This paper introduces a data-driven traffic microsimulation framework in CARLA that reconstructs real-world wave dynamics using high-fidelity time-space data from the I-24 MOTION testbed. Calibration of road networks in microsimulators to reproduce ephemeral phenomena such as traffic waves for large-scale simulation is a process that is fraught with challenges. This work reconsiders the existence of the traffic state data as boundary conditions on an ego vehicle moving through previously recorded traffic data, rather than reproducing those traffic phenomena in a calibrated microsim. Our approach is to autogenerate a 1 mile highway segment corresponding to I-24, and use the I-24 data to power a cosimulation module that injects traffic information into the simulation. The CARLA and cosimulation simulations are centered around an ego vehicle sampled from the empirical data, with autogeneration of "visible" traffic within the longitudinal range of the ego vehicle. Boundary control beyond these visible ranges is achieved using ghost cells behind (upstream) and ahead (downstream) of the ego vehicle. Unlike prior simulation work that focuses on local car-following behavior or abstract geometries, our framework targets full time-space diagram fidelity as the validation objective. Leveraging CARLA's rich sensor suite and configurable vehicle dynamics, we simulate wave formation and dissipation in both low-congestion and high-congestion scenarios for qualitative analysis. The resulting emergent behavior closely mirrors that of real traffic, providing a novel cosimulation framework for evaluating traffic control strategies, perception-driven autonomy, and future deployment of wave mitigation solutions. Our work bridges microscopic modeling with physical experimental data, enabling the first perceptually realistic, boundary-driven simulation of empirical traffic wave phenomena in CARLA.

As Artificial Intelligence makes its way to edge devices, it becomes necessary to understand how Learning Enabled Components (LECs) will perform in resource-limited environments. A two-part evaluation procedure is developed here using a combination of testing data to evaluate the LECs' performance, including but not limited to time-domain performance, independent of the target system, for assessing the LEC within the context of system it will be deployed. The target system for this evaluation is a BlueROV2 device simulated in Gazebo using the UUV Simulator package that has been configured to function as an autonomous underwater vehicle (AUV) for infrastructure inspection. The task of the vehicle was to detect and track an underwater pipeline using a side-scan sonar. Nine LEC architectures were constructed in Tensorflow, trained, quantized, and deployed on a Google Edge Tensor Processing Unit (TPU) LEC accelerator for evaluation using generated data and deployed as a hardware-in-the-loop simulation using the BlueROV2 model. It was found that the Mean IoU metric in the evaluations that used sonar data from (simulated) pipes that were smaller than the ones used in the training set had the strongest correlation with the LECs ability to continue to track an underwater pipe during the mission simulations. The size of the model did not increase the time required to load a sonar image on the edge device and interpret the sonar images suggesting that neither model size, nor inference time affected the results of the evaluation. The architecture of a given LEC does not guarantee its performance within the context of an AUV executing a pipe inspection task and, therefore, must be evaluated within the context of the full system to properly characterize its performance.

In Partially Observable Markov Decision Processes (POMDPs), maintaining and updating belief distributions over possible underlying states provides a principled way to summarize action-observation history for effective decision-making under uncertainty. As environments grow more realistic, belief distributions develop complexity that standard mathematical models cannot accurately capture, creating a fundamental challenge in maintaining representational accuracy. Despite advances in deep learning and probabilistic modeling, existing POMDP belief approximation methods fail to accurately represent complex uncertainty structures such as high-dimensional, multi-modal belief distributions, resulting in estimation errors that lead to suboptimal agent behaviors. To address this challenge, we present ESCORT (Efficient Stein-variational and sliced Consistency-Optimized Representation for Temporal beliefs), a particle-based framework for capturing complex, multi-modal distributions in high-dimensional belief spaces. ESCORT extends SVGD with two key innovations: correlation-aware projections that model dependencies between state dimensions, and temporal consistency constraints that stabilize updates while preserving correlation structures. This approach retains SVGD's attractive-repulsive particle dynamics while enabling accurate modeling of intricate correlation patterns. Unlike particle filters prone to degeneracy or parametric methods with fixed representational capacity, ESCORT dynamically adapts to belief landscape complexity without resampling or restrictive distributional assumptions. We demonstrate ESCORT's effectiveness through extensive evaluations on both POMDP domains and synthetic multi-modal distributions of varying dimensionality, where it consistently outperforms state-of-the-art methods in terms of belief approximation accuracy and downstream decision quality.

Formal validation of the design and properties of distributed software entities for Cyber Physical Systems (CPS) is challenging due to the non-linear sequence of operations and multiple possible inter-leavings of events and processes. Current model-checking tools are more suited to represent independent systems or pieces of code that are self-contained and rarely consider interactions between different participants of a composite distributed software application. This paper introduces an automated model generation tool for distributed CPS software applications written in a software framework called RIAPS. The tool combines the application model, edge deployment architecture, and individual component level source code annotated with user-supplied timing parameters to produce a network of Timed Automata models compatible with the popular model checker UPPAAL. The generated model can then be verified using UPPAAL’s formal verification engine. The article uses a simple distributed application example CPS to demonstrate how the tool can be used to verify and compare the design and timing of different deployment configurations.

The integration of computational capabilities with the electrical infrastructure of the grid can be envisioned as a societal scale Cyber Physical System (CPS). Middleware frameworks can act as a layer of abstraction that manages the interaction between disparate applications to facilitate intelligent control and management of energy production and consumption. This demonstration showcases Resilient Information Architecture Platform for Smart Grid (RIAPS), a distributed software platform that combines a domain specific modeling language with framework-level services such as communication, remote deployment of applications, distributed coordination, time synchronization, and fault tolerance, to develop and run distributed applications. An example of an energy demand curtailment scheme called load shedding is presented, to highlight how the RIAPS framework can be used to implement distributed algorithms to control elements of a power system, which runs as a simulation using OpenDSS.

