Guaranteeing Proper-Temporal-Embedding Safety Rules in Wireless CPS: - - PowerPoint PPT Presentation

▶
guaranteeing proper temporal embedding safety rules in
SMART_READER_LITE
LIVE PREVIEW

Guaranteeing Proper-Temporal-Embedding Safety Rules in Wireless CPS: - - PowerPoint PPT Presentation

May 03, 2023 163 likes •1.12k views

Guaranteeing Proper-Temporal-Embedding Safety Rules in Wireless CPS: A Hybrid Formal Modeling Approach Feng Tan * , Yufei Wang * , Qixin Wang * , Lei Bu , Rong Zheng , Neeraj Suri ** * Embedded Systems & Networking Lab, Dept. of

slide-1
SLIDE 1

Guaranteeing Proper-Temporal-Embedding Safety Rules in Wireless CPS: A Hybrid Formal Modeling Approach

Feng Tan*, Yufei Wang*, Qixin Wang*, Lei Bu†, Rong Zheng‡, Neeraj Suri**

* Embedded Systems & Networking Lab, Dept. of Computing, The Hong Kong Polytechnic Univ. † State Key Lab for Novel Software Tech., Dept. of Computer Sci. & Tech., Nanjing Univ., China ‡ Dept. of Computing and Software, McMaster Univ., Canada ** Dept. of Computer Science, TU Darmstadt, Germany

June 26, 2013

slide-2
SLIDE 2

Evaluation Related Work Background Problem Solution Demand Overview

slide-3
SLIDE 3

Cyber-Physical Systems (CPS) are typically distributed and life/mission critical. Life/Mission critical CPS demand wireless Wireless is unreliable Conflict

slide-4
SLIDE 4

Cyber-Physical Systems (CPS) are typically distributed and life/mission critical. Life/Mission critical CPS demand wireless Wireless is unreliable Conflict PTE Safety Guarantee

slide-5
SLIDE 5

Cyber-Physical Systems (CPS) are typically distributed and life/mission critical. Life/Mission critical CPS demand wireless Wireless is unreliable Conflict PTE Safety Guarantee

Design Pattern Hybrid Modeling

slide-6
SLIDE 6

Cyber Physical Systems (CPS): systems involving tight/complex coupling of computer and physical subsystems Medical Manufacturing Avionics

slide-7
SLIDE 7

CPS Features

Typically distributed and life/mission-critical Real-time (in addition to logical time) matters Modeling must integrate both discrete and continuous aspects

slide-8
SLIDE 8

Distributed life/mission critical CPS demand wireless communications.

slide-9
SLIDE 9

Distributed life/mission critical CPS demand wireless communications.

slide-10
SLIDE 10

Distributed life/mission critical CPS demand wireless communications.

slide-11
SLIDE 11

Distributed life/mission critical CPS demand wireless communications. Wireless is unreliable

slide-12
SLIDE 12

How to guarantee the safety of life/mission critical wireless CPS? Life/Mission critical CPS demand wireless Wireless is unreliable Conflict

slide-13
SLIDE 13

How to guarantee the Proper-Temporal-Embedding (PTE) safety rule of life/mission critical wireless CPS?

Life/Mission critical CPS demand wireless Wireless is unreliable Conflict PTE Safety Guarantee

slide-14
SLIDE 14

What is Proper-Temporal-Embedding (PTE) safety rule?

slide-15
SLIDE 15

CPS Feature 2: real-time (in addition to logical time) matters!

slide-16
SLIDE 16

CPS Feature 2: real-time (in addition to logical time) matters!

risky state dwelling time upper bound risky state dwelling time upper bound

slide-17
SLIDE 17

CPS Feature 2: real-time (in addition to logical time) matters!

enter-risky safeguard interval

slide-18
SLIDE 18

CPS Feature 2: real-time (in addition to logical time) matters!

exit-risky safeguard interval

slide-19
SLIDE 19

How to guarantee PTE safety despite of arbitrary wireless link failures?

slide-20
SLIDE 20

How to guarantee PTE safety despite of arbitrary wireless link failures? Leasing Design Pattern: risky state dwelling time must be leased.

slide-21
SLIDE 21

General concepts of Leasing design pattern: each CPS entity takes one of the 3 roles. Initiator Supervisor Participant Participant

  • 1. request
  • 2. lease
  • 2. lease
  • 3. approve
slide-22
SLIDE 22

CPS Features: 1. real-time matters; 2. real-time PTE even when aborting/canceling. (+ 3. arbitrary comm. failures)

Initiator Participant Participant

active fallback active fallback active fallback

slide-23
SLIDE 23

How to formally describe, analyze, and use Leasing design pattern in the context of CPS?

slide-24
SLIDE 24

How to formally describe, analyze, and use Leasing design pattern in the context of CPS? CPS Feature 3 implies the use of hybrid automata modeling

slide-25
SLIDE 25

Hybrid Automaton is a state-of-the-art modeling tool for CPS.

