 per million hours at a 15-year renewal interval</td></tr><tr><td>[G<sub>55</sub>], [G<sub>57</sub>], [G<sub>58</sub>], [G<sub>66</sub>], [G<sub>67</sub>], [G<sub>70</sub>], [G<sub>72</sub>], [G<sub>73</sub>], [G<sub>74</sub>], [G<sub>79</sub>], [G<sub>80</sub>]</td><td>[6]</td><td>Assume or derive an annual failure rate</td></tr><tr><td>[G<sub>60</sub>], [G<sub>62</sub>], [G<sub>63</sub>]</td><td>[8]</td><td>Assume failure rate is 1.09 × 10<sup>-7</sup> per year based on concrete stress and corrosion data</td></tr><tr><td>[G<sub>69</sub>]</td><td>—</td><td>Assume failure rate is 20 per million hours</td></tr></tbody></table>

# 6. Attack-Fault Tree Analysis

Simulations were conducted to quantify the impacts of attacks and faults on swing bridge operations. During each test, UPPAAL stepped through a number of runs until the results became statistically significant (or insignificant) to provide feedback on the results. A run was stopped and considered to be a hit if the goal $[G_0]$ was reached within a specified time frame. If the time expired before the goal $[G_0]$ was reached, then the run was considered to be a miss. Statistical significance was assessed using 95% confidence intervals.

## 6.1 Critical Fault Path Analysis

The first set of simulations was conducted to analyze the probability of disruption over time. Figure 6 shows the probabilities of disruption over time for five scenarios. This helps identify the paths that result in maximum disruption to the railroad bridge over a ten-year period. After one year, the Only Faults scenario yielded a fault probability $P(t \le 365)$ of 0.75. After two years, the
<figure><img src="image_7.png" /><figcaption>Figure 6. Probability of disruption at time t (95% confidence interval).</figcaption></figure>

Only Faults scenario yielded a higher fault probability $P(t \le 730)$ of 0.942. Scenarios with No Attack Detection, Low Attack Detection Rate and High Attack Detection Rate yielded two-year probabilities of 0.175, 0.147 and 0.0631, respectively.

The next set of simulations sought to identify the critical path in the attack-fault tree. This involved repeated simulations while disabling each basic component failure leaf in the attack-fault tree for a one-year period, where the Only Faults scenario yielded a fault probability $P(t \le 365)$ of 0.75. After considering all the leaves, the percentage differences between the new results and the baseline value were computed.

