Secure at the source. Ready for what’s next.
Railway HVAC is no longer an isolated system.
As rolling stock becomes increasingly connected, HVAC controllers are becoming part of a wider digital ecosystem, exchanging data with onboard networks, sensors and control systems. This connectivity creates new opportunities for smarter operation, but it also introduces new requirements for cybersecurity, interoperability and long-term system resilience.
The challenge is particularly relevant for fleets designed long before today’s connected railway. Mechanical HVAC equipment can remain operational for decades, while electronics, software, communication standards and cybersecurity requirements evolve much faster.
Smartair answers this challenge by combining three complementary building blocks: the HEC-CS electronic controller, the Smartair Multisensor, and a capability that helps predict the best maintenance window.
THE EU CYBER RESILIENCE ACT AND CONNECTED HVAC CONTROLLERS
WHY HVAC CONTROLLERS FALL UNDER THE CRA
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity requirements for products with digital elements placed on the European market. A connected HVAC controller that communicates with onboard networks is exactly such a product: it must be designed, delivered and maintained with security built in throughout its lifecycle. Smartair is engineered to meet these essential requirements at the source.
CRA TIMELINE
The CRA entered into force on 10 December 2024. Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026, and the main obligations of the regulation apply from 11 December 2027. Modernizing HVAC control now gives operators time to align legacy and new fleets ahead of full application.
Public regulatory dates — source: European Commission.
GLOBALLY CERTIFIED
Cybersecurity expectations are rising across railway markets worldwide. Merak already holds IEC 62443-4-1 certification for its secure development process in Spain, Austria and Australia, supporting operators who need to demonstrate a recognised, standards-based approach to cybersecurity in and beyond the European Union.
SECURE-BY-DESIGN RAIL HVAC CONTROLLER, BUILT AT THE SOURCE
At the heart of Smartair is the HEC-CS, Merak's railway HVAC controller, secure by design and aligned with Cyber Resilience Act (CRA) requirements. Built on the new HEC (HVAC Electronic Controller) platform under an IEC 62443-4-1 certified Secure Development Lifecycle, it combines defense in depth security mechanisms, secure communications, advanced diagnostics and intelligent monitoring within a single embedded control architecture, creating a robust foundation for connected HVAC operation and future digital services.
IEC 62443 COMPLIANCE
The HEC-CS controller is developed under an IEC 62443-4-1 secure product development lifecycle, ensuring that cybersecurity is embedded from design through delivery and long-term maintenance — not added afterwards.
PROTOCOL ARCHITECTURE
The HEC-CS controller integrates into modern railway networks through a broad range of communication interfaces, providing the foundation for secure digital services, remote diagnostics and future software evolution:
- Ethernet (M12), CAN, RS-485 and RS-232 as standard interfaces
- USB maintenance interface
- Optional MVB communication board and optional SIBAS PROFINET interface
- Optional dual-homing Ethernet architecture for increased network availability
CYBERSECURITY STARTS WITH KNOWING THE SYSTEM
YOU CAN’T SECURE WHAT YOU DON’T FULLY UNDERSTAND.
As the original designer and manufacturer of its embedded HVAC electronics, Merak brings deep system knowledge to every Smartair modernization. The controller is not treated as an isolated component, but as part of an HVAC architecture whose interfaces, operating logic and lifecycle requirements are already understood.
The HEC-CS follows a fit, form and function approach designed to preserve compatibility with existing systems while introducing new control, communication and cybersecurity capabilities. Combined with pre-qualified architectures and lifecycle expertise, this helps simplify integration, reduce technical risk and accelerate deployment.
Because when cybersecurity is engineered by the people who understand the HVAC system at its source, modernization becomes more than a replacement. It becomes a controlled evolution.
THREE CYBERSECURITY TIERS, ONE HARDWARE PLATFORM
The HEC-CS platform is available in three cybersecurity tiers, so operators and OEMs can align protection and services with their operational needs, regulatory requirements and budget — all on the same hardware, compatible with existing HVAC control architecture.
Core
Core
Essential cybersecurity functions: secure boot, certificates, cryptography, secure communications (HTTPS), password management, digital signatures, system logging (syslog), RTC synchronization and physical protection.
Basic
Basic
Builds on Core with web-based monitoring, password reset and syslog download through web services, together with incident and vulnerability management services.
Premium
Premium
Advanced web monitoring, enhanced security packages, centralized security log management, certificate-based web services and RADIUS authentication — for highly connected fleets.
CONDITION-BASED HVAC MAINTENANCE: LESS DOWNTIME, MORE ENERGY SAVINGS
A SMARTER CONTROLLER CAN DO MORE THAN PROTECT THE SYSTEM. IT CAN HELP OPERATORS UNDERSTAND IT.
Smartair combines advanced sensing — through the Smartair Multisensor — with real-time diagnostics and condition-based maintenance capabilities to provide greater visibility into HVAC operation. By turning system data into actionable insight, operators can identify developing issues earlier, optimize maintenance planning and support higher fleet availability.
This shift from reactive intervention towards more condition-based maintenance can help reduce unnecessary maintenance, improve asset utilization and support more efficient lifecycle management.
TECHNICAL SPECIFICATIONS
Mechanical Operating conditions Power HEC S1/S2/S3: 190 × 266 × 86.4 mm, approx. 1.75 kg.
HEC + REMio: 190 × 266 × 152.4 mm, approx. 3.2 kg. Temperature: −40°C to +85°C (OT4 class, EN 50155).
Max altitude: 5,000 m.
Humidity: annual avg ≤ 75%, up to 95% in prolonged damp conditions. Supplied through the Power Supply Module (PSm), supporting railway battery voltages.
Typical HEC S3: 4.32 W @ 24 Vdc / 5.39 W @ 110 Vdc.
CERTIFICATION
- Cyber Resilience Act (CRA) — HEC-CS functionalities aligned with CRA essential requirements
- IEC 62443-4-1 — secure product development lifecycle (certified: Spain, Austria, Australia)
- EN 50155:2021 — electronic equipment used on rolling stock
- EN 50121-3-2:2016+A1:2019 — electromagnetic compatibility (EMC)
- EN 61373:2010+AC:2017 — shock and vibration resistance
- EN 45545-2 — fire and smoke protection
- STM-E-001 — French railway electronic equipment standard
- RoHS Directive 2011/65/EU — fully compliant
RETROFIT YOUR FLEET
HVAC SYSTEMS CAN LAST FOR DECADES. THEIR ELECTRONICS SHOULDN’T STAND STILL.
Smartair enables operators to modernize outdated HVAC controllers without replacing complete HVAC units. Through the Naturail retrofit approach, existing rolling stock can gain updated cybersecurity, intelligent control and digital communication capabilities while preserving valuable mechanical assets already in service. Designed around existing system architectures, Smartair can support controller modernization during scheduled fleet overhauls, helping limit operational disruption while extending equipment service life — allowing legacy fleets to evolve with changing digital and cybersecurity requirements without the cost and complexity of unnecessary full-system replacement.
SUSTAINABLE, FULL-SYSTEM RAILWAY HVAC SOLUTIONS
As part of Naturail, Smartair works within a broader approach to railway HVAC modernization — three complementary technologies, one direction: moving railway HVAC forward.
Naturail
The modular approach to sustainable railway HVAC modernization - new build and retrofit.
Greenair
Lower-impact climate control wih natural refrigerants
Cleanair
Advanced onboard air quality through multistage distribution, filtration and purification.