scispace - formally typeset
Search or ask a question

Showing papers on "Cyber-physical system published in 2008"


Proceedings ArticleDOI
05 May 2008
TL;DR: It is concluded that it will not be sufficient to improve design processes, raise the level of abstraction, or verify designs that are built on today's abstractions to realize the full potential of cyber-Physical Systems.
Abstract: Cyber-Physical Systems (CPS) are integrations of computation and physical processes. Embedded computers and networks monitor and control the physical processes, usually with feedback loops where physical processes affect computations and vice versa. The economic and societal potential of such systems is vastly greater than what has been realized, and major investments are being made worldwide to develop the technology. There are considerable challenges, particularly because the physical components of such systems introduce safety and reliability requirements qualitatively different from those in general- purpose computing. Moreover, physical components are qualitatively different from object-oriented software components. Standard abstractions based on method calls and threads do not work. This paper examines the challenges in designing such systems, and in particular raises the question of whether today's computing and networking technologies provide an adequate foundation for CPS. It concludes that it will not be sufficient to improve design processes, raise the level of abstraction, or verify (formally or otherwise) designs that are built on today's abstractions. To realize the full potential of CPS, we will have to rebuild computing and networking abstractions. These abstractions will have to embrace physical dynamics and computation in a unified way.

3,309 citations


Proceedings ArticleDOI
17 Jun 2008
TL;DR: This position paper identifies and defines the problem of secure control, investigates the defenses that information security and control theory can provide, and proposes a set of challenges that need to be addressed to improve the survivability of cyber-physical systems.
Abstract: In this position paper we investigate the security of cyber-physical systems. We (1) identify and define the problem of secure control, (2) investigate the defenses that information security and control theory can provide, and (3) propose a set of challenges that need to be addressed to improve the survivability of cyber-physical systems.

820 citations


Journal ArticleDOI
TL;DR: A vulnerability assessment framework to systematically evaluate the vulnerabilities of SCADA systems at three levels: system, scenarios, and access points is proposed based on cyber systems embedded with the firewall and password models, the primary mode of protection in the power industry today.
Abstract: Vulnerability assessment is a requirement of NERC's cybersecurity standards for electric power systems. The purpose is to study the impact of a cyber attack on supervisory control and data acquisition (SCADA) systems. Compliance of the requirement to meet the standard has become increasingly challenging as the system becomes more dispersed in wide areas. Interdependencies between computer communication system and the physical infrastructure also become more complex as information technologies are further integrated into devices and networks. This paper proposes a vulnerability assessment framework to systematically evaluate the vulnerabilities of SCADA systems at three levels: system, scenarios, and access points. The proposed method is based on cyber systems embedded with the firewall and password models, the primary mode of protection in the power industry today. The impact of a potential electronic intrusion is evaluated by its potential loss of load in the power system. This capability is enabled by integration of a logic-based simulation method and a module for the power flow computation. The IEEE 30-bus system is used to evaluate the impact of attacks launched from outside or from within the substation networks. Countermeasures are identified for improvement of the cybersecurity.

523 citations


Journal ArticleDOI
TL;DR: A CPS definition is given and a prototype architecture is proposed and it is argued that this architecture captures the essential attributes of a CPS and lead to identification of many research challenges.
Abstract: Cyber-Physical Systems (CPS) is an exciting emerging research area that has drawn the attention of many researchers. Although the question of "What is a CPS?" remains open, widely recognized and accepted attributes of a CPS include timeliness, distributed, reliability, fault-tolerance, security, scalability and autonomous. In this paper, a CPS definition is given and a prototype architecture is proposed. It is argued that this architecture captures the essential attributes of a CPS and lead to identification of many research challenges.

171 citations


Proceedings ArticleDOI
30 Nov 2008
TL;DR: This work co-designs the control law and the task scheduling algorithm for predictable performance and power consumption for both the computing and the physical systems.
Abstract: The wide applications of cyber-physical systems (CPS) call for effective design strategies that optimize the performance of both computing units and physical plants.We study the task scheduling problem for a class of CPS whose behaviors are regulated by feedback control laws. We co-design the control law and the task scheduling algorithm for predictable performance and power consumption for both the computing and the physical systems. We use a typical example, multiple inverted pendulums controlled by one processor, to illustrate our method.

