Jean-Baptiste Légal

Thierry Meyer

Antonia Csillik

Pierre-André Nicolas

Goal priming, public transportation habit and

come

Introduction

Among the most habitual overt behaviors occurring recurrently in a stable context, transportation would probably be ranked in the top 10, along with eating, working, and sleeping. Indeed, using a travel mode is one of the most habitual behaviors people routinely perform. Imagine you just got a new job. In order to go to your new office for the first time, you have to choose a travel mode (own car, car sharing, bus, bicycle, railway, etc.). In that situation, you can either scrutinize available modes of transportation as a function of one or more attributes (distance, travel frequency, monetary cost, speed, comfort, social reputation, risk level, etc.) or even imitate the majority's choice, follow the advice of your neighbor, or be persuaded by the advertising campaign of a public transportation company. After this deliberative phase, perhaps you decide to use your car to reach your workplace. As you execute this daily behavior, the chosen transportation mode becomes a firmly established habit, leading you to quickly and easily select this transportation mode rather than any other. In the end, a simple smell of coffee in the morning may become a sufficient cue to remind you that it is time to start your car and drive to your office.

Goal priming, public transportation habit and travel mode selection: The moderating role of trait mindfulness Jean-Baptiste Légal, Thierry Meyer, Antonia Csillik, Pierre-André Nicolas

Habits and automaticity

If habits in transportation have been largely investigated, the concept of habit stems from the history of psychological science. Habits can be defined as ''learned dispositions to repeat past responses. They are triggered by features of the context that have covaried frequently with past performance, including performance places, preceding actions in a sequence, and particular people. Context activates habitual responses directly, without the mediation of goal states" (Wood & Neal, 2007, p. 843). In short, habits refer to near-automatic choices or behaviors in stable contexts [START_REF] Neal | Habits: A repeat performance[END_REF][START_REF] Neal | The pull of the past: When do habits persist despite conflict with motives?[END_REF][START_REF] Ouellette | Habit and intention in everyday life: The multiple process by which past behavior predicts future behavior[END_REF][START_REF] Verplanken | Habit: From overt action to mental events[END_REF][START_REF] Verplanken | Habit, attitude, and planned behaviour: Is habit an empty construct or an interesting case of goal-directed automaticity[END_REF][START_REF] Wood | A new look at habits and the habit-goal interface[END_REF].

From a decision-making point of view, habits have both benefits and pitfalls [START_REF] Neal | How do people adhere to goals when willpower is low? The profits (and pitfalls) of strong habits[END_REF]. First of all, once they are well established, using habits requires few cognitive resources. Indeed, literature about habits in transportation (Aarts, Verplanken, & van Knippenberg, 1997;[START_REF] Banister | The influence of habit formation on modal choice -A Heuristic model[END_REF][START_REF] Chen | Habitual or reasoned? Using the theory of planned behavior, technology acceptance model, and habit to examine switching intentions toward public transit[END_REF][START_REF] Fujii | Role and acquisition of car use habits[END_REF][START_REF] Gärling | Habitual travel choice[END_REF][START_REF] Gärling | Empirical tests of a model of determinants of script-based driving choice[END_REF][START_REF] Joireman | An interdependence analysis of commuting decisions[END_REF]Verplanken, Aarts, & van Knippenberg, 1997;[START_REF] Verplanken | Context change and travel mode choice: Combining the habit discontinuity and self-activation hypotheses[END_REF] broadly documents that the choice of a transport mode required few cognitive resources when people repeatedly used a mode of transportation in a given context. If you take your car every day from your home garage to your workplace, you don't weigh the pros and cons of travel modes every morning, unless an important change occurs in the context that focuses your attention on your choice. Conversely, a stable context and a satisfactory cost/benefit ratio lead to a scripted decision-making mode. Habitual users also need fewer attributes to decide, and are more resistant to other interfering tasks at hand [START_REF] Aarts | Habit and information use in travel mode choices[END_REF]. Another self-regulatory benefit of habit is that people can use their free mind space to concentrate on other issues. For instance, before and/or during their transportation time, people can plan their next professional meeting and, in a global fashion, can be more open to their present environment. At odds, habits have some pitfalls when their presence leads people to miss the benefits of new opportunities. Habits have been successfully introduced in social cognitive models of prediction of behavior, as they make a specific contribution to behavioral intentions or behaviors [START_REF] Chen | Habitual or reasoned? Using the theory of planned behavior, technology acceptance model, and habit to examine switching intentions toward public transit[END_REF]. Nevertheless, travel choice remains a deliberate decision when people have to change their current habits, as in the context of an intervention that persuades them to change [START_REF] Bamberg | Choice of travel mode in the theory of planned behavior: The roles of past behavior, habit, and reasoned action[END_REF].

From a cognitive point of view, people learn, from repeated choices, to connect a place (i.e., where to go) and a travel mode (i.e., how to reach this place). In other words, through time and experience, people develop strong links in memory between places and travel modes that allow them to reach these places. By means of associative networks, people can rapidly decide on a transportation mode at a low cognitive cost. For habitual travelers, as place-travel modes' associations are very accessible in memory, a place, a goal, or an activity can automatically trigger the choice of a given travel mode. Other travel options are not scrutinized.

Experimental demonstration of automaticity in habits is substantially grounded on the effect of nonconscious primes on decision-making and behavior (e.g., [START_REF] Bargh | What have we been priming all these years? On the development, mechanisms, and ecology of nonconscious social behavior[END_REF][START_REF] Bargh | Our unconscious mind[END_REF]. In the case of daily behaviors, [START_REF] Neal | How do habits guide behavior? Perceived and actual triggers of habits in daily life[END_REF] observed that priming places leads individuals to quickly recognize words related to an activity they regularly perform in these places. For example, priming the word ''forest" led participants habitually exercising in woody areas to shorter recognition times for the word ''running". This was not the case with more abstract words, even when they were related to the ultimate goal of the behavior (in this example, ''to be in good health"). In the transportation domain, as far as we know, only Aarts andDijksterhuis (2000a, 2000b) provided a demonstration of automaticity in decision-making among habitual users of a transportation mode. They observed that students in the Netherlands, where cycling is a widely used transportation mode, responded faster to bicycle-related words upon the presentation of the word ''university" when the goal ''to attend lectures at the university" was previously nonconsciously primed. The magnitude of this effect increased with habit strength, measured as the frequency of use of the bicycle to reach target locations (e.g., ''university"). In other words, habit strength moderates the effect of nonconscious goal priming.

In sum, previous research indicated that when a means is strongly associated with a goal, the mere activation of a place or a goal activates the corresponding habitual means' mental representation that, in turn, triggers the behavior. One might wonder if individual differences occur in such effortless or automatic effects of habits. Moderation by individual variables is plausible when measurement goes beyond questions focused on explicit and reasoned intentions [START_REF] Conner | Relations between implicit and explicit measures of attitudes and measures of behavior: evidence of moderation by individual difference variables[END_REF]. Many choices are driven by contextual cues, but we are more or less able to purposely use these cues to pursue our current goals. As research on mindfulness (e.g., Brown, Creswell, & Ryan, 2015;[START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF] points out individual differences in the way people trade off between their current goal(s) and their attention to environmental cues, we will focus here on this concept as a source of differences in the ability to process and utilize contextual cues.

Mindfulness and decision making

In the framework of Self-Determination Theory [START_REF] Deci | Intrinsic motivation and self-determination in human behavior[END_REF], [START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF] suggest that mindfulness covers a specific sense of situational awareness and openness to experience. More precisely, Brown and Ryan (2003, p. 822) define mindfulness as ''an open or receptive attention to and awareness of ongoing events and experience"; in other words, individuals' ability for ''being attentive to and aware of what is taking place in the present". Individuals in the general population reliably differ in their propensity to be mindful (e.g., [START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF][START_REF] Carlson | Validation of the Mindful Attention Awareness Scale in a cancer population[END_REF]. Two forms of mindfulness have been operationalized. Dispositional mindfulness refers to stable individual differences concerning average levels of mindfulness across time; whereas, state mindfulness concerns systematic fluctuations above and below a person's average level of mindfulness. Although dispositional and state effects of mindfulness on experience are theorized as separate constructs, individuals scoring higher on dispositional mindfulness are more likely to experience higher levels of momentary mindfulness over time [START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF]. Among the many ways in which mindfulness is operationalized [START_REF] Davidson | Empirical explorations of mindfulness: Conceptual and methodological conundrums[END_REF], we will focus on dispositional mindfulness. Dispositional mindfulness has demonstrated both conceptual and empirical worth in recent years, and has been associated with a variety of positive outcomes. Empirical research showed that, due to the tendency to evaluate future situations in non-threatening ways, dispositional mindfulness predicts higher well-being and more adaptive stress processing. Furthermore, mindfulness is positively associated with openness to experience, attention, and internal state awareness. Conversely, it is negatively related to social anxiety [START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF]. Mindfulness may also promote more adaptive cognitive appraisals, as it involves a greater willingness or ability to process internal stimuli as they occur, and it fosters more objectively informed responding [START_REF] Weinstein | A multi-method examination of the effects of mindfulness on stress attribution, coping, and emotional well-being[END_REF]. A short training in mindfulness (e.g., concentration and breathing exercise) is sufficient to increase the quality of decision making. For example, mindful people are less prone to the sunk cost bias (the tendency to overestimate past unrewarding investments in future decision making; [START_REF] Hafenbrack | Debiasing the mind through meditation: Mindfulness and the sunk-cost bias[END_REF].