Table 3 shows the results for all the basic component failure leaves. The results demonstrate that the power-related leaves pose the greatest risk to bridge failure. The $G_{33}$ leaf corresponding to motor brake power failure yielded the greatest difference of -25.200% at $P(t \le 365) = 0.561$, followed by $G_{21}$ corresponding to generator failure with a difference of -21.730% and $G_{20}$ corresponding to power outage with a difference of -19.870%. Note that $G_{20}$ and $G_{21}$ share the same critical failure path because the power generator should take
<table><caption>Table 3. Fault disruption percentages measured for all leaves (0.750).</caption><thead><tr><th>Leaf</th><th>P(t ≤ 365)</th><th>Difference</th><th>Leaf</th><th>P(t ≤ 365)</th><th>Difference</th></tr></thead><tbody><tr><td>G<sub>15</sub></td><td>0.720</td><td>-4.000%</td><td>G<sub>57</sub></td><td>0.748</td><td>-0.270%</td></tr><tr><td>G<sub>16</sub></td><td>0.693</td><td>-7.600%</td><td>G<sub>58</sub></td><td>0.734</td><td>-2.130%</td></tr><tr><td>G<sub>17</sub></td><td>0.724</td><td>-3.470%</td><td>G<sub>60</sub></td><td>0.749</td><td>-0.130%</td></tr><tr><td>G<sub>20</sub></td><td>0.601</td><td>-19.870%</td><td>G<sub>62</sub></td><td>0.716</td><td>-4.530%</td></tr><tr><td>G<sub>21</sub></td><td>0.587</td><td>-21.730%</td><td>G<sub>63</sub></td><td>0.748</td><td>-0.270%</td></tr><tr><td>G<sub>27</sub></td><td>0.702</td><td>-6.400%</td><td>G<sub>66</sub></td><td>0.758</td><td>1.070%</td></tr><tr><td>G<sub>33</sub></td><td>0.561</td><td>-25.200%</td><td>G<sub>67</sub></td><td>0.728</td><td>-2.930%</td></tr><tr><td>G<sub>38</sub></td><td>0.699</td><td>-6.800%</td><td>G<sub>69</sub></td><td>0.689</td><td>-8.130%</td></tr><tr><td>G<sub>40</sub></td><td>0.718</td><td>-4.270%</td><td>G<sub>70</sub></td><td>0.749</td><td>-0.130%</td></tr><tr><td>G<sub>42</sub></td><td>0.731</td><td>-2.530%</td><td>G<sub>72</sub></td><td>0.737</td><td>-1.730%</td></tr><tr><td>G<sub>43</sub></td><td>0.724</td><td>-3.470%</td><td>G<sub>73</sub></td><td>0.724</td><td>-3.470%</td></tr><tr><td>G<sub>50</sub></td><td>0.722</td><td>-3.730%</td><td>G<sub>74</sub></td><td>0.752</td><td>0.270%</td></tr><tr><td>G<sub>51</sub></td><td>0.708</td><td>-5.600%</td><td>G<sub>79</sub></td><td>0.722</td><td>-3.730%</td></tr><tr><td>G<sub>53</sub></td><td>0.697</td><td>-7.070%</td><td>G<sub>80</sub></td><td>0.735</td><td>-2.000%</td></tr><tr><td>G<sub>55</sub></td><td>0.735</td><td>-2.000%</td><td></td><td></td><td></td></tr></tbody></table>

over in the event of a power failure. Generators are not built to last forever, but they have low exponential failure rates ($\lambda = 0.0042$). This may indicate a weakness in the model. Without some power system repair capabilities, the purpose of having a backup power system is defeated if its uptime (reliability) is less than the time between power failures.

## 6.2 Attacker Profile Analysis

Attacker profiles based on the attack-fault tree were created to evaluate various strategies against simulated adversaries. In particular, three attacker profiles were created to evaluate the effectiveness of adding security controls:

* **Nate:** Nation state attacker; Budget = $10,000 × 10³; Success rate for logical attacks $p = 90\%$; Success rate for physical attacks $p = 90\%$.

* **Mallory:** Hacker; Budget = $5,000 × 10³; Success rate for logical attacks $p = 80\%$; Success rate for physical attacks $p = 60\%$.

* **Chuck:** External attacker; Budget = $3,000 × 10³; Success rate for logical attacks $p = 60\%$; Success rate for physical attacks $p = 80\%$.

Table 4 compares the results obtained for the As-Is and What-If scenarios by running the three attack profiles against the attack-fault tree over a ten-year time period.

In the As-Is scenario, Nate had a 36% chance of conducting a successful attack compared with 12.7% for Mallory and 10.2% for Chuck. Although Nate spent twice as much money on average in conducting a successful attack in
<table><caption>Table 4. As-Is versus What-If scenario results over ten years.</caption><thead><tr><th></th><th>Nate</th><th>Mallory</th><th>Chuck</th></tr></thead><tbody><tr><td><strong>As-Is Scenario</strong></td><td></td><td></td><td></td></tr><tr><td>Probability P(t ≤ 3,650)</td><td>0.360</td><td>0.127</td><td>0.102</td></tr><tr><td>Mean Time E(t) (days)</td><td>828.469</td><td>606.163</td><td>410.418</td></tr><tr><td>Mean Cost E(cost) (10<sup>3</sup> dollars)</td><td>4,158.215</td><td>2,388.666</td><td>1,706.83</td></tr><tr><td>Mean Damage E(damage) (10<sup>3</sup> dollars)</td><td>1,066.595</td><td>1,058.763</td><td>442.77</td></tr><tr><td>Successful Attacks</td><td>133</td><td>22</td><td>14</td></tr><tr><td>Runs</td><td>371</td><td>182</td><td>150</td></tr><tr><td><strong>What-If Scenario</strong></td><td></td><td></td><td></td></tr><tr><td>Probability P(t ≤ 3,650)</td><td>0.226</td><td>0.0454</td><td>0.0515</td></tr><tr><td>Mean Time E(t) (days)</td><td>982.201</td><td>628.984</td><td>971.847</td></tr><tr><td>Mean Cost E(cost) (10<sup>3</sup> dollars)</td><td>4,409.470</td><td>1,650.969</td><td>1,776.107</td></tr><tr><td>Mean Damage E(damage) (10<sup>3</sup> dollars)</td><td>1,361.609</td><td>752.78</td><td>670.127</td></tr><tr><td>Successful Attacks</td><td>65</td><td>4</td><td>5</td></tr><tr><td>Runs</td><td>287</td><td>88</td><td>97</td></tr></tbody></table>

