1. Zilong Ye, Ph.D. zye5@calstatela.edu
Cyber physical system
Zilong Ye, Ph.D.

2. What is Cyber Physical System?
Cyber Physical System is a system featuring a tight combination of, and coordination between, the system’s computational and physical elements.
CPS uses computations and communication deeply embedded in and interacting with physical processes to add new capabilities to physical system.
from miniscale to large-scale systems
dependably, safely, securely, efficiently and in real-time
Convergence of computation, communication, and control

3. Why Cyber Physical Systems?
Embedded computers allow us to add capabilities to physical systems.
Computer-controlled automotive engines are fuel-efficient and low-emission.
By merging computing and communication with physical processes, CPS brings many benefits:
Safer and more efficient systems
Reduce the cost of building and operating systems
Could form complex systems that provide new capabilities
Technological and Economic Drivers
The decreasing cost of computation, networking, and sensing provides the economic motivation.
Computers and communication are ubiquitous enables national or global scale CPSs. (eg. national power grid, national transportation network)
Social and economic forces require more efficient use of national infrastructure.
Environmental pressures make new technologies appear to improve energy efficiency and reduce pollution.

4. CPS: Computing Perspective
Number of microprocessor units per year
Millions in desktops
Billions in embedded processors
Applications:
Automotive Systems
Light and heavy automobiles, trucks, buses
Aerospace Systems
Airplanes, space systems
Consumer electronics
Mobile phones, office electronics, digital appliances
Health/Medical Equipment
Patient monitoring, MRI, infusion pumps, artificial organs
Industrial Automation
Supervisory Control and Data Acquisition (SCADA) systems for chemical and power plants
Manufacturing systems
Defense
Source of superiority in all weapon systems
Two types of computing systems
Desktops, servers, PCs, and notebooks
Embedded
The next frontier
Mainframe computing (60’s-70’s)
Large computers to execute big data processing applications
Desktop computing & Internet (80’s-90’s)
One computer at every desk to do business/personal activities
Embedded computing (21st Century)
“Invisible” part of the environment
Transformation of industry

5. Cps application

6. CPS in transportation system
Current picture
Largely single-vehicle focus
Integrating safety and fuel economy (full hybrids, regenerative braking, adaptive transmission control, stability control)
Safety and convenience “add-ons” (collision avoidance radar, complex airbag systems, GPS, …)
Cost of recalls, liability; growing safety culture
Better future?
Multi-vehicle high-capacity cooperative control roadway technologies
Vehicular networks
Energy-absorbing “smart materials” for collision protection (cooperative crush zones?)
Alternative fuel technologies, “smart skin” integrated photovoltaics, ….
Integrated operation of drivetrain, smart tires, active aerodynamic surfaces, …
Safety, security, privacy certification; regulatory enforcement
Image thanks to Sushil Birla, GMC

7. On-road service delivery

8. Effective carpooling

9. vehicle speed control for eco-driving

10. Eco-driving and security+

11. CPS IN HEALTH CARE
National Health Information Network, Electronic Patient Record initiative
Medical records at any point of service
Hospital, OR, ICU, …, EMT?
Home care: monitoring and control
Pulse oximeters (oxygen saturation), blood glucose monitors, infusion pumps (insulin), accelerometers (falling, immobility), wearable networks (gait analysis), …
Operating Room of the Future (Goldman)
Closed loop monitoring and control; multiple treatment stations, plug and play devices; robotic microsurgery (remotely guided?)
System coordination challenge
Progress in bioinformatics: gene, protein expression; systems biology; disease dynamics, control mechanisms

12. CPS IN POWER GRID Current picture: Better future?
Equipment protection devices trip locally, reactively
Cascading failure: August (US/Canada) and October (Europe), 2003
Better future?
Real-time cooperative control of protection devices
Or -- self-healing -- (re-)aggregate islands of stable bulk power (protection, market motives)
Ubiquitous green technologies
Issue: standard operational control concerns exhibit wide- area characteristics (bulk power stability and quality, flow control, fault isolation)
Context: market (timing?) behavior, power routing transactions, regulation
IT Layer

