CRII: CPS: Safe Cyber-Physical Systems Upgrades

网络物理系统(CP)包含了对物理世界及其相互作用的无数方面进行计算机控制的下一代技术。CPS的典型工程流程是从一个版本到下一个版本重复使用现有的设计、模型、组件和软件。例如，在汽车工程中，在开发下一个模型年的车辆时，重复使用现有模型年车辆设计的很大一部分是常见的，这种做法在从航空航天到生物医学的CPS行业中很常见。虽然重用极大地提高了效率和生产力，但它可能会在子组件的规范之间引入意外的不匹配。例如，2011年美国国家公路交通安全管理局(NHTSA)召回了超过150万辆2005-2010款车型，原因是升级了一个物理变速器组件，该组件在软件中没有得到适当的解决。当软件或硬件升级(实际上是网络或物理规范更改)没有通过另一个域中的更新(实际上是匹配的规范更改)来解决时，可能会发生网络和物理规范之间的不匹配。这项研究将开发新的技术和软件工具，以自动检测是否存在网络物理规范不匹配，然后在运行时减轻此类不匹配的影响，总体目标是产生社会日益依赖的更可靠和更安全的CPS。开发的探测和缓解方法将在能源CPS试验台上进行评估。虽然评估试验台在能源领域，但该方法也适用于其他CPS领域，如汽车、航空航天和生物医学。教育目标将弥合计算机科学和电气工程之间的差距，通过开发教育平台来提高CPS工程设计和验证技能，培养不同的下一代CPS工程师。拟议的研究是开发新的技术和工具，以自动识别和缓解网络物理规范不匹配的影响。主要研究目标有三个。第一个目标是确定网络物理规格不匹配。为了识别失配，检测问题将使用混合输入/输出自动机(HIOA)框架进行形式化。离线算法将被设计为使用静态和动态分析从模型和实现中找到候选规范，然后识别候选不匹配。第二个目标是监测和确保安全的CPS升级。由于现代CPS设计很复杂，因此在设计时确定所有规格和所有子组件之间的不匹配可能是不可行的。将为推断的规范开发运行时监控和验证方法，以在运行时检测不匹配。当它们被识别时，建立在监督控制和Simplex架构上的运行时保证框架将确保CPS运行时的安全。第三个目标是通过一个示例CPS来评估安全的CPS升级。其他目标的结果及其确保安全CPS升级的能力将在能源CPS试验台中进行评估，即交流配电微电网，将光伏等直流产生的可再生能源连接到交流。

Cyber-physical systems (CPS) encompass the next generation of computerized control for countless aspects of the physical world and interactions thereof. The typical engineering process for CPS reuses existing designs, models, components, and software from one version to the next. For example, in automotive engineering, it is common to reuse significant portions of existing model-year vehicle designs when developing the next model-year vehicle, and such practices are common across CPS industries, from aerospace to biomedical. While reuse drastically enhances efficiency and productivity, it leads to the possibility of introducing unintended mismatches between subcomponents' specifications. For example, a 2011 US National Highway Traffic Safety Administration (NHTSA) recall of over 1.5 million model-year 2005-2010 vehicles was due to the upgrade of a physical transmission component that was not appropriately addressed in software. A mismatch between cyber and physical specifications may occur when a software or hardware upgrade (in effect, a cyber or physical specification change) is not addressed by an update (in effect, a matching specification change) in the other domain. This research will develop new techniques and software tools to detect automatically if cyber-physical specification mismatches exist, and then mitigate the effects of such mismatches at runtime, with the overall goal to yield more reliable and safer CPS upon which society increasingly depends. The detection and mitigation methods developed will be evaluated in an energy CPS testbed. While the evaluation testbed is in the energy domain, the methods are applicable to other CPS domains such as automotive, aerospace, and biomedical. The educational goals will bridge gaps between computer science and electrical engineering, preparing a diverse set of next-generation CPS engineers by developing education platforms to enhance CPS engineering design and verification skills.The proposed research is to develop new techniques and tools to automatically identify and mitigate the effects of cyber-physical specification mismatches. There are three major research objectives. The first objective is to identify cyber-physical specification mismatches. To identify mismatches, a detection problem will be formalized using the framework of hybrid input/output automata (HIOA). Offline algorithms will be designed to find candidate specifications from models and implementations using static and dynamic analyses, and then identify candidate mismatches. The second objective is to monitor and assure safe CPS upgrades. As modern CPS designs are complex, it may be infeasible to determine all specifications and mismatches between all subcomponents at design time. Runtime monitoring and verification methods will be developed for inferred specifications to detect mismatches at runtime. When they are identified, a runtime assurance framework building on supervisory control and the Simplex architecture will assure safe CPS runtime operation. The third objective is to evaluate safe CPS upgrades in an example CPS. The results of the other objectives and their ability to ensure safe CPS upgrades will be evaluated in an energy CPS testbed, namely an AC electrical distribution microgrid that interfaces DC-producing renewables like photovoltaics to AC.