Engineering Decision Dashboard
Product and cybersecurity architecture understanding package generated from Markdown-derived requirements.
Search
Last updated: 2026-06-29 11:49
RTRFQX Review TeamWorkspace
Engineering Decision Dashboard
Product and cybersecurity architecture understanding package generated from Markdown-derived requirements.
Confirmed Engineering Conclusions
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| ECA ECU product identity and AMT platform context | Confirmed | source document function statements; source document | Stabilizes review-board naming | Confirm final product designation/variant |
| Cybersecurity concept and evidence package are in scope | Confirmed | Cybersecurity and process requirements | Makes this an architecture/security baseline, not a brochure | Confirm approval workflow |
Inferred Conclusions
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| Secure diagnostics, update and key/certificate handling apply to the ECU | Inferred | UDS, flash/IVD and certificate/key requirements | Drives security services and trust-boundary design | Confirm exact allocation |
Customer-Confirmation Conclusions
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| SecOC/SDT-style protection is needed for selected data flows | Requires Confirmation | Secure communication requirements | Blocks final interface-security allocation | Customer must identify protected signals |
Architecture Risks
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Risk | Area | Impact | Mitigation / Next Step | Owner |
|---|---|---|---|---|
| Unconfirmed item boundary | Architecture | Asset, interface and TARA allocation can shift | Run item-definition workshop | OEM + Supplier |
| Unconfirmed SecOC/SDT scope | Interface | Vehicle-data authenticity/freshness cannot close | Map protected signals and freshness model | OEM |
Security Risks
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Risk | Area | Impact | Mitigation / Next Step | Owner |
|---|---|---|---|---|
| Unconfirmed diagnostic role model | Security | Privileged services may be under- or over-controlled | Define roles, services, certificates and lockout | OEM + Supplier |
| Unconfirmed update/key ownership | Security | Signing, rollback, PKI and HSM decisions remain open | Confirm update sequence, key hierarchy and HSM capability | OEM + Supplier |
Required Next Decisions
Open decisions only; confirmed conclusions are listed above.
This table is horizontally scrollable. Use the bottom scrollbar to view all columns.
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| Secure diagnostics, update and key/certificate handling apply to the ECU | Inferred | UDS, flash/IVD and certificate/key requirements | Drives security services and trust-boundary design | Confirm exact allocation |
| SecOC/SDT-style protection is needed for selected data flows | Requires Confirmation | Secure communication requirements | Blocks final interface-security allocation | Customer must identify protected signals |
Evidence
Detailed conclusion register
Engineering Decision Dashboard
Confirmed engineering conclusions
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| ECA ECU product identity and AMT platform context | Confirmed | source document function statements; source document | Stabilizes review-board naming | Confirm final product designation/variant |
| Cybersecurity concept and evidence package are in scope | Confirmed | Cybersecurity and process requirements | Makes this an architecture/security baseline, not a brochure | Confirm approval workflow |
Inferred conclusions
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| Secure diagnostics, update and key/certificate handling apply to the ECU | Inferred | UDS, flash/IVD and certificate/key requirements | Drives security services and trust-boundary design | Confirm exact allocation |
Customer-confirmation conclusions
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| SecOC/SDT-style protection is needed for selected data flows | Requires Confirmation | Secure communication requirements | Blocks final interface-security allocation | Customer must identify protected signals |
Architecture risks
| Risk | Area | Impact | Mitigation / Next Step | Owner |
|---|---|---|---|---|
| Unconfirmed item boundary | Architecture | Asset, interface and TARA allocation can shift | Run item-definition workshop | OEM + Supplier |
| Unconfirmed SecOC/SDT scope | Interface | Vehicle-data authenticity/freshness cannot close | Map protected signals and freshness model | OEM |
Security risks
| Risk | Area | Impact | Mitigation / Next Step | Owner |
|---|---|---|---|---|
| Unconfirmed diagnostic role model | Security | Privileged services may be under- or over-controlled | Define roles, services, certificates and lockout | OEM + Supplier |
| Unconfirmed update/key ownership | Security | Signing, rollback, PKI and HSM decisions remain open | Confirm update sequence, key hierarchy and HSM capability | OEM + Supplier |
Required next decisions
| Conclusion | Status | Evidence | Impact | Decision Needed |
|---|---|---|---|---|
| ECA ECU product identity and AMT platform context | Confirmed | source document function statements; source document | Stabilizes review-board naming | Confirm final product designation/variant |
| Cybersecurity concept and evidence package are in scope | Confirmed | Cybersecurity and process requirements | Makes this an architecture/security baseline, not a brochure | Confirm approval workflow |
| Secure diagnostics, update and key/certificate handling apply to the ECU | Inferred | UDS, flash/IVD and certificate/key requirements | Drives security services and trust-boundary design | Confirm exact allocation |
| SecOC/SDT-style protection is needed for selected data flows | Requires Confirmation | Secure communication requirements | Blocks final interface-security allocation | Customer must identify protected signals |
Detailed conclusion register
Working system: Electric Clutch Actuator (ECA) Control ECU - TRATON GW AMT Gearbox Platform. Conclusions are graded and traced to requirement evidence.
Confirmed by Requirements
- The ECU controls an electric clutch actuator via CAN and a 1kHz PWM wake-up signal, with closed-loop position control and error handling.
- Status: Confirmed
- Evidence basis: RFQX-3299216-1-0002; RFQX-3299216-1-0003; RFQX-3299216-1-0004; RFQX-3299216-1-0005; RFQX-3299216-1-0006; RFQX-3299216-1-0020; RFQX-3299216-1-0021; RFQX-3299216-1-0022 (sample: 8 of 225)
- Impact: Architecture, Interface
- A cybersecurity concept with risk-assessment input, control derivation, V&V evidence and OEM residual-risk approval is a mandatory deliverable.
