Numerous applications of cyber-physical systems in safetycritical spheres of human activity are the main reason for the fact that the development of methods intended for on-line faults diagnoses in these systems is one of the actual problems. One of the essential sub-problems for this problem is elaboration of models and methods intended for online checking of faults in cyber-physical systems. In the given paper this sub-problem is investigated under the supposition that these systems can be modeled by the 1-dimensional hybrid automata defined in the given paper. On the base of this model-based approach, some completely distributed system intended for on-line monitoring and fault components isolation in cyber-physical systems is proposed. This system consists of controllers of two types. Controllers of the first type are intended for checking the dynamics of physical processes, while controllers of the second type are intended for checking switching between dynamics. The structure of both types of proposed controllers is considered in detail. Necessary and sufficient conditions that guarantee for both types of proposed controllers that they carry out correct on-line checking are established and proved.
Modern information technologies have stimulated penetration of cyber-physical systems (CPS) into different spheres of mankind activity. Informally, any CPS (see [1], for example) consists of some computer networks and/or built-in controllers that are used for control of considered physical processes via the feedback, i.e. the considered physical processes conduct the computations, while the computations, in its turn, conduct the choice and the mode of these physical processes. The state of the art in the development of CPS is presented in [2,3].
At present, CPS are widely used at the research of the Space, in power, military, transport, healthcare, and production spheres, for the design of modern infrastructure, etc. By this reason, in the overwhelming majority of cases, these domains are critical ones. Therefore, in the vast majority of cases, CPS are safety-critical systems. For this reason, the development of methods intended for faults diagnoses in CPS is one of the actual problems. Different approaches for investigation of this problem have been presented in [4–6].
The essential sub-problem for the problem of on-line faults diagnoses in CPS is the problem of on-line monitoring and fault components isolation in these systems. The given paper is devoted to the investigation of this problem.
We propose some model-based completely distributed system intended for on-line monitoring and fault components isolation in the analyzed CPS. This system consists controllers of two types. Controllers of the first type are intended for checking the dynamics of physical processes in the analyzed CPS, while controllers of the second type are intended for checking switching between dynamics in the analyzed CPS. 2
It is well-known that hybrid automata (HA) are one of the most often used mathematical models for the design of formal specification and the analysis of CPS. Therefore, it is natural to develop any model-based algorithms or systems intended for analysis of CPS in terms of HA.
One of the first definitions for HA has been proposed in [7]. Although this definition of HA provides to us a convenient conceptual model, it is very difficult to apply this model for the development of algorithms for CPS. Indeed, at the solution of specific problems for CPS by means of these or those software tools, the researcher, as the rule, must predetermine, detail and reformulate analyzed objects and concepts in such way that the received model can be very problematically squeezed in this definition of HA.
For the development of algorithms for analysis of CPS, much more convenient and much more widely used is the model of HA defined in [8] in the following way.
An HA is a system
H = (Q, X, I, D, f, E, G, R), where:
Q is a finite set of discrete states; X ⊆ Rn is a set of continuous states; f : Q × X → Rn is vector field; I ⊆ Q × X is a set of initial states; D : Q → B(X) is a domain; E ⊆ Q × Q is a set of edges; G : E → B(X) is a guard condition; R : E × X → B(X) is a reset map.
It is well-known that there is a considerable number of difficulties connected with computations and algorithmic solvability for such general model of HA. By this reason, at the resolving of specific problems for CPS, the researchers take this circumstance into consideration and usually limit themselves to the analysis of sufficiently narrow sets of HA.
Due to this approach, we investigate the problem of checking of faults in CPS under the assumption that the associated model of HA is an element of the set H0 of 1-dimensional HA that has been defined and investigated in [9].
This set H0 of 1-dimensional HA has been defined proceeding from the model of HA offered in [8], as follows.
It is assumed that for each discrete state q ∈ Q the following six conditions hold: 1. The set D(q) = Xq ⊆ X is some finite interval.
2. The set of initial values of the continuous state is the set of pair-wise disjoint closed intervals [αq,h, Aq,h] (αq,h ≤ Aq,h), where h = 1, . . . , rq.
3. The guard condition associated with the set of initial values [αq,h, Aq,h] (h = 1, . . . , rq) is some closed interval [βq,h, Bq,h] (βq,h ≤ Bq,h), and the sets [βq,h, Bq,h] (h = 1, . . . , rq) are pair-wise disjoint.
