Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
PD CEN TS 16702 — Electronic Fee Collection Secure Monitoring for Autonomous Toll Systems (Part 1 Compliance Checking; Part 2 Trusted Recorder)
Electronic Fee Collection — Secure Monitoring for Autonomous Toll Systems — Compliance Checking / Trusted Recorder
🚗 PD CEN/TS 16702 is a series of Published Documents issued by the British Standards Institution (BSI) based on the European Technical Specification CEN/TS 16702 for Electronic Fee Collection (EFC), specifically addressing the secure monitoring requirements of autonomous toll systems. In “autonomous” tolling, tolls are collected without roadside toll gantries: the vehicle uses an on-board unit (OBU) and satellite positioning to determine when it enters a tolling area and to complete charging itself, which places more demanding requirements on fraud prevention and data trustworthiness. The two parts in this batch, PD CEN/TS 16702-1:2014 (compliance checking) and PD CEN/TS 16702-2:2015 (trusted recorder), are core elements of this security framework.
⚠️ In the autonomous tolling model there is no physical toll gantry to serve as “natural evidence”; the correctness of charging relies entirely on the integrity of the on-board system’s self-declaration. Consequently, secure-monitoring capability (monitoring, recording, verification) is the key to fair, trustworthy autonomous tolling and the basis for fraud prevention and dispute arbitration.
1. Overview of the Series 📌
The CEN/TS 16702 series is prepared by the European Committee for Standardization (CEN) intelligent transport systems committee; the UK participates through Technical Committee EPL/278 and publishes it as a Published Document. The series uses a multi-part structure to define a systematic set of requirements for secure monitoring of autonomous toll systems. The two parts in this batch are summarised below:
| Standard | Part Topic | Main Content | Year |
|---|---|---|---|
| PD CEN/TS 16702-1:2014 | Compliance Checking | Processes, data handling and privacy considerations for compliance checking across the whole autonomous toll process | 2014 |
| PD CEN/TS 16702-2:2015 | Trusted Recorder | Functional, security and data-integrity requirements of the trusted recorder | 2015 |
💡 In an autonomous toll system, the generation, declaration and verification of charges can be viewed as three stages: the on-board system calculates and declares the charge (customer side) → the trusted recorder objectively records trip and charge evidence (evidence side) → the road-network operator performs compliance checking and audit (operator side). Parts 1 and 2 support the “verification” and “evidence” stages respectively.
2. Part 1: Compliance Checking 🔍
PD CEN/TS 16702-1:2014 specifies requirements for compliance checking in autonomous toll systems. Its objective is to verify whether vehicle owners/on-board systems have declared the charges due as required, and to investigate journeys suspected of non-compliance. The standard covers:
- Checking processes: the complete process from journey declaration, risk assessment, selection of audit subjects, to initiating verification;
- Processes and options: different options for compliance checking (e.g., random sampling, risk-based targeted checks, evidence-driven special checks) and their applicable scenarios;
- Data handling: requirements for collecting and processing position, time and identity data involved in checking;
- Privacy protection: compliance checking should follow principles of minimal collection and purpose limitation, balancing enforcement needs with user privacy.
⚠️ Compliance checking must balance “deterrence effectiveness” and “fairness”: too low a checking rate cannot curb toll evasion, while excessive checking may violate privacy or cause false accusations. By defining checking types and processes, the standard helps operators establish a proportionate and transparent verification mechanism.
3. Part 2: Trusted Recorder 🔒
PD CEN/TS 16702-2:2015 specifies requirements for the Trusted Recorder. The trusted recorder is an independent, reliable data-recording device installed in the vehicle, used to objectively record charge-related journey information (time, position, distance, calculated charge, etc.) as a trustworthy evidence source for compliance checking and dispute resolution.
Because recorder data may be used to determine whether to charge or exempt a vehicle owner, it must satisfy strict security requirements:
- Integrity: recorded data cannot be tampered with or falsified and supports verification and audit;
- Reliability: stable operation in the vehicle environment, with data not lost on power failure or malfunction;
- Secure access: writing, reading and export of data are protected by access control against unauthorised modification;
- Auditability: recorded content is traceable and can be used in dispute arbitration.
