Modeling and Quantification of Cyber-to-Safety Impact Propagation in Railway Signalling Systems

The digitalization of safety-critical systems, particularly in the railway sector, increases exposure to cyber threats such as jamming and spoofing, which can escalate into hazardous operational failures. Although current standards acknowledge the interdependence between safety and security, they lack quantitative methods to assess how cyber attacks propagate into safety degradation. This paper presents the Security Safety Stochastic Game Framework (S3G), a two layer quantitative model that links cybersecurity decisions with safety performance in complex cyber physical systems. The inner stochastic game captures dynamic attacker-defender interactions, while the outer Stackelberg layer determines the defender configuration, redundancy, transmission power, etc., that minimizes worst-case safety loss. To demonstrate its effectiveness, the framework is instantiated on the ERTMS/ETCS Level 2 signalling architecture. Results show that S3G identifies configurations that enhance safety resilience, mitigate integrity compromise, and accelerate recovery from cyber disruptions, while maintaining acceptable operational overhead. This confirms the relevance of integrating safety semantics into cybersecurity optimization to achieve resilient equilibria in safety-critical domains.