Cyber-physical systems are increasingly deployed in safety-critical applications, making their robustness under adversarial conditions a critical concern. Among the diverse range of threats, timed attacks, i.e., attacks triggered at particular timing, pose a unique challenge due to their ability to disrupt system behaviors in subtle and complex ways. In this paper, we propose a formal framework for quantitative analysis of the robustness of system's safety against timed attacks on cyber-physical systems modeled via the formalism of hybrid programs and differential dynamic logic. We introduce a series of timing related properties to characterize the robustness of safety against timed attacks, and develop a system of reasoning techniques, with a focus on the timing of dynamics, to establish these properties. We showcase the reasoning techniques with a case study on a water tank system with non-trivial dynamics.

Abstract A digital twin is a virtual replica of a physical system that has to interact with it in real-time in order to facilitate decision-making, to reduce failures and costs, and to ensure a coherent and safe system execution. We call effectiveness the ability of the digital twin to direct the physical counterpart. In this paper we provide the means to evaluate the effectiveness of a digital twin in the case that the physical system is operating under uncertainty, and it is therefore subject to perturbations . Specifically, we present the DT-Stark tool, that extends Stark , a tool for modelling and verification of systems operating under uncertainty, with feedback , a special mechanism that allow us to model the communications, and their effects, between the digital and the physical (perturbed) twin in a concise, clean fashion. We can then exploit the features of Stark to compare the behaviour of the twins, to verify properties over them, and to measure effectiveness. We provide some examples of the use of our tool by applying it to the evaluation of the effectiveness of digital twins in two robotic scenarios: an industrial plant and a smart hospital.

In probabilistic process algebras the classic qualitative description of process behaviour is enriched with quantitative information on it, usually modelled in terms of probabilistic weights and/or distributions over the qualitative behaviour. In this setting, we use behavioural equivalences to check whether two processes show exactly the same behaviour, and, if this is not the case, we can use behavioural metrics to measure the distance between them. Compositional reasoning requires that equivalence, or closeness, of behaviour of two processes are not destroyed when language operators are applied on top of them in order to build larger processes. Formally, the equivalence must be a congruence, and the metric must be uniformly continuous, with respect to language operators. Instead of verifying these compositional properties by hand, operator-by-operator, it is much more convenient to prove them for a class of operators once for all, and to check that the operators one is dealing with are in that class. This is achieved by means of SOS specification formats: they consist in a set of syntactical constraints characterising a class of operators on the patterns of SOS rules, that define the operational semantics of languages. With this survey, we aim to collect and describe the specification formats that have been proposed in the literature to guarantee the compositional properties of (variants of) bisimulation equivalences and bisimulation metrics in the probabilistic setting.

We present the Software Tool for the Analysis of Robustness in the unKnown environment (Stark), our Java tool for the specification, analysis and verification of robustness properties of Cyber-Physical Systems (CPSs). Stark includes: (i) a specification language for systems behaviour, perturbations, distances on systems behaviours, and requirements on systems behaviour expressed in the Robustness Temporal Logic (RobTL), a temporal logic for the specification and verification of properties on the evolution of distances between the behaviours of CPSs, and thus also of robustness properties; (ii) a module for the simulation of system behaviours and their perturbed versions; (iii) a module for the evaluation of distances between behaviours; (iv) a statistical model checker for RobTL formulae.

We propose two step-by-step approaches to the analysis of robustness in biochemical networks. Our aim is to measure the ability of the network to exhibit step-by-step limited variations on the concentration of a species of interest at varying of the initial concentration of other species. The first approach we propose is reaction-by-reaction, i.e. we compare the states reached by nominal and perturbed networks after they have performed the same number of reactions. We provide a statistical technique allowing for estimating robustness, we implement it in a tool called spebnr ( a Simple Python Environment for statistical estimation of Biochemical Network Robustness ) and showcase it on three case studies: the EnvZ/OmpR osmoregulatory signaling system of Escherichia Coli, the mechanism of bacterial chemotaxis of Escherichia Coli, and enzyme activity at saturation. Then, we consider a time-by-time approach, in which networks are compared on the basis of the states they reached at the same time point, regardless of how many reactions occurred. This approach is implemented in Stark , and we apply it to the study the robustness of the EnvZ/OmpR osmoregulatory signaling system and the Lotka-Volterra equations.