13. INTERDEPENDENT POWER AND COMMUNICATION NETWORKS
Concerns
Risk of Large blackouts such as 2003 blackout in North-East America
Requires
Communication Network
Power Grid
Risk of blackout increases due to nature of Renewable Energies (fluctuations stress the grid more)
Challenge
What if we lose part of communication network in the presence of large disturbances in the power grid?
Extra Failures in Communication Network
Extra Failures in Power Grid
Strong Interdependency

14. Abstract Interdependency Model
First Model on Interdependency: “Catastrophic cascade of failures in interdependent networks”, Buldyrev, et al, 2010
Many Follow-ups on this model
Erdos-Renyi Graph with 500 nodes and expected degree of 4
Two Networks A and B
Node i in network A operates if 1) it is connected to a node in network B
2) It is part of the largest component in network A
Interdependent Networks are more vulnerable than Single Networks
One-to-one interdependency picture from “Catastrophic cascade of failures in interdependent networks”

15. Very different behavior in Power Grid!
Metric in Power Grid: Fraction of Served Load; i.e. Yield
Metric: Ave size of largest component (fraction of remaining nodes)
Random Power Grid - Erdos-Renyi with 500 Nodes and average degree of 4; 1/5th of the nodes are generators and 1/5th are loads with random value in range [1000,2000]; unit reactance
Power Grids are More Vulnerable to Failures due to Cascading Failures

16. Model: Dependence of Communication on Power
Dependency of communication on power grid
Pc1 P1
Pc2
Pc3 P2
Transmission
Power Grid
Distribution C1 C2 C3
Communication
Network
Network ECP C1 P1 C2 P2 C3
Communication
Network
Transmission
Power Grid
Every communication node requires power Preq for operation
If Pci > Pireq for operation, then Ci continues operating
Simple model allows us to associate a load with every communication node

17. Dependence of Power on Communication
Each Power node depends on at least one communication node
What happens if communication is lost?
Generators may fail due to Frequency drop
Loads may fail due to voltage drop
If a power node loses its correspondent communication node, it cannot be controlled and fails (Deterministic Model)
Extendable to a probabilistic model where the power node fails randomly with some probability
Clearly, this is not what happens today, as the present grid does not depend on communications for its control in a critical way

18. Interdependent Power Grid
Metric in Power Grid: Fraction of Served Load; i.e. Yield
The purpose of designing a communication network intertwined with the power grid is to provide real-time monitoring and control for the grid.
a proper analysis of interdependent networks should account for the availability of control schemes that can mitigate cascading failures.
Wrong Conclusion: power grid is vulnerable to communication failures, without taking advantage of communications for intelligent control and failure mitigation

19. Interdependent Power Grid
Pessimistic Scenario: Vulnerable Communication Network, but communication nodes do not control the cascading failures inside power grid
Optimistic Scenario: Robust Communication Network (e.g. all communication nodes are backed-up with batteries), and communication nodes control the cascading failures: i.e., using centralized load shedding and generator re-dispatch
Intelligent Load Shedding/redispatch
Mitigation Policy inside Power Grid:

20. Accounting for Failures in the Communication Network
What if the communication nodes are vulnerable to power failures?
Failures will cascade between the communication network and power grid
Simple Mitigation Policy for Interdependent Networks:
Mitigate Failures inside Power Grid using load shedding
Remove all the communication nodes that receive less than required power
Remove all power nodes that lose their correspondent communication node
go back to step 1 until no failure occurs

21. Intelligent Mitigation Policy
The previous mitigation strategy did simple load shedding, and as a result cause communication nodes to fail
A more intelligent policy will shed load “intelligently” to avoid the failure of critical communication nodes
Load Control Policy
Phase 1) Find the Set of all unavoidable failures (i.e., disconnected nodes)
Phase 2) Re-dispatch the generators and loads so that
All remaining communication nodes can operate (receive enough power)
Minimum amount of load is shed; i.e. Maximize Yield