the average case as Mallory ($4,158.215 × 10³ versus $2,388.666 × 10³), they caused roughly the same amount of average damage per attack ($1,066.595 × 10³ versus $1,058.763 × 10³). This similarity suggests that logical attacks were likely to be more successful because Mallory had a higher probability of successful attacks. Meanwhile, Chuck spent an average of $1,706.83 × 10³ per successful attack, resulting in an average of $442.77 × 10³ in damage per successful attack. This also confirms that logical attacks are more likely to occur given the resources because Chuck is more likely to succeed with physical attacks. Time comparisons show that Nate (828.469 days) took longer on average than Mallory (606.163 days) and Chuck (410.418 days).

In the What-If scenario, the detection values for $w_1$ and $w_2$ were reconfigured as shown in Table 1. The percentages of successful attacks declined for Nate by -37.22%, Mallory by -64.25% and Chuck by -49.51%, demonstrating the utility of implementing detection mechanisms for all three attacker profiles. Nate's average time for attacks increased by 18.56% and cost increased by 6.04%, but he presumably took greater risks with his additional resources because the damage inflicted also increased by 27.66%. The simulation for Nate was executed ten additional times and similar results were obtained, confirming that the results were not anomalous. In contrast, Mallory saw an increase in the average time required to conduct successful attacks of only 3.76%, but decreases in cost of -30.88% and damage of -28.8%. Chuck saw a very large increase in the average time required to conduct successful attacks of 136.79%, only a slight increase in the average cost of 4.06%, but a large increase in damage of 51.35%. These results indicate that additional detection mechanisms would be more useful against strictly logical attackers (Mallory) than adversaries who are stronger at physical attacks (Nate and Chuck).
<table><caption>Table 5. Analysis of attack disruptions measured against $P(t \le 3,650) = 0.341$.</caption><thead><tr><th>Attack</th><th>P(t ≤ 3,650)</th><th>Difference</th><th>Attack</th><th>P(t ≤ 3,650)</th><th>Difference</th></tr></thead><tbody><tr><td>A<sub>1</sub></td><td>0.275</td><td>-19.365%</td><td>A<sub>6</sub></td><td>0.347</td><td>1.858%</td></tr><tr><td>A<sub>2</sub></td><td>0.343</td><td>0.8072%</td><td>A<sub>7</sub></td><td>0.349</td><td>2.38%</td></tr><tr><td>A<sub>3</sub></td><td>0.343</td><td>0.8072%</td><td>A<sub>8</sub></td><td>0.358</td><td>5.234%</td></tr><tr><td>A<sub>4</sub></td><td>0.341</td><td>0%</td><td>A<sub>9</sub></td><td>0.339</td><td>-0.5234%</td></tr><tr><td>A<sub>5</sub></td><td>0.330</td><td>-3.244%</td><td></td><td></td><td></td></tr></tbody></table>

## 6.3 Critical Attack Path Analysis

The observation that attackers with strengths in logical attacks may be at a disadvantage influenced the identification of critical attack paths in the attack-fault tree that might provide an explanation. This was accomplished by re-executing the No Attack Detection scenario discussed in Section 6.1 with Nate as the attacker.