Virtual topologies in peer-to-peer networks can reduce the traffic consumed by altering the logical connectivity of peers without altering the underlying network. However, such sparsely connected virtual topologies do not focus on the needs for smart grid applications, which is information dissemination throughout the network, and in turn degrade the performance of distributed control algorithms running on peer-to-peer networks. This paper provides a flexible solution for application developers to prototype and deploy different virtual topologies that balances these trade-offs. First, it introduces a configurable virtual communication topology framework, TopLinkMgr, which enables users to specify any chosen connectivity configuration and deploy peer-to-peer applications using it. Second, it proposes a novel fault-tolerant self-adaptive virtual topology management algorithm, Bounded Path Dissemination, that can ensure the dissemination of information to all peers within a specified number of hops. Experiments show that the algorithm improves on convergence speed and accuracy over state-of-the-art methods and is also robust against node failures while consuming significantly less communication bandwidth.

High-assurance software is often used in safety- and mission-critical systems where loss of functionality can lead to loss of life or property. Naturally, such systems need to be certified before use and several technologies have been developed to support such efforts. The techniques build structured assurance arguments to justify the safety and performance of the system. Most frequently, software is certified as part of a larger system where that larger system changes rather infrequently. However, this contradicts the current practice of rapid software evolution, where the need for new functionality is addressed by a software upgrade. As a consequence, assurance arguments often lag behind, leading to delays in implementing new capabilities. Hence, there is a clear need for the rapid re-analysis and re-evaluation of the assurance arguments. This paper argues that assurance arguments are a special kind of software documentation that need to be tightly integrated with the implementation, and their construction and managed evolution are critical to the safety and performance of software-integrated systems.

Deep Neural Networks are actively being used in the design of autonomous Cyber-Physical Systems (CPSs). The advantage of these models is their ability to handle high-dimensional state-space and learn compact surrogate representations of the operational state spaces. However, the problem is that the sampled observations used for training the model may never cover the entire state space of the physical environment, and as a result, the system will likely operate in conditions that do not belong to the training distribution. These conditions that do not belong to training distribution are referred to as Out-of-Distribution (OOD). Detecting OOD conditions at runtime is critical for the safety of CPS. In addition, it is also desirable to identify the context or the feature(s) that are the source of OOD to select an appropriate control action to mitigate the consequences that may arise because of the OOD condition. In this article, we study this problem as a multi-labeled time series OOD detection problem over images, where the OOD is defined both sequentially across short time windows (change points) as well as across the training data distribution. A common approach to solving this problem is the use of multi-chained one-class classifiers. However, this approach is expensive for CPSs that have limited computational resources and require short inference times. Our contribution is an approach to design and train a single β -Variational Autoencoder detector with a partially disentangled latent space sensitive to variations in image features. We use the feature sensitive latent variables in the latent space to detect OOD images and identify the most likely feature(s) responsible for the OOD. We demonstrate our approach using an Autonomous Vehicle in the CARLA simulator and a real-world automotive dataset called nuImages.

Deep Learning (DL) model-based AI services are increasingly offered in a variety of predictive analytics services such as computer vision, natural language processing, speech recognition. However, the quality of the DL models can degrade over time due to changes in the input data distribution, thereby requiring periodic model updates. Although cloud data-centers can meet the computational requirements of the resource-intensive and time-consuming model update task, transferring data from the edge devices to the cloud incurs a significant cost in terms of network bandwidth and are prone to data privacy issues. With the advent of GPU-enabled edge devices, the DL model update can be performed at the edge in a distributed manner using multiple connected edge devices. However, efficiently utilizing the edge resources for the model update is a hard problem due to the heterogeneity among the edge devices and the resource interference caused by the colocation of the DL model update task with latency-critical tasks running in the background. To overcome these challenges, we present Deep-Edge, a load- and interference-aware, fault-tolerant resource management framework for performing model update at the edge that uses distributed training. This paper makes the following contributions. First, it provides a unified framework for monitoring, profiling, and deploying the DL model update tasks on heterogeneous edge devices. Second, it presents a scheduler that reduces the total re-training time by appropriately selecting the edge devices and distributing data among them such that no latency-critical applications experience deadline violations. Finally, we present empirical results to validate the efficacy of the framework using a real-world DL model update case-study based on the Caltech dataset and an edge AI cluster testbed.

Fault-tolerance in distributed cyber-physical systems involves a close interplay between the physical system: the ’plant’ to be controlled and the distributed computing layer that controls it. In this paper, a systematic approach for designing resilient decentralized control applications is presented that considers both the cyber and physical faults and how they affect each other (if at all). It establishes a formal methodology for system design and then illustrates its use in an example application related to the power grid.

Pre-trained deep learning models are increasingly being used to offer a variety of compute-intensive predictive analytics services such as fitness tracking, speech, and image recognition. The stateless and highly parallelizable nature of deep learning models makes them well-suited for serverless computing paradigm. However, making effective resource management decisions for these services is a hard problem due to the dynamic workloads and diverse set of available resource configurations that have different deployment and management costs. To address these challenges, we present a distributed and scalable deep-learning prediction serving system called Barista and make the following contributions. First, we present a fast and effective methodology for forecasting workloads by identifying various trends. Second, we formulate an optimization problem to minimize the total cost incurred while ensuring bounded prediction latency with reasonable accuracy. Third, we propose an efficient heuristic to identify suitable compute resource configurations. Fourth, we propose an intelligent agent to allocate and manage the compute resources by horizontal and vertical scaling to maintain the required prediction latency. Finally, using representative real-world workloads for an urban transportation service, we demonstrate and validate the capabilities of Barista.

Occupancy identification using Electricity Consumption data has been shown as an effective, non-intrusive strategy aiding the design of efficient Energy Management solutions. This paper introduces DeepECO, a Deep Learning framework for the Occupancy Classification task. It studies the impact of different feature selection algorithms, namely Principal Component Analysis (PCA) and a new game-theoretic approach called SHapley Additive exPlanation (SHAP) on the network performance. Three different metrics- Classification Accuracy, Mathew's Correlation Coefficient and F2 score are used for evaluation and comparison between the mentioned algorithms. The results obtained serve as a comprehensive evaluation of different feature selection methods for deep CNNs and their effectiveness in addressing the given problem.