To date, surprisingly, effects of dispositional mindfulness on habits and more generally, cue driven behaviors, remain underexplored. Studies analyzed the way mindfulness moderates the link between behavior and a more or less deliberate motivation. For instance, mindfulness can provide unique predictions in the framework of dual processes models of thinking [START_REF] Strack | Reflective and impulsive determinants of social behavior[END_REF]) that focus on the interplay between a reflective (or propositional) and an impulsive (associative) mode of thinking. [START_REF] Chatzisarantis | Mindfulness and the intention behavior relationship within the theory of planned behavior[END_REF] also found that deliberate intentions predicted physical activity among mindful individuals, but not among less mindful participants. Interestingly, they concluded that the mindfulness construct catches specific effects that were not confounding with habits. As mindfulness is linked with a greater sense of autonomy and control, it was suspected that mindful individuals could be less responsive to priming manipulation than les mindfull individuals. [START_REF] Radel | Subliminal priming of motivational orientation in educational settings: Effect on academic performance moderated by mindfulness[END_REF], using a proxy of mindfulness measurement, found that priming a learning goal (vs. a performance goal) increased performance -as predicted by goal achievement literature -but only among less mindful participants. This interaction between students' level of dispositional mindfulness and priming condi-tions indicated that, whereas the less mindful participants were affected by priming, the more mindful tended to be immune to the manipulation. [START_REF] Levesque | Mindfulness as a moderator of the effect of implicit motivational self-concept on day-to-day behavioural motivation[END_REF] observed a similar pattern about an implicit motivation to autonomy that was manipulated through an Implicit Association Test (IAT; [START_REF] Greenwald | Attitudinal dissociation: What does it mean?[END_REF]. Mindfulness, focusing on implicit awareness, also moderates the link between a nonconscious prime and food choice (fruit vs. chocolate bar). In sum, literature provides evidence of a moderating role of mindfulness in implicit and explicit decision-making, and we think that mindfulness could be useful to document, explain, and predict individual differences in habits.

Present research

The objective of the present study was twofold. First, we attempted to replicate results concerning priming effects in travel mode selection in habitual users (Aarts & Dijksterhuis, 2000a, 2000b) and extend them to another transportation mode. We think that a process-based replication is useful considering the complexity of the transportation domain. Transportation means are very dissimilar as a function of multiple attributes (ownership, availability, complexity, cost, risk perception, social norms, etc.) that can interfere with the habit process. For example, as ownership is associated with the self, it could be expected that ownership of a travel means increases the accessibility of this very travel means in memory (Wood & Neal, 2009). So, a replication with a public transportation mode (subway) would broaden the evidence of automaticity-based selection of transportation modes among habitual users. Second, and most importantly, our aim was to investigate to what extent effortless or automatic effects of habits and priming are susceptible in individual differences. If habitual choices are driven by subtle contextual cues, we may be more or less able to purposely use these cues to pursue our current goals. That is why we investigated whether or not dispositional mindfulness (as a source of individual difference in awareness and attention) could moderate the direct association between cues and travel mode choice. For these purposes, we observed how more or less mindful and habitual users of a subway line select a transportation mode after being nonconsciously primed with a proximal travel goal that could be reached by subway.

As stated earlier, day-to-day repetition of behaviors in a stable context has a cognitive consequence: cues in the environment become sufficient to trigger decisions without extensive deliberation. In the transportation domain, and especially modal choice, habits are firmly established. If people are conscious of the result of their choice, they are not necessarily aware of the processes underlying their decision [START_REF] Bargh | Our unconscious mind[END_REF]. Precisely, the processing of a contextual cue (e.g., a concrete travel goal) can either follow a deliberative path with a conscious travel goal that drives modal choice; or a more direct, associative, or habitual path that does not need to be mediated by a conscious goal. For habitual users of a travel mode, the accessibility of a cue (e.g., the name of a place, an activity, or a goal) is sufficient to elicit a regular means of travel. Conversely, people with no travel habits need to associate the cue and a deliberate travel goal in order to select and adopt a travel mode. From this point of view, habit strength should be a good predictor of a less deliberative mode of thinking. According to previous research (e.g., Aarts & Dijksterhuis, 2000a, 2000b), having a place or an activity in mind is sufficient to find and select a travel mode. Thus, priming a travel goal that is firmly linked with a transportation mode should speed the decision to select the habitual travel mode.

We also posit that people can make transportation choices in a more or less mindful way of thinking. As mindfulness refers to the degree to which a person is receptive to present experience, participants with higher levels of mindfulness should take more advantage of cues present in their environment to decide among transportation options. Specifically, since the association between a place and a travel mode is firmly established among habitual users, we hypothesize that habitual users of a trans-portation means, whatever their level of dispositional mindfulness, would be more able to quickly decide on a travel mode as a function of an accessible contextual cue. For them, a high level of mindfulness would only marginally facilitate response to con-textual cues. On the contrary, non-habitual users should be more dependent on their level of mindfulness. As less mindful indi-viduals are supposed to have a lower ability to purposefully process mental or environmental events, a low level of mindfulness could puzzle over the link between available environmental cues and travel mode. In other words, we assume that a low level of mindfulness should hinder the use of the associations between cues and transport means in the decision-making process. Con-versely, non-habitual users with a high level of mindfulness should benefit more from useful cues in the environment.

In sum, this study tested the effect of priming travel goals to specific places as a function of habit strength and level of mindfulness on the time subsequently required to decide whether or not a travel mode fits with a given place or activity. Following previous observations (Aarts & Dijksterhuis, 2000a, 2000b), priming should shorten response times more among habitual users than non-habitual users (H1: interaction between priming and habit strength). We also expected that mindfulness level would moderate this interaction (H2). More precisely, the interaction between priming and habit strength should only be observed among less mindful users. One consequence of this expected pattern is that the benefit of habits in decision-making should be greater for people with a low level of mindfulness.

Material and method

Participants and context

Undergraduate students (N = 86; M age = 20; 80% women) were recruited and filled out a consent form. They received course credits for their participation. The participants studied at Paris Ouest University (France). The area's complex transportation network offers multiple travel modes that can be chosen by users. Public transportation to the university is afforded by a large station (more than 60 000 passengers/day) that combines a suburban subway station and a railway line. The university can also be reached through several bus lines as well as by using main and secondary roads by car, motorcycle and/or cycle, or on foot.

Variables

Transportation habits

In terms of measurement, habits are generally considered as reports of frequent -ordinary daily -behaviors in stable contexts. Beyond self-reports of past behavior, habits can be measured not only as overt actions, but also as mental events (i.e., a subjective experience that is associated with frequent and well-learned behaviors; [START_REF] Verplanken | Habit: From overt action to mental events[END_REF]. A few weeks before the experiment, we measured transportation habits during a mass testing session. We assessed habits through the conjunction of reported past behavior's frequency (number of days of subway use) and stability of context, assessed by subjective experience of frequency [START_REF] Verplanken | Reflections on past behavior: A self-report index of habit strength[END_REF]. Participants reported: (1) how many times a week they used the subway (using an open-ended question) and (2) their agreement with the fact they use the subway on a day-to-day basis (using a 5-point Likert scale ranging from 1: Totally disagree to 5: Totally agree). We combined these two measures (r = .51, p < .01) to create a habit score. We used a median split procedure to separate habitual vs. non-habitual users of the subway. Habitual users reported using the subway about 11 times a week (M = 10.5, SD = 4.9) whereas non-habitual users reported using it about 4 times a week (M = 3.7, SD = 1.5), F(1, 82) = 74.2, p < .0001, g 2 = .48.

