Cyber-Physical Systems (CPS) are exposed to a plethora of attacks and their attack surface is only increasing. However, whilst many attack paths are possible, only some can threaten the system's safety and potentially lead to loss of life. Identifying them is of essence. We propose a methodology and develop a tool-chain to systematically analyse and enumerate the attacks leading to safety violations. This is achieved by lazily combining threat modelling and safety analysis with formal verification and with attack graph analysis. We also identify the minimum sets of privileges that must be protected to preserve safety. We demonstrate the effectiveness of our methodology to discover threat scenarios by applying it to a Communication Based Train Control System. Our design choices emphasise compatibility with existing safety and security frameworks, whilst remaining agnostic to specific tools or attack graphs representations.

Autonomous driving is a safety critical application of sensing and decision-making technologies. Communication technologies extend the awareness capabilities of vehicles, beyond what is achievable with the on-board systems only. Nonetheless, issues typically related to wireless networking must be taken into account when designing safe and reliable autonomous systems. The aim of this work is to present a control algorithm and a communication paradigm over 5G networks for negotiating traffic junctions in urban areas. The proposed control framework has been shown to converge in a finite time and the supporting communication software has been designed with the objective of minimizing communication delays. At the same time, the underlying network guarantees reliability of the communication. The proposed framework has been successfully deployed and tested, in partnership with Ericsson AB, at the AstaZero proving ground in Goteborg, Sweden. In our experiments, three heterogeneous autonomous vehicles successfully drove through a 4-way intersection of 235 square meters in an urban scenario.