Cyber Physical Systems: New Challenges for Model-based Design

1. Cyber Physical Systems: New Challenges for Model-based Design Janos Sztipanovits ISIS, Vanderbilt University From Embedded Systems to Cyber-Physical Systems: A Review of the State-of-the-Art and Research Needs CHESS Workshop April 21, 2008

2. Embedded Systems Challenge Modeling Layer • Abstraction • Adjustable • Integrative • Precise • Safe (analyzable) • Integration • Affordable • Model-based (end-to-end) • Manage heterogeneity better • Automation • Domain-specific tool chains, but • Reusable infrastructure Systems industry turns IT driven: Aerospace, Automotive, Process,.. Software Control Systems package org.apache.tomcat.session; import org.apache.tomcat.core.*; import org.apache.tomcat.util.StringManager; import java.io.*; import java.net.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; /** * Core implementation of a server session * * @author James Duncan Davidson [duncan@eng.sun.com] * @author James Todd [gonzo@eng.sun.com] */ public class ServerSession { private StringManager sm = StringManager.getManager("org.apache.tomcat.session"); private Hashtable values = new Hashtable(); private Hashtable appSessions = new Hashtable(); private String id; private long creationTime = System.currentTimeMillis();; private long thisAccessTime = creationTime; private long lastAccessed = creationTime; private int inactiveInterval = -1; ServerSession(String id) { this.id = id; } public String getId() { return id; } public long getCreationTime() { return creationTime; } public long getLastAccessedTime() { return lastAccessed; } public ApplicationSession getApplicationSession(Context context, boolean create) { ApplicationSession appSession = (ApplicationSession)appSessions.get(context); if (appSession == null && create) { // XXX // sync to ensure valid? appSession = new ApplicationSession(id, this, context); appSessions.put(context, appSession); } // XXX // make sure that we haven't gone over the end of our // inactive interval -- if so, invalidate and create // a new appSession return appSession; } void removeApplicationSession(Context context) { appSessions.remove(context); } /** * Called by context when request comes in so that accesses and * inactivities can be dealt with accordingly. */ void accessed() { // set last accessed to thisAccessTime as it will be left over // from the previous access lastAccessed = thisAccessTime; thisAccessTime = System.currentTimeMillis(); } void validate()

3. Platforms, Abstractions and Domain Specific Modeling Languages (DSML) Key Idea: Manage design complexity by creating layers of abstractions in the design flow.(Alberto Sangiovanni-Vincentelli) Abstraction layers define platforms. Software architecture defines the composition of functions such that a least fixed point exists and is unique. Platform mapping Abstractions are linked through refinement relations. Hardware architecture defines a set of concurrent functional units, where the software architecture can be deployed. Platform mapping Abstraction layers allow the verification of different properties . Behavior models define a set of timed automata with local clocks and broadcast. Models can be analyzed with TCTL.

4. Model-Integrated Computing Key Idea: Capture intrinsic domain concepts with domain-specific modeling languages (DSML-s) and partition DSML-s into structural and behavioral semantics. The structural semantics excludes semantically meaningless models. • The structural semantics views a model as a structure, and provides a means for calculating which structures are well-formed. No operator was provided for composition of values, so this merge model is semantically meaningless in this domain. The behavioral semantics defines what the structures do.

5. Specification of Structural Semantics of DSML-s • Metamodels define the structural semantics of DSML-s: Abstract syntax of DSML-s are defined by metamodels. Metamodeling languages provide structural semantics. • GME, the metaprogrammable modeling tool of ISIS, supports rapid construction of metamodels and DSML models. OCL Constraints:self.transTo->forAll(s | s <> self) A metamodeling language is one of the DSML-s: the same tool can be used for modeling and metamodeling. Basic metamodeling notation: UML Class Diagram + OCL Model-editor generated from metamodel MetaGME metamodel of simple statecharts

6. Specification of Behavioral Semantics of DSML-s • Behavioral semantics are defined with model transformations and semantic anchoring. C++ coding permits complex behavioral semantics, but the “specifications” are cluttered with C++ details. Graph transformations provide a transparent mechanism to attach semantics. However, not all behavioral semantics ca be specified this way. Semantic anchoring with ASM captures the best of both worlds: Simple graph transformations and simple behavioral specifications.