Bouncing Ball Example

slide-26
SLIDE 26

Leasing Design Pattern for PTE Safety Rules: detailed Supervisor's hybrid automaton

slide-27
SLIDE 27

Leasing Design Pattern for PTE Safety Rules: detailed Initiator's hybrid automaton

slide-28
SLIDE 28

Leasing Design Pattern for PTE Safety Rules: detailed Participant's hybrid automaton

slide-29
SLIDE 29

Leasing Design Pattern for PTE Safety Rules: detailed Participant's hybrid automaton

slide-30
SLIDE 30

Leasing Design Pattern for PTE Safety Rules: detailed Participant's hybrid automaton

slide-31
SLIDE 31

Validity of the design pattern

Theorem 1: If the temporal parameters of the design pattern hybrid automata satisfy a certain set of linear inequalities, then PTE safety is guaranteed despite of arbitrary communications link failures.

slide-32
SLIDE 32

Validity of the design pattern

slide-33
SLIDE 33

Using the design pattern: how to turn design pattern into detailed CPS designs?

slide-34
SLIDE 34

We proposed a formal procedure to elaborate a design pattern hybrid automaton into a detailed design hybrid automaton.

Elaborate

slide-35
SLIDE 35

Validity of elaboration

Theorem 2: If detailed design hybrid automata are respectively derived by elaborating corresponding design pattern hybrid automata, then PTE safety is guaranteed despite of arbitrary communications link failures.

slide-36
SLIDE 36

Laser Tracheotomy Medical CPS: interconnect/interlock smart medical devices to increase safety Laser Tracheotomy without Device Interlock

slide-37
SLIDE 37

Laser Tracheotomy CPS Laser Tracheotomy Medical CPS: interconnect/interlock smart medical devices to increase safety

slide-38
SLIDE 38

Demand to use wireless links for safety and efficiency concerns.

Laser Tracheotomy CPS wireless links wireless links

slide-39
SLIDE 39

Demand to use wireless links for safety and efficiency concerns.

slide-40
SLIDE 40

Demand to use wireless links for safety and efficiency concerns.

Laser Tracheotomy CPS wireless links wireless links

slide-41
SLIDE 41

Laser Tracheotomy CPS PTE safety rule.

≥3sec ≥1.5sec ≤60sec

slide-42
SLIDE 42

System architecture and roles of the design pattern: Initiator, Supervisor, Participant

slide-43
SLIDE 43

System architecture and roles of the design pattern: Initiator, Supervisor, Participant

slide-44
SLIDE 44

System architecture and roles of the design pattern: Initiator, Supervisor, Participant

slide-45
SLIDE 45

System architecture and roles of the design pattern: Initiator, Supervisor, Participant

slide-46
SLIDE 46

Following the Leasing design pattern and Elaboration procedure, we derive detailed designs

slide-47
SLIDE 47

Emulation Scheme

slide-48
SLIDE 48

Emulation Results

slide-49
SLIDE 49

Related Work

Leasing Protocol [7,8,9,10,11,12][24]

check-point & roll-back logical time vs. real-time PTE uncontrollable physical world parameters

slide-50
SLIDE 50

Related Work

Use of formal modeling in design pattern [30~33]. Hybrid modeling mostly used for verification [3],[13~16]. Tichakorn [34] proposes use a subclass of hybrid automata for designing periodical hybrid control systems.

slide-51
SLIDE 51

Conclusion

  • 1. Proposed a Lease based design pattern to guarantee

PTE safety rules in wireless CPS, under arbitrary communication link failures.

  • 2. Derived the corresponding closed-form linear constraints

for temporal configuration parameters.

  • 3. Formal description of design pattern with hybrid modeling.
  • 4. Proposed a formal methodology to elaborate design

pattern hybrid automata to detailed design hybrid automata, while maintaining PTE safety properties.

slide-52
SLIDE 52

Thank you!