The executions were configured to run for ten years without any detection mechanisms in place. After running through a baseline test with all the basic attack step leaves enabled, the differences in the new results with probability $P(t \le 3,650) = 0.341$ were computed.

Table 5 shows the results for all the attack paths. The physical attack $A_1$, which physically cut network links, is critical because it has the highest difference: a -19.365% drop in the probability of successful attacks. This explains why physical attackers fared better in the What-If scenario. Upon applying detection methods of similar strength to both logical and physical attacks, adversaries who were stronger at physical attacks (Nate and Chuck) were still able to increase the amount of damage caused. This was due to their ability to perform attack $A_1$ that cut bridge network links with higher success rates.

## 7. Related Work

Previous work [27] introduced the security and safety risks facing movable railroad bridges and leveraged dynamic attack trees and fault trees to map possible vulnerabilities. Two separate models, one involving security and the other involving safety, were developed after researching control systems for a specific swing bridge. The previous work also revealed that many of the attacks and faults tended to overlap.

In contrast, the research described in this chapter integrates attacks and faults in a single model. The integrated attack-fault tree model was recently introduced by Kumar and Stoelinga [16], who used it to analyze a number of example systems. However, this chapter describes the first real-world application of the integrated attack-fault tree model, as well as the first application to a bridge system.
## 7.1 Historical Swing Bridge Failures

As discussed in the introductory section, data about swing bridge failures is limited due to a variety of factors. This research began by compiling data about swing bridge failures that was used to create the attack-fault tree.

The following additional information, categorized by the impacted swing bridge subsystems, is highly relevant to the faults considered in the model:

* **Superstructure System:** In 2014, a fire at a 104-year-old portal swing bridge in New York City cut power to the bridge. The resulting 70-minute outage delayed or cancelled 52 trains [17].

* **Substructure System:** The Gasparilla Island Swing Bridge in Charlotte County, Florida was recently replaced because its concrete girders from 1958 were structurally deteriorating, leading to high risks of failure due to storm surges and vehicular impacts [24]. Incident data about bridge allisions by marine vessels is posted by the U.S. Coast Guard [26].

* **Support System:** Older swing bridge center bearing designs are prone to instability when the bridges are unbalanced. As a result, a number of swing bridge renovation projects have been undertaken recently to address the problem, including the Court Street Bridge in Hackensack, New Jersey [3] and the East Haddam Swing Bridge in Connecticut [9]. In 2010, the Somerleyton Swing Bridge in Norfolk, England suffered a catastrophic failure due to a bearing system failure [22].

Wedge faults have led to several prolonged swing bridge outages. In 2017, degraded wedges impacted operations of the Little Current Swing Bridge in Ontario, Canada [4]. In 2014, a complete wedge failure resulted in significant downtime of the Walk Bridge in Norwalk, Connecticut [23].

* **Drive System:** In 2010, a gearbox failure in the Whitby Swing Bridge in North Yorkshire, England terminated bridge operations for one week [2].

* **Interlocking System:** In 1996, Amtrak Train No. 12 derailed on the Portal Bridge near Secaucus, New Jersey due to defective miter rails [$G_{72}, G_{73}, G_{74}$] [19]. In 2014, the Walk Bridge in Norwalk, Connecticut was closed due to an interlocking problem with its miter rails [23].

* **Electrical System:** An interesting story from 2002 about the Old Saybrook Bridge is recounted in [21]. This bascule bridge had electrical components dating back to its original design and construction in 1907. Troubleshooting the failed electrical system was an extremely complex task.

## 7.2 Rules and Regulations

Several rules and regulations govern the management of movable bridges in the United States. The U.S. Coast Guard oversees movable bridge operations
on navigable waterways. Organizations such as the American Association of Railroads (AAR) and the American Association of State Highway and Transportation Officials (AASHTO) promulgate national standards and requirements for movable bridge construction, maintenance and inspection. In addition, the following federal regulations govern movable bridge operations:

* Movable Bridge, Interlocking of Signal Appliances with Bridge Devices (49 CFR 236.312 [12]): This section specifies rules and restrictions governing the passage of trains over movable bridges.