7. Model-based development is practical! Domain specific abstractions are not only desirable; they are affordable DSML-s are not programming languages Lessons Learned: Metaprogrammable Tools OTIF Component Abstraction (TA) Design Space Modeling (MD) Design Space Encoding (TE) Generic Model Editor (GME) GME Model Management UDM Design Space Exploration Component Reconstruction Design Decoding Design Space Pruning DESERT • Best of Breed • Modeling Tools • Simulators • Verifiers • Model Checkers Meta Models Open Tool IntegrationFramework GReAT MIC Tool Suite Model Transformation

8. Researchers partnering with End Users with real stake and new challenges Working model for managing proprietary issues (Open Source, Gated Source) Repository is active, live, quality controlled (and costs money to operate) Creates future market for tool vendors. Example: Microsoft Software Factories (health care, web services) MathWorks interactions NEW TRANSITIONIN MODEL IS ESSENTIAL IF WE EXPECT RAPID ANDSUBSTANTIAL IMPACT Lessons Learned: Transitioning A small scale experiment with potentially large impact that works: ESCHER FCS Universities Non-profit IR&D criteria funding Research groups ESCHER Institute Boeing, GM Raytheon DDX emphasis C2W High quality tools & SW maturation Repository

9. New Challenges: Cyber Physical Systems • Abstraction • Adjustable • Integrative • Safe • Precise • Integration • Affordable • Model-based (end-to-end) • Manage heterogeneity better • Automation • Domain-specific tool chains, but • Reusable infrastructure Systems industry turns IT driven: Aerospace, Automotive, Process,.. Software Control Systems package org.apache.tomcat.session; import org.apache.tomcat.core.*; import org.apache.tomcat.util.StringManager; import java.io.*; import java.net.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; /** * Core implementation of a server session * * @author James Duncan Davidson [duncan@eng.sun.com] * @author James Todd [gonzo@eng.sun.com] */ public class ServerSession { private StringManager sm = StringManager.getManager("org.apache.tomcat.session"); private Hashtable values = new Hashtable(); private Hashtable appSessions = new Hashtable(); private String id; private long creationTime = System.currentTimeMillis();; private long thisAccessTime = creationTime; private long lastAccessed = creationTime; private int inactiveInterval = -1; ServerSession(String id) { this.id = id; } public String getId() { return id; } public long getCreationTime() { return creationTime; } public long getLastAccessedTime() { return lastAccessed; } public ApplicationSession getApplicationSession(Context context, boolean create) { ApplicationSession appSession = (ApplicationSession)appSessions.get(context); if (appSession == null && create) { // XXX // sync to ensure valid? appSession = new ApplicationSession(id, this, context); appSessions.put(context, appSession); } // XXX // make sure that we haven't gone over the end of our // inactive interval -- if so, invalidate and create // a new appSession return appSession; } void removeApplicationSession(Context context) { appSessions.remove(context); } /** * Called by context when request comes in so that accesses and * inactivities can be dealt with accordingly. */ void accessed() { // set last accessed to thisAccessTime as it will be left over // from the previous access lastAccessed = thisAccessTime; thisAccessTime = System.currentTimeMillis(); } void validate() package org.apache.tomcat.session; import org.apache.tomcat.core.*; import org.apache.tomcat.util.StringManager; import java.io.*; import java.net.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; /** * Core implementation of a server session * * @author James Duncan Davidson [duncan@eng.sun.com] * @author James Todd [gonzo@eng.sun.com] */ public class ServerSession { private StringManager sm = StringManager.getManager("org.apache.tomcat.session"); private Hashtable values = new Hashtable(); private Hashtable appSessions = new Hashtable(); private String id; private long creationTime = System.currentTimeMillis();; private long thisAccessTime = creationTime; private long lastAccessed = creationTime; private int inactiveInterval = -1; ServerSession(String id) { this.id = id; } public String getId() { return id; } public long getCreationTime() { return creationTime; } public long getLastAccessedTime() { return lastAccessed; } public ApplicationSession getApplicationSession(Context context, boolean create) { ApplicationSession appSession = (ApplicationSession)appSessions.get(context); if (appSession == null && create) { // XXX // sync to ensure valid? appSession = new ApplicationSession(id, this, context); appSessions.put(context, appSession); } // XXX // make sure that we haven't gone over the end of our // inactive interval -- if so, invalidate and create // a new appSession return appSession; } void removeApplicationSession(Context context) { appSessions.remove(context); } /** * Called by context when request comes in so that accesses and * inactivities can be dealt with accordingly. */ void accessed() { // set last accessed to thisAccessTime as it will be left over // from the previous access lastAccessed = thisAccessTime; thisAccessTime = System.currentTimeMillis(); } void validate() Modeling Layer