Priming

A Scrambled Sentence Task (SST; e.g., [START_REF] Chartrand | Automatic activation of impression formation and memorization goals: Nonconcious goal priming reproduces effects of explicit task instructions[END_REF][START_REF] Srull | The role of category accessibility in the interpretation of information about persons: Some determinants and implications[END_REF] was used to prime concrete travel goals. In the goal-priming condition, all the sentences included a place that was associated with the use of the subway line (e.g., going to the university). Processing those sentences thus activated this travel means (i.e., subway) in the memory (Aarts & Dijksterhuis, 2000b). In the control condition, sentences to unscramble were about an activity that was neutral in regard to travelling and using the subway (e.g., playing the piano).

Mindfulness

Participants filled out the Mindful Attention Awareness Scale (MAAS; [START_REF] Brown | The benefits of being present: Mindfulness and its role in psychological well-Being[END_REF] as a part of a mass testing session. The MAAS is a 15-item scale, assessing the frequency of open attention to, and awareness of, internal states and external events in the present, using both general and situation-specific statements (e.g., I find it difficult to stay focused on what's happening in the present). The MAAS measures mindfulness by asking respondents to rate the frequency with which their day-to-day consciousness reflects this quality. Higher scores on the scale indicate greater mindfulness. The MAAS has been extensively validated and used in a number of previous studies [START_REF] Brown | Mindfulness: Theoretical foundations and evidence for its salutary effects[END_REF]. In this research, we used an original French translation [START_REF] Csillik | The Mindful Attention Awareness Scale (MAAS) French validation: convergent and divergent validity[END_REF] that replicated the original one-factor structure.

Procedure

When arriving at the lab, participants were informed that they would participate in two unrelated studies. The first one was presented as a language test, and the second one as a survey about travel preferences. In the first part, participants were randomly handed one version of the scrambled sentence task (place-priming version or control version) in which they had to arrange words given in a random order to build sentences. After completing this task, participants moved on to the travel preferences study that consisted of a computer-driven task adapted from Aarts and Dijksterhuis (2000b). In this task, participants were presented with 5 target places (university, Australia, shopping center, library, and airport) and had to decide as quickly as possible if the travel mode displayed on the screen (subway, bicycle, plane, bus, or pedestrian) was appropriate or not to reach the place. Pre-test indicated that among the 5 concrete travel goals, 3 had a strong subjective association with the use of the subway line (airport, university, and shopping center). After 5 training trials, participants completed 25 test trials in which the 5 places were randomly assigned to each of the 5 travel modes. Decision times were recorded (in milliseconds). Finally, participants completed a funneled debriefing questionnaire [START_REF] Bargh | The mind in the middle: A practical guide to priming and automaticity research[END_REF] in order to probe the detection of a link between the studies by participants, as well as any potential influence of the first task on the second one. No participants guessed the link between the scrambled sentence task and the travel preferences study.

Results

We conducted a 2 Â 2 mixed analysis of covariance (ANCOVA) with Priming and Habits, respectively, as manipulated and observed categorical predictors. Z-standardized MAAS scores served as a quantitative predictor [START_REF] Aiken | Multiple regression: Testing and interpreting interactions[END_REF] in a full factorial design. Response times to the three concrete travel goals (airport, university, and shopping center) were introduced as a within-subject factor (Target).

First, we analyzed the data for the three places considered altogether (see Fig. 1). Response times were shorter for primed participants (M = 1285 ms, SD = 424 ms) than for participants in the control condition (M = 1123 ms, SD = 425 ms), F(1, 78) = 6.2, p = .016, g 2 = .073. Habitual users of the subway line displayed shorter response times (M = 1086 ms, SD = 60 ms) com- pared to non-habitual users (M = 1293 ms, SD = 59 ms), F(1, 78) = 2.9, p = .094, g 2 = .035. Level of mindfulness was negatively but not significantly related to response times F(1, 78) = 2.76, p = .11, g 2 =.033. Interaction between Priming and Habit, F (1, 78) = 2.9, p = .045, g 2 = .05, indicated that only habitual users were influenced by the priming manipulation (Scheffé post hoc test, p = .032). The Priming  Mindfulness  Habit interaction, F(1, 78) = 6.00, p = .017, g 2 = .072, pointed out that the priming effect was moderated by mindfulness when habit strength was low. Priming induced shorter response times in participants having a high score on the mindfulness scale, but increased response times among participants with a low score on mindfulness. When habit strength was high, goal priming led to shorter response times, no matter what the mindfulness score was. The same pattern of interaction was observed when habit was introduced in the model as a continuous variable rather than a dichotomous variable, F(1, 78) = 9.8, p < .0025, g 2 = .11.

We also conducted two separate ANOVAs, respectively for low and high levels of mindfulness. For those demonstrating low levels of mindfulness, the interaction between habit and goal priming was significant, F(1, 36) = 11.4, p < .002, g 2 = .24.

Travel goal priming decreased the speed of response to subway when habit was strong (post hoc Scheffé, p < .022), but not when habit was weak (post hoc Scheffé, p < .50). For those demonstrating high levels of mindfulness, habits and priming contributed as main effects, respectively F(1, 42) = 2.1, p < .051 and F(1, 42) = 2.9, p < . 099. There were no interactions between factors. results indicated that the previous observations were less significant for University compared to the other places (longer response times). To illustrate this pattern, we performed separate ANOVAs for each place. For participants with a low mindfulness score, the interaction between Habits and Priming remained significant for Airport (F(1, 78) = 6.72, p = .011, g 2 = .079) and Shopping Center (F(1, 78) = 5.96, p = .017, g 2 = .071), and was marginally significant for University (F(1, 78) = 3.42, p = .065, g 2 = .042).

Discussion

From an ecological point of view, our laboratory task captures decisions in a specific environment (a Parisian university and its transportation network), and for a specific travel mode (a subway line) and a specific task (deciding on a travel mode). Corroborating internal validity of the habit construct as an automatic mode of action control, a concrete travel goal (i.e., where to go) can automatically activate transportation means (i.e., how to travel) among habitual users. Only habitual users of a public transportation means needed less time to select this travel mode, as the transportation goal was nonconsciously primed comparing to a condition with no prime (H1). Globally, and even the measurement of habit strength is slightly different from previous observations (Aarts & Dijksterhuis, 2000a, 2000b), the replication of this pattern from a domain (private transportation: bicycle) to another domain (public transportation: subway) ensures the robustness of the effect and of underlying processes. Beyond adding a small piece of external validity, our main purpose was to explore the moderating role of dispositional mindfulness (as measured by MAAS), considering the interaction between travel goal priming and habit strength. The expected interaction between habit strength and priming was found only at low levels of mindfulness. At high levels of mindfulness, habits and travel goal contributed additively to decision making, as if participants were able to separate previous habits from a contextual inner cue (priming manipulation). Thus, the three-way interaction hypothesis is confirmed (H2). Considering the speed of decision for a travel mode, habits appear to benefit more to less mindful participants than to mindful participants. For participants with low levels of mindfulness, habits compensate the disturbing effect of nonconscious primes. As observed by [START_REF] Neal | How do people adhere to goals when willpower is low? The profits (and pitfalls) of strong habits[END_REF] in a depletion of self-control framework, habits can improve goal adherence when self-control is low. As they indicate that habits follow different paths as a function of dispositional mindfulness, our results confirm the interest of the mindfulness construct to explore the flexibility of the habit processes. These results also contribute to the exploration of the processes of automaticity in habits, which are far from being fully understood [START_REF] Wood | Habits in dual process models[END_REF].