* Movable Bridge Locking (49 CFR 236.387 [13]): This section mandates that movable bridges shall be inspected once a year.

* Bridge Lighting and Other Signals (33 CFR Chapter 1, Sub-Chapter j, Part 118 [25]): This section mandates the lighting requirements required for signaling the status of movable bridge operations on navigable waters.

## 8. Conclusions

Movable bridges have been used for hundreds of years, but they continue to evolve in their designs and implementations. Numerous movable bridges are being upgraded by automating and networking their components, which adds a new layer of risk to these vital transportation infrastructure assets. The research described in this chapter has leveraged the attack-fault tree model to integrate the physical risks involved in operating railroad swing bridges in the face of risks posed by physical attacks on bridge subsystems and cyber attacks on control systems.

The attack-fault tree approach integrates attacks and faults in a single model that supports the use of stochastic timed automata to identify the critical failure paths for a movable swing bridge. In particular, the integrated model reveals that physical network attacks and power faults are the best ways to disrupt movable swing bridge operations. Moreover, by stepping through the model, it was determined that superstructure and substructure system faults are statistical anomalies as far as the integrated attack-fault model is concerned. Thus, future research should focus on the attack surfaces and mechanical and electrical system failures.

The principal conclusion of this research is that the attack-fault tree approach is effective at identifying critical attack and fault paths at a high level. However, the swing bridge analysis reveals that the model falls short in some ways. In the case of a swing bridge, many faults can only occur while the bridge is moving and other faults can occur only when the bridge is closed. The state of the system is, therefore, important, but the attack-fault tree model does not take the system state into account. For example, components such as electric motors and gears have failure rates that are established only when the system is in use. A movable bridge is in motion only for a few minutes at a time and these components spend the majority of their time at rest. Additionally,
the attack-fault tree allows for the incorporation of attack chains, but it does not necessarily consider the specific system configurations included in previous attack tree models. The attack-fault tree model also abstracts security control solutions as simple detection mechanisms, which reduces its applications in real-world environments.

Note that the views and opinions expressed herein are those of the authors and do not necessarily state or reflect the views and opinions of the Federal Railroad Administration or U.S. Department of Transportation, and shall not be used for advertising or product endorsement purposes.

## Acknowledgements

This research was supported by Grant No. DTFR5317C00018 from the Federal Railroad Administration, U.S. Department of Transportation. The authors thank Mr. Francesco Bedini Jacobini and Mr. Jared Withers from the Federal Railroad Administration for their advice and assistance.

## References

[1] G. Antony, How to determine the MTBF of gearboxes, *Power Transmission Engineering*, pp. 32–37, April 2008.

[2] BBC News, Swing bridge reopens in Whitby after gearbox failure, July 30, 2010.

[3] L. Burgos, Machinery rehabilitation of the Court Street Bridge over the Hackensack River, Hackensack, New Jersey, presented at the *Heavy Moving Structures Fourteenth Biennial Symposium*, 2012.

[4] CBC News, Delays at swing bridge in Little Current due to repairs says MTO, July 7, 2017.

[5] P. Chaux, J. Roussel, J. Lesage, G. Deleuze and M. Bouissou, Towards a unified definition of minimal cut sequences, *Proceedings of the Fourth IFAC Workshop on Dependable Control of Discrete Systems*, paper no. 1, 2013.

[6] W. Cook, Bridge Failure Rates, Consequences and Predictive Trends, Ph.D. Dissertation, Department of Civil and Environmental Engineering, Utah State University, Logan, Utah, 2014.

[7] A. David, K. Larsen, A. Legay, M. Mikucionis and D. Poulsen, UPPAAL SMC tutorial, *International Journal on Software Tools for Technology Transfer*, vol. 17(4), pp. 397–415, 2015.

[8] C. Davis-McDaniel, Fault-Tree Model for Bridge Collapse Analysis, M.S. Thesis, Department of Civil Engineering, Clemson University, Clemson, South Carolina, 2011.