This paper contributes a formal framework for quantitative analysis of bounded sensor attacks on cyber-physical systems, using the formalism of differential dynamic logic. Given a precondition and postcondition of a system, we formalize two quantitative safety notions, quantitative forward and backward safety, which respectively express (1) how strong the strongest postcondition of the system is with respect to the specified postcondition, and (2) how strong the specified precondition is with respect to the weakest precondition of the system needed to ensure the specified postcondition holds. We introduce two notions, forward and backward robustness, to characterize the robustness of a system against sensor attacks as the loss of safety. Two simulation distances, which respectively characterize upper bounds of the degree of forward and backward safety loss caused by the sensor attacks, are developed to reason with robustness. We verify the two simulation distances by expressing them as formulas of differential dynamic logic. We showcase an example of an autonomous vehicle that needs to avoid a collision.

Due to the diffusion of IoT, modern software systems are often thought to control and coordinate smart devices in order to manage assets and resources, and to guarantee efficient behaviours. For this class of systems, which interact extensively with humans and with their environment, it is thus crucial to guarantee their correct behaviour in order to avoid unexpected and possibly dangerous situations. In this paper we will present a framework that allows us to measure the robustness of systems. This is the ability of a program to tolerate changes in the environmental conditions and preserving the original behaviour. In the proposed framework, the interaction of a program with its environment is represented as a sequence of random variables describing how both evolve in time. For this reason, the considered measures will be defined among probability distributions of observed data. The proposed framework will be then used to define the notions of adaptability and reliability. The former indicates the ability of a program to absorb perturbation on environmental conditions after a given amount of time. The latter expresses the ability of a program to maintain its intended behaviour (up-to some reasonable tolerance) despite the presence of perturbations in the environment. Moreover, an algorithm, based on statistical inference, is proposed to evaluate the proposed metric and the aforementioned properties. We use two case studies to the describe and evaluate the proposed approach.

Cyber-Physical systems (CPSs) are exposed to cyber- physical attacks, i.e., security breaches in cyberspace that adversely affect the physical processes of the systems.We define two probabilistic metrics to estimate the physical impact of attacks targeting cyber-physical systems formalised in terms of a probabilistic hybrid extension of Hennessy and Regan's Timed Process Language. Our impact metrics estimate the impact of cyber-physical attacks taking into account: (i) the severity of the inflicted damage in a given amount of time, and (ii) the probability that these attacks are actually accomplished, according to the dynamics of the system under attack. In doing so, we pay special attention to stealthy attacks, i. e., attacks that cannot be detected by intrusion detection systems. As further contribution, we show that, under precise conditions, our metrics allow us to estimate the impact of attacks targeting a complex CPS in a compositional way, i.e., in terms of the impact on its sub-systems.

In this paper, we recall the basic features of the CospanSpan(Graph) algebra for the compositional description of reconfigurable hierarchical networks. In particular, we focus on compositionality and on the possibility of describing the interactions among physical/biological systems, using a parall el with communication operation not considered in the usual Kleene’s algebra. As a novel application, we give a complete compositional description in Span(Graph) of a simplified version of the heart system.

We propose a method for the decomposition of modal formulae on processes with nondeterminism and probability with respect to Structural Operational Semantics. The purpose is to reduce the satisfaction problem of a formula for a process to verifying whether its subprocesses satisfy certain formulae obtained from the decomposition. To deal with the probabilistic behavior of processes, and thus with the decomposition of formulae characterizing it, we introduce a SOS-like machinery allowing for the specification of the behavior of open distribution terms. By our decomposition, we obtain (pre)congruence formats for probabilistic bisimilarity, ready similarity and similarity.

Gossip protocols have been proposed as a robust and efficient method for disseminating information throughout large-scale networks. In this paper, we propose a compositional analysis technique to study formal probabilistic models of gossip protocols expressed in a simple probabilistic timed process calculus for wireless sensor networks. We equip the calculus with a simulation theory to compare probabilistic protocols that have similar behaviour up to a certain tolerance. The theory is used to prove a number of algebraic laws which revealed to be very effective to estimate the performances of gossip networks, with and without communication collisions, and randomised gossip networks. Our simulation theory is an asymmetric variant of the weak bisimulation metric that maintains most of the properties of the original definition. However, our asymmetric version is particularly suitable to reason on protocols in which the systems under consideration are not approximately equivalent, as in the case of gossip protocols.

