Model Checking Actor-based Cyber-Physical Systems

Theatre is a control-based, light-weight, reflective actor system designed to address the development of general distributed, timed (possibly probabilistic) systems and cyber-physical systems in particular. Theatre is characterized by its formal operational semantics. An abstract Theatre model, including the services of a possible deterministic network and associated protocol, can be analyzed by exhaustive model-checking or by statistical model checking or through ad-hoc simulators. Theatre is currently implemented in Java. Other languages are possible. A key point of Theatre is its volition to favoring a seamless transformation of an analyzed model into the terms of design and implementation phases. The tutorial will illustrate the modelling aspects of Theatre, its supporting analysis tools, its capability of combining discrete-time with continuous time, its maturity as a software engineering methodology, and some developed applications.

The development of Cyber Physical Systems (CPS) requires to model both the cyber (i.e., digital) parts, the physical parts and the interaction between them. The state of the practice in such domain usually involves different stakeholders, which use dedicated modeling languages tailored syntactically and semantically to their domain. Functional Mock-up Interface (FMI) is a recent standard, which provides technical facilities to enable the co-simulation among the different dedicated modeling languages. In this context, this paper investigates how discrete-event models of the cyber part are supported by FMI standard for co-simulation. Two main results are presented: 1) how SystemC models can be integrated into the FMI environment and 2) FMI limitations for the efficient use of discrete-event models in co-simulation. Both results are illustrated by using a simple but illustrative use case mixing models in SystemC (for the cyber part) and Modelica (for the physical part).

Design and verification of Cyber-Physical Systems using TrueTime, evolutionary optimization and UPPAAL

The emerging field of Cyber-Physical Systems (CPS) calls for new scenarios of the use of models. In particular, CPS require to support both the integration of physical and cyber parts in innovative complex systems or production chains, together with the management of the data gathered from the environment to drive dynamic reconfiguration at runtime or finding improved designs. In such a context, the engineering of CPS must rely on models to uniformly reason about various heterogeneous concerns all along the system life cycle. In the last decades, the use of models has been intensively investigated both at design time for driving the development of complex systems, and at runtime as a reasoning layer to support deployment, monitoring and runtime adaptations. However, the approaches remain mostly independent. With the advent of DevOps principles, the engineering of CPS would benefit from supporting a smooth continuum of models from design to runtime, and vice versa. In this vision paper, we introduce a vision for supporting model-based DevOps practices, and we infer the corresponding research roadmap for the modeling community to address this vision by discussing a CPS demonstrator.

Cyber Physical Systems (CPSs) are both software and hardware intense systems which are integrated into the digital world. An increasingly relevant application area for CPSs are software-driven industrial Production Automation Systems. A major driver of these Cyber Physical Production Systems is the need to integrate intelligent and smart functionalities into the production process at runtime that can run in the cyber world and do not radically change the underlying control flow of the physical plant. To gather the necessary knowledge for smart functionalities both cyber and physical parts must be captured, kept and analyzed together in a suitable CPS architecture – also despite frequent evolutionary changes during their whole (usually relative long) life span. This paper addresses this problem by presenting a service-component architecture for smart service-oriented CPSs which can manage implicit knowledge by acquiring, handling and analyzing domain specific service-components with respect to the CPS context.

Graph transformation has recently become more and more popular as a general, rule-based visual specification paradigm to formally capture (a) requirements or behavior of user models (on the model-level), and (b) the operational semantics of modeling languages (on the meta-level) as demonstrated by benchmark applications around the Unified Modeling Language (UML). The current paper focuses on the model checking-based automated formal verification of graph transformation systems used either on the model-level or meta-level. We present a general translation that inputs (i) a metamodel of an arbitrary visual modeling language, (ii) a set of graph transformation rules that defines a formal operational semantics for the language, and (iii) an arbitrary well-formed model instance of the language and generates a transitions system (TS) that serve as the underlying mathematical specification formalism of various model checker tools. The main theoretical benefit of our approach is an optimization technique that projects only the dynamic parts of the graph transformation system into the target transition system, which results in a drastical reduction in the state space. The main practical benefit is the use of existing back-end model checker tools, which directly provides formal verification facilities (without additional efforts required to implement an analysis tool) for many practical applications captured in a very high-level visual notation. The practical feasibility of the approach is demonstrated by modeling and analyzing the well-known verification benchmark of dining philosophers both on the model and meta-level.