128 citations


Proceedings ArticleDOI
20 Jul 2008
TL;DR: In this article, a model of a future combined cyber-physical energy system is introduced, which is qualitatively different from the currently used models that do not explicitly account for the effects of sensing and communications.
Abstract: In this paper a model of a future combined cyber-physical energy system is introduced. We view such systems as the intertwined physical-cyber network interconnections of many non-uniform components, such as diverse energy sources and different classes of energy users, equipped with their own local cyber. This modeling approach is qualitatively different from the currently used models that do not explicitly account for the effects of sensing and communications. The proposed approach is based, instead, on representing all physical components as modules interconnected by means of an electric network. However, not all physical components can be modeled from first principles because of the extreme non-uniformity and the complexity of various classes of components. Instead, many components and/or groups of components have to be monitored and their models have to be identified using extensive signal processing, sensing, and model identification. We illustrate such combined cyber-physical models of key components, and use these to introduce a structure preserving model of a cyber-physical infrastructure of the interconnected system. Such a model becomes a basis for deciding what to sense and at which rate, what level of data mining is needed for which (groups of) physical modules to achieve predictable performance for cyber-physical future energy systems. This model rests on the premise that the performance of future energy systems can be shaped in major ways by means of broadly available cyber technologies. In order to make the most out of the available cyber technologies, the first step is to establish models which capture these interdependencies. This paper is a step in such direction.

114 citations


Book ChapterDOI
14 Nov 2008
TL;DR: This paper discusses event-based semantics in the context of the emerging concept of Cyber Physical Systems and describes two related formal models concerning policy-based coordination and Interactive Agents.
Abstract: This paper discusses event-based semantics in the context of the emerging concept of Cyber Physical Systems and describes two related formal models concerning policy-based coordination and Interactive Agents

107 citations


Proceedings ArticleDOI
30 Nov 2008
TL;DR: This paper proposes a holistic approach to SHM that integrates a decentralized computing architecture with the damage localization assurance criterion algorithm, and presents a prototype implementation of this system built using the TinyOS operating system running on the Intel Imote2 sensor network platform.
Abstract: Wireless sensor networks (WSNs) have become an increasingly compelling platform for structural health monitoring (SHM) applications, since they can be installed relatively inexpensively onto existing infrastructure. Existing approaches to SHM in WSNs typically address computing system issues or structural engineering techniques, but not both in conjunction. In this paper, we propose a holistic approach to SHM that integrates a decentralized computing architecture with the damage localization assurance criterion algorithm. In contrast to centralized approaches that require transporting large amounts of sensor data to a base station, our system pushes the execution of portions of the damage localization algorithm onto the sensor nodes, reducing communication costs by an order of magnitude in exchange for moderate additional processing on each sensor. We present a prototype implementation of this system built using the TinyOS operating system running on the Intel Imote2 sensor network platform. Experiments conducted using two different physical structures demonstrate our system's ability to accurately localize structural damage. We also demonstrate that our decentralized approach reduces latency by 64.8% and energy consumption by 69.5% compared to a typical centralized solution, achieving a projected lifetime of 191 days using three standard AAA batteries. Our work demonstrates the advantages of a holistic approach to cyber-physical systems that closely integrates the design of computing systems and physical engineering techniques.

99 citations



Proceedings ArticleDOI
05 Nov 2008
TL;DR: This work presents a macroprogramming framework called MacroLab that offers a vector programming abstraction similar to Matlab for Cyber-Physical Systems (CPSs) that introduces almost no additional overhead over TinyOS programs.
Abstract: We present a macroprogramming framework called MacroLab that offers a vector programming abstraction similar to Matlab for Cyber-Physical Systems (CPSs). The user writes a single program for the entire network using Matlab-like operations such as addition, find, and max. The framework executes these operations across the network in a distributed fashion, a centralized fashion, or something between the two - whichever is most efficient for the target deployment. We call this approach deployment-specific code decomposition (DSCD). MacroLab programs can be executed on mote-class hardware such as the Telos [24] motes. Our results indicate that MacroLab introduces almost no additional overhead in terms of message cost, power consumption, memory footprint, or CPU cycles over TinyOSprograms.