22. Unavoidable Failures Due to Loss of ConnectivityG
Power node
Generator
Control node
Control center
Power line
Communication
line
Power Grid
Communication Network
Unavoidable Failures – Without Considering the Power Flows
A Power node fails if it loses its connection to 1) Communication Network OR 2) Generator A Communication node fails if it loses its connection to 1) Power Grid OR 2) Control Center

23. Unavoidable Failures Due to Loss of ConnectivityG
Power node
Generator
Control node
Control center
Power line
Communication
line
Power Grid
Communication Network
Unavoidable Failures – Without Considering the Power Flows
A Power node fails if it loses its connection to 1) Communication Network OR 2) Generator A Communication node fails if it loses its connection to 1) Power Grid OR 2) Control Center

24. Unavoidable Failures Due to Loss of ConnectivityG
Power node
Generator
Control node
Control center
Power line
Communication
line
Power Grid
Communication Network
Unavoidable Failures – Without Considering the Power Flows
A Power node fails if it loses its connection to 1) Communication Network OR 2) Generator A Communication node fails if it loses its connection to 1) Power Grid OR 2) Control Center

25. Unavoidable Failures Due to Loss of ConnectivityG
Power node
Generator
Control node
Control center
Power line
Communication
line
Power Grid
Communication Network
Unavoidable Failures – Without Considering the Power Flows
A Power node fails if it loses its connection to 1) Communication Network OR 2) Generator A Communication node fails if it loses its connection to 1) Power Grid OR 2) Control Center

26. Unavoidable Failures Due to Loss of ConnectivityG
Power node
Generator
Control node
Control center
Power line
Communication
line
Power Grid
Communication Network
Unavoidable Failures – Without Considering the Power Flows
A Power node fails if it loses its connection to 1) Communication Network OR 2) Generator A Communication node fails if it loses its connection to 1) Power Grid OR 2) Control Center

27. Load Control Mitigation Policy
Phase 1) Find the Set of all unavoidable failures
Phase 2) Re-dispatch the generators and loads
Minimum Load Shedding
Slide 6
Communication Nodes receive enough Power
Connecting communication and power grid

28. Load Control Mitigation Policy

29. Why is CPS Hard? Crosses Interdisciplinary Boundaries Software Control
import org.apache.tomcat.util.StringManager;
package org.apache.tomcat.session;
import org.apache.tomcat.core.*;
import javax.servlet.http.*;
import javax.servlet.*;
import java.net.*;
import java.util.*;
import java.io.*;
James Duncan Davidson
* Core implementation of a server session
/**
James Todd */ *
StringManager.getManager("org.apache.tomcat.session");
public class ServerSession {
private long creationTime = System.currentTimeMillis();;
private Hashtable appSessions = new Hashtable();
private Hashtable values = new Hashtable();
private StringManager sm =
private long thisAccessTime = creationTime;
private long lastAccessed = creationTime;
private String id;
private int inactiveInterval = -1;
public String getId() {
ServerSession(String id) {
this.id = id;
public long getCreationTime() {
return id; }
public long getLastAccessedTime() {
return creationTime;
public ApplicationSession getApplicationSession(Context context,
return lastAccessed;
(ApplicationSession)appSessions.get(context);
ApplicationSession appSession =
boolean create) {
if (appSession == null && create) {
appSession = new ApplicationSession(id, this, context);
// sync to ensure valid?
// XXX
appSessions.put(context, appSession);
// inactive interval -- if so, invalidate and create
// make sure that we haven't gone over the end of our
// a new appSession
void removeApplicationSession(Context context) {
appSessions.remove(context);
return appSession;
* Called by context when request comes in so that accesses and
* inactivities can be dealt with accordingly.
// set last accessed to thisAccessTime as it will be left over
void accessed() {
thisAccessTime = System.currentTimeMillis();
lastAccessed = thisAccessTime;
// from the previous access
void validate()
Software
Control
Systems
Crosses Interdisciplinary Boundaries
Disciplinary boundaries need to be realigned
New fundamentals need to be created
New technologies and tools need to be developed
Education need to be restructured