CRII: CPS: Safe Cyber-Physical Systems Upgrades

信息物理系统（CPS）包括下一代计算机控制的无数方面的物理世界及其相互作用。CPS的典型工程流程从一个版本到下一个版本重复使用现有设计、模型、组件和软件。例如，在汽车工程中，在开发下一个车型年的车辆时，通常会重用现有车型年车辆设计的重要部分，并且这种做法在CPS行业中很常见，从航空航天到生物医学。虽然重用极大地提高了效率和生产力，但它可能会在子组件的规范之间引入意想不到的不匹配。例如，2011年美国国家公路交通安全管理局（NHTSA）召回了超过150万辆2005-2010年款汽车，原因是软件中没有适当解决的物理变速器组件升级。当软件或硬件升级（实际上，网络或物理规范更改）未通过其他域中的更新（实际上，匹配规范更改）解决时，可能会发生网络规范和物理规范之间的不匹配。这项研究将开发新的技术和软件工具，以自动检测是否存在网络物理规范不匹配，然后在运行时减轻这种不匹配的影响，总体目标是产生社会越来越依赖的更可靠，更安全的CPS。开发的检测和缓解方法将在能源CPS测试平台上进行评估。虽然评估测试平台是在能源领域，该方法适用于其他CPS领域，如汽车，航空航天和生物医学。教育目标将弥合计算机科学和电气工程之间的差距，通过开发教育平台，以提高CPS工程设计和验证技能，培养多样化的下一代CPS工程师。拟议的研究是开发新的技术和工具，以自动识别和减轻网络物理规范不匹配的影响。有三个主要的研究目标。第一个目标是确定网络-物理规范不匹配。为了识别不匹配，检测问题将使用混合输入/输出自动机（HIOA）的框架进行形式化。离线算法将被设计为使用静态和动态分析从模型和实现中找到候选规范，然后识别候选不匹配。第二个目标是监控和确保CPS升级的安全。由于现代CPS设计很复杂，在设计时确定所有子组件之间的所有规格和失配可能是不可行的。将为推断出的规范开发可持续监测和验证方法，以在运行时检测不匹配。当它们被识别时，基于监督控制和Simplex架构的运行时保证框架将确保CPS运行时的安全操作。第三个目标是评估示例CPS中的安全CPS升级。其他目标的结果及其确保安全CPS升级的能力将在能源CPS测试平台中进行评估，即交流配电微电网，该微电网将产生DC的可再生能源（如光伏发电）与AC连接。

Cyber-physical systems (CPS) encompass the next generation of computerized control for countless aspects of the physical world and interactions thereof. The typical engineering process for CPS reuses existing designs, models, components, and software from one version to the next. For example, in automotive engineering, it is common to reuse significant portions of existing model-year vehicle designs when developing the next model-year vehicle, and such practices are common across CPS industries, from aerospace to biomedical. While reuse drastically enhances efficiency and productivity, it leads to the possibility of introducing unintended mismatches between subcomponents' specifications. For example, a 2011 US National Highway Traffic Safety Administration (NHTSA) recall of over 1.5 million model-year 2005-2010 vehicles was due to the upgrade of a physical transmission component that was not appropriately addressed in software. A mismatch between cyber and physical specifications may occur when a software or hardware upgrade (in effect, a cyber or physical specification change) is not addressed by an update (in effect, a matching specification change) in the other domain. This research will develop new techniques and software tools to detect automatically if cyber-physical specification mismatches exist, and then mitigate the effects of such mismatches at runtime, with the overall goal to yield more reliable and safer CPS upon which society increasingly depends. The detection and mitigation methods developed will be evaluated in an energy CPS testbed. While the evaluation testbed is in the energy domain, the methods are applicable to other CPS domains such as automotive, aerospace, and biomedical. The educational goals will bridge gaps between computer science and electrical engineering, preparing a diverse set of next-generation CPS engineers by developing education platforms to enhance CPS engineering design and verification skills.The proposed research is to develop new techniques and tools to automatically identify and mitigate the effects of cyber-physical specification mismatches. There are three major research objectives. The first objective is to identify cyber-physical specification mismatches. To identify mismatches, a detection problem will be formalized using the framework of hybrid input/output automata (HIOA). Offline algorithms will be designed to find candidate specifications from models and implementations using static and dynamic analyses, and then identify candidate mismatches. The second objective is to monitor and assure safe CPS upgrades. As modern CPS designs are complex, it may be infeasible to determine all specifications and mismatches between all subcomponents at design time. Runtime monitoring and verification methods will be developed for inferred specifications to detect mismatches at runtime. When they are identified, a runtime assurance framework building on supervisory control and the Simplex architecture will assure safe CPS runtime operation. The third objective is to evaluate safe CPS upgrades in an example CPS. The results of the other objectives and their ability to ensure safe CPS upgrades will be evaluated in an energy CPS testbed, namely an AC electrical distribution microgrid that interfaces DC-producing renewables like photovoltaics to AC.