84 citations


Book ChapterDOI
01 Oct 2008
TL;DR: A model-integrated development approach is introduced that addresses the development needs of cyber-physical systems through the pervasive use of models and a complete model-based view is proposed that covers all aspects of the hardware and software components, as well as their interactions.
Abstract: Cyber-physical systems represent a new class of systems that integrate physics with computation. Their correct design is frequently of great importance as they are applied in safety- or business-critical contexts. This paper introduces a model-integrated development approach that addresses the development needs of such systems through the pervasive use of models. A complete model-based view is proposed that covers all aspects of the hardware and software components, as well as their interactions. Early experiments and work in progress are also reported.

Journal ArticleDOI
TL;DR: This article investigates challenges in industrial process control and proposes a CPS architecture for future research, which can only be solved by a new unifying network and control theory.
Abstract: As a large-scale interconnected system of heterogeneous components integrating computation with physical processes, Cyber-Physical Systems (CPS) can greatly improve the efficiency of industrial process control systems. However, the inherent heterogeneity and the close integration of different components pose new challenges, which can only be solved by a new unifying network and control theory. This article investigates such challenges in industrial process control and proposes a CPS architecture for future research. Some open research issues are also suggested.

Proceedings ArticleDOI
29 Jul 2008
TL;DR: In this article, the main characteristics of WSANs and the requirements of QoS provisioning in the context of cyber-physical computing are examined and a feedback scheduling framework is proposed to tackle some of the identified challenges.
Abstract: Technical advances in ubiquitous sensing, embedded computing, and wireless communication are leading to a new generation of engineered systems called cyber-physical systems (CPS). CPS promises to transform the way we interact with the physical world just as the Internet transformed how we interact with one another. Before this vision becomes a reality, however, a large number of challenges have to be addressed. Network quality of service (QoS) management in this new realm is among those issues that deserve extensive research efforts. It is envisioned that wireless sensor/actuator networks (WSANs) will play an essential role in CPS. This paper examines the main characteristics of WSANs and the requirements of QoS provisioning in the context of cyber-physical computing. Several research topics and challenges are identified. As a sample solution, a feedback scheduling framework is proposed to tackle some of the identified challenges. A simple example is also presented that illustrates the effectiveness of the proposed solution.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: Empirical results demonstrate the need for, and the effectiveness of, the configurable component middleware approach in supporting different applications with a periodic and periodic events, and providing a flexible software platform for distributed cyber-physical systems with end-to-end timing constraints.
Abstract: Different distributed cyber-physical systems must handle a periodic and periodic events with diverse requirements. While existing real-time middleware such as real-time CORBA has shown promise as a platform for distributed systems with time constraints, it lacks flexible configuration mechanisms needed to manage end-to-end timing easily for a wide range of different cyber-physical systems with both aperiodic and periodic events. The primary contribution of this work is the design, implementation and performance evaluation of the first configurable component middleware services for admission control and load balancing of a periodic and periodic event handling in distributed cyber-physical systems. Empirical results demonstrate the need for, and the effectiveness of, our configurable component middleware approach in supporting different applications with a periodic and periodic events, and providing a flexible software platform for distributed cyber-physical systems with end-to-end timing constraints.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: In this paper, network-enabled real-time embedded databases (nRTEDBs) communicate with each other and control and communicate with wireless sensors in a secure, timely manner and significantly enhance the overall timeliness, security, and efficiency in CPSs.
Abstract: Cyber physical systems (CPSs) have grand visions with great socio-economic impacts such as blackout-free electricity supply and real-time disaster recovery. A key challenge is providing real-time data services for CPSs. Existing real-time data management techniques and wireless sensor networks (WSNs) fall far short to support timely, secure real-time data services for CPSs. In this paper, we present a novel information-centric approach to supporting these requirements in CPSs. In our approach, network-enabled real-time embedded databases (nRTEDBs) communicate with each other and control and communicate with wireless sensors in a secure, timely manner. Unlike sensor databases such as TinyDB, nRTEDBs collaboratively derive global knowledge of real world phenomena. Based on the collective information, they actively control a WSN to extract important data directly relevant to an event of interest. In this way, nRTEDBs considerably enhance the overall timeliness, security, and efficiency.