We investigate the compositionality of both weak bisimilarity metric and weak similarity quasi- metric semantics with respect to a variety of standard operators, in the context of probabilistic process algebra. We show how compositionality with respect to nondeterministic and probabilistic choice requires to resort to rooted semantics. As a main application, we demonstrate how our results can be successfully used to conduct compositional reasonings to estimate the performances of group key update protocols in a multicast setting.

We propose a SOS-based method for decomposing modal formulae for nondeterministic probabilistic processes. The purpose is to reduce the satisfaction problem of a formula for a process to verifying whether its subprocesses satisfy certain formulae obtained from its decomposition. By our decomposition, we obtain (pre)congruence formats for probabilistic bisimilarity, ready similarity and similarity.

We study function elimination for Arithmetical Logics. We propose a method allowing substitution of functions occurring in a given formula with functions with less arity. We prove the correctness of the method and we use it to show the decidability of the satisfiability problem for two classes of f ormulas allowing linear and polynomial terms.

Compositional reasoning over probabilistic systems wrt. behavioral metric semantics requires the language operators to be uniformly continuous. We study which SOS specifications define uniformly continuous operators wrt. bisimulation metric semantics. We propose an expressive specification format that allows us to specify operators of any given modulus of continuity. Moreover, we provide a method that allows to derive from any given specification the modulus of continuity of its operators.

Rule formats are sets of syntactical constraints over SOS rules ensuring semantical properties of the derived LTS. Given a rule format, our proposal is to relax the constraints imposed on each single rule and to introduce some constraints on the form of the whole set of rules, thus obtaining a new format ensuring the same semantical property and being less demanding than the original one. We apply our idea to a well known rule format for rooted branching bisimulation equivalence.

P Systems are computing devices inspired by the structure and the functioning of a living cell. A P System consists of a hierarchy of membranes, each of them containing a multiset of objects, a set of evolution rules, and possibly other membranes. Evolution rules are applied to the objects of the same membrane with maximal parallelism. In this paper we present an extension of P Systems, called P Systems with Membrane Channels (PMC Systems), in which membranes are enriched with channels and objects can pass through a membrane only if there are channels on the membrane that enable such a passage. We show that PMC Systems are universal even if only the simplest form of evolution rules is considered, and we give two application examples.

We propose both an SOS transition rule format for the generative model of probabilistic processes, and an SOS transition rule format for the reactive model of the probabilistic processes. Our rule formats guarantee that probabilistic bisimulation is a congruence with respect to process algebra operations. Moreover, our rule format for generative process algebras guarantees that the probability of the moves of a given process, if there are any, sum up to 1, and the rule format for reactive process algebras guarantees that the probability of the moves of a given process labeled with the same action, if there are any, sum up to 1. We show that most operations of the probabilistic process algebras studied in the literature are captured by our formats, which, therefore, have practical applications.

Abstract. We prove that both the synchronous data-flow language Lustre restricted to types with finite values and the synchronous state-oriented language Argos are embedded in the synchronous paradigm Timed Concurrent Constraint Programming (tccp). In fact, for each of the two languages we provide a tccp language encoding it compositionally with respect to the syntax of programs and linearly with respect to the size of programs. Besides giving results of expressiveness for tccp, our encodings permit us to obtain a language tailored for programming reactive systems where both control handling aspects and data processing aspects are relevant.

Our aim is to study the information flow problem in hybrid systems, namely systems consisting of a discrete program with an analog environment. Information flows compromise the security of a system because they cause leakage of protected information. In order to tackle information flow in real-life systems, we introduce new classes of hybrid systems that extend the known ones while preserving their properties. Then, we define a logic to specify information flow. By means of some examples, we show that, by this logic, we are able to express information flows in hybrid systems and to certify that some suspect behaviors of these systems do not give rise to any information flow. We give a model checking procedure for our logic, and we prove that it gives a correct answer whenever it terminates. Moreover, for a particular class of hybrid systems, we give a version of the procedure that always terminates.

In synchronous programming, programs can be perceived as purely sequential, and parallelism is only a logical concept useful to develop programs in a modular way. Classical semantics for synchronous languages interpret programs as sequential input/ou