- Status: Confirmed
- Evidence basis: RFQX-1001379436-P10-000-01-0003; RFQX-1001379436-P10-000-01-0005; RFQX-1001379436-P10-000-01-0008; RFQX-1001379436-P10-000-01-0011; RFQX-1001379436-P10-000-01-0012; RFQX-1001379436-P10-000-01-0013; RFQX-1001379436-P10-000-01-0014; RFQX-1001379436-P10-000-01-0015 (sample: 8 of 64)
- Impact: Process, Security
- UDS-based diagnostic access (including Authentication 0x29) is in scope for the ECU.
- Status: Confirmed
- Evidence basis: RFQX-3299216-1-0107; RFQX-3299216-1-0126; RFQX-3299216-1-0127; RFQX-CVS123-2-0005; RFQX-CVS123-2-0009; RFQX-CVS123-2-0010; RFQX-CVS123-2-0017; RFQX-CVS123-2-0023 (sample: 8 of 509)
- Impact: Security, Interface
Strongly Inferred
- Secure software update / flash with authenticity and integrity verification and bootloader state control is required.
- Status: Inferred
- Evidence basis: RFQX-3299216-1-0176; RFQX-CVS123-2-0001; RFQX-CVS123-2-0004; RFQX-CVS123-2-0023; RFQX-CVS123-2-0031; RFQX-CVS123-2-0054; RFQX-CVS123-2-0055; RFQX-CVS123-2-0062 (sample: 8 of 44)
- Impact: Architecture, Security
- Key and certificate handling (provisioning, validation, lifecycle) underpins authentication and secure communication.
- Status: Inferred
- Evidence basis: RFQX-1001379436-P10-000-01-0041; RFQX-1001379436-P10-000-01-0042; RFQX-CVS123-2-0090; RFQX-CVS123-2-0112; RFQX-CVS123-2-0113; RFQX-CVS123-2-0295; RFQX-CVS123-2-0296; RFQX-CVS124-0072 (sample: 8 of 125)
- Impact: Security, Interface
- Security-relevant vehicle data needs authenticity, integrity and freshness protection (SecOC/SDT-style).
- Status: Inferred
- Evidence basis: RFQX-CVS123-2-0241; RFQX-CVS31-0014; RFQX-CVS31-0015; RFQX-CVS32-0007; RFQX-CVS32-0009; RFQX-CVS32-0010; RFQX-CVS32-0011; RFQX-CVS32-0012 (sample: 8 of 196)
- Impact: Security, Interface
Requires Customer Confirmation
- Exact diagnostic role model, service list, lockout and rate-limiting behaviour.
- Status: Requires Confirmation
- Evidence basis: RFQX-3299216-1-0107; RFQX-3299216-1-0126; RFQX-3299216-1-0127; RFQX-CVS123-2-0005; RFQX-CVS123-2-0009; RFQX-CVS123-2-0010; RFQX-CVS123-2-0017; RFQX-CVS123-2-0023 (sample: 8 of 509)
- Impact: Security, Interface
- Update-sequence ownership, signing chain, rollback policy and backend responsibilities.
- Status: Requires Confirmation
- Evidence basis: RFQX-3299216-1-0176; RFQX-CVS123-2-0001; RFQX-CVS123-2-0004; RFQX-CVS123-2-0023; RFQX-CVS123-2-0031; RFQX-CVS123-2-0054; RFQX-CVS123-2-0055; RFQX-CVS123-2-0062 (sample: 8 of 44)
- Impact: Security, Process
- Key hierarchy, HSM/protected-storage capability, PKI ownership and certificate lifecycle.
- Status: Requires Confirmation
- Evidence basis: RFQX-1001379436-P10-000-01-0041; RFQX-1001379436-P10-000-01-0042; RFQX-CVS123-2-0090; RFQX-CVS123-2-0112; RFQX-CVS123-2-0113; RFQX-CVS123-2-0295; RFQX-CVS123-2-0296; RFQX-CVS124-0072 (sample: 8 of 125)
- Impact: Security, Architecture
- Which signals require SecOC/SDT, the protection profile, and the ECU boundary/item definition for TARA.
- Status: Requires Confirmation
- Evidence basis: RFQX-CVS123-2-0241; RFQX-CVS31-0014; RFQX-CVS31-0015; RFQX-CVS32-0007; RFQX-CVS32-0009; RFQX-CVS32-0010; RFQX-CVS32-0011; RFQX-CVS32-0012 (sample: 8 of 196)
- Impact: Security, Architecture
Main Architecture Risks
- The ECU item boundary and variant scope are not finally confirmed, so interface and asset allocation remain provisional.
- Update/bootloader and application state ownership is split across supplier, backend and OEM and is not yet allocated.
- Hardware security capability (HSM/protected storage) is assumed but not confirmed, affecting key-protection design.
Main Security Risks
- Diagnostics can unlock privileged functions; without a confirmed role model the access-control design cannot be finalized.
- A weak or unconfirmed update signing chain would allow attacker-controlled software onto the ECU.
- Unallocated SecOC/SDT scope leaves vehicle-data authenticity and freshness undefined.
Recommended Next Actions
- Run an item-definition and diagnostic-role workshop with the customer to close the top open decisions.
- Confirm the secure-update architecture (signing, rollback, ownership) and key/PKI model.
- Confirm SecOC/SDT signal scope and protection profile, then complete TARA and update traceability with approved decisions.