Cyber-Physical Systems (CPS) integrate discrete-time computing and continuous-time physical-world entities, which are often wirelessly interlinked. The use of wireless safety-critical CPS requires safety guarantees despite communication faults. This paper focuses on one important set of such safety rules: Proper-Temporal-Embedding (PTE), where distributed CPS entities must enter/leave risky states according to properly nested temporal pattern and certain duration spacing. Our solution introduces hybrid automata to formally describe and analyze CPS design patterns. We propose a novel leasing based design pattern, along with closed-form configuration constraints, to guarantee PTE safety rules under arbitrary wireless communication faults. We propose a formal procedure to transform the design pattern hybrid automata into specific wireless CPS designs. This procedure can effectively isolate physical world parameters from affecting the PTE safety of the resultant specific designs. We conduct two wireless CPS case studies, one on medicine and the other on control, to show that the resulted system is safe against communication failures. We also compare our approach with a polling based approach. Both approaches support PTE under arbitrary communication failures. The polling approach performs better under severely adverse wireless medium conditions; while ours performs better under benign or moderately adverse wireless medium conditions.

ZigBee and other wireless technologies operating in the (2.4GHz) ISM band are being applied in Wireless Personal Area Networks (WPAN) for many medical applications. However, these low duty cycle, low power, and low data rate medical WPANs suffer from WiFi co-channel interferences. WiFi interference can lead to longer latency and higher packet losses in WPANs, which can be particularly harmful to safety-critical applications with stringent temporal requirements, such as ElectroCardioGraphy (ECG). This paper exploits the Clear Channel Assessment (CCA) mechanism in WiFi devices and proposes a novel policing framework, WiCop, that can effectively control the temporal white-spaces between WiFi transmissions. Such temporal white-spaces can be utilized for delivering low duty cycle WPAN traffic. We have implemented and validated WiCop on SORA, a software-defined radio platform. Experimental results show that with the assistance of the proposed WiCop policing schemes, the packet reception rate of a ZigBee-based WPAN can increase by up to 116% in the presence of a heavy WiFi interferer. A case study on the medical application of WPAN ECG monitoring demonstrates that WiCop can bound ECG signal distortion within 2% even under heavy WiFi interference. An analytical framework is devised to model the CCA behavior of WiFi interferers and the performance of WPANs under WiFi interference with or without WiCop protection. The analytical results are corroborated by experiments.

Cyber-Physical Systems (CPS) integrate discrete-time computing and continuous-time physical-world entities, which are often wirelessly interlinked. The use of wireless safety critical CPS (control, healthcare etc.) requires safety guarantees despite communication faults. This paper focuses on one important set of such safety rules: Proper-Temporal-Embedding (PTE). Our solution introduces hybrid automata to formally describe and analyze CPS design patterns. We propose a novel lease based design pattern, along with closed-form configuration constraints, to guarantee PTE safety rules under arbitrary wireless communication faults. We propose a formal methodology to transform the design pattern hybrid automata into specific wireless CPS designs. This methodology can effectively isolate physical world parameters from affecting the PTE safety of the resultant specific designs. We conduct a case study on laser tracheotomy wireless CPS to show that the resulting system is safe and can withstand communication disruptions.

The rapid scaling up of modern avionics is forcing its communication infrastructure to evolve from shared medium toward multi-hop switched real-time networks. This prompts the proposal of avionics full-duplex switched Ethernet (AFDX) standard. Since its publication, AFDX has been well-received, and is deployed or to-be-deployed in state-of-the-art aircrafts, such as Airbus A380/A400M/A350, Boeing 787, Bombardier CSeries etc. On the other hand, AFDX standard only specifies the behavior that an underlying switch must follow, but leaves the architecture design open. This creates an open market for switch vendors. Among the different candidate designs for this market, the TDMA crossbar real-time switch architecture stands out as it complies with and even simplifies many mainstream switch architectures, hence lays a smooth evolution path toward AFDX. In this paper, we focus on analyzing this switch design for AFDX networks. We first prove that TDMA crossbar real-time switch architecture complies with the AFDX specifications; and derive closed-form formulae on the corresponding AFDX networks' traffic characteristics and end-to-end real-time delay bound. Then we prove the resource planning problem in the corresponding AFDX networks is NP-Hard. To address this NP-Hard challenge, we re-model the problem. Based upon the re-modeling, we propose an approximation algorithm.

