# Failure Mode and Effect Analysis for Cyber-Physical Systems
## 5 Communications-Based Train Control  
CBTC is a modern communication-based system that uses radio communication to exchange train control information between trains and wayside equipment. [PERSON] et al. [22] provided a complex CBTC system architecture which we compacted into Figure 1. Onboard the train the Automatic Train Control (ATC) functions, namely Automatic Train Protection (ATP) and Automatic Train Operation (ATO) actuate in consideration of the exchanged information between the train and the wayside devices. The train continuously sends traveling data, such as location and traveling speed, to the wayside equipment over a Wi-Fi connection. With this information, the limit of movement authority (LMA), which consists of the limit of speed and distance the train is permitted to travel, is calculated on the wayside's traffic control center and sent back to the train [23]. Based on this information, the train onboard ATC equipment continuously keeps the safety distance to any preceding trains adjusting the train speed. We chose CBTC as a use case for our CPS risk assessment study because, besides being a safety and time-critical system, the CBTC system is highly dependable on-network data transfer and software availability. Moreover, the social and economic impact of CBTC software faults may be catastrophic, as train collisions and fatalities emerge as the worst consequences. Further ahead, we succinctly describe the most essential components of a CBTC system, as well as the networked communication between the train and the wayside devices. This network consists of the following three integrated networks: Train onboard network, trackside backbone network, and train-to-trackside network. The first two networks communicate through Ethernet, while the last one generally uses Wi-Fi [24]. Following, we will discuss the major onboard components of a CBTC system: The Vehicle Onboard Computer (VOBC), the onboard ATC, and the Radio Communication System (RCS). Together, these components represent the train onboard network. VOBC is the system responsible for consistently sending train control information to the wayside. This system either includes, or works together with, the onboard ATP, and ATO subsystems of the ATC. ATO is in charge of the train driving functions and ATP takes care of safety-related functions. The ATP subsystem helps avoid collisions when the driver ignores the speed limitations. This system automatically audits and regulates the train speed, and if necessary, uses the brakes. The ATO subsystem is responsible for automating the train operation, which includes starting and stopping the train, acceleration, braking, and stopping accuracy. The RCS stands also as an essential onboard component, having a critical influence on sending and receiving data from the wayside AP. RCS includes software and hardware, radios, and antennas, and its primary function is to establish the communication between the train and the wayside AP. Regarding the wayside components, the Zone Controller (ZC), which in most cases includes the wayside ATP and ATO subsystems, is responsible for its correspondent zone inside the railway network. The railway network is divided into independent zones, such that each zone constitutes its respective wayside infrastructure. The primary function of a ZC is to prevent trains from colliding inside its zone. The ATP subsystem of a ZC is responsible for all the data exchange with the trains in its zone. This subsystem is also in charge of calculating the movement authority for every train inside its zone. The ATO subsystem supplies the train destination and dwells times to all the trains in its zone. The Computer-based Interlocking (CI) is responsible for defining routes for trains and controlling signals and switch machines regarding these trains' destinations. The Automatic Train Supervision (ATS) system, which is charged for scheduling and supervising the traffic, is also a trackside component but independent from the ZC [24].