4. For each set [αq,h, Aq,h] (h = 1, . . . , rq) of initial values the dynamics is presented by the differential equation x˙ = fq,h(x), where Dom(fq,h) ⊇ Xq and fq,h is some Lipschitz continuous function.
5. For each set [αq,h, Aq,h] (h = 1, . . . , rq) of initial values the duration of the dynamics is some number tq,h ∈ [θq,h, Θq,h] (where either θq,h = Θq,h = 0, or 0 < θq,h < Θq,h), such that x(tq,h) ∈ [βq,h, Bq,h].
6. For each guard condition [βq,h, Bq,h] (h = 1, . . . , rq) there exists the single arc (q, q′) ∈ E and the single set [αq′,m, Aq′,m] (m ∈ {1, . . . , rq′ }) of initial values, such that the inclusion R(q,q′)([βq,h, Bq,h]) ⊆ [αq′,m, Aq′,m] holds, where R(q,q′)(·) = R((q, q′), ·).
It should be noted that when the condition θq,h = Θq,h = 0 holds, de facto we deal not with the continuous dynamics, but with usual switching. Besides, it is more correct to use denotation ((q, h), (q′, m)) for the elements of the set E. This denotation will be used in what follows.
The set H0 has been called the set of 1-dimensional HA, since each dynamics is presented by a differential equation from the same variable, though the number the different dynamics in discrete states can be different. The main aim to define this set of HA has been to aggregate the discrete states of HA, and thus to simplify structure of the transition graph due to reduction the number of vertices.
Let Sqin,h and Sqf,ihn be the maximal relatively to the inclusion relation sets that are defined by the following three axioms: (i) Sqin,h ⊆ [αq,h, Aq,h]&Sqf,ihn ⊆ [βq,h, Bq,h]; (ii) θq,h = Θq,h = 0 ⇒ Sqin,h = Sqf,ihn; (iii) 0 < θq,h < Θq,h ⇒ (∀x(t))(x(0) ∈ Sqin,h ⇒
⇒ (∃t0 ∈ [θq,h, Θq,h])(x(t0) ∈ Sqf,ihn)&(∀t ∈ [0, Θq,h])(x(t) ∈ Xq))&
&(∀b ∈ Sqf,ihn)(∃x(t))(x(0) ∈ Sqin,h&(∃t0 ∈ [θq,h, Θq,h])(x(t0) = b)).
It has been proved in [9] that each HA H ∈ H0 can be reduced to equivalent model, such that the following two conditions hold:
Condition 1. The equalities and are true for all q ∈ Q and h = 1, . . . , rq.
Condition 2. The equality
Sqin,h = [αq,h, Aq,h]
Sqf,ihn = [βq,h, Bq,h]
R((q,h),(q′,m))(Sqf,ihn) = Sqin′,m is true for all ((q, h), (q′, m)) ∈ E.
In what follows it is supposed that the Conditions 1 and 2 hold for any considered HA. 3
It is evident that different architectures for the system of on-line checking of faults in CPS can be offered. The main criteria of the efficiency for this system are the reliability, the scalability, and the minimal time for decision-making.
Due to these criteria, the best solution is the completely distributed system for on-line checking of faults in CPS. Thus, for each dynamical process, as well as for each switching its own controller can be associated.
It should be emphasized that we consider the controller as some discrete electronic device implemented on the base of the microprocessor and RAM.
Let us characterize these controllers for CPS presented by HA H ∈ H0. 3.1
It is assumed that if any of physical processes in the analyzed CPS is not activated after obtaining the relevant input data, then the special physical device instantly blocks this process. Thus, we will deal with the situation when each physical process in the analyzed CPS is activated after obtaining the relevant input data.
It is also assumed that the controllers which are carrying out on-line checking of different dynamical processes in the analyzed CPS are different, and do not interact with each other in any way. Therefore, considering the HA H ∈ H0 associated with the analyzed CPS, we conclude that the total number of controllers intended for on-line checking of different dynamical processes in the analyzed CPS does not exceed the integer ∑ rq.
q∈Q
Cq,h (q ∈ Q; h ∈ {1, . . . , rq}), which for the fixed discrete state q ∈ Q of HA H ∈ H0 carries out on-line checking of the continuous dynamics for the analyzed CPS, under assumption that this dynamics is presented in the HA H by the differential equation x˙ = fq,h(x) , where fq,h is, at least, some Lipschitz continuous function on the closed interval [0, Θq,h].
It should be noted that this assumption about the function fq,h holds for sufficiently wide class of CPS.