This demo showcases the features of an adaptive middleware framework for resource constrained autonomous robots like DeepNNCar (Figure 1). These robots use Learning Enabled Components (LECs), trained with deep learning models to perform control actions. However, these LECs do not provide any safety guarantees and testing them is challenging. To overcome these challenges, we have developed an adaptive middleware framework that (1) augments the LEC with safety controllers that can use different weighted simplex strategies to improve the systems safety guarantees, and (2) includes a resource manager to monitor the resource parameters (temperature, CPU Utilization), and offload tasks at runtime. Using DeepNNCar we will demonstrate the framework and its capability to adaptively switch between the controllers and strategies based on its safety and speed performance.

The modern electric grid is a complex, decentralized cyber-physical system requiring higher-level control techniques to balance the demand and supply of energy to optimize the overall energy usage. The concept of Transactive Energy utilizes distributed system principle to address this challenge. In this demonstration we show the usage of the distributed application management platform RIAPS in the implementation of one such Transactive Energy approach to control elements of a power system, which runs as a a simulation using the Gridlab-d simulation solver.

The vision of the `Smart Grid' assumes a distributed real-time embedded system that implements various monitoring and control functions. As the reliability of the power grid is critical to modern society, the software supporting the grid must support fault tolerance and resilience in the resulting cyber-physical system. This paper describes the fault-tolerance features of a software framework called Resilient Information Architecture Platform for Smart Grid (RIAPS). The framework supports various mechanisms for fault detection and mitigation and works in concert with the applications that implement the grid-specific functions. The paper discusses the design philosophy for and the implementation of the fault tolerance features and presents an application example to show how it can be used to build highly resilient systems.

Smart infrastructure demands resilient data storage, and emerging applications execute queries on this data over time. Typically, time-series databases serve these queries; however, cloud-based time-series storage can be prohibitively expensive. As smart devices proliferate, the amount of computing power and memory available in our connected infrastructure provides the opportunity to move resilient time-series data storage and analytics to the edge. This paper proposes time-series storage in a Distributed Hash Table (DHT), and a novel key-generation technique that provides time-indexed reads and writes for key-value pairs. Experimental results show this technique meets demands for smart infrastructure situations.

Learning enabled components (LECs) trained using data-driven algorithms are increasingly being used in autonomous robots commonly found in factories, hospitals, and educational laboratories. However, these LECs do not provide any safety guarantees, and testing them is challenging. In this paper, we introduce a framework that performs weighted simplex strategy based supervised safety control, resource management and confidence estimation of autonomous robots. Specifically, we describe two weighted simplex strategies: (a) simple weighted simplex strategy (SW-Simplex) that computes a weighted controller output by comparing the decisions between a safety supervisor and an LEC, and (b) a context-sensitive weighted simplex strategy (CSW-Simplex) that computes a context-aware weighted controller output. We use reinforcement learning to learn the contextual weights. We also introduce a system monitor that uses the current state information and a Bayesian network model learned from past data to estimate the probability of the robotic system staying in the safe working region. To aid resource constrained robots in performing complex computations of these weighted simplex strategies, we describe a resource manager that offloads tasks to an available fog nodes. The paper also describes a hardware testbed called DeepNNCar, which is a low cost resource-constrained RC car, built to perform autonomous driving. Using the hardware, we show that both SW-Simplex and CSW-Simplex have 40% and 60% fewer safety violations, while demonstrating higher optimized speed during indoor driving (~ 0.40 m/s) than the original system (using only LECs).

Cyber-Physical Systems (CPS) are used in many applications where they must perform complex tasks with a high degree of autonomy in uncertain environments. Traditional design flows based on domain knowledge and analytical models are often impractical for tasks such as perception, planning in uncertain environments, control with ill-defined objectives, etc. Machine learning based techniques have demonstrated good performance for such difficult tasks, leading to the introduction of Learning-Enabled Components (LEC) in CPS. Model based design techniques have been successful in the development of traditional CPS, and toolchains which apply these techniques to CPS with LECs are being actively developed. As LECs are critically dependent on training and data, one of the key challenges is to build design automation for them. In this paper, we examine the development of an autonomous Unmanned Underwater Vehicle (UUV) using the Assurance-based Learning-enabled Cyber-physical systems (ALC) Toolchain. Each stage of the development cycle is described including architectural modeling, data collection, LEC training, LEC evaluation and verification, and system-level assurance.

Power grids are undergoing major changes due to rapid growth in renewable energy and improvements in battery technology. Prompted by the increasing complexity of power systems, decentralized IoT solutions are emerging, which arrange local communities into transactive microgrids. The core functionality of these solutions is to provide mechanisms for matching producers with consumers while ensuring system safety. However, there are multiple challenges that these solutions still face: privacy, trust, and resilience. The privacy challenge arises because the time series of production and consumption data for each participant is sensitive and may be used to infer personal information. Trust is an issue because a producer or consumer can renege on the promised energy transfer. Providing resilience is challenging due to the possibility of failures in the infrastructure that is required to support these market based solutions. In this paper, we develop a rigorous solution for transactive microgrids that addresses all three challenges by providing an innovative combination of MILP solvers, smart contracts, and publish-subscribe middleware within a framework of a novel distributed application platform, called Resilient Information Architecture Platform for Smart Grid. Towards this purpose, we describe the key architectural concepts, including fault tolerance, and show the trade-off between market efficiency and resource requirements.

