Questions concerning cyber security amendments for approvals of STU submitted by the expert from Japan that address timing of working document submission to GRVA, whether Part II components may include certificated base vehicle equipment under UN R155 multi-stage categorization, whether STU definition includes ECUs within base vehicle E/E architecture, examination of use cases and implementation challenges, consistency of applicant terminology between Section 3.3.1 and Section 7.6, whether approval authorities for Parts I, II, and III must be identical, clarification of end of support period requirements in para. 2.7(b), installation agreement requirements in para. 5.1.2.1(d), and whether total Cyber Security Risk Assessment Process for whole vehicle with other equipment than ESAs is necessary after ESA installation under para. 7.4.10.

Proposal to amend para. 7.2.1.2.2. to delete, in cases where RXSWINs are not held on the vehicle, the requirement that the manufacturer shall declare the software version(s) of the vehicle or single ECUs with the connection to the relevant type approvals to the Approval Authority and that this declaration shall be updated each time the declared software version(s) is updated, and add that the link between the software version(s) and the RXSWINs shall be declared.

Japan submitted comments on RXSWIN assignment at the 38th CS/OTA IWG. Q.1 asks whether, when a type approval is extended from UN R156-00 to UN R156-01, RXSWIN may be assigned at extension time, and if a UN Regulation refers to RE.3 Annex 7 through a supplementary amendment after UN R156-01 transitional provisions become applicable, whether RXSWIN is assigned at that time. Q.2 asks whether Approval Authorities other than the Authority granting approval are expected to have access to the OEM’s Auditable Register, as access information appears provided only to the Approval Authority concerned through paragraph 9.5.2. Q.3 asks whether software updates affecting type approval can be performed under Regulations that do not reference RE.3 Annex 7.

Comments concerning the implementation of the following paragraph:
7.3.7. The vehicle manufacturer shall implement measures for the vehicle type to:

1. detect and prevent cyber-attacks against vehicles of the vehicle type;
2. support the monitoring capability of the vehicle manufacturer with regards to detecting threats, vulnerabilities and cyber-attacks relevant to the vehicle type;
3. provide data forensic capability to enable analysis of attempted or successful cyberattacks.

Japan input for Annex 1 “List of threats and corresponding principles and mitigations” of the proposed paper on cybersecurity recommendations.

EU/JPN CO2/FC COP Procedures

Proposal to clarify that dipped-beam headlamps may not be switched OFF manually when they have been switched ON automatically according to paragraph 6.2.7.5., except in the case specified in paragraph 6.2.7.5.1. Manual switching OFF of headlamps at night should be limited to exceptional cases specified in the regulation. This proposal clarifies that daytime running lamps shall not be switched OFF except as specified in paragraphs 6.19.7.1. to 6.19.7.6.

Task force draft text based upon the original proposal from Japan.

Comments as revised during the 15th TFRWS session.