Limitations and perspectives

Further studies are needed to explore the process of decision making in habitual context in regards of mindfulness. For instance, do people with a high level of mindfulness develop habits earlier compared to people with a low level of mindfulness? In this research, we considered mindfulness a trait. Yet, mindfulness can change within individuals as a function of the task, moment, age, or the learning of meditation techniques [START_REF] Davidson | Empirical explorations of mindfulness: Conceptual and methodological conundrums[END_REF]. Even if further research is needed to explore this issue, we expect that changes in mindfulness within people would result in the same pattern of results as in the current study. Beyond mindfulness, related concepts such as mind wandering [START_REF] Mrazek | Mindfulness and mind-wandering: Finding convergence through opposing constructs[END_REF][START_REF] Mrazek | Mindfulness training improves working memory capacity and GRE performance while reducing mind wandering[END_REF] should also be of interest. As travel mode becomes a firmly grounded habit based on a day-to-day behavioral repetition, modal change is a very difficult issue for policy makers [START_REF] Gärling | Habitual travel choice[END_REF]. From this point of view, habits have benefits, but also pitfalls when they lead people to miss the benefits of new opportunities. Indeed, the dark side of habits is to sustain inaction, because people don't consider other available options [START_REF] Gifford | The dragons of inaction: Psychological barriers that limit climate change mitigation and adaptation[END_REF], or they even fall in lapses when they maintain old habits even when having in mind a new conscious goal [START_REF] Reason | Absent minded? The psychology of mental lapses and everyday errors[END_REF]. Interventions focus either on maintaining good habits or changing bad habits. Following our results, such intervention may consider habit as a construct where individual differences in decision making matter. From this point of view, mindfulness could be a barrier to change, as it raises habits; but also an opportunity for change, as mindful people are more able to resist impulsive decisions and use the present information when this information is congruent with their present goal. Behavioral interventions based on minor changes in the proximal context have gained popularity, with the promise to improve decision making beyond deliberated reasoning [START_REF] Thaler | Nudge: Improving decisions about health, wealth, and happiness[END_REF]. Our results emphasize the need to better understand individual differences in near-automatic decision-making processes. Indeed, subtle cues or minor changes in the environment did not benefit all participants, but only the ones who already had habits in place, and the ones with a high level of mindfulness. Badly designed cues could impair decision making among people with no habits and a low level of mindfulness (i.e., people who are less able to adjust their attention to their current environment for purposeful action). Recognizing that many people experience difficulties in focusing their attention on congruent cues could prevent paradoxical effects of policy interventions. Nevertheless, travel choice remains a deliberate decision when people have to change their current habits, as in the context of an intervention that persuades them to change [START_REF] Bamberg | Choice of travel mode in the theory of planned behavior: The roles of past behavior, habit, and reasoned action[END_REF] or an unplanned change in the decision framework. For instance, a major increase in gas price could make alternative transportation options more attractive than your car. In such a disrupting case, you could be more aware of a discrepancy between your car-use habit and your personal preference for car, your financial needs or your pro-environmental values [START_REF] Verplanken | Context change and travel mode choice: Combining the habit discontinuity and self-activation hypotheses[END_REF]. Therefore, exploring the role of dispositional mindfulness at more deliberative levels of decision making would be useful. Finally, interventions focusing on metacognitive insight about one's automatic response to transportation choice could be explored. The extensive literature about change in mindfulness (Brown et al., 2015) could open interesting paths for changing or maintaining habits in the real-world context.

Fig. 1 .

 1 Fig. 1. Response times (in ms) as a function of goal priming, habit strength and mindfulness score (regression lines).


Ph.D Andreas Erik Riel

Ph.D.; Christian Kreiner

Ph.D Richard Messnarz

Alexander Much

An architectural approach to the integration of safety and security requirements in smart products and systems design

Keywords: design, integration, safety design, integration, safety

HAL is

Introduction

Smart products and modern digital manufacturing systems are characterised by their integration in networks, most notably the Internet of Things (IoT) and/or Industrial Internet of Things (IIoT). Such cyber-physical systems (CPS) are increasingly taking over control of essential value-added functions which are often safety-critical, i.e. any failures linked to these functions might harm human health. This leads to the necessity of taking functional safety into account in the very design of these systems and the infrastructure they depend on. At the same time, their integration in integrated technology (IT) networks exposes CPS to cybersecurity risks, i.e. malicious intrusions aiming at modifying the intended behaviour of the network and/or the linked devices.

While not every secure system is necessarily safety-critical, the opposite always holds true: safety-critical systems have to be secure as well, otherwise the built-in safety features might be compromised by intruders. In several industry sectors, though, functional safety, cybersecurity and related standards have evolved separately from each other as their treatment in design requires very special knowledge. This paper uses the example of an automotive electric power steering system (EPS) to propose a systematic approach to integrating functional safety and cybersecurity in the early design based on Axiomatic Design (AD) [START_REF] Suh | The Principles of Design[END_REF] and Signal Flow Analysis (SFA) [START_REF] Abrahams | Signal Flow Analysis[END_REF]. Section 2 explains the context, the research objectives and methodology. Section 3 introduces essential related work in the automotive domain. Section 4 illustrates an integrated approach to safety and cybersecurity requirements elicitation based on AD and SFA applied to the EPS. Section 5 shows the integration of this concept in the three most dominant automotive development standards through a framework. Based on this, section 6 suggests a core element for the extension of these standards to also cover requirements linked to the cyberinfrastructure. Finally, section 7 concludes with a summary of this paper's key contributions and an outlook.

Target and methodology

Designing CPS increasingly requires integrated design methods [START_REF] Tichkiewitch | Methodology and product model for integrated design using a multiviews system[END_REF] due to the high degree of dependability of these CPS in terms of their functional safety, cybersecurity, reliability, availability, integrity, maintainability and other essential system properties [START_REF] Ghemraoui | Design method for systematic safety integration[END_REF]. We have published our results of the application of integrated design methods to the integration of both functional safety and cybersecurity requirements of automotive embedded systems essentially based on the hardware-software-interface (HSI) specification in [START_REF] Riel | Integrated design for tackling safety and security challenges of smart products and digital manufacturing[END_REF]. In this paper, we build on this work in order to investigate how to use SFA in combination with AD in order to integrate requirements to functional safety and cybersecurity, as well as requirements linked to the cyber-infrastructure in the design of CPS. We use AD in order to enable design complexity reduction on system architecture level, while deploying SFA for the identification of the key functional requirements (FR) that are linked to the product and the larger context of the latter's cyberinfrastructure. In order to assure the practical applicability of our approach, we align our methodology with the systematic integration of current and upcoming functional safety and cybersecurity design standards in a leading industry domain.

Essential related work in the automotive context

CPS are considered the most important driver for innovation in the automotive domain as they are the enablers of new and improved functionalities such as steer-and brake-by-wire and advanced driver assistance systems (ADAS) leading towards the autonomous vehicle. Functional safety development aspects are currently addressed by the ISO 26262 [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF] which is based on the ISO 61508, the corresponding standard for industrial automation. There is no comparable standard for automotive cybersecurity yet, the SAE guideline J3061 [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF] is the only published industry agreement at this stage. The Industrial Internet Consortium has published a generic reference architecture for the design of CPS manufacturing systems [START_REF][END_REF].

In terms of published research, Ward et al. [START_REF] Ward | Threat Analysis and Risk Assessment in Automotive Cyber Security[END_REF] suggest a risk assessment method for security risk in the automotive domain named threat analysis and risk assessment, based on the Hazard and Risk Analysis (HARA) specified in [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF]. Steiner et al. [START_REF] Steiner | Combination of Safety and Security Analysis -Finding Security Problems That Threaten The Safety of a System[END_REF] deal with safety and security analysis, however focus on state/event fault trees for modelling of the system under development. Bloomfield et al. [START_REF] Bloomfield | Security-Informed Safety: If It's Not Secure, It's Not Safe[END_REF] mention a security-informed risk assessment with a focus on a "security-informed safety case" and the impact of security on an existing safety case.

SFA and AD for integrated safety/security design

In [START_REF] Tichkiewitch | Methodology and product model for integrated design using a multiviews system[END_REF] we explain the hazard and risk analysis (HARA) using the ESCL example. Here we apply the same principle to an EPS in which an electric motor provides steering power support (instead of a hydraulic pump driven by the combustion engine). The HARA results in an ASIL D rating (i.e., highest possible safety criticality) and a safety goal (i.e., high-level functional safety requirement):  FR1: "There must be no unwanted steering actuation". When carrying out a system analysis, this safety goal needs to be decomposed to system safety FRs. The safety experts and system analyst usually look at the potential faults that can lead to this failure (e.g. based on an FMEA) and define Functional Safety Concept requirements to diagnose and avoid these faults. In order to render this process systematic, we propose signal-flow analysis as depicted in Figure 1. The signal flow analysis starts from the steering torque sensor rather than from the steering angle sensor that is typically provided by the vehicle manufacturer (OEM) rather than the EPS supplier. This fact also has strong consequences on the FR's and DP's linked to the safety goal FR1 analysed here.