The exponential growth of information and communication technologies have caused a profound shift in the way humans engineer systems leading to the emergence of closed-loop systems involving strong integration and coordination of physical and cyber components, often referred to as cyber-physical systems (CPSs). Because of these disruptive changes, physical systems can now be attacked through cyberspace and cyberspace can be attacked through physical means. The paper considers security and resilience as system properties emerging from the intersection of system dynamics and the computing architecture. A modeling and simulation integration platform for experimentation and evaluation of resilient CPSs is presented using smart transportation systems as the application domain. Evaluation of resilience is based on attacker-defender games using simulations of sufficient fidelity. The platform integrates 1) realistic models of cyber and physical components and their interactions; 2) cyber attack models that focus on the impact of attacks to CPS behavior and operation; and 3) operational scenarios that can be used for evaluation of cybersecurity risks. Three case studies are presented to demonstrate the advantages of the platform: 1) vulnerability analysis of transportation networks to traffic signal tampering; 2) resilient sensor selection for forecasting traffic flow; and 3) resilient traffic signal control in the presence of denial-of-service attacks.

The emerging Fog Computing paradigm provides an additional computational layer that enables new capabilities in real-time data-driven applications. This is especially interesting in the domain of Smart Grid as the boundaries between traditional generation, distribution, and consumer roles are blurring. This is a reflection of the ongoing trend of intelligence distribution in Smart Systems. In this paper, we briefly describe a component-based decentralized software platform called Resilient Information Architecture Platform for Smart Systems (RIAPS) which provides an infrastructure for such systems. We briefly describe some initial applications built using this platform. Then, we focus on the design and integration choices for a resilient Discovery Manager service that is a critical component of this infrastructure. The service allows applications to discover each other, work collaboratively, and ensure the stability of the Smart System.

This paper presents the time synchronization infrastructure for a low-cost run-time platform and application framework specifically targeting Smart Grid applications. Such distributed applications require the execution of reliable and accurate time-coordinated actions and observations both within islands of deployments and across geographically distant nodes. The time synchronization infrastructure is built on well-established technologies: GPS, NTP, PTP, PPS and Linux with real-time extensions, running on low-cost BeagleBone Black hardware nodes. We describe the architecture, implementation, instrumentation approach, performance results and present an example from the application domain. Also, we discuss an important finding on the effect of the Linux RT_PREEMPT real-time patch on the accuracy of the PPS subsystem and its use for GPS-based time references.

Design-time analysis and verification of distributed real-time embedded systems necessitates the modeling of the time-varying performance of the network and comparing that to application requirements. Earlier work has shown how to build a system network model that abstracted away the network's physical medium and protocols which govern its access and multiplexing. In this work we show how to apply a network medium channel access protocol, such as Time-Division Multiple Access (TDMA), to our network analysis methods and use the results to show that the abstracted model without the explicit model of the protocol is valid.

This paper describes a testbed for development, deployment, testing, and analysis of Cyber-Physical Systems (CPS) applications. The testbed incorporates smart network hardware, allowing high-fidelity emulation of CPS network characteristics, and CPS simulation environments to enable high-frequency sensor reading, actuator control and physical environmental changes. We discuss the architecture of this testbed and present the types of experiments and applications which can be run to study hardware and software fault tolerance, software reconfiguration, and system stability characteristics in distributed real-time embedded systems. We also describe the scalability, limitations, and potential extensions to this testbed.

This paper presents ROSMOD, a model-driven component-based development tool suite for the Robot Operating System (ROS). ROSMOD is well suited for the design, development and deployment of large scale distributed applications on embedded hardware devices. We present the various features of ROSMOD including the modeling language, the graphical user interface, code generators and deployment infrastructure. We describe the utility of this tool with a real-world case study - An Autonomous Ground Support Equipment (AGSE) robot that was designed and prototyped using ROSMOD for the NASA Student Launch competition, 2014-2015.

System design typically involves the specification of requirements and evaluation of the design with respect to those requirements. The requirements describe and quantify the desired physical and software properties of the system. Evaluating requirements often involves performing domain-specific analysis. Domain-specific analyses are spread across a wide range of domains and tools, e.g., geometric properties vs. dynamics behavior of the system. Different analysis types require different tools, where each tool targets a narrow range of domains or a single domain. For large system designs, the requirements could be too complex to be evaluated by a single analysis tool. In such cases, the coupling of multiple domains and analysis tools is inevitable, and managing these interactions can prove to be difficult, often leading to wasted efforts. In this paper we present an analysis-driven rapid design process for Cyber-Physical Systems that spans multiple domain models and various analysis tools from a wide range of domains, and helps to reduce the design time through the following: (1) revealing and tracking instances of cross-domain coupling, thereby reducing design time; (2) disqualifying non-viable design configurations; and (3) using analysis templates for continuous design evolution with respect to the requirements; minor adjustments to requirements can be done seamlessly, without a complete redesign of the existing reusable analysis templates. Furthermore, we present a case study for an automotive driveline design to demonstrate an implementation of this process.

Cyber-physical systems increasingly rely on distributed computing platforms where sensing, computing, actuation, and communication resources are shared by a multitude of applications. Such 'cyber-physical cloud computing platforms' present novel challenges because the system is built from mobile embedded devices, is inherently distributed, and typically suffers from highly fluctuating connectivity among the modules. Architecting software for these systems raises many challenges not present in traditional cloud computing. Effective management of constrained resources and application isolation without adversely affecting performance are necessary. Autonomous fault management and real-time performance requirements must be met in a verifiable manner. It is also both critical and challenging to support multiple end-users whose diverse software applications have changing demands for computational and communication resources, while operating on different levels and in separate domains of security. The solution presented in this paper is based on a layered architecture consisting of a novel operating system, a middleware layer, and component-structured applications. The component model facilitates the construction of software applications from modular and reusable components that are deployed in the distributed system and interact only through well-defined mechanisms. The complexity of creating applications and performing system integration is mitigated through the use of a domain-specific model-driven development process that relies on a domain-specific modeling language and its accompanying graphical modeling tools, software generators for synthesizing infrastructure code, and the extensive use of model-based analysis for verification and validation.