Proceedings ArticleDOI
30 Nov 2008
TL;DR: The architecture is described for a system consisting of a robotic manipulator controlled by a digital controller over a wireless network and it is shown that the system is stable even in the presence of time-varying delays.
Abstract: Real-life cyber-physical systems, such as automotive vehicles, building automation systems, and groups of unmanned vehicles are monitored and controlled by networked control systems. The overall system dynamics emerges from the interaction among physical dynamics, computational dynamics, and communication networks. Network uncertainties such as time-varying delay and packet loss cause significant challenges. This paper proposes a passive control architecture for designing wireless networked control systems that are insensitive to network uncertainties. We describe the architecture for a system consisting of a robotic manipulator controlled by a digital controller over a wireless network and we show that the system is stable even in the presence of time-varying delays. We present simulation results that demonstrate the advantages of the architecture with respect to stability and performance and show that the system is insensitive to network uncertainties.

Journal ArticleDOI
TL;DR: Requirements for Immersive CPSs, in which people interact with their local environments, are presented, and a design for distributed data stream creation and sharing is described.
Abstract: Emerging research in cyber-physical systems (CPSs) often leaves out a key component--the ordinary user. We present requirements for Immersive CPSs, in which people interact with their local environments, and describe a design for distributed data stream creation and sharing.

Journal ArticleDOI
TL;DR: The problems and challenges of Cyber Physical Systems (CPS) are presented, and features and benefits of a generic framework to enable design, modeling and simulation of large-scale, heterogeneous CPS systems in an integrated manner are discussed.
Abstract: Wireless technologies have contributed to extensive development of many kinds of applications that enable cost-effective and intelligent monitoring and control of physical environments, objects, activities such as smart buildings, home or industry automation, and remote patient care. These kinds of applications often require support of heterogeneous physical environments and large-scale systems mixing several different types of monitoring and control. In addition to heterogeneity and scalability support, mobility support is crucial in the development of these software systems.Although much research has addressed design, modeling and simulation of such systems, most solutions usually do not cover all requirements from different domains. Rather, these solutions restrict the development environment and reduce flexibility of design by enforcing the use of a specific software platform and tightly-coupled tools.This paper presents problems and challenges of Cyber Physical Systems (CPS) like the aforementioned applications, and discusses features and benefits of a generic framework to enable design, modeling and simulation of large-scale, heterogeneous CPS systems in an integrated manner.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: This article proposes using formal methods, self-stabilization, and (m,k)-firm scheduling to allow the safe cyber-physical operation of a medical ventilator, a life-critical reactive device to move breathable air into and out of the lungs of a patient with respiratory difficulties, with the ultimate goal of speeding-up the recovery of the patient.
Abstract: Medical and medication devices are real-time systems with safety and timing requirements. They range from hard-real-time, embedded, and reactive systems such as pacemakers to soft-real-time, stand-alone medication dispensers. Many of these devices are already connected to computer networks, especially in hospital intensive-care units, so that patients' conditions detected by sensors can be monitored in real-time at remote computer stations nearby or at other sites. However, remote adjustment of medical devices' output and actuation is typically not allowed due to safety concerns. This article discusses a number of issues such as verification that must be resolved in order to allow cyber-physical operation of medical devices. In particular, we propose using formal methods, self-stabilization, and (m,k)-firm scheduling to allow the safe cyber-physical operation of a medical ventilator, a life-critical reactive device to move breathable air into and out of the lungs of a patient with respiratory difficulties, with the ultimate goal of speeding-up the recovery of the patient.

