Safety inspection and certification of processes and products
As the first Swiss certification body for functional safety and cyber security, SNV member CertX makes an important contribution to the reliability of products and processes. Standards of various kinds form the basis for its work and certification for its customers.
Cybersecurity is not just about hackers attacking email systems, company servers or customer databases. Literally everything that is networked can be hacked: from medical devices to the power grid, from the home alarm system to the gas network. These cases are referred to as "operational cybersecurity." For example, if a car was purchased after 2017, it has a SIM card built in as standard that would launch an automatic emergency call in the event of an emergency. A small feature that networks the car with other systems, making it attractive to hackers. For example, in 2015, hackers managed to control a Chrysler Cherokee in a strange way: All without wires, from a great distance and with a laptop. The driver no longer had control over the engine, steering and brakes. Class action lawsuits, court cases, software adjustments and a recall of 1.4 million Chrysler Jeeps were the consequences.
A recent example is the hacker attack on the largest gasoline pipeline in the US, where Colonial Pipeline ended up paying the hackers millions - in US dollars and bitcoins - to regain control of the gasoline supply. To avoid such security breaches wherever possible, processes and products are security tested and certified. "It pays to involve a certification body early on in the development of a product or service, as the development process is an essential element of a certification and cannot be corrected after the fact," explains Jens Henkner, CEO of CertX.
Hacking with honorable intentions?
To make it as difficult as possible for hackers with sinister intentions, manufacturers, industrial users as well as end users need to be aware of security vulnerabilities and strictly adhere to precautionary measures. Attacks like Chrysler's are deliberately undertaken by hackers to alert companies to eminent security vulnerabilities. CertX employees also participate in so-called "ethical hacking" in their free time, so that consumers and companies can be spared greater damage. Jens Henkner emphasizes: "Only if everyone, from the development to the user, develops and handles networked devices correctly, the greatest possible security is guaranteed. Cybersecurity is needed to ensure that safe products from the factory remain safe. Unfortunately, many players still follow the Floriani principle - namely, not to solve the danger situation, but to wait and see what happens first.
Are mistakes teachers or tolggen in the clean book?
"In aviation, people have long been used to sharing mistakes and learning from them together," says Henkner. Most industries are still far from living this culture unconditionally. Public discussions about mistakes like those at Boeing are hard to imagine in the automotive industry, for example. But slowly the attitude towards error culture is changing here as well. Henkner is convinced that standards can play a supporting role in this area: "Standards are experience cast in writing; as an engineer, I see no sense in inventing the wheel twice". This principle is also followed by CertX, which sees itself as a partner and not as a civil servant-like control body. Henkner says: "We are the co-pilot. We read the checklist and ask the right questions so that customers can easily find the right solutions on their own."
Do I still drive my car or am I being driven?
The classic combustion engine is no longer the only dominator on the roads. Electric cars are enriching the road scene more and more. Buzzwords such as "autonomous driving" are fuelling the discussion about safe driving. If you believe the visionaries, road traffic will change fundamentally in the next few years. The fact is that the automotive industry is facing very different challenges today than it did just a few years ago. Building mechanical or electric cars are two completely different disciplines. If, for example, the clutch in the car and thus the manual control to interrupt propulsion suddenly disappears, completely new tests are placed in the path of the manufacturers, which require functionally safe control systems. New pieces of the puzzle, such as charging stations or more power-intensive batteries, appear on the radar. Today, for example, even more electric vehicles are being damaged by fire rather than problems with driver assist systems. "Standards also help in such an innovative environment, serving as best practices and a recipe book during development," Henkner believes. "Employee awareness and training are key contributors to success. For example, we're proud to say that before Covid-19, we trained the most automotive employees in the world on standards."
And what does Henkner think about autonomous driving? He sees great potential for motorway journeys, but he cannot imagine autonomous driving in urban traffic in the near future because of the complexity involved. CertX is convinced of the multimodal transport of the future and is therefore involved in the SwissMoves research project of the University of Applied Sciences in Fribourg, where they contribute their certification knowledge in the field of functional safety and cyber security.
Source: CertX
And what about artificial intelligence?
Many of today's applications rely on artificial intelligence, especially for image recognition in various areas of automation. The difficulty is that after development, the so-called neural networks become a black box and are difficult to verify. Here, it is all the more important to proceed in a process-related manner and to certify accordingly. If, for example, drivers make mistakes, these are always attributed to the individual human being as a failure and not regarded as a system error. Artificial intelligence must now prove that it operates more safely than humans, does not exceed today's human error rates, and does not cause systematic errors. Practical proof requires an immense amount of testing, which is practically unaffordable in today's development cycles. Additionally, standards in this area are still largely lacking. "The art is no longer to test the end result, but to optimally regulate the development process so that a so-called 'Equivalent Level of Safety' can be achieved. Factors like 4-eyes principle, complete documentation, clean database, digitized tests and so on play an important role in assessing the safety of neural networks. The big challenge is to package agile systems into codified standards. This creates friction between all parties involved in the standardization work, which I consider to be very useful, because it ultimately leads to good results," emphasizes Jens Henkner.
Source: CertX