Cyber-Physical Systems (CPS) integrates computing and physical processing: their behaviour is dictated by both computation and physical components. In this paper, we present a Model Checking approach for the automatic verification of the correctness of the system at hand. The strengths of our approach are the followings. First, we have implemented the CPS using the modelling and simulation based software JModelica to exploit its modular and parametrizables components. Second, we have verified the system's properties with a model-checking technique to exploit the automaticity of this approach and the completeness of the exploration of all the states of the CPS. In fact, with very few basic notions of the field to investigate, it is possible to design a complete model of a CPS. The system we model, for our proof of concept, is a Distributed Maximum Power Point Tracking (DMPPT) for photovoltaic systems, which relies on a control software to manage the system in every condition imposed by the environment (e.g. irradiation, temperature). We have parameterized the main physical inputs to carry out an automatic verification of a thorough simulation of the circuit under a large number of operational conditions, to deeply investigate the critical aspects of the system. The final goal of our study has been to design a tool to enable automatic verification using a model-checking approach in order to ensure the system correctness with respect to given requirements provided by the designer.

ProTest: An Automatic Test Environment for B Specifications

The massive penetration of Distributed Energy Resources (DER) and high speed power electronics, even at the distribution grid edge, increases the management and operational complexity of the network while necessitates predictive maintenance, control and failure prediction mechanisms in near real time. A distribution subsystem comprises a CPS (Cyber Physical System) where the Cyber part is enabled by a low latency IIoT network and computational resources at the edge (distribution grid subsystem controller) while the physical system is represented (Digital Twin) by a hybrid model of the grid: a data driven machine learning representation of a limited number of nodes, along with a discrete-time model-based transient state estimator which captures the near real time physical operation of the grid. In case of early warning measurements acquired through the IIoT, machine learning edge computations can detect the severity of the warning, identify the network area of interest while ignite the execution of the transient state estimation. The transient state estimation predicts the incoming failure in near real time while the timing window allows possible preventive actuation.

A model checker is an automatic tool that traverses a specific structure (normally a Kripke structure referred as the modelM) to check the satisfaction of some (temporal) logical propertyf. This is formally stated asM⊧f. For some formal notations, the modelMof a specificationS(written in a formal languageL) can be described as a labelled transition system (LTS). Specifically, it is not clear in general how usual tools such as SPIN, FDR, PAT, etc., create the LTS representation from a given process. Although one expects the coherence of the LTS generation with the semantics ofL, it is completely hidden inside the model checker itself. In this paper we show how to create a model checker forL, using a development approach based on its operational semantics. We use a systematic semantics embedding and the formal modeling using logic programming and analysis (FORMULA) framework to this end. We illustrate our strategy considering the formal language COMPASS modelling language (CML)—a new language that was based on CSP, VDM and the refinement calculus proposed for modelling and analysis of systems of systems. As FORMULA is based on satisfiability modulo theories solving, our model checker can handle communications and predicates involving data with infinite domains by building and manipulating a symbolic LTS. This goes beyond the capabilities of traditional CSP model checkers such as FDR and PAT. Moreover, we show how to reduce time and space complexities by simple semantic modifications in the embedding. This allows a more semantics-preserving tuning. Finally, we show a real implementation of our model checker in an integrated development platform for CML and its practical use on an industrial case study.