To integrate the nowadays rapidly expanding distributed real-time systems, we need multi-hop real-time switched networks. A (if not "the") widely recognized/adopted real-time switch architecture is the TDMA crossbar real-time (TCRT) switch architecture. However, the original TCRT switch architecture assumes per-flow queueing. To support scalability, however, queue sharing (i.e. flow aggregation), must be allowed. With simple flow aggregation, flow burstiness can grow and infect, making schedulability and end-to-end delay bound analysis an open problem. To deal with this, we propose the real-time aggregate scheme. The scheme complies with the existing TCRT switch architecture, and deploys spatial-temporal isolation and over-provisioning to curb aggregate member flows' burstiness. This allows us to derive the closed-form end-to-end delay bound, and give the corresponding resource planning and admission control strategies. Simulations are carried out to show the effectiveness of the design.

The rapid scaling up of Networked Control Systems (NCS) is forcing traditional single-hop shared medium industrial fieldbuses (a.k.a. fieldbuses) to evolve toward multi-hop switched fieldbuses. Such evolution faces many challenges. The first is the re-design of switch architecture. To meet the real-time nature of NCS traffic, and to lay a smooth evolution path for switch manufacturers, it is widely agreed that a (if not the) promising switch architecture is an input queueing crossbar architecture running TDMA scheduling. The second challenge is real-time multicast. NCS applications usually involve complex distributed multiple-input-multiple-output interactions, which by their nature necessitate real-time multicast. In shared medium fieldbuses, real-time multicast is straightforward as data sent to the medium is heard by all nodes. On multi-hop switched fieldbuses, however, real-time multicast becomes non-trivial. In this paper, we prove real-time multicast on multi-hop switched fieldbuses is NP-Hard. What is more, real-time multicast on multi-hop switched fieldbuses is fundamentally different from Internet multicast, due to real-time requirement and the homogeneous input queueing crossbar switch architecture. Particularly, switch external links' capacities are no longer mutually independent. Such drastic change of assumptions warrants developing new routing algorithms, and a heuristic algorithm is hereby proposed.

ZigBee and other wireless technologies operating in the (2.4GHz) ISM band are being applied in Wireless Body Area Networks (WBAN) for many medical applications. However, these low duty cycle, low power, and low data rate medical WBANs suffer from WiFi co-channel interferences. WiFi interference can lead to longer latency and higher packet losses in WBANs, which can be particularly harmful to safety-critical applications with stringent temporal requirements. Existing solutions to WiFi-WBAN coexistence either require modifications to WiFi or WBAN devices, or have limited applicability. In this paper, by exploiting the Clear Channel Assessment (CCA) mechanisms in WiFi devices, we propose a novel policing framework, WiCop, that can effectively control the temporal white-spaces between WiFi transmissions. Specifically, the WiCop Fake-PHY-Header policing strategy uses a fake WiFi PHY preamble-header broadcast to mute other WiFi interferers for the duration of WBAN active interval, while the WiCop DSSS-Nulling policing strategy uses repeated WiFi PHY preamble (with its spectrum side lobe nulled by a band-pass filter) to mute other WiFi interferers throughout the duration of WBAN active interval. The resulted WiFi temporal white-spaces can be utilized for delivering low duty cycle WBAN traffic. We have implemented and validated WiCop on SORA, a software defined radio platform. Experiments show that with the assistance of the proposed WiCop policing schemes, the packet reception rate of a ZigBee-based WBAN can increase by up to 43.8% in presence of a busy WiFi interferer.