A word from the CiA Managing Director

Do you know the so-called Conway ‘law’: “.. organizations which design systems are constrained to produce designs which are copies of the communication structures of these organizations.” (“How do committees invent?” by Melvin E. Conway, article published in Datamation, April 1968).

Recently, Dr. Ken Tindell, working with the CiA member JK Energy, referenced this ‘law’ in a LinkedIn post: “Conway's law is the bane of my existence. I'm either talking to security people about real-time issues or talking to embedded real-time networking people about security issues. And in neither case do the issues I raise resonate much: security people don't know about watchdog or lock-step core fault resets, and networking people don't know about the subtle intricacies of replay attacks. This is why there are key agreement protocols that will freeze communication for 100 ms+ and there are cryptographic CAN messaging schemes that can be side-stepped by a theft device clipped to the bus. Time to repeal Conway's law.”

I have had similar experiences with Conway’s law where technical structures were related to human structures: Many engineers designing CAN-based automation systems implement communication rules as used between officer and soldier, master and slave (these terms should not more be used, because of non-inclusive terminology), or commander and responder. The CAN data link layer protocols themselves are more democratic. CANopen protocols keep some of this democratic communication regarding PDO (process data object) and SDO (service data object). CANopen nodes may send and consume PDOs or provide an SDO client to any other CANopen node, which implements a corresponding SDO server. There are few exceptions: NMT (network management) services are initiated by one dedicated CANopen node with NMT manager functionality, one TIME producer service for the global network time, and one SYNC producer service for coordinating the PDO transmission of different CANopen nodes. This is somehow similar to democratic meetings, where a chairperson opens and closes the meeting and schedules the breaks. Of course, you can do this also in a democratic discussion; however, this would cost time, which could be better used for discussions of the agenda topics.

I would like to go a step further: Engineers with an open-minded culture are able to develop communication technologies, which protect human rights in any respect.

Coming back to the cybersecure communication in real-time control networks. It is even more complicated, when there is additionally a functional-safe communication required. In this case, the functional-safe network is normally certified by a legal authority. You lose this certificate, when you change the hard-, firm-, or software. On the other hand, when a cybersecurity vulnerability is detected, you should immediately update your hard-, firm-, or software. This leads to a dilemma: To secure your communication, you lose the functional safety or you can secure the communication, because you do not want to lose the functional-safety certificate.

There might be additional conflicts between different sets of regulations such as the right-to-repair versus cybersecurity and functional safety.

As Dr. Ken Tindell stated, it is time to listen to other experts and to find together innovative solutions to make CAN-based networks safe and secure, not reducing the real-time capability. CiA has established the Interest Group (IG) safety and security, in order to develop solutions for CAN-based networks fulfilling all these requirements. We try to open our minds and to listen carefully to all experts.