The article presents an analysis of the world experience in the use of digital technologies, including in the implementation of the "Industry-4.0" project, and highlights the key areas of use of "smart technologies" in the coal industry. The considered innovative scenario for the development of the digital transformation of the coal industry corresponds to the state’s intention to make the transition from a resource-based economy to an intellectual innovation. Digitalization, cyber-physical production systems and the "Internet of things" systems will be key technologies in the coal industry’s transformation. It was noted that it is necessary to create robotic mines to expand the area of coal production and production in a continuous mode, and coal processing based on the use of production cyber-physical systems, as well as the creation of an industrial Internet network in the coal industry. "Internet of things", automation and robotics of production processes will form the basis for the emergence of new production units - "Intelligent mine (section)", "Intelligent factory" and "Intelligent transport". The central element in the basic processes of mining production will be cyber-physical production systems in the extraction, preparation of reserves, processing and transportation of coal. It is emphasized that a full-fledged joint work of services and specialists in a single information space is necessary, which has difficulties in connection with finding the industry at the first level of "digital maturity". The research highlights the main promising technologies and areas of implementation of the "Industry-4.0" project in the coal industry.

This paper presents a cyber-physical systems modelling language for capturing and describing health-based critical infrastructures. Following this practice incident response plan developers are able to model and reason about security and recovery issues in medical cyber-physical systems from a security requirements engineering perspective. Our work builds upon concepts from the Secure Tropos methodology, where in this paper we introduce novel cyber-physical concepts, relationships and properties in order to carry out analysis of incident response plans based on security requirements. We illustrate our concepts through a case study of a radiological department’s medical cyber-physical systems that have been infected with the WannaCry ransomware. Finally, we discuss how our modelling language enriches security models with incident response concepts, guiding plan developers of health-based critical infrastructures in understanding cyber-physical systems vulnerabilities and support decision making at a tactical and a strategic level, through semi-automated secure recovery analysis.

Automation and the digital transformation have become important factors in the energy sector, as modern energy systems increasingly rely on communication and information technology to combine smart controls with hardware infrastructure. With the emergence of cyber-physical systems (CPS) as a trans-disciplinary field, such modern energy systems can be classified as cyber-physical energy systems (CPES), integrating the related research and development within a broader scope. An important aspect of the research and development related to CPS is to bridge the gap between the traditional engineering domains and computer science. This is especially true for CPES, where the related engineering domains have in the past come up with proven and reliable methods for designing even large and complex systems. However, existing modeling and simulation tools still struggle to cover all aspects of CPES. Hence, a combination of universal modeling languages and established, domain-specific tools (such as grid simulators and telecommunication simulators) is necessary. New methods, tools and algorithms are needed that are compact, computationally inexpensive, potentially self-organizing and intrinsically stable if applied to real energy systems.

False data injection (FDI) attacks are malicious insertions of false data as sensor measurements in a cyber-physical system, in order to lead the system to take a wrong action. False data injection attacks do not attack the computational or network components of cyber-physical systems but the interface between the physical and the cyber part. Such attacks are powerful and can have catastrophic results. Defense against them can be achieved by limiting the attack surface through vulnerability analysis of the cyber-physical system design and by monitoring system operation in the field with monitors that observe system parameters and sensor measurements and detect abnormal operation early. In this chapter, we describe promising techniques for vulnerability analysis and dynamic monitoring, based on efficient SMT solvers and Kalman filter techniques, respectively.

Multivariate conditional regression using a Bayesian estimation approach for the development of a surrogate dissolution model as part of a comprehensive Process Analytical Technology (PAT) release strategy is the subject of this chapter. An appropriate experimental design provides the basis for constructing a process model in the first step, relating dissolution variables as the response to the critical process parameters (CPPs). Dissolution variables are either: Case 1: in vitro release measurements at one or several specific dissolution time points, or Case 2: the three parameters of the Weibull function describing the full profile at the tablet or batch or run average level. The dissolution variables are augmented with the measured API Content-by-NIR of the tablet to form the multivariate response vector in the process model. Then a conditional regression of the dissolution variables given API Content-by-NIR content and process parameters settings in the second step yields a predictive surrogate model of the dissolution variables. In the first case, the surrogate model directly yields predictions of the in vitro release measurement at the specific time point(s). In the second case, Weibull parameters are predicted, yielding a mean dissolution prediction at any time point on the dissolution profile. The Bayesian estimation approach to the conditional regression model permits simulations that can characterize the analytical performance of the surrogate model with respect to accuracy and precision for model qualification purposes. Two examples are given which show the statistical modeling details of both cases.