Mobile clouds such as network-connected vehicles and satellite clusters are an emerging class of systems that are extensions to traditional real-time embedded systems: they provide long-term mission platforms made up of dynamic clusters of heterogeneous hardware nodes communicating over ad hoc wireless networks. Besides the inherent complexities entailed by a distributed architecture, developing software and testing these systems is difficult due to a number of other reasons, including the mobile nature of such systems, which can require a model of the physical dynamics of the system for accurate simulation and testing. This paper describes a rapid development and testing framework for a distributed satellite system. Our solutions include a modeling language for configuring and specifying an application's interaction with the middleware layer, a physics simulator integrated with hardware in the loop to provide the system's physical dynamics and the integration of a network traffic tool to dynamically vary the network bandwidth based on the physical dynamics.

Component-based programming models are well-suited to the design of large-scale, distributed applications because of the ease with which distributed functionality can be developed, deployed, and validated using the models' compositional properties. Existing component models supported by standardized technologies, such as the OMG's CORBA Component Model (CCM), however, incur a number of limitations in the context of cyber physical systems (CPS) that operate in highly dynamic, resource-constrained, and uncertain environments, such as space environments, yet require multiple quality of service (QoS) assurances, such as timeliness, reliability, and security. To overcome these limitations, this paper presents the design of a novel component model called F6COM that is developed for applications operating in the context of a cluster of fractionated spacecraft. Although F6COM leverages the compositional capabilities and port abstractions of existing component models, it provides several new features. Specifically, F6COM abstracts the component operations as tasks, which are scheduled sequentially based on a specified scheduling policy. The infrastructure ensures that at any time at most one task of a component can be active - eliminating race conditions and deadlocks without requiring complicated and error-prone synchronization logic to be written by the component developer. These tasks can be initiated due to (a) interactions with other components, (b) expiration of timers, both sporadic and periodic, and (c) interactions with input/output devices. Interactions with other components are facilitated by ports. To ensure secure information flows, every port of an F6COM component is associated with a security label such that all interactions are executed within a security context. Thus, all component interactions can be subjected to Mandatory Access Control checks by a Trusted Computing Base that facilitates the interactions. Finally, F6COM provides capabilities to monitor task execution deadlines and to configure component-specific fault mitigation actions.

Molecular dynamics simulators are indispensable tools in the arsenal of chemical engineers and material scientists. However, they are often difficult to use and require programming skills as well as deep knowledge of both the given scientific domain and the simulation software itself. In this paper, we describe a metaprogramming approach where simulator experts can create a library of simulation components and templates of frequently used simulations. Domain experts, in turn, can build and customize their own simulations and the required input for the various supported simulators is automatically synthesized. The web-based environment also supports setting up a suite of simulation jobs, for example, to carry out automated parameter optimization, via a visual programming environment. The entire simulation setup – including the various parameters, the version of tools utilized and the results – is stored in a database to support searching and browsing of existing simulation outputs and facilitating the reproducibility of scientific results.

Complex real-time software systems require an active fault management capability. While testing, verification and validation schemes and their constant evolution help improve the dependability of these systems, an active fault management strategy is essential to potentially mitigate the unacceptable behaviors at run-time. In our work we have applied the experience gained from the field of Systems Health Management towards component-based software systems. The software components interact via well-defined concurrency patterns and are executed on a real-time component framework built upon ARINC-653 platform services. In this paper, we present the lessons learned in architecting and applying a two-level health management strategy to assemblies of software components.

Distributed real-time and embedded (DRE) systems are a class of real-time systems formed through a composition of predominantly legacy, closed and statically scheduled real-time subsystems, which comprise over-provisioned resources to deal with worst-case failure scenarios. The formation of the system-of-systems leads to a new range of faults that manifest at different granularities for which no statically defined fault tolerance scheme applies. Thus, dynamic and adaptive fault tolerance mechanisms are needed which must execute within the available resources without compromising the safety and timeliness of existing real-time tasks in the individual subsystems. To address these requirements, this paper describes a middleware solution called Safe Middleware Adaptation for Real-Time Fault Tolerance (SafeMAT), which opportunistically leverages the available slack in the over-provisioned resources of individual subsystems. SafeMAT comprises three primary artifacts: (1) a flexible and configurable distributed, runtime resource monitoring framework that can pinpoint in real-time the available slack in the system that is used in making dynamic and adaptive fault tolerance decisions, (2) a safe and resource aware dynamic failure adaptation algorithm that enables efficient recovery from different granularities of failures within the available slack in the execution schedule while ensuring real-time constraints are not violated and resources are not overloaded, and (3) a framework that empirically validates the correctness of the dynamic mechanisms and the safety of the DRE system. Experimental results evaluating SafeMAT on an avionics application indicates that SafeMAT incurs only 9-15% runtime fail over and 2-6% processor utilization overheads thereby providing safe and predictable failure adaptability in real-time.

System integration is the elephant in the china store of large-scale cyber-physical system (CPS) design. It would be hard to find any other technology that is more undervalued scientifically and at the same time has bigger impact on the presence and future of engineered systems. The unique challenges in CPS integration emerge from the heterogeneity of components and interactions. This heterogeneity drives the need for modeling and analyzing cross-domain interactions among physical and computational/networking domains and demands deep understanding of the effects of heterogeneous abstraction layers in the design flow. To address the challenges of CPS integration, significant progress needs to be made toward a new science and technology foundation that is model based, precise, and predictable. This paper presents a theory of composition for heterogeneous systems focusing on stability. Specifically, the paper presents a passivity-based design approach that decouples stability from timing uncertainties caused by networking and computation. In addition, the paper describes cross-domain abstractions that provide effective solution for model-based fully automated software synthesis and high-fidelity performance analysis. The design objectives demonstrated using the techniques presented in the paper are group coordination for networked unmanned air vehicles (UAVs) and high-confidence embedded control software design for a quadrotor UAV. Open problems in the area are also discussed, including the extension of the theory of compositional design to guarantee properties beyond stability, such as safety and performance.

