Rail Settlement Plan Limited (RSP) is a company owned by the UK franchised Train Operating Companies (TOCs). RSP provides and manages on behalf of TOCs a number of shared services, ranging from the provision of ticket stock to the allocation of industry revenue.
RSP is currently working with TOCs to provide a 'smart ticketing' infrastructure at stations in the South East of England. The SEFT programme has identified a requirement for ITSO compliant platform validator (PVAL) equipment and associated services within SEFT rail stations.
PVALs will be required in two forms – free standing and wall mounted, with hardwired power supply and ethernet connectivity. There will also be an optional requirement for wireless and mobile communication solutions.
The requirement includes the provision of equipment, hardware and software design, development, testing, and installation services. Maintenance and ongoing service support will also be required.
PVALs will conform to the ISO/IEC 14443 standard to allow reading of ITSO and contactless payment cards (CPCs). They must also support the installation of an ITSO Security Application Module (ISAM), and be capable of interfacing with an ITSO Host or Operator Processing System (HOPS). PVALs shall operate within an ITSO infrastructure as defined by the ITSO 2.1.4 specification, ITSO on National Rail (NR) specification RSPS 3002, and allow the collection and validation of ITSO products.
SEFT's vision is to allow customers to use contactless payment cards (CPCs) for transit within, and potentially beyond, the SEFT area. This functionality will be delivered to ensure PVALs are EMV (Visa, MasterCard and American Express) enabled to read approved CPCs.
An integral part of the PVAL enablement is the requirement for EMV Level 1 and Level 2 certification with support for EMV card schemes, namely:
Level 1 – covering hardware, and including electro-mechanical aspects of the card/reader interface; and
Level 2 – covering software components associated with the interface between the card and reader only, including the scheme specific software kernels.
Adequate PCI DSS measures will be required within the PVAL unit to ensure the security of the cardholder data is not compromised.
Subject to the terms of the framework agreement, the goods/services to be provided under the framework may be provided directly to RSP, other public transport service providers and/or TOCS (from time to time and including any other entities akin to or replacing TOCs).