Book ChapterDOI
14 Nov 2008
TL;DR: A novel paradigm is proposed, based on the idea of using simplicity to control complexity, to achieve highly reliable CPS designs that embody design rules of this complexity-control nature in highly reusable, very robust, and formally verified architectural patterns.
Abstract: The design of cyber physical systems (CPS) presents many challenges because of their complexity, strong safety requirements, distribution, and real-time nature. We propose a novel paradigm, based on the idea of using simplicity to control complexity, to achieve highly reliable CPS designs. The goal is to embody design rules of this complexity-control nature in highly reusable, very robust, and formally verified architectural patterns. We discuss some preliminary work and experiments illustrating how this can be done for CPS systems.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: In this paper, the authors make use of formal information flow models to describe leakage in a model CPS, the Cooperating FACTS Power System, and show that while a casual observer cannot ascertain confidential internal information, when application semantics, including timing, are considered, this confidentiality is lost.
Abstract: Security in a cyber-physical system (CPS) is not well understood. Interactions between components in the cyber and physical domains lead to unintended information flow. This paper makes use of formal information flow models to describe leakage in a model CPS, the Cooperating FACTS Power System. Results show that while a casual observer cannot ascertain confidential internal information, when application semantics, including timing, are considered, this confidentiality is lost. Model checking is used to verify the result. The significance of the paper is in showing an example of the complex interactions that occur between the Cyber and Physical domains and their impact on security.

Proceedings ArticleDOI
15 Sep 2008
TL;DR: The main goal of the research is to develop techniques for the detection of feature interactions for embedded systems in the automotive domain by using formal methods to detect all possible interactions.
Abstract: The main goal of our research is to develop techniques for the detection of feature interactions for embedded systems in the automotive domain. Automotive systems are cyber-physical systems (CPS), which are composed of a "cyber" part that consists of software components running on digital hardware and a "physical" part that is the mechanical processes monitored by the software. Feature interactions in automotive systems arise from the activation of two or more features sending requests to the mechanical processes that create contradictory physical forces, possibly at distinct times, that cause unsafe behaviours. An example is having simultaneous requests to apply the brakes and the throttle. While both actions may be "correct" according to the intended behaviour of each feature, their interaction is undesired and potentially dangerous. To deal with the feature interaction problem, we propose to perform analysis at design time by using formal methods to detect all possible interactions.

Journal ArticleDOI
TL;DR: This essay proposes several research directions for transforming existing real-time embedded systems to ones that conform with standards of modern cyber-physical systems.
Abstract: Most research directions in the context of cyber-physical systems have focused on developing computing foundations for designing, analyzing, and reasoning about systems being constructed from scratch. However, an equally important issue is to develop sound methods for transforming existing real-time embedded systems to ones that conform with standards of modern cyber-physical systems. This essay proposes several research directions for achieving such transformation techniques.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: This paper addresses challenges of resilient mission-critical cyber-physical systems by unifying formal software engineering with a suite of feedback control laws and efficient resource monitoring within a comprehensive design and development methodology.
Abstract: Mission-critical cyber-physical systems must be resilient to all classes of failures, both hardware and software components. Failures affecting a systempsilas ability to accurately control its physical actions are of special concern, requiring a meta-level monitoring and reaction ability to enable high-performance nominal and safe post-failure operation. This paper addresses these challenges by unifying formal software engineering with a suite of feedback control laws and efficient resource monitoring within a comprehensive design and development methodology.

Proceedings ArticleDOI
18 Nov 2008
TL;DR: A lazy schedule policy is designed to minimize energy expenditure of N mission-critical services without violating temporal constraints and simulations show its significant energy efficiency comparing to a non-lazy schedule.
Abstract: Energy consumption and timely requirements are two key factors affecting the performance of mission-critical cyber-physical systems. Little work deals with scheduling a set of time-sensitive services in a finite time interval. We consider a server serving N users in time interval [0, T]. Each user demands its service to be completed in a strict deadline. Based on convex power-speed relationship, a lazy schedule policy is designed to minimize energy expenditure of N mission-critical services without violating temporal constraints. Simulations show its significant energy efficiency comparing to a non-lazy schedule.