In large programs such as NASA Exploration, multiple systems that interact via safety-critical protocols are already designed with different Statechart variants. To verify these safety-critical systems, a unified framework is needed based on a formal semantics that captures the variants of Statecharts. We describe Polyglot, a unified framework for the analysis of models described using multiple State-chart formalisms. In this framework, Statechart models are translated into Java and analyzed using pluggable semantics for different variants operating in a polymorphic execution environment. The framework has been built on the basis of a parametric formal semantics that captures the common core of Statecharts with extensions for different variants, and addresses previous limitations. Polyglot has been integrated with the Java Pathfinder verification tool-set, providing analysis and test-case generation capabilities. We describe the application of this unified framework to the analysis of NASA/JPL's MER Arbiter whose interacting components were modeled using multiple Statechart formalisms.

SUMMARY The size and complexity of software in safety‐critical systems is increasing at a rapid pace. One technology that can be used to mitigate this complexity is component‐based software development. However, in spite of the apparent benefits of a component‐based approach to development, little work has been done in applying these concepts to hard real‐time systems. This paper improves the state of the art by making three contributions: (1) we present a component model for hard real‐time systems and define the semantics of different types of component interactions; (2) we present an implementation of a middleware that supports this component model. This middleware combines an open‐source CORBA Component Model (CCM) implementation (MICO) with ARINC‐653: a state‐of‐the‐art real‐time operating systems (RTOS) standard, (3) finally; we describe a modeling environment that enables design, analysis, and deployment of component assemblies. We conclude with a discussion of the lessons learned during this exercise. Our experiences point toward extending both the CCM as well as revising the ARINC‐653. Copyright © 2011 John Wiley & Sons, Ltd.

Service-Oriented Architectures (SOAs) are increasingly being used for designing and building large-scale networked and distributed systems. Catering to the complex and dynamically varying needs of business applications/clients, these systems must usually be realized by dynamically composing a variety of network-available services. Evaluation of large-scale SOAs, particularly on dynamic network platforms, such as Mobile Ad-hoc Networks (MANETs), is a non-trivial problem that requires not only a correct modeling of SOAs and the network platform, but also their relationships. This paper describes a new tool - SOAMANET - to design and rapidly synthesize simulations for the experimental evaluation of SOAs on MANET platforms. With its modeling techniques and analysis capabilities, SOAMANET allows simulation-based and system execution-based analysis of dynamic SOA and/or MANET designs and implementations.

Our previous work has explored the use of compositional stabilization techniques for embedded flight control software[9] based on passivity properties of controller components and systems. Zames[21] presented a compositional behavior-bounding technique for evaluating stability of nonlinear systems based on real intervals representing cones (sectors) that bound possible component behaviors. Many innovations in control theory have developed from his insights. We present a novel use of his sector bound theory to validate the stability of embedded control implementations online. The sector analysis can be implemented as a computationally efficient check of stability for different parts of a control design. The advantage of the online application of this technique is that it takes into account software platform effects that impact stability, such as time delays, quantization, and data integrity.

The complexity of software in systems like aerospace vehicles has reached the point where new techniques are needed to ensure system dependability while improving the productivity of developers. One possible approach is to use precisely defined software execution platforms that (1) enable the system to be composed from separate components, (2) restrict component interactions and prevent fault propagation, and (3) whose compositional properties are well-known. In this paper we describe the initial steps towards building a platform that combines component-based software construction with hard real-time operating system services. Specifically, the paper discusses how the CORBA Component Model (CCM) could be combined with the ARINC-653 platform services and the lessons learned from this experiment. The results point towards both extending the CCM as well as revising the ARINC-653.

Existing Design Space Exploration (DSE) frameworks are tailored specifically to a particular problem domain and cannot be easily re-used between domains. Typically these frameworks translate the DSE problem to a single formulation of the problem (e.g. ILP or CSP) and then solve it to retrieve satisfying alternatives. In order to compare the efficiency of different formulations/techniques on a given problem, the domain-expert has to manually reformulate the problem in another constraint language, which is time-consuming. In order to overcome this lack of reusability and flexibility in the current frameworks, we present here the Generic Design Space Exploration (GDSE) framework that allows the designer to solve DSE problems from different domains. Rather than using one strict formulation of the design problem, the framework supports a higher level formulation that can be mapped to different low level encodings. The main contributions of this framework are: 1) a generic representation which can be used to express any DSE problem, and 2) a flexible exploration technique which supports several exploration techniques.

Time-triggered architectures (TTA) provide replica determinism in safety-critical distributed embedded software designs. TTA has become a crucial part of many high-confidence embedded paradigms, as it decouples functional concerns from platform timing concerns in system designs. Complex embedded software development workflows for safety-critical applications are increasingly managed by model-based design tools, in order to support automated verification and reconcile conflicts between functional and non-functional concerns in designs. We present a prototype scheduling tool (ESched) which calculates cyclic schedules for time-triggered networks. ESched supports the model-based workflow of the ESMoL modeling language and tool suite. Using ESMoL, designers can rapidly iterate through simulating a control design, capturing platform effects in models, generating a schedule (if feasible), and re-simulating the control design subject to the platform model and the computed schedule. ESched specifications include a number of useful platform parameters, and it supports troubleshooting of infeasible schedules by allowing the user to specify partial platform models to solve.

Fault-tolerant frameworks for large scale computing clusters require sensor programs, which are executed periodically to facilitate performance and fault management. By construction, these clusters use general purpose operating systems such as Linux that are built for best average case performance and do not provide deterministic scheduling guarantees. Consequently, periodic applications show jitter in execution times relative to the expected execution time. Obtaining a deterministic schedule for periodic tasks in general purpose operating systems is difficult without using kernel-level modifications such as RTAI and RTLinux. However, due to performance and administrative issues kernel modification cannot be used in all scenarios. In this paper, we address the problem of jitter compensation for periodic tasks that cannot rely on modifying the operating system kernel. ; Towards that, (a) we present motivating examples; (b) we present a feedback controller based approach that runs in the user space and actively compensates periodic schedule based on past jitter; This approach is platform-agnostic i.e. it can be used in different operating systems without modification; and (c) we show through analysis and experiments that this approach is platform-agnostic i.e. it can be used in different operating systems without modification and also that it maintains a stable system with bounded total jitter.