Based on this analysis we find that two potential sources of violating the safety goal FR1 are erroneous values for the steering angle demand or the torque applied to the steering wheel by the driver. Hence, we can decompose FR1 to  FR1-1: "The steering angle has to be measured with ASIL-D quality."  FR1-2: "The driver demand torque has to be measured with ASIL-D quality." In the following, we will limit decomposition considerations [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF] to FR1-1. For the reason explained above, the decomposition continues on Technical Safety Concept level as follows:

 FR1-1-1: "The internal steering angle is calculated from the rotor angle."  FR1-1-2: "The index position has to be provided with ASIL-D quality." In the technical safety design in system architecture level, we can identify the following design parameters (DP), based on decomposition according to [START_REF] Ghemraoui | Design method for systematic safety integration[END_REF]:  FR1-1-3: "Every 1 ms the sin and cos and index counters have to be measured and the redundant steering angles calculated".  FR1-1-4: "Both steering angles must match within a 5 degrees range (plausibility-check). This comparison has to be executed and monitored independently of the calculation linked to FR1-1-3". In autonomous driving, however, the demand value for steering will be provided by the cyber-infrastructure and/or the vehicle's central electronic control (ECU) rather than by the driver. Consequently, we have to extend our system boundaries and the related analyses as illustrated in Figure 2. This change has a significant impact on the ASIL ratings, as well as the top-level safety goal:  FR2: "The EPS must steer exactly according to the external steering command." The external steering command contains the requested steering angle, which the steering controller (ASIC) translates to a steering torque before comparing the actually achieved internal steering angle with the externally requested one. Moreover, the system's safe state on vehicle level has to change, since there is no driver to hand over steering control in the event of EPS failure:  DP3: Use redundant and diverse motor concepts (e.g. 6 phase, 12 phase) to allow a limp-home mode to a garage. Adding cybersecurity requirements to this involves the analysis of both static and dynamic dependencies between functional safety FR's and the results of the cybersecurity threat analysis and risk assessment (TARA) [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF]. In this contribution, we will focus on the signal (attack) flow analysis, i.e., the dynamic part only. Figure 3 shows the signal flow analysis of two selected potential attacks, one originating in the cyber-infrastructure, the other one-more classically-originating in the service garage via the vehicle's traditional diagnostic interface. This analysis has been used in order to identify the requirements for the design of diverse defence layers implementing the defence-in-depth design pattern. Linking design patterns with AD is particularly interesting in the cybersecurity domain where researchers and industry experts have come up with numerous attack/threat and defence patterns over the last 15 years. Particularly outstanding, Hafiz et al. [START_REF] Hafiz | Growing a pattern language (for security)[END_REF] sum up 96 such patterns without which it is very difficult for system analysts to identify and integrate cybersecurity requirements. Thomas et al. [START_REF] Thomas | Axiomatic Design/Design Patterns Mashup: Part 1&2[END_REF] build on this work in order to make these (bottom-up) design patterns usable in AD (top-down). We applied their unique approach to our case study. The key DPs affected by the defence-in-depth pattern are the following:

 location of each layer (shielding of system components),  properties of each layer (defence mechanisms). The power of AD lies in the integration of all DPs in a design matrix in order to analyse and improve the complexity of design decisions made for each FR in each domain (functional safety and cybersecurity in particular).

Integration applied to applicable industry standards

In order for our research results to be accepted and actually deployed in industrial application, our industry research partners pushed and helped us integrate our concepts in the three currently applicable industry standards Automotive SPICE [START_REF] Vda Qmc | Automotive SPICE® Process Assessment/Reference Model[END_REF] and [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF][START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF]. This translates itself in a completely integrated treatment of requirements for the system, as well as its electronics hardware and software components while taking into account the three standards.

The methodology we applied is based on a systematic investigation of each standard's practices in terms of the design tasks they require in order to achieve each specialist domain's objectives. Subsequently we analysed the complementarity of these practices and ways of integrating them such that they help architects adopt a systemic view on designing CPS that are both safe and secure. Figure 4 shows a top-level overview of the results of this exhaustive research work on system level (processes SYS.1-5). We have achieved a similar mapping on software (SWE.1-6) and electronic hardware levels (HWE.1-4). Each rectangle represents a particular design process phase along the V-cycle, which is the backbone of automotive development. The arrows indicate (explicit or implicit) dependencies that we could identify among these processes. In order to give a small insight into the complete framework linking the three standards, we will look at the System Requirements Analysis process (SYS.2 in Automotive SPICE 3.0 [START_REF] Vda Qmc | Automotive SPICE® Process Assessment/Reference Model[END_REF]).

Automotive SPICE base practice SYS.2.BP1: "Specify system requirements. Use the stakeholder requirements and changes to the stakeholder requirements to identify the required functions and capabilities of the system. Specify functional and nonfunctional system requirements in a system requirements specification" [START_REF] Vda Qmc | Automotive SPICE® Process Assessment/Reference Model[END_REF].

Complementary functional safety design tasks: Related to [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF], clauses ISO 26262-4 6. Automotive SPICE base practice SYS.2.BP4: "Analyse the impact on the operating environment. Identify the interfaces between the specified system and other elements of the operating environment. Analyse the impact that the system requirements will have on these interfaces and the operating environment" [START_REF] Vda Qmc | Automotive SPICE® Process Assessment/Reference Model[END_REF].

Complementary functional safety design tasks: Related to [START_REF]ISO 26262 Road vehicles Functional Safety Part[END_REF], clause ISO 26262-4 6.4.1:  Specify technical safety requirements in accordance with the functional safety concept, the preliminary architectural assumptions of the item and the following system properties: a) the external interfaces, such as communication and user interfaces, if applicable; b) the constraints, e.g. environmental conditions or functional constraints; and c) the system configuration requirements.  Specify the hardware-software interface (HSI).

Complementary cybersecurity design tasks: Related to [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF], clause 8.3.1:  Identify the feature's physical boundaries, its cybersecurity and network perimeter, as well as its trust boundaries.



Define the feature's scope and its interfaces to the cyberinfrastructure.

This integration work addresses the huge challenge both designers and quality (safety, security) assessors are increasingly confronted with, which is having a holistic, integrated view on the functional, non-functional and process requirements induced by the three automotive development standards.

Extension of applicable industry standards

Our work revealed that the current standards do not yet cover the challenges imposed by CPS in the form of ADAS and autonomous vehicles. An ADAS-based cyber-infrastructure will require an additional life cycle to be considered in Automotive SPICE. Therefore we propose a new set of processes, which we call the ASI (Automotive Service Infrastructure) processes. They are connected with the related system process life cycle (SYS. 1 -5) in Automotive SPICE, as shown in Figure 5 below. The previously analysed base practice SYS.2.BP4 will need a complementary part in the corresponding ASI.2 base practice:

Proposed Automotive SPICE base practice ASI .2.BP4: "Analyse the interfaces between the vehicle and the service infrastructure. Identify the interfaces between the vehicle and the service infrastructure. Analyse the impact that the service infrastructure interfaces will have with the vehicle's operating environment."

Outcomes: required Quality of Service (availability), reaction in case of no availability, criticality of information, safety integrity level, encryption and identification mechanisms.

From a more general, industry-sector independent point of view, this extension reflects the necessity for CPS development to take into account requirements purely linked to the cyberinfrastructure and directly or indirectly influencing the product's or system's behaviour [START_REF] Abramovici | Semantic data management for the development and continuous reconfiguration of smart products and systems[END_REF]. Significantly more attention will have to be paid to the very clear definition of system interfaces beyond the CPS boundaries, as well as the scope and quality of service that is required by and/or provided by each CPS functionality.

Conclusion and outlook

In this paper we extend our methodology for the integration of functional safety and cybersecurity aspects in the early phases of industrial embedded systems design [START_REF] Riel | Integrated design for tackling safety and security challenges of smart products and digital manufacturing[END_REF] by a systematic approach to integrated requirements elicitation based on AD and SFA on system architecture level. Our method leverages the integration of functional safety and cybersecurity design requirements on system architecture level, which is key to detailed component design that is safe and combats cyber threats effectively and efficiently. We have shown the application of our concept to the design of a modern automotive electric power steering system. In particular, we have investigated the functional safety and cybersecurity challenges linked to functions driven or at least influenced by the cyber-infrastructure. As increasingly many products and manufacturing processes are moving into the (I)IoT for being increasingly autonomous and smart, functional safety and cybersecurity are about to become the most essential horizontal quality characteristics. The automotive industry is considered precursor in this domain, as cars are extremely complex with respect to the high number of interconnected functions and required expert domains and organisational structures. In addition to that, innovation cycles are extremely short, and the automotive sector is moving from a product-focus to a product-service-system (IPS²) focus in terms of multi-modal mobility provision. The latter is a key driver for the advent of autonomous vehicles, which will be heavily dependent on the cyber-infrastructure even for providing basic vehicle functions such as steering. For this sector, we have also elaborated a framework for the integration of the three most prominent automotive development standards both on system architecture and detailed design levels. This framework includes an extension to cover requirements linked to the cyber-infrastructure. These results are on a good way of being adopted as an industry-wide standard.