[9] J. DeWolf, History of Connecticut’s Short-Term Strain Program for Evaluation of Steel Bridges, Report No. CT-2251-F-09-6, Connecticut Department of Transportation, Storrs, Connecticut, 2009.
[10] H. Douthit, The Use and Effectiveness of Sabotage as a Means of Unconventional Warfare – An Historical Perspective from World War I through Viet Nam, M.S. Thesis, School of Systems and Logistics, Air Force Institute of Technology, Wright-Patterson Air Force Base, Ohio, 1987.

[11] R. Eacker and M. Bardsley, Electrical reliability analysis for transit applications, *Proceedings of the ASME/IEEE Joint Railroad Conference*, pp. 81–88, 2002.

[12] Federal Railroad Administration, Code of Federal Regulations, Title 49, Section 236.312 – Movable Bridge, Interlocking of Signal Appliances with Bridge Devices, Department of Transportation, Washington, DC, 2018.

[13] Federal Railroad Administration, Code of Federal Regulations, Title 49, Section 236.387 – Movable Bridge Locking, Department of Transportation, Washington, DC, 2018.

[14] G. Hansen, E. Frame and E. Sattler, Generator Set Durability Testing, Interim Report TFLRF No. 419, U.S. Army TARDEC Fuels and Lubricants Research Facility, Southwest Research Institute, San Antonio, Texas, 2012.

[15] T. Koglin, *Movable Bridge Engineering*, John Wiley and Sons, Hoboken, New Jersey, 2003.

[16] R. Kumar and M. Stoelinga, Quantitative security and safety analysis with attack-fault trees, *Proceedings of the Eighteenth IEEE International Symposium on High Assurance Systems Engineering*, pp. 25–32, 2017.

[17] P. McGeehan, 104-year-old portal bridge presents $900 million problem for rail commuters, *The New York Times*, September 25, 2014.

[18] S. Morgan, Burlington Northern Railroad Bridge 9.6, *Wikipedia* (en.wikipedia.org/wiki/Burlington_Northern_Railroad_Bridge_9.6#/media/File:BNSF_Bridge_9.6_swing_span_turning.jpg), June 25, 2011.

[19] National Transportation Safety Board, Derailment of Amtrak Train No. 12 and Sideswipe of Amtrak Train No. 79 on Portal Bridge near Secaucus, New Jersey, November 23, 1996, Railroad Special Investigation Report, Notation 6813B, Washington, DC, 1996.

[20] Naval Surface Warfare Center (Carderock Division), *Handbook of Reliability Prediction Procedures for Mechanical Equipment*, West Bethesda, Maryland, 2010.

[21] P. O'Neill and A. Ostrovsky, Failure and quick recovery of movable bridge on the Acela Line, presented at the *Heavy Movable Structures Ninth Biennial Movable Bridge Symposium*, 2002.

[22] M. Rimmer, Somerleyton Swing Bridge, Report by Waterways Strategy Officer, Navigation Committee, 2 September 2010, Agenda Item No. 8, Broads Authority, Norwich, United Kingdom, 2010.

[23] Short Term Action Team, Connecticut DOT BR. NO. 04288R Walk Bridge over Norwalk River, Norwalk, Connecticut, Emergency Repair and Reliability Report FINAL July 17, 2014, Connecticut Department of Transportation, Newington, Connecticut, 2014.
[24] H. Sinson, Gasparilla Island Swing Bridge replacement, presented at the *Heavy Movable Structures Sixteenth Biennial Movable Bridge Symposium*, 2016.

[25] United States Coast Guard, Code of Federal Regulations, Title 33 – Navigation and Navigable Waters, Washington, DC, 2010.

[26] United States Coast Guard, Homeport, Washington, DC (homeport.uscg.mil), 2019.

[27] Y. Wang, M. Jablonski, C. Yavvari, Z. Wang, X. Liu, K. Holt and D. Wijesekera, Safety and security analysis for movable railroad bridges, presented at the *ASME Joint Rail Conference*, 2019.