Life/Mission critical CPS demand wireless Wireless is unreliable Conflict PTE Safety Guarantee

Design Pattern Hybrid Modeling

slide-53
SLIDE 53

Cyber Physical Systems (CPS): systems involving tight/complex coupling of computer and physical subsystems Anesthesiology Surgical Medicine Nursing Communications Mechanics Computer Control

slide-54
SLIDE 54

Cyber Physical Systems (CPS): systems involving tight/complex coupling of computer and physical subsystems Chemical Engineering Control Mechanics Thermal Engineering Communications Computer

slide-55
SLIDE 55

Cyber Physical Systems (CPS): systems involving tight/complex coupling of computer and physical subsystems Computer Mechanics Aerodynamics Control Material Communications

slide-56
SLIDE 56

Demand to use wireless links for safety and efficiency concerns.

The Operation Room Spider Web

slide-57
SLIDE 57

Demand to use wireless links for safety and efficiency concerns.

The Operation Room Spider Web, after medical CPS safety interlocks

slide-58
SLIDE 58

Demand to use wireless links for safety and efficiency concerns.

Spider Web OR vs. Wireless OR

slide-59
SLIDE 59

How to guarantee PTE safety despite of arbitrary wireless link failures?

Leasing Design Pattern Hybrid Automata Modeling: formally describe, analyze, and use the design pattern

slide-60
SLIDE 60

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant

slide-61
SLIDE 61

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Fallback Fallback Fallback Fallback

slide-62
SLIDE 62

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Fallback Fallback Fallback Request

slide-63
SLIDE 63

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Fallback Request Lease Fallback

slide-64
SLIDE 64

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Fallback Request Lease

slide-65
SLIDE 65

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Request Lease Lease Fallback

slide-66
SLIDE 66

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Request Lease Lease

slide-67
SLIDE 67

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Supervisor Participant Participant Request Lease Lease Approve

slide-68
SLIDE 68

General concept of Leasing Design Pattern for CPS PTE guarantee Initiator Participant Participant

active fallback active fallback active fallback

slide-69
SLIDE 69

The same scenario can also apply to purely cyber

  • systems. What's the difference that CPS makes?

Initiator Participant Participant

active fallback active fallback active fallback

slide-70
SLIDE 70

CPS Features: 1. real-time matters; 2. real-time PTE even when aborting/canceling. (+ 3. arbitrary comm. failures)

Initiator Participant Participant

active fallback active fallback active fallback

slide-71
SLIDE 71

Leasing Design Pattern for PTE Safety Rules: sketch of Supervisor's hybrid automaton

slide-72
SLIDE 72

Leasing Design Pattern for PTE Safety Rules: sketch of Initiator's hybrid automaton

slide-73
SLIDE 73

Leasing Design Pattern for PTE Safety Rules: sketch of Participant's hybrid automaton

slide-74
SLIDE 74

Emulation Scheme

) ( 5 . 1 ), ( 3 : intervals safeguard PTE ) ( 6 ), ( 35 ), ( 3 : Ventilator ) ( 5 . 1 ), ( 20 ), ( 10 ), ( 5 : Initiator ) ( 3 ), ( 13 : Supervisor

min 1 2 : min 2 1 : 1 , max 1 , max 1 , 2 , max 2 , max 2 , max 2 , max min ,

s T s T s T s T s T s T s T s T s T s T s T

safe risky exit run enter exit run enter req wait fb

          

 

slide-75
SLIDE 75

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-76
SLIDE 76

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-77
SLIDE 77

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-78
SLIDE 78

Example Scenario Patient SpO2 Sensor Laser Scalpel Surgeon Supervisor Ventilator Pausing

slide-79
SLIDE 79

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-80
SLIDE 80

Example Scenario Patient SpO2 Sensor Ventilator Pausing

Laser Scalpel Shooting

Surgeon Supervisor

slide-81
SLIDE 81

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-82
SLIDE 82

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

lost

slide-83
SLIDE 83

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-84
SLIDE 84

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-85
SLIDE 85

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-86
SLIDE 86

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor

slide-87
SLIDE 87

Example Scenario Patient SpO2 Sensor Laser Scalpel Surgeon Supervisor Ventilator Pausing

slide-88
SLIDE 88

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-89
SLIDE 89

Example Scenario Patient SpO2 Sensor Ventilator Pausing

Laser Scalpel Shooting

Surgeon Supervisor

slide-90
SLIDE 90

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-91
SLIDE 91

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

lost

slide-92
SLIDE 92

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-93
SLIDE 93

Example Scenario Patient SpO2 Sensor Ventilator Pausing Laser Scalpel Surgeon Supervisor

slide-94
SLIDE 94

Example Scenario Patient SpO2 Sensor Ventilator Laser Scalpel Surgeon Supervisor