Based on our generally applicable integration concept, the next steps in our research are focussed on the identification and characterisation of architectural design patterns that take into account both functional safety and cybersecurity by design, and can be deployed in several different industrial contexts.

Response to reviewers of our paper 2018-Dn-10R1

First of all, many thanks for having critically reviewed our paper! Please find our responses below.

The proposed topic is very relevant.

No changes.

The advantages of integrating Axiomatic design int the analysis of safety and security should be clarified better in the paper and in the conclusions.

Added explanations to section 2, 4, and "Conclusions and Outlook". We particularly highlight the importance of AD as a facilitating method for reducing the architectural design complexity of CPS with respect to safety and cybersecurity integration by design. Formulating safety and cybersecurity design requirements as FRs and mapping them to DP's inspired by related design standards transfers the problem of complexity reduction to the mathematical space of matrix operations.

The second part of Section 5 could in principle be presented as a Table.

We did not follow this suggestion, because a table representation of the design task lists could be misleading with respect to comparing the complementary design tasks for safety and cybersecurity. However, there is no point in comparing them directly. It is much rather in complementing each clause mentioned by the additional design tasks aiming at capturing safety and cybersecurity requirements in system level. Therefore, we consider a list representation better suited (just as in the related standards).

Font size in Fig. 3

This paper on an important aspect, but the paper is not very strong from research rigour point of view.

In several places (introduction, section 2, 5, 6, and Conclusions and outlook), we clearly point out that we have carried out our research in very close collaboration with industry. This has been vital to assure the practical relevance of our integration approach. Nonetheless, we followed a clear methodology which is also proven by the fact that our paper builds on the results of our previous CIRP publication.

Link with standard is good but it is not derived in a systematic manner.

We improved the explanation of our systematic approach in the second paragraph of section 5.

It is not clear how the architecture would combat cyber threats!

We have slightly modified the abstract and section 2 such that they explain better what we mean by "architectural approach" in the paper's title. Furthermore, we added "on system architecture level" to the description of the technical safety concept in section 3, as well as to the Conclusions and outlook section. The point is that our method leverages the integration of functional safety and cybersecurity design requirements on system architecture level, which is key to detailed component design that is safe and combats cyber threats effectively and efficiently. We have added this explanation to the Conclusion and outlook section as well.

Detailed Response to Reviewers

The paper has copied 350 words from 2017.eurospi.net -this is a problem too, this needs to be rewritten.

The part concerned are the base practices cited from the Automotive SPICE standard (we added a reference in the respective locations), and our analysis findings for the complementary design tasks (in the initial version formulated as questions). We have published those as questions to be asked during a safety/cybersecurity assessment in a practitioner paper at the EuroSPI 2017. (2017.eurospi.net) conference in order to disseminate them to the mostly industrial audience. In this revised version of our CIRP paper, we have re-written this part as complementary design tasks in a way that they even better complement the base practices of the Automotive SPICE standard.

Rather narrative and practice-oriented.

See justification related to practice-orientation above.

The claim (in the title) towards the architectural approach is not substantiated in the paper.

Please see the justification given for the argument "It is not clear how the architecture would combat cyber threats".

With this, the paper leans too much on straight forward analysis and reasoning.

We agree that a significant part of our research relies on systematic analysis of design practices applied to tackle functional safety and cybersecurity challenges in automotive embedded systems design. However, we were obliged to do this in order to be able to propose an integrated approach to tackling these design challenges from a SYSTEMIC and INTEGRATED point of view that is also ACCEPTED by stakeholders in the automotive industry. To achieve this, it is vital to build research on the terminology and frameworks accepted in the industry sector.

Figure 1 .

 1 Figure 1. Signal flow analysis of the EPS system.



  DP1: The internal steering angle calculation is done with two rotor position sensors fulfilling ASIL-B quality goals.  DP2: The rotor position sensor signals are compared against each other using an ASIL-D rated ASIC delivering sin and cos angle information and index counter.  DP3: Diversity and independency are assured in the hardware design (not having the same fault behaviour) and algorithms (sin and cos function). This design choice induces the following technical software requirement:

Figure 2 .

 2 Figure 2. EPS signal flow analysis in an autonomous vehicle.

Figure 3 .

 3 Figure 3. EPS attack data flow analysis for the defence-in-depth pattern.

Figure 4 .

 4 Figure 4. Integration of automotive development standards.

  4.1.1, 6.4.1.3, 6.4.1.4:  Make technical safety requirements consistent with functional safety requirements.  Make technical safety requirements traceable back to their sources.  Use semiformal notations for ASIL C and D. Related to [6], clauses ISO 26262-4 6.4.2.1, 6.4.2.2, 6.4.2.3:  Specify the required safety mechanisms in the technical safety concept, including control and monitoring systems to achieve all safety goals in time immediately or by a warning or degradation concept with the correct prioritization.  Specify measures to detect all possible failures and failure combinations including all operation modes and interactions with other systems. Related to [6], clauses ISO 26262-4 6.4.4.1, 6.4.4.2, 6.4.4.3:  Specify safety mechanisms to prevent faults from being latent for ASIL C/D requirements.  Specify the multiple-fault detection interval to avoid multiple-point failures and to be consistent with the avoidance of latent faults for ASIL C/D requirements. Complementary cybersecurity design tasks: Related to [7], clauses 8.3.6, 8.3.7, 8.4.2:  Derive cybersecurity requirements from the system level vulnerability analysis.  Define the cybersecurity concept including functional cybersecurity requirements, cybersecurity plan, feature definition, threat analysis and risk assessment, cybersecurity assessment.  Organise regular cybersecurity reviews for the identification of new threats and related cybersecurity requirements.

Figure 5 .

 5 Figure 5. A new A-SPICE process life cycle for the cyber-infrastructure

  and Fig. 5 should be enlarged. Increased from 10,5 points to 12 points.

  Figure

Acknowledgements

The research leading to these results has received funding from the ARTEMIS Joint Undertaking under grant agreement 621429 (project EMC²). Furthermore, we express our thanks to our supporting industry partners, who are all members of the German SOQRATES initiative (www.soqrates.de).


Ph.D Andreas Erik ; Riel

Christian Kreiner

Georg Macher

J Christian

Ph.D.; Georg Kreiner

Ph.D Richard Macher

Ph.D Messnarz

Richard Messnarz

Integrated design for tackling safety and security challenges of smart products and digital manufacturing

Keywords: design, integration, safety design, integration, safety

Integrated design for tackling safety and security challenges of smart products and digital manufacturing

This is a very important and emerging area in design under 'design for security'.

No changes.

Section 3 should also include latest research on cyber-secure industrial control systems.

We extended Section 3 by one paragraph elaborating on the CPS and ICS and citing three of the still very few key references on the subject of the integration of cybersecurity and functional safety in the design of ICS (new references [START_REF]Security of Industrial Control Systems and Cyber Physical Systems[END_REF][START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF][START_REF] Ellis | Integrating Industrial Control System (ICS) safety and security -A potential approach[END_REF]). To make the transition to the automotive sector, we have added a statement explaining the since industry is still the min driving force in the cybersecurity/safety integration, most relevant works can be found in sector-specific research and industry practice publications.

You need to discuss role of people, hardware and software in the security of ESCL.

We interpret this as a supporting remark, since we indicate in several places that the key idea and objective of our research is to enable an integrated design view on cybersecurity and functional safety aspects. Integrated design is essentially about enabling human experts from several different fields to collaborate efficiently in the design process, which is exactly what we search to facilitate by our method. Furthermore, in table 1 we established a vehicular vocabulary leveraging the communication between cybersecurity and safety experts.

Also link between safety and cyber security is well presented. Good work.

No changes.

The paper introduces a new logic to drive safety and security concerns in cyber-physical systems. The proposed method is applied on an industrial case.

No changes.

The promised methodology is too shallow by far; New logic engineering methods for CPS.