Applying the Euler method, we can transform the equation (
Therefore, with each solution x(t) of the differential equation (
x0, x1, . . . (x0 = x(0)),
calculated in accordance with the formula (
The controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) consists of the two blocks, namely B1 and B2.
The block B1 consists of two input channels, namely i1,1 and i1,2, and one output channel, namely o1.
The input channel i1,1 obtains from some sensor the information that the initial value for the analyzed physical process in CPS is x0.
The input channel i1,2 is a binary channel. It obtains through some sensor
the information whether the analyzed physical process in CPS presented by the
differential equation (
It is assumed that the symbol 1 is associated with the situation that analyzed physical process in the analyzed CPS is activated, the symbol 0 is associated with the situation that this physical process is not activated, the impulse 0 → 1 activates the block B1 and the impulse 1 → 0 deactivates this block.
As soon as the block B1 is activated, it carries out calculation of the sequence
(
It is assumed that the symbol x0 and each calculated symbol xj (j = 1, 2, . . .) at once appears on the output channel o1 of the block B1.
The block B2 consists of three input channels, namely i2,1, i2,2 and i2,2, and one output channel, namely o2.
The input channel i2,1 is identical with the input channel i1,2. Thus, the input channels i2,1 and i1,2 can be treated as the branching of the same line connected with the same sensor.
Similarly, to destination of the input channel i1,2, the input channel i2,1 activates the block B2 by the impulse 0 → 1.
The input channel i2,2 of the block B2 is connected with the output channel o1 of the block B1.
The input channel i2,3 of the block B2 obtains from some sensor, symbol by symbol, the information that the analyzed physical process generates the sequence
y0, y1, . . . (y0 = x0) of its output values.
The output channel o2 of the block B2 is a binary channel connected with the physical device Dq,h that can immediately deactivate and isolate the analyzed physical process in CPS.
It is assumed that the symbol 1 is associated with the situation when the device Dq,h must be activated and the symbol 0 is associated with the situation when this device is deactivated.
As soon as the block B2 is activated, the value of the signal on its output channel o2 is equal to 0.
When the block B2 obtains the symbols xj and yj, respectively, on its input channels i2,2 and i2,3, where j = 1, 2, . . ., it carries out the following calculations.
The block B2 computes the value
tj = tj−1 + ∆t (t0 = 0), and checks whether the inequality holds.
Let and the value of the signal on the input channel i2,1 is equal to 1. Then the signal 1 is generated on the output channel o2 of the block B2, and the block B2 deactivates itself.
Let and the value of the signal on the input channel i2,1 is equal to 1. Then the block B2 checks, whether the condition
Otherwise (i.e. when the condition yj ∈ Xq holds), the condition is checked, where ε is some sufficiently small properly chosen positive number.
If this condition is violated, then the signal 1 is generated on the output channel o2 of the block B2, and the block B2 deactivates itself.
Let and the impulse 1 → 0 is applied to the input channel i2,1 of the block B2. Then this block checks whether the inequality |xj − yj| ≤ ε holds.
If tj < θq,h then the signal 1 is generated on the output channel o2 of the block B2, and the block B2 deactivates itself.
Otherwise (i.e. when tj ≥ θq,h), the block B2 deactivates itself.
It is evident that the time spent by the block B2 on the considered above calculations is insignificant in the comparison with the time spent by the block B1 on its calculations. By this reason, the time spent by the block B2 on the considered above calculations can be neglected at all.
Therefore, it can be assumed that the calculations of the block B2 are carried out instantly.
The controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) offered above can be characterized as follows.
Theorem 1. It can be guaranteed that the controller
Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) carries out correct on-line checking of the analyzed physical process in the analyzed CPS if and only if the equality
TB1 = TB2
(
From the definition of the controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) we get that if this controller is activated then on the input channels i2,2 and i2,3 of the block B2 the signals xj and yj, associated to each other, are obtained in each instant of time.
Besides, from the definition of the block B2 it follows that the signal 1 can be produced on its output channel o2 if and only if this block is activated, and some fault in the analyzed physical process in the analyzed CPS reveals itself at the current instant of time. In this case the device Dq,h is activated, and the analyzed physical process in the analyzed CPS is deactivated and isolated.
Thus, it can be guaranteed that the controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) carries out correct on-line checking of the analyzed physical process in the analyzed CPS.
Let us suppose that the equality (
From the definition of the controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) it follows that if this controller is activated then there can exist some instant of time such that on the input channels i2,2 and i2,3 of the block B2 are obtained the signals xj1 and yj2 , where j1 ̸= j2. Starting from this instant of time the functioning of the controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) can be incorrect.
Thus, there is no guarantee that the controller Cq,h (q ∈ Q; h ∈ {1, . . . , rq}) carries out correct on-line checking of the analyzed physical process in the analyzed CPS.
Q.E.D. 3.2
It is assumed that with each switching between dynamics in the analyzed CPS its own controller is associated, and different non-interacting with each other controllers are associated with different switching. Therefore, there is a oneto-one correspondence between non-interacting controllers intended for on-line checking of switching between dynamics in the analyzed CPS and the elements of the set E in the associated HA H ∈ H0, i.e. the total number of these controllers is equal to |E|.
It is also assumed that for the analyzed CPS the time needed to carry out any switching between dynamics is some sufficiently small positive number τ . This assumption reflects the fact that in real systems switching are made not instantly, but with some delay.
Now we define the controller
C((q,h),(q′,m)) (q, q′ ∈ Q; h ∈ {1, . . . , rq}; m ∈ {1, . . . , rq′ }), intended for on-line checking of switching in the analyzed CPS, defined by the arc ((q, h), (q′, h′)) ∈ E in the associated HA H ∈ H0.
The controller C((q,h),(q′,m)) consists of three input channels i1, i2, i3 and one output channel o.
The input channel i1 of the controller C((q,h),(q′,m)) is a binary channel, and through some sensor obtains the information whether the physical process in the analyzed CPS, associated with the dynamics x˙ = fq,h(x) in the HA H, is activated or is not activated.
It is assumed that the symbol 1 is associated with the situation when the physical process in the analyzed CPS, associated with the dynamics x˙ = fq,h(x) in the HA H, is activated, the symbol 0 is associated with the situation when this process is deactivated, and the impulse 1 → 0 activates the controller C((q,h),(q′,m)).
The input channel i2 of the controller C((q,h),(q′,m)) is connected with the output channel of the block B1 of the controller Cq,h, which is intended for online checking of the dynamics x˙ = fq,h(x), and obtains, symbol by symbol, the sequence computed by this block.
The input channel i3 of the controller C((q,h),(q′,m)) through some sensor obtains, symbol by symbol, the values x0, x1, . . . , xtq,h y0, y1, . . . , ytq,h produced by the physical process in the analyzed CPS, associated with the dynamics x˙ = fq,h(x) in the HA H.
The output channel o of the controller C((q,h),(q′,m)) is a binary channel connected with the physical device S((q,h),(q′,m)). This device carries out in the analyzed CPS the switching between the physical process associated with the dynamics x˙ = fq,h(x) in the HA H and the physical process associated with the dynamics x˙ = fq′,m(x) in the HA H.
It is assumed that the symbol 1 on the output channel o of the controller C((q,h),(q′,m)) is associated with the situation when the device S((q,h),(q′,m)) is activated, and the symbol 0 is associated with the situation when this physical device is deactivated.
It is also assumed that initially the value of the signal on the output channel o of the controller C((q,h),(q′,m)) is equal to 1.
In the instance of time when the impulse 1 → 0 is applied to the input channel i1, the values of the symbols on the input channels i2 and i3 are equal to xtq,h and ytq,h respectively, where tq,h ∈ [θq,h, Θq,h].
The controller C((q,h),(q′,m)) is activated, and carries out checking of the truth value of the following condition
|xtq,h − ytq,h | ≤ ε&ytq,h ∈ [βq,h, Bq,h]&
&R(((q, h), (q′, m)), ytq,h ) ∈ [αq′,m, Aq′,m],
(
If the condition (
The controller C((q,h),(q′,m)) offered above can be characterized as follows. Theorem 2. It can be guaranteed that the controller
C((q,h),(q′,m)) (q, q′ ∈ Q; h ∈ {1, . . . , rq}; m ∈ {1, . . . , rq′ })
carries out correct on-line checking of the switching in the analyzed CPS, defined
by the arc ((q, h), (q′, h′)) ∈ E in the HA H ∈ H0, if and only if the inequality
T|x−y|≤ε + Ty∈[βq,h,Bq,h] + TR < τ
(
From the definition of the controller C((q,h),(q′,m)) we get that at the instance when this controller is activated, the symbols on its input channels i2 and i3 are equal to xtq,h and ytq,h respectively, where tq