Proceedings ArticleDOI
17 Jun 2008
TL;DR: The proposed interactive protocol could be used for incorporating into future electric power grids high penetration of distributed generation resources, and this is illustrated on a simple example.
Abstract: In this paper we present a module-based modeling of electrical power grids. Each (group of) component(s) is defined as a module and its dynamics is represented in terms of its local variables and the interconnection variables between the module and the system network. Therefore, it is possible to specify the performance sub-objectives of each module for a given range of variations in interaction variables and to ensure that the local sub-objectives are met through local sensing and actuation. The specifications are implemented through an interactive cyber-based protocol between the local modules and the network operator. The network operator defines bounds on the interaction variables. Individual modules, in turn, adjust their own localcontrol to meet local performance specifications for the given bounds on the interaction variables. Sufficient conditions on network properties are derived under which this interactive protocol between the network operation and themodules converges to a system-wide stable operation. The proposed interactive protocol could be used for incorporating into future electric power grids high penetration of distributed generation resources, and this is illustrated on a simple example.

Proceedings ArticleDOI
17 Dec 2008
TL;DR: The top challenges in cyber-physical systems are discussed and conjectures on research directions of increasing interest in this realm are discussed.
Abstract: Moore's law, automation considerations, and the pervasive need for timely information lead to a next generation of distributed systems that are open, highly interconnected, and deeply embedded in the physical world. Such systems, called cyber-physical, were recently named the first research priority in networking and information technology in the US by the nation's presidential council of advisors on science and technology. They offer new research challenges that stem from openness, scale, and tight coupling between computation, communication, and distributed interaction with both physical and social contexts. Growing challenges span a large spectrum ranging from new models of computation for systems that live in physical and social spaces, to the enforcement of reliable, predictable, and timely end-to-end behavior in the face of high interactive complexity, increased uncertainly and imperfect implementation. This talk discusses the top challenges in cyber-physical systems and conjectures on research directions of increasing interest in this realm.

Journal ArticleDOI
TL;DR: CPS-IP is designed for special- purpose CPS systems built on critical infrastructure which requires global regulation and performance assurance for cyber physical interaction.
Abstract: As sensing, wireless communication, and embedded computing technologies evolve, more and more special-purpose cyber physical systems are emerging in our daily lives, such as mobile tracking and health care system, emplaced environmental monitoring systems, and building maintenance control systems. In these systems, heterogeneity is a fundamental research issue. To enable standard communication between these systems, we propose a new communication construct: CPS-IP and a framework combined with it. The goal is to facilitate the creation of systems of systems where there is an integration of myriads of physical data sources, actuators, and computing elements. Different from the Internet Protocol which is designed for a large scale, general-purpose systems, CPS-IP is designed for special- purpose CPS systems built on critical infrastructure which requires global regulation and performance assurance for cyber physical interaction. The novelty of our design is that we address heterogeneity of CPS systems at three different levels: function interoperability, policy regulation, and performance assurance.

01 Jan 2008
TL;DR: In this paper, the authors proposed an abstract heat flow model for Environmentally Coupled Cyber-Physical Distributed Systems (E CCPDS), which can be used for thermal-aware communication scheduling of biosensor networks and thermal management of data centers.
Abstract: This dissertation work deals with a special type of distribu ted systems which are referred to as Environmentally Coupled Cyber-Physical Distributed System (E CCPDS). An ECCPDS is a distributed system in which the operation of the distributed system has a direct ph ysical impact on its environment and vice versa. The deployment and operation of such distributed systems ma y have thermal, electrical, biological, acoustic, or mechanical interference on the surrounding environment . This work mainly focuses on thermal interference because te mperature rising is the most critical issue for electronic devices, and thermal interference is the mos t direct impact applied on the environment and distributed nodes themselves. This work explores the possi bility of minimizing interference through the network and system operation approach, instead of the indiv idual design approach. The work focuses on two exemplar applications: thermal-awa re in-vivo biosensor network design and thermal management of data center. These two applications a re vastly different and help to validate general applicability of the proposed approaches and methodology. Numerical simulations show that the approaches can reduce the temperature rise through heuristic scheduli ng a gorithms which consider some extra design factors such as locations, job history, cross interference , etc. For thermal-aware scheduling of biosensor networks, the scheduling approach minimizes the peak tempe ratur rise, reduces the thermal impact to human tissues, and achieves more balanced power consumption. For thermal management of data center, the approach reduces the heat recirculation, lowers the demand for cooling capacity and minimizes the energy costs. The contributions of the dissertation can be summarized as f ollows: • proposed an abstract heat flow model for Environmentally Cou pled Cyber-Physical Distributed Systems; the model can be used for identifying potential hot spo s and estimating thermal performance of ECCPDS in a more efficient and faster manner. • solved two thermal-aware application issues, namely, ther mal aware communication scheduling of biosensor networks and thermal management of data centers.