Deliberately and due to the requirements we were having for this research, we have based our method and our related research methodology on two emerging industry standards. Therefore, it is true that what we propose is rather a novel method than a profound methodology. We also agree to the reviewer that this methods represents a now logic of applying existing engineering methods for achieving integration n design. In order to take this explicitly into account, we have replaced the word "methodology" both in the abstract and the body of the text by "method" and/or "new logic of engineering methods".

Introduction

Digital manufacturing and smart, completely customizable product-service systems go hand in hand with each other in what is widely called the fourth industrial revolution (Industry 4.0). The key element enabling and driving these paradigms is the high integration of complex interconnected embedded systems of electronics and software in traditional manufacturing systems and products. Through this integration, such cyber-physical systems (CPS) are increasingly taking over control of essential value-added functions. In applications like automotive, aeronautics, medical, nuclear power plants, etc. such functions are often safety-critical, i.e. any failures linked to these functions might harm human health. The same applies to manufacturing environments where high levels of automation and autonomy of machines and robots lead to the necessity of taking safety criticality into account in the very design of Industrial Control Systems (ICS) and their operating environments.

At the same time, safety-critical embedded systems are increasingly part of networks of systems which interact among each other in order to provide added-value functions on system level. This interaction takes place via computer networks which are either private to the system, or linked to an information technology (IT) cloud, or both. A key challenge of such networks is the assurance of cybersecurity, i.e. the protection of these networks against malicious intrusions aiming at modifying the intended behaviour of the network and/or the linked devices. The Industrial Internet of Things (IIoT) and the growing reliance on automation and big data have rendered cybersecurity the biggest risk factor in manufacturing [2].

While not every secure system is necessarily safety-critical, the opposite always holds true: safety-critical systems have to be secure as well, otherwise the built-in safety features might be compromised by intruders. In several industry sectors, though, functional safety and cybersecurity have evolved separately from each other as their treatment in design requires very special knowledge. This paper uses the example of an automotive electronic steering column lock system (ESCL) to propose a method and logic of integrating functional safety and cybersecurity in the early design, i.e. the requirements and constraints analysis phase, of CPS. Section 2 explains the context, the research objectives and methodology. Section 3 introduces essential related work in the automotive domain. Section 4 suggests an integrated approach to safety and cybersecurity requirements elicitation applied to the ESCL. Section 5 builds on this approach in order to identify trust boundaries in the system as a fundamental basis for the design of safe and secure CPS. Finally, section 6 concludes with a summary of the paper's key contributions and an outlook.

Target and methodology

Designing CPS increasingly requires integrated design methods [START_REF] Tichkiewitch | Methodology and product model for integrated design using a multiviews system[END_REF] due to the high degree of dependability of these CPS in terms of their functional safety, cybersecurity, reliability, availability, integrity, maintainability and other essential system properties [START_REF] Ghemraoui | Design method for systematic safety integration[END_REF]. The key objective of this research is to propose a universal actionable method of enabling the integrated design of CPS with a particular focus on the identification and evaluation of functional safety and cybersecurity requirements and constraints in the early design phases. In order to assure the required high level of industry relevance, we have had to align our method with the constraints imposed by two recent industry standards addressing the automotive domain. We actually combined the two core safety and cybersecurity requirements elicitation methods imposed by these two standards with the originally military concept of defence-in-depth as a facilitator for the integration of safety and security experts as well as electronic and software engineers. This concept uses multiple successive diverse layers of failure and/or attack prevention/detection rather than one single protective layer which therefore would have to be perfect. In the context of a larger research initiative, we applied this approach to the design of various automotive systems in collaboration with work groups composed of experts representing leading automotive tier-1 suppliers.

Essential related work in ICS and the automotive sector

A broad treatment of research activities in the area of cybersecurity for CPS and IPS in several application contexts can be found in [START_REF]Security of Industrial Control Systems and Cyber Physical Systems[END_REF]. Stouffer et al. [START_REF] Stouffer | Guide to Industrial Control Systems (ICS) Security[END_REF] take a more instructive approach to explaining essential Cybersecurity aspects of ICS, however without taking into functional safety. Cybersecurity and safety integration in ICS through successive consideration of the effect of decisions is discussed in [START_REF] Ellis | Integrating Industrial Control System (ICS) safety and security -A potential approach[END_REF]. In general, we found that cybersecurity-safety integration is a very new subject that is still mainly driven by industry, which is probably why the most helpful and exhaustive published works we found are issued from in domain-specific research, in our case automotive.

CPS are considered the most important driver for innovation in the automotive domain as they are the enablers of new and improved functionalities such as steer-and brake-by-wire and advanced driver assistance systems (ADAS) leading towards the autonomous vehicle. While functional safety has been addressed quite exhaustively in the automotive domain over the last decade, cybersecurity has come up as a top design priority only recently. Research and industry practice has led to the internationally recognized functional safety standard ISO 26262 [START_REF]ISO 26262 Road vehicles Functional Safety Part 1-10[END_REF] which is based on the ISO 61508, the corresponding standard for industrial automation. There is no comparable standard for automotive cybersecurity yet, the SAE guideline J3061 [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF] is the only published industry agreement at this stage.

In terms of essential published research, Ward et al. [START_REF] Ward | Threat Analysis and Risk Assessment in Automotive Cyber Security[END_REF] suggest a risk assessment method for security risk in the automotive domain named threat analysis and risk assessment, based on the Hazard and Risk Analysis (HARA) specified in [START_REF]ISO 26262 Road vehicles Functional Safety Part 1-10[END_REF]. Roth et al. [START_REF] Roth | Modeling and Analysis of Safety-Critical Cyber Physical Systems using State/Event Fault Trees[END_REF] and Steiner et al. [START_REF] Steiner | Combination of Safety and Security Analysis -Finding Security Problems that Threaten the Safety of a System[END_REF] deal with safety and security analysis, however focus on state/event fault trees for modelling the system under development. Schmittner et al. [START_REF] Schmittner | Security Application of Failure Mode and Effect Analysis (FMEA)[END_REF] present a failure mode and failure effect model for safety and security cause-effect analysis. Bloomfield et al. [START_REF] Bloomfield | Security-Informed Safety: If It's Not Secure, It's Not Safe[END_REF] mention a securityinformed risk assessment with a focus on a "security-informed safety case" and the impact of security on an existing safety case.

Integrated safety/cybersecurity requirements elicitation

Integration in design starts with the definition of a common vocabulary containing vehicular terms that can be used to foster mutual understanding of domain experts. Table 1 shows a mapping of safety and cybersecurity oriented engineering terms regarding the initial requirements analysis step, which is the HARA [START_REF]ISO 26262 Road vehicles Functional Safety Part 1-10[END_REF] and TARA (Threat Analysis and Risk Assessment) [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF]. Thanks to this shared vocabulary it is possible to perform the first step in the safety/cybersecurity development life cycle from an integrated perspective [START_REF] Macher | SAHARA: A security-aware hazard and risk analysis method[END_REF]. In order to illustrate this, we will use the concrete example of an ESCL.

Modern ESCL systems provide highly representative safety and security relevant use-cases, thanks to their comparatively low system complexity, yet strong safety and security relevance. The basic function of the ESCL is the following: When the driver gets into the car, the vehicle immobilizer (IM) receives an ignition key signal. When the driver starts the car, an ignition-on message is communicated via the controller area network (CAN) bus. When this signal is received by the ESCL and the IM enables the ESCL, an electric motor moves the locking bolt and unblocks the steering column. The inverse process, locking the steering column, happens by a bolt movement by the electric motor in the opposite direction as soon as the vehicle is in standstill and the driver switches off the ignition.

From a security point of view, the system shall lock the steering column when the ESCL's diagnostic functions reveal an inconsistency of the relevant control signals, which might be the result of an attack. From a safety perspective, however, the steering column must not be locked during driving. Moreover, forcing a safety-critical system to go into a known safe-state can provide additional attack vectors if security considerations do not also cover safe-states and reactions of safety-critical systems. These considerations have been taken into account in the HARA and TARA depicted in table 2 and 3 respectively. Based on the assumption that particular cybersecurity attacks must take place in a specific order to enable more sophisticated attacks, we propose an architectural model with several static layers of defence. Any such automotive defence layer (AutoDL) represents typical steps an attacker would have to walk through to get increasing impact on the target system. This static defence layer model, shown in Fig. 1, helps to reveal attack patterns. In the portrayed scenario, an information disclosure attack on the maintenance tool can overcome AutoDL 1 and thus enable spoofing of identity and elevation of privilege attacks. These attacks facilitate other attacks and finally result in the attack 'spoofing of commands leading to unintended locking of steering column' which violates a safety goal rated ASIL D (highest level).