✅ The trusted recorder separates “customer declaration” from “objective evidence”: even if the on-board charging unit malfunctions, the trusted recorder still provides independent, complete data, giving both parties a reliable basis and significantly enhancing the credibility of autonomous tolling.
4. Key Technical Requirements 🔧
Combining the two parts, the key technical requirements for secure monitoring of autonomous toll systems can be summarised as:
- Complete evidence chain: from journey start to end, the generation, recording and declaration of position/time/charge data should form a complete, verifiable evidence chain;
- Data integrity and anti-tampering: use checksums, digital signatures and similar mechanisms to ensure data cannot be altered;
- Security management: key management, device authentication and secure-upgrade mechanisms to prevent device cloning and cracking;
- Privacy compliance: data processing complies with data-protection regulations, with minimal collection, clear purpose and protection of user identity;
- Process transparency: compliance-checking processes, determination rules and appeal channels are open and transparent to guarantee fairness.
5. Engineering Practice and Applications 🛠️
Autonomous tolling and secure-monitoring technology are widely applied in various road-charging scenarios:
- Free-flow / gantry-less tolling: distance-based free-flow tolling on motorways, urban congestion charging zones (e.g., the London, Singapore models);
- Multi-country interoperability: unified EFC security architectures support cross-regional and cross-border tolling interoperability;
- Goods-vehicle / heavy-goods charging: distance-based charging for freight vehicles, combined with compliance checking to combat diversion and false declaration;
- Anti-fraud audit: compare declaration records with trusted-recorder data to identify and handle toll evasion.
💡 Implementation advice: operators should build “monitoring and evidence” mechanisms into the autonomous toll system architecture from the outset (rather than as an afterthought), embed compliance-checking processes, trusted-recorder selection and data-security management in the design, and simultaneously develop a privacy impact assessment and user appeal process.
6. Frequently Asked Questions ❓
❓ Q: What is an “autonomous toll system”?
A: A tolling model that, without toll gantries, uses on-board units and positioning technology to automatically determine when a vehicle enters a tolling area and to charge accordingly. Its advantages are lower infrastructure cost and free traffic flow, but it relies on self-declaration and therefore needs secure monitoring to ensure fairness.
A: A tolling model that, without toll gantries, uses on-board units and positioning technology to automatically determine when a vehicle enters a tolling area and to charge accordingly. Its advantages are lower infrastructure cost and free traffic flow, but it relies on self-declaration and therefore needs secure monitoring to ensure fairness.
❓ Q: What is the relationship between Parts 1 and 2?
A: Part 1 defines “how to verify” (compliance-checking processes), and Part 2 defines “what evidence to verify with” (the trusted recorder’s data and security requirements). Together they form a complete audit loop of “record evidence → verify declaration”.
A: Part 1 defines “how to verify” (compliance-checking processes), and Part 2 defines “what evidence to verify with” (the trusted recorder’s data and security requirements). Together they form a complete audit loop of “record evidence → verify declaration”.
❓ Q: How does the trusted recorder differ from a normal on-board charging unit?
A: The trusted recorder is designed to satisfy security requirements such as integrity, anti-tampering and auditability, as an “objective evidence device” independent of the charging algorithm; a normal charging unit focuses on completing the charging function and may not have the same evidence trustworthiness.
A: The trusted recorder is designed to satisfy security requirements such as integrity, anti-tampering and auditability, as an “objective evidence device” independent of the charging algorithm; a normal charging unit focuses on completing the charging function and may not have the same evidence trustworthiness.
❓ Q: How does autonomous tolling protect user privacy?
A: Through minimal data collection, purpose limitation, anonymisation/pseudonymisation and strict access control, using only the data strictly necessary for verification in compliance checking, together with transparent data-use statements and appeal mechanisms.
A: Through minimal data collection, purpose limitation, anonymisation/pseudonymisation and strict access control, using only the data strictly necessary for verification in compliance checking, together with transparent data-use statements and appeal mechanisms.
❓ Q: Is the technical specification mandatory?
A: CEN/TS is a technical specification and is not itself mandatory; however, it is often incorporated into system procurement and operation contracts by toll operators, becoming the agreed basis for design, construction and acceptance of autonomous toll systems.
A: CEN/TS is a technical specification and is not itself mandatory; however, it is often incorporated into system procurement and operation contracts by toll operators, becoming the agreed basis for design, construction and acceptance of autonomous toll systems.