Recent advances in software processes and artifacts for automating middleware configurations in distributed realtime and embedded (DRE) systems are starting to address the complexities faced by system developers in dealing with the flexibility and configurability provided by contemporary middleware. Despite the benefits of these new processes, there remain significant challenges in verifying their correctness, and validating their effectiveness in meeting the end-to-end quality of service (QoS) requirements of DRE systems. This paper addresses this problem by describing how model-checking and structural correspondence can be used to verify the correctness of a middleware QoS configuration process that uses model-based graph transformations at its core. Next, it provides empirical proof to validate the effectiveness of our technique to meet the end-to-end QoS requirements in the context of a representative DRE system.

Visual modeling languages are often used today in engineering domains, Mathworks' Simulink/Stateflow for simulation, signal processing and controls being the prime example. However, they are also becoming suitable for implementing other computational tasks, like model transformations. In this paper we briefly introduce GReAT: a visual language with simple, yet powerful semantics for implementing transformations on attributed, typed hypergraphs with the help of explicitly sequenced graph transformation rules. The main contribution of the paper is a Simulink/Stateflow code generator that generates executable code (running on a distributed platform) from the visual input models. The paper provides an overview of the algorithms used and their realization in GReAT.

Embedded software and systems are at the intersection of electrical engineering, computer engineering, and computer science, with, increasing importance, in mechanical engineering. Despite the clear need for knowledge of systems modeling and analysis (covered in electrical and other engineering disciplines) and analysis of computational processes (covered in computer science), few academic programs have integrated the two disciplines into a cohesive program of study. This paper describes the efforts conducted at Vanderbilt University to establish a curriculum that addresses the needs of embedded software and systems. Given the compartmentalized nature of traditional engineering schools, where each discipline has an independent program of study, we have had to devise innovative ways to bring together the two disciplines. The paper also describes our current efforts in using learning technology to construct, manage, and deliver sophisticated computer-aided learning modules that can supplement the traditional course structure in the individual disciplines through out-of-class and in-class use.

Distributed real-time embedded (DRB) systems often need to satisfy various time, resource and fault-tolerance constraints. To manage the complexity of scheduling these systems many methods use rate monotonic scheduling assuming a time-triggered architecture. This paper presents a method that captures the reactive behavior of complex time- and event-driven systems, can provide simulation runs and can provide exact characterization of timed properties of component-based DRE applications that use the publisher/subscriber communication pattern. We demonstrate our approach on real-time CORBA avionics applications.

In this paper we propose a method to create discrete abstraction of state space behavior for continuous-time systems based on gradient analysis of the system dynamics. Then we describe how to use such a discrete model to design a supervisory controller for a given safety specification for the system. Finally we provide an entropy measure of nondeterminism, which can be used to evaluate the quality of the result discrete model as the degree of nondeterminism in that model.

The paper describes a model-integrated approach for embedded software development that is based on domain-specific, multiple-view models used in all phases of the development process. Models explicitly represent the embedded software and the environment it operates in, and capture the requirements and the design of the application, simultaneously. Models are descriptive , in the sense that they allow the formal analysis, verification, and validation of the embedded system at design time. Models are also generative, in the sense that they carry enough information for automatically generating embedded systems using the techniques of program generators. Because of the widely varying nature of embedded systems, a single modeling language may not be suitable for all domains; thus, modeling languages are often domain-specific. To decrease the cost of defining and integrating domain-specific modeling languages and corresponding analysis and synthesis tools, the model-integrated approach is applied in a metamodeling architecture, where formal models of domain-specific modeling languages-called metamodels-play a key role in customizing and connecting components of tool chains. This paper discusses the principles and techniques of model-integrated embedded software development in detail, as well as the capabilities of the tools supporting the process. Examples in terms of real systems will be given that illustrate how the model-integrated approach addresses the physical nature, the assurance issues, and the dynamic structure of embedded software.

Composition and component-based design are key tools of modern software engineering for managing complexity. The concept of component-based design is straightforward: systems are built by composing software components with precisely defined interfaces using standardized interconnection mechanisms. "Plug-and-play" construction is supported by some underlying composition framework, such as CORBA, which facilitates the component interactions by providing standard services such as request broker, interface repository and others. Unfortunately, this solution tends to work only for building systems with a giant component using small "plug-ins" or for very small systems with a few components.The success of building applications based on a giant component is the result of strong restrictions on plug-in-s and their interaction: the dominant component (such as databases or web browsers) preserves the overall design integrity. In case of small systems, the system designers can preserve design integrity without extensive tool support. The problems of software composition for embedded systems are even harder. Embedded computers are surrounded by physical processes: they receive their inputs from sensors and send their outputs to actuators. Embedded computing devices, viewed from their sensor and actuator interfaces, act like physical processes with dynamics, noise, fault, size, power and other physical characteristics.It is not surprising that using current software technology, logical/functional composability does not imply physical composability. In fact, physical properties are not composable, rather, they appear as cross-cutting constraints in the development process. .Our vision with Model-Integrated Computing (MIC) is to answer the composition challenges of embedded systems the following way:.Modeling: The software development paradigm is changing from the use of dominantly imperative programming languages to dominantly declarative, Domain-Specific Modeling Languages (DSML). Complexity is managed by the use of multiple-view modeling and model analysis techniques.Model-Based Generators: The tight relationship between the model-based design and the modeled system is ensured by the extensive use of model-based generators, which translate the synthesized and verified models into code and other artifacts that form the application.The MIC toolset of ISIS has significant progress in implementing this vision.

