FRMCS Should Treat the Mobile Network as Transport, Not as Trust

Modern connectivity does not remove the end-to-end assurance problem

The European Union Agency for Railways has published its opinion and supporting specifications for FRMCS Version 2, reflecting the migration of railway communications toward 5G-based services. The capability brings major operational benefits, but it also expands the set of telecom components and service relationships on which railway applications depend.

The critical distinction is between transport and authority. A mobile network can provide authenticated connectivity, quality of service and operational monitoring, but the railway application still needs its own controls to determine whether a message is authentic, current and acceptable for the safety or operational context.

Treating network membership as proof of application trust would recreate the same implicit-trust problem seen elsewhere in OT, only at a much larger and more dynamic scale.

Railway zoning still matters when the bearer changes

ENISA railway guidance highlights risk management, legacy systems, supply-chain dependencies and the practical use of zones and conduits. FRMCS should be integrated into that architecture as a conduit with defined security assumptions, not as a reason to flatten them.

This means separating telecom-service health from railway-message validity. Loss of coverage, routing anomalies or compromised telecom credentials should not directly determine a safety outcome without application-level checks and safe degraded behaviour.

The engineering test is therefore simple to state: if the mobile carrier or a FRMCS component is degraded, malicious or simply wrong, can the railway system reject unsafe authority and transition predictably without losing the evidence needed to understand what happened?