ITSO Standards Update Contract - Vix

Descriptions

The ITSO on Mobile (IoM) enables customers to purchase digital smart tickets, which are stored in the wallet of their mobile phones. Smart tickets already exist in the form of a physical card, but currently, customers must scan the card with an app each time they want to know what ticket(s) they are currently holding.

The advantages of ITSO over existing ticketing media:

• Fraud reduction - Tickets marked as lost of refunded can be removed through native wallet commands, and are immediately rendered unusable. Copying of tickets is also prevented

• Ability to facilitate removal of magstripe - Existing infrastructure can be utilised for complex use cases currently still on magstripe tickets, avoiding costly hardware retrofits. IoM gives an option for the removal of magstripe ticketing at a potentially lower cost.

• Cost of completing the infrastructure rollout - Barcode is the single largest used ticket format in the railway industry today. However there are still some considerable challenges to completing the rollout to the remaining parts of the network and journey connections where through ticketing acceptance is in place. IoM provides an opportunity to resolve this issue.

• Speed of throughput - IoM in Apple Wallet with Express Mode, or in Google Wallet with Skip Device Unlock, can be expected to achieve the same throughput speed as contactless payment on mobile, as they both use the same NFC technology. Contactless is almost 40% faster than paper barcode tickets, and much more reliable.

• Speed of CPAY and cEMV expansion - IoM allows customers to bring their own device for ticketing, with similar ease of travelling and validation as cEMV, without the need for a new back office.

ITSO provides a smartcard standard in use across the UK public transport sector. The specification has been recently updated to version 2.1.5. Cubic's efforts are concentrated on delivering software and integration for all outboundary readers as a single, unified phase. These updates are required to achieve ITSO 2.1.5 specification compliance. This consolidated approach is enhanced by a vanguard period preceding the full rollout, facilitating early validation and refinement of the solution before network-wide implementation. Inboundary gates remain outside the scope at this stage.

Cubic will design, develop, test and deliver the Cubic gate reader and back office changes required to support the ITSO 2.1.5 and RSPS3002 specifications.

The work focuses on enabling ITSO 2.1.5 functionality across existing Cubic devices. No new hardware is introduced, and development will occur on the current infrastructure. As such, there are no proposed changes to the overall solution architecture. The impacted components include Reader Software, TR3 and IPV Software, and TOC back-office systems such as the BDP and DGC. Components such as the DPF, SCU, and SC remain unaffected.

A number of key enhancements are required to support ITSO 2.1.5. These include support for DESFire card emulation in Apple Wallet, enhanced contactless polling (v2.3), and acceptance of CMD11 and CMD12 commands on TR3 and MM6 devices. Additionally, updates to PDB Table 3810 are necessary to support these new commands.

Remote ISAM querying functionality will be introduced, enabling new ITSO request and response messages to be handled by both the TOC DGC and MM6 systems. Epoch handling is also addressed, with changes to support new DateTime stamp formats and message structures. These updates ensure compatibility with evolving ITSO standards and improve system resilience.

The RSPS3002 component of the work involves addressing gaps in validation logic and implementing necessary fixes. This includes validation of concessionary pass cost centres and class fields, as well as checks for TYP22, TYP23, and TYP24 product attributes. Fulfilment actions and expiry date updates are also covered.

Fixes are required for a range of journey validation scenarios, including break-of-journey logic, check-in and check-out behaviour, and OSI (Out of Station Interchange) handling. These updates ensure that the system behaves consistently and accurately under all expected operational conditions.

Testing will be begin using the I2F ITSO test environment at AFC House. This will include device-to-back office testing, regression testing of ITSO functionality. Scripted and ad hoc testing will be managed via the TestRail test management tool, with defects triaged and prioritised based on customer impact. Further end-to-end testing will be carried out at RDG test facility and final accreditation by ITSO.

Deployment activities include firmware and profile updates for CMDs 11 and 12 (non-Cubic), rollout of updated software to selected stations, and updates to BaseData including the TOC BDP and Table 3810. It should be noted that other table changes are required but these relate to content changes and not design changes. Training may be required to support these changes, and deployment will be managed as part of business-as-usual (BAU) processes.

The biggest risk to the industry by not going ahead with this programme will be detrimental to the customer. DfT have funded for the programme to go ahead and the funding amount for Cubic has come in below the expected cost in the GFA. The timeline is tight, especially with managing other key integrated suppliers that if this was not approved, the programme would not be able to move forward. Cubic are a key component to the programme as one of our gate suppliers.

Any incompatibility between existing systems/equipment and new goods, services or works could also result in time consuming and complex redesign and modification which could be unacceptable in the circumstances, for example, resulting in significant cost and/or delay to an important service.