Model based approaches to diagnosis for dynamic systems have been based on continuous and discrete event models. Systems that combine continuous and discrete behaviors, i.e., hybrid systems have been typically abstracted into discrete event models or approximated by continuous models with steep slopes so that existing algorithms can be applied for fault isolation tasks. This approach runs into problems when both discrete events and continuous behaviors provide vital diagnostic information. We propose a diagnostic methodology that uses hybrid models of the system to perform diagnosis.

A multi-agent system (MAS) is a cooperation focused implementation of multiple programs (agents) that coordinate with each other to attempt to converge on the solution to one or more tasks. Agent negotiation is the convergence upon this solution through compromise and communication. Currently, the implementation of agents is highly dependent on the programming language, and any perspective to the negotiation methods agents use to achieve goals and tasks are drawn after the implementation phase of the development. A better solution to the development of agent interaction is to model the negotiation interaction on a high level, and produce from that model the implementation. Model-Integrated Computing (MIC) and Model-Integrated Program Synthesis (MIPS) are two tools which may be used toward the implementation of such a method.

Modern computing technologies-hardware, software, and algorithmic-have enabled the deployment of more exacting diagnostic reasoning (DR) systems than has heretofore been possible. Compromises in algorithm and modeling paradigm complexity, due to computational throughput and state-space explosion constraints, have historically dominated practical applications of such systems. This paper describes approaches that have been shown to be applicable in a wide set of domains. The algorithms used are highly scaleable and support a symbolic modeling formalism for analyzing the properties of the complex, dynamic systems. Moreover, analysis of simultaneous failures occurs as a natural byproduct of this formalism.

Many large software systems are tightly integrated with their physical environments and must be adapted when their environment changes. Typically, software development methodologies do not place a great emphasis on modeling the system's environment, and hence environmental changes may lead to significant and complicated changes in the software. We argue that (1) the modeling of the environment should be an integral part of the process, and (2) to support software evolution, wherever possible, the software should be automatically generated. We present a model-integrated development approach that is capable of supporting cost effective system evolution in accordance with changes in the system's environment. The approach is supported by a "meta-architecture" that provides a framework for building model-based systems. This framework has been successfully used in various projects. One of these projects, a site-production flow visualization system for a large manufacturing operation, is analyzed in detail.

The building of custom monitoring, control, simulation and diagnostics applications for complex chemical plants necessitates the integration of models into the problem solving process. This paper describes a system and its practical applications that supports this activity. It is based on the Multigraph Architecture, which is a generic framework for building these model-based systems. The paper discusses the modeling paradigms used, how the applications are generated, and some practical, existing applications.

The design, implementation and deployment of computer applications tightly integrated with complex, changing environments is a difficult task. This paper presents the Multigraph Architecture (MGA) developed for building complex embedded systems. The MGA is a meta-level architecture which includes tools and methods to create domain specific model integrated program synthesis environments. These environments support the integrated modeling of systems independently from their implementation, include tools for model analysis and application specific model interpreters for the synthesis of executable programs.

We describe a programming environment which is being developed for the automatic generation of parallel image processing applications. Through the use of model-based software synthesis, we transparently create large grained data parallel applications which can be executed on arbitrary processor networks. The high-level abstractions provided by the modeling paradigm isolates the user from the complexity of the underlying implementation, allowing developers with little or no experience in parallel programming to rapidly create parallel applications. The data parallel modeling facilities perform the same tasks as the data alignment and distribution compiler directives of High Performance Fortran and the aggregate objects of pC++. However, we have found that by introducing the parallelism on the system level, instead of in the algorithm, we can use traditional compilers and leave the application specific code unchanged. This allows us to take advantage of existing well developed image processing code libraries. Here we describe a system which generates data parallel versions of applications created in Khoros, the popular image processing package developed by the University of New Mexico. This system retains the best qualities of Khoros: its interactive and experimental nature, and its visual interface, but adds the capability for automatically generating much higher performance parallel implementations when needed. This system demonstrate the suitability of the model-based approach for developing parallel imaging software.>

A real-time fault diagnostics system that is applicable for diagnosing large-scale plants is described. It uses a multiple aspect model of the plant including the hierarchical process model, the hierarchical component model, and the hierarchical fault model (HFM). HFM represents the spatial and temporal aspects of faulty behavior in the form of a hierarchical fault propagation digraph. The reasoning algorithm is based on the structural and temporal constraint enforcement, and is migrated to lower levels of HFM hierarchy. It is able to guarantee response times, perform nonmonotonic and temporal reasoning, operate continuously, accept asynchronous data, generate requests, perform time and diagnostic resolution tradeoffs, and diagnose single and most multiple fault cases.>

Structurally adaptive and dynamically reconfigurable systems are presented as important ingredients in the design and development of robust large-scale signal-processing systems for operation in complex nonstationary environments. The multigraph programming and execution environment (MPEE) is a complete, parallel, fully integrated programming and execution environment for structurally adaptive signal-processing systems. It provides a user-friendly environment for designing, programming, and executing such a signal-processing system. The MPEE is shown to have many advantages, due to graph-based processing, dynamic scheduling, multiprocessor programming capabilities, a hierarchical approach to system design, and graphic editors.>

A approach is proposed for the design and implementation of an intelligent monitoring and diagnostic system for a cogenerator plant. The approach is based on multiple-aspect modeling and model interpretation: sensory input signals from the plant are processed and interpreted in the context of various models of the cogenerator system. Experiences obtained during the development and the field test of the system have proved that the approach is viable even in real-time applications and results in considerable improvement in software technology.>

In a large class of intelligent machines, one of the tasks of the knowledge-based system components is to configure real-time signal processing systems. These systems implement low-level sensory or control algorithms according to the model of the system to be observed or controlled. If a change in the state of the model is detected, or the goal of the operation is modified, the real-time signal processing schemes have to be dynamically restructured. This article describes a system which has been developed for the knowledge-based generation and restructuring of real-time signal processing systems in parallel computing environments. the system is based on the integration of a hierarchical representation technique, the corresponding interpretation method, and an execution environment, which includes a graph model of computations.