01 Jan 2008
TL;DR: This work identifies cases where cyber-physical transportation systems pose particularly demanding challenges for future research in formal analysis techniques, and discusses the increasing need for analysis techniques that scale to today’s tightly integrated transportation control.
Abstract: Substantial technological and engineering advances in various disciplines make it possible more than ever before to provide autonomous control choices for cars, trains, and aircraft. Correct automatic control can improve overall safety tremendously. Yet, ensuring a safe operation of those control assistants under all circumstances requires analysis techniques that are prepared for the rising complexity resulting from combinations of several computerized safety measures. We identify cases where cyber-physical transportation systems pose particularly demanding challenges for future research in formal analysis techniques. 1 Cyber-Physical Transportation Systems Cyber-physical systems are becoming more important in the supervisory and safety control functions of rail-based, airborne, and automotive transportation systems that have typically been performed by human operators before. Improvements in sensor accuracy, computational resources, and their understanding enable manufacturers to assist drivers and pilots on a level of sophistication that has never been possible before. Transportation assistance technology has most impact when supporting safety-critical driver or pilot decisions to prevent fatal accidents. It is of ultimate importance that these safety-critical control decisions are correct. Control assistance technology can influence the actual control choices that take effect in the transportation system in several ways: 1. Pure alerting functions in lane change assistants for cars, the traffic alert and collision avoidance system (TCAS) for aircraft; 2. Fine-grained adaptations of human control actions like stuttering and selective force distribution in anti-lock braking systems and electronic stability control for cars; and 3. Semi-automatic control by speed supervision controllers on rails and car parking assistants. Fully automatic proactive control has become feasible. Recent examples of this kind include the automatic train protection unit of the European train control system (ETCS) and auto pilot control for various aircraft maneuvering modes. Similar advances have been achieved in radar-based adaptive cruise control for cars that brake autonomously when approaching the end of a traffic jam. Recent robotic applications even allow completely driverless vehicle control. More generally, it turns out that nearly all modern transportation technology depends on a tight coupling with computer control. This makes them cyber-physical systems (CPS) and hybrid systems with interacting discrete and continuous dynamics. Soon, there will be a complete coverage of assistance technologies for important driver and pilot decisions. Simultaneously, the need for analysis techniques has become more pressing. Either, verification techniques have to ensure correct functioning of such safety-critical control devices or detect errors in their design before they cause fatal injuries. Tragic accidents indicate that the rising complexity of transportation systems makes it impossible for humans to understand their effects and side effects under all circumstances. This includes flaws in the warning system that led to the frontal train collision in Chatsworth 2008, deficiencies in some adaptive cruise controllers for cars from 2005, and unfortunate human-controller interactions causing the fatal mid-air collision in Uberlingen in 2002. Several large research projects have been launched already in Europe, including AVACS, ARTIST-2, HYCON, Minalogic, and SPEEDS. We need major initiatives for the US to take a lead in advancing the state of the art in CPS analysis. 2 Important Research Challenges for CPS Transportation The increasing need for analysis techniques that scale to today’s tightly integrated transportation control imposes several research challenges for CPS analysis and verification. Scalable Analysis with respect to Complexity and Dimensionality: The most pressing need today are analysis techniques that actually scale to the full complexity of real applications. The two most fundamental limitations today are that most analysis techniques can only handle fairly limited classes of system dynamics (usually only linear or even constant dynamics) and that the dimension of the continuous state space they can handle is low (around 3-8). Most applications are governed by more complicated differential equations (e.g., flight dynamics) and have substantially higher dimensions (models of the environment). Beyond any doubt, the major challenge for handling realistic traffic systems is to develop techniques that scale reliably both in the dimension and complexity of the system dynamics. Even today’s high precision analyses would already need non-linear dynamics for hundreds of variables. If future research advances are not able to