10. New Challenges: Cyber Physical Systems Systems industry builds CPS: Aerospace, Automotive, Process,.. Software Control Security Systems package org.apache.tomcat.session; import org.apache.tomcat.core.*; import org.apache.tomcat.util.StringManager; import java.io.*; import java.net.*; import java.util.*; import javax.servlet.*; import javax.servlet.http.*; /** * Core implementation of a server session * * @author James Duncan Davidson [duncan@eng.sun.com] * @author James Todd [gonzo@eng.sun.com] */ public class ServerSession { private StringManager sm = StringManager.getManager("org.apache.tomcat.session"); private Hashtable values = new Hashtable(); private Hashtable appSessions = new Hashtable(); private String id; private long creationTime = System.currentTimeMillis();; private long thisAccessTime = creationTime; private long lastAccessed = creationTime; private int inactiveInterval = -1; ServerSession(String id) { this.id = id; } public String getId() { return id; } public long getCreationTime() { return creationTime; } public long getLastAccessedTime() { return lastAccessed; } public ApplicationSession getApplicationSession(Context context, boolean create) { ApplicationSession appSession = (ApplicationSession)appSessions.get(context); if (appSession == null && create) { // XXX // sync to ensure valid? appSession = new ApplicationSession(id, this, context); appSessions.put(context, appSession); } // XXX // make sure that we haven't gone over the end of our // inactive interval -- if so, invalidate and create // a new appSession return appSession; } void removeApplicationSession(Context context) { appSessions.remove(context); } /** * Called by context when request comes in so that accesses and * inactivities can be dealt with accordingly. */ void accessed() { // set last accessed to thisAccessTime as it will be left over // from the previous access lastAccessed = thisAccessTime; thisAccessTime = System.currentTimeMillis(); } void validate() Modeling Layer CPS - Integrated Modeling Discipline • It is not possible to identify whether behavioral attributes are the result of computations (computer programs), physical laws, or both working together; • Functionality and salient system characteristics are emerging through the interaction of physical and computational objects.

11. Model-Based Methods will drive the progress in CPS technology Major advancements are needed in: Composition theory Certification and high confidence design Secure systems design System Integration Design automation Education New application domains will emerge rapidly Model-based system integration Architecture exploration Resilient systems CPS and Model-Based Design

12. Example: System-of-System Engineering

13. Tool Chain for Architecture Exploration in FCS C++ ______ ______ ______ ______ ______ IDL ______ ______ ______ ______ ______ ADeVS, IONS RELEX Excel System Integration GReAT Transform System Model Segment IDD Component Adapters System Integration Test Harness GReAT Transform C++ ______ ______ ______ ______ ______ IDL ______ ______ ______ ______ ______ XML ______ ______ ______ ______ ______ Rose CAT file Runtime Glue (Deployed) Integration Laboratory Tools FCS Program: Boeing – Vanderbilt/ISIS

14. Risk Mitigation: SurrogateModeling and Synthesis GME System Models Networks Deployment Instance Topology GME Component Models Interfaces Interfaces, Business Logic Code Generator Code Generator BC Surrogate Component BC Surrogate Component “Real” BC Component Input Interfaces Acquired Business Logic Output Interfaces Input Interfaces Business Logic (Generated) Output Interfaces “Real” BC Component System Of Systems Common Operating Environment

15. Building a Software/System “Wind Tunnel” (SSW) Unmanned Sensor Platforms Human Controllers Mixed Initiative Controller Context Dep. Command Interpretation Adaptive Resource Allocation Assigned Platform Commands HCI Platform Commands Abstract Commands Coordination Decision Support Platform Status Data Distribution Network Model-Based Experiment Integration Environment: SSW Issues to be studied experimentally: • Information Sharing • Shared situation awareness • Common Operation Picture (COP) • Network effects • Distributed Command and Control • Synchronization and coordination • Distributed dynamic decision making • Network effects AFOSR PRET Project: Vanderbilt-ISIS, Berkeley, GMU

16. SSW Integration Architecture: Simulation Components and Models code “Virtual” Experiment Specification & Configuration Components Model Integration Layer Controller Models Network Models Org. Models Fusion Models Env. Models Models Run-time Simulink Federate DEVS Federate. OGRE Federate OmNet++ Federate CPN Federate. Instrumentation Layer Instrumentation Layer Simulation Integration Platform (HLA) Simulation Data Distribution/Communication Middleware Distributed Simulation Platform

17. Model Integration Processing (Tracking) Controller/Vehicle Dynamics 3-D Environment (Sensors) Organization/Coordination Adaptive Human Organization Mixed Initiative Controller Context Dep. Command Interpretation Adaptive Resource Allocation Assigned Platform Commands HCI Platform Commands Abstract Commands CPN Devs SL/SF SL/SF Coordination Decision Support Platform Status COP Elements COP Elements COP Elements Data Distribution Network Model-Integrated System and Software Laboratory Environment: C2 Windtunnel GME Ogre GME Simulation Architecture Simulation Interaction OMNET Network Architecture

18. Summary • CPS-s represent the coming new age in systems design • The required technology changes are profound – go way beyond the reach of “multidisciplinary” approaches • Role of model-based methods and tools is • The impact on competitiveness is huge: CPS-s are the foundation for the systems industry