The key added value of this layer-based approach lies in the facilitation of the analysis of a limited number of attack patterns rather than a huge number of potential individual attacks, some of which are not even known at the design stage. With respect to the integration of safety and security, it becomes possible to focus the TARA on the threats on the violation of the most critical safety goals. Furthermore, the defence in depth approach allows to defend a system against any particular attack using several independent and diverse defence methods (cf. Fig. 1). If any of the layers fails to protect, then the subsequent layer is in place. In order to determine where to actually implement the individual sequential defence layers in the vehicle system architecture, designers have to analyse each system function (e.g. the ESCL's locking function) in terms of their data and signal flows against potential attack flows. Fig. 2 shows two possible attack flows through the defence layers defined for the ESCL. The two attack scenarios depicted follow a certain data flow through the affected elements of the vehicle's system architecture. This approach is suitable for the analysis of the isolation of software functions executed on the same electronic control unit (ECU) and is based on a data flow representation.

Trust boundary identification

Trust boundary identification completely differs in safety and security engineering. For the safety-related aspects of automotive systems, trust boundaries are determined by a function-oriented definition of system borders where dangerous malfunctions are controlled ("item" in ISO 26262 terminology). In cybersecurity, by contrast, trust boundaries are used to describe a boundary where program execution or data protection change their levels of "trust". This term refers to any distinct boundary within which a system trusts all other sub-systems that are within this boundary. Trust boundaries can be related to privileges, integrity, control units or communication networks, and can also refer to points or attack surfaces where attackers can intervene. In order to clearly distinguish (sub)system boundaries, the term "feature definition" is used for the cybersecurity aspects of a product or system [START_REF]SAE J3061 Cybersecurity Guidebook for Cyber-Physical Automotive Systems[END_REF].

Based on the concept of the layered cybersecurity defence approach introduced earlier, we propose a way to identify trust boundaries and attack vectors via signal interfaces based on the hardware-software interface (HSI), a key development artefact of the ISO 26262 functional safety development process [START_REF]ISO 26262 Road vehicles Functional Safety Part 1-10[END_REF]. Defining the transition of electronic signals to software variables, the HSI represents an essential vehicular work product of the automotive system design process linking hardware and software designers. Establishing the HSI requires mutual knowledge of hardware and software components and their interactions.

Safety and/or cybersecurity relevant signals inherit their ASIL ratings from the HARA and/or their security level from the TARA. Depending on the related security level/ASIL, the signal shall be protected against cybersecurity attacks according to a defence in depth pattern as mentioned earlier in this work. The enhancing of the HSI definition with supplementary cybersecurity information and related signals provides the systematic basis to determine trust boundaries and attack vectors by focusing on signals and thus identifying controllers which can intervene with the involved signals.

To this aim, all signals required for the system are analysed. Based on this analysis, all control units having access to these signals are identified. These control units are within the same trust boundary and thus are equally trusted. The access to the trust boundary is enabled via dedicated devices (gateways) which also have connections outside the trust boundaries. The gateways are required to prevent the misuse of trust, and thus they protect the control units within a trust boundary from outside attacks. The identification of trust boundaries and gateways protecting these boundaries is both crucial and cumbersome for complex system and network structures. Using the HSI definition for this purpose, however, provides a structured and methodical pattern for the identification. From the HSI of the ESCL system (cf. table 4) it can be seen that the SecL of the three signals directly connected to the ESCL ECU (endpos, CL15, and CL30) are treated as 0 (not security relevant) while the three signals provided via CAN bus (thus provided from outside of trust boundary 0 in Fig. 3) have a security level of SecL =2. This results from the fact that in order to raise a security attack, these signals would have to be manipulated in the vehicle directly at the ESCL system and that these signals are within the same trust boundary 0. On the other hand, the SecL=2 indicates a possible cybersecurity vulnerability and thus requires built-in security solutions exhibiting a defence-in-depth approach.

Departing from this and based on the rough ESCL system architecture specified in the item definition depicted in Fig. 3, we can proceed by determining the trust levels of the ESCL components having direct access to the ESCL signals. These controllers either generate the signals directly (such as the vehicle immobilizer IM) or are connected to the same communication bus (antilock braking system ABS, on-board diagnosis connector OBD, transmission control unit TCU and wireless gateway GW). The second step identifies the inner trust boundary 0 which includes signals directly connected to the ESCL and simultaneously the gateways to the trust boundary (IM and ECU), which are required to ensure protection of the integrity of the trust boundary 0. These steps are repeated for the remaining signals to establish further trust boundaries. As can be seen in Fig. 3, trust boundary 1 covers the first layer of all signals related to the ESCL system and also includes the wireless gateway (GW), which appears as a gateway to trust-boundary 1 and therefore enables remote cybersecurity attacks on the ESCL. Additionally, if the on-board diagnostic connector (OBD) does not provide protection mechanisms for trust-boundary 1 (which is the case in current vehicle designs), any maintenance system using this connector are included in trust boundary 1 as well. This security exposure could be missed easily without performing an integrated trust boundary analysis.

Conclusion and outlook

In this paper we propose a method for the integration of functional safety and cybersecurity aspects in the early phases of industrial embedded systems design, with a focus on the automotive sector and a related case study. This sector can be considered a reference for many other industrial sectors, as it is currently undergoing a radical transformation which is mainly driven by the ubiquitous presence of smart networked embedded electronic systems, which are also at the heart of the CPS that are about to transform industrial production [START_REF] Abramovici | Semantic data management for the development and continuous reconfiguration of smart products and systems[END_REF]. As increasingly many products and manufacturing processes are moving into the (I)IoT for being increasingly autonomous and smart, functional safety and cybersecurity are about to become the most essential horizontal quality characteristics. Our method is based on two core elements: (1) the introduction of a static defence layer concept that enables the identification of security attack patterns as well as the analysis of dynamic functional flows with respect to the vulnerability of architectural system elements needed to implement those functions; (2) the use of the embedded system's vehicular hardware-software interface specification to determine the trust borders which are essential for the embedded system's architectural design under safety and security constraints. Since these elements are applicable to whatever industrial embedded system, our concept is universally applicable. We have shown its feasibility using the example of a real automotive subsystem having the highest possible safety integrity level as well as a significant exposure to security attacks.

The next steps in our research are focussed on the identification of architectural design patterns that take into account both functional safety and cybersecurity by design, and can be deployed in several different industrial contexts.

Figure 1 .

 1 Figure 1. Static defence layers of the ESCL system [17].

Figure 2 .

 2 Figure 2. ESCL data flow representation including AutoDL layers [17].

Fig. 3

 3 depicts the block diagram of the ESCL from a safety perspective (item definition[START_REF]ISO 26262 Road vehicles Functional Safety Part 1-10[END_REF]). It shows the main architectural components of the ESCL. The required sensor signals are a redundant feedback channel of the bolt position (represented by the endpos signal), power supply and ignition key status information (CL30 and CL15), and vehicle status information via the CAN bus (ignition key status, vehicle speed signal, gear lever position).

Figure 3 .

 3 Figure 3. Block diagram of the built-in ESCL including trust boundaries.

Table 1

 1 Vehicular safety/cybersecurity requirements analysis terms.

Table 2

 2 HARA of the ESCL.

Table 3

 3 TARA of the ESCL (based on the STRIDE threat model[START_REF]The STRIDE Threat Model[END_REF]).

Table 4

 4 Excerpt of the ESCL's HSI definition with relevant signals and safety/security classification for the determination of trust boundaries.

	Signal name	CL30	CL15	endpos	ignition key status	vehicle speed signal	gear lever position
	Description	supply voltage	ignition-starter switch	end position ESCL bolt	ignition-starter switch	actual vehicle speed	actual gear lever position
	Direction	in	in	in	In	in	In
	ASIL	ASIL B	ASIL B(D)	ASIL B (D)	ASIL B(D)	ASIL B(D)	ASIL B(D)
	SecL	0	0	0	2	2	2
	Source	ANA	ANA	DIG	CAN	CAN	CAN
	…	…	…	…	…	…	…

Acknowledgements

The research leading to these results has received funding from the ARTEMIS Joint Undertaking under the grant agreement 621429 (project EMC²). We also want to express our gratitude to our supporting industry partners, all members of the German SOQRATES initiative (www.soqrates.de).