# Wireless Communication Technologies for Safe Cooperative Cyber Physical Systems
## 4 Safety and Security for SafeCOP Co-CPSs
### V2I Cooperation for Traffic Management  
Fundamental safety requirements for this use case are as follows:* _Early detection of communication errors_, i.e., packet loss, packet insertion, packet replication, packet inversion. * _Bounding to a known upper limit the WSN communication latency to the roadside unit_. * _Executing image processing for VCA on two different HW components_ (i.e., locally on the camera and remotely on the Network Video Recorder). From the safety standpoint, a thorough hazard and risk analysis has been conducted, employing both ISO 26262 and STAMP [31] methodologies. The former identifies 35 hazard conditions, related to incorrect behaviours from a given subsystem. Since in ISO 26262 all components are considered in isolation, a safe state needs to be defined every time a component cannot guarantee an Automotive Safety Integrity Level at the \"Quality Management\" rank (i.e., the most safe). For the sake of brevity, we exemplify only the most dangerous condition identified, that of the on-board unit of the vehicle performing a braking action when no danger is actually present. Since this action could actually lead to accidents (ASIL-C), the runtime manager needs to inhibit the transmission of commands from the on-board unit to the control CAN bus. The latter identified 11 system-level risks. While it may appear that ISO 26262 provides a more detailed analysis of risks, it must be taken into account the fact that STAMP risks are system-level by nature, and are therefore relevant when considering the combined effects of multiple subsystems. As an example, the STAMP analysis highlighted as a key hazard the violation of integrity level of the V2I system, and led to the need to include appropriate detection tools (e.g., those developed in [78] at system level to preserve the operational status from external intrusion. In terms of road safety, the most critical function provided in this use case is the image processing performed at the RSU-C and forwarded at the VCA platform, in order to detect dangerous situations and accidents in the monitored area and alert the LCU/RSU. This unit will apply then a specific countermeasure (GLOSA, ATL-S) over the relevant traffic zone. For this application, the requirements of latency and reliability of the wireless communication channel are of utmost importance, since the warning messages and countermeasures at the traffic lights should reach the destination at the due time. A full analysis of the computational workload is reported in [52]. It is worth noting, however, that such analysis is typically dependent on the specific road intersection scenario, and the resources available for the analysis must therefore be tuned to minimize the risk of exceeding the required latency. From the security standpoint, authentication and encryption shall be applied to all communications; any non-authenticated and/or non-encrypted transmission cannot be automatically considered trustworthy. A non-authenticated communication may come to the control center from either a traffic light, a car or a WSN node. In the former case, the breach of authenticity is a critical issue, and the Co-CPS should switch to a safe mode. In the latter case, the non-authenticated information may simply be discarded, or be used in the decision process only if it is corroborated by coherent information coming from authenticated entities. Similar considerations apply for breaches of integrity. Regarding breaches of availability, the safety of the system clearly depends on the timeliness of the information. If breaches of availability are detected, the runtime manager should aptly react by moving to safer states. Therefore, we identify three service levels: (1) integrity, authenticity and availability are ensured for any message; (2) integrity, authenticity and availability are ensured for messages exchanged among infrastructure components only; (3) at least one infrastructure component cannot ensure integrity, authenticity and availability.