solve the scalability problem, the growing complexity of CPS cannot be managed any more. Without significant technological advances, we are convinced that a thorough safety analysis will never become possible! Large-scale Verification Architectures for Cyber-Physical Systems: To speed up the verification process with good scalability properties for industrial settings, we envision the development of layered architectures. Rather than verifying each new transportation system from scratch, we consider it more economic and probably even more tractable to devise domain-specific verification frameworks. In much the same way as, e.g., cars are designed as instances of a product family, their safety and failure-robustness analysis should be conducted as a special instance of the general verification framework for ground transportation. For such a framework, a common parametric setup can then be pre-verified once and for all. Each design of a specific traffic agent would then only need to be re-analyzed with respect to a correct instantiation of the more general verification pattern. Ultimately, we conceive the forming of Verification Engineering as a new discipline devoted to the systematic development and use of corresponding domain-specific verification plans. Dynamic Networks of Cyber-Physical Systems: A different research challenge results from the overwhelming increase of wireless communication in transportation and the resulting consequences for the overall system scope. Already in current implementations of ETCS, GSM-based wireless is the exclusive communication channel for establishing consent as to which train is allowed to move how far on which track. Similarly, the upcoming CAR2CAR standard for co-operative car communication strives to use wireless adhoc networks to prevent road accidents and circumvent traffic jams. Consequently, we no longer find a fixed static setup of traffic agents. Instead, traffic agents form a fully dynamic network of physically moving hybrid systems with dynamically changing logical communication topology. The primary research challenge caused by CPS with dynamic topology is that the number of participants can change over time, so that not even the dimension of the system state space remains constant during its evolution. New verification techniques are in order that can handle arbitrary dimensionality adjustments during system transitions. Without these advances, analysis techniques will never be applicable to next generation transportation systems, so that the high potential of modern communication technology could never be used for safety-critical transportation. Probabilistic Effects in Cyber-Physical Transportation: A further challenge is automatic stochastic analysis of the likelihood of a certain event happening when taking the probability distribution of the corresponding transitions in the CPS into account. For instance, a train in ETCS may stop moving completely when all wireless communication channels suffer from 100% packet loss so that the train cannot receive movement negotiation messages. This is extremely unlikely, though. The question is: Is there an automatic algorithm for determining the probability of a train reaching its destination in time, given, e.g., a certain message loss probability and a particular repetitive sending scheme. More generally, is there an automatic tool that can prove that the failure probability in a stochastic CPS is bounded? Likewise, can we analyze stochastic environment models and sensor failure probabilities? The primary research challenge for stochastic CPS verification is to find analysis techniques that can handle their coupling of stochastic and hybrid dynamic system behavior by analyzing the transformation of appropriate probability distributions during hybrid evolutions. This technology will be of tremendous importance for conducting a formal risk analysis in future CPS for transportation. 3 Biographical Information Edmund M. Clarke is a University Professor at Carnegie Mellon University and FORE Systems Professor in the School of Computer Science. Among several other awards, he received the ACM Kanellakis Award, the IEEE Harry H. Goode Memorial Award, the ACM Turing Award, and the CADE Herbrand Award. Bruce Krogh is a Professor in the Department of Electrical and Computer Engineering at Carnegie Mellon University. He was the founding Editor-in-Chief of the IEEE Transactions on Control Systems Technology. Dr. Krogh is a Distinguished Member of the IEEE Control Systems Society and a Fellow of the IEEE. Andre Platzer is an Assistant Professor in the Computer Science Department at Carnegie Mellon University, Pittsburgh, PA. Among other awards, he received the best paper award at TABLEAUX 2007 and the Woody Bledsoe Award at IJCAR 2006. Raj Rajkumar is a Professor in the Department of Electrical and Computer Engineering at Carnegie Mellon University. He is Director of the Real-Time and Multimedia Systems Lab and Co-Director of the General Motors-Carnegie Mellon Collaborative Research Labs on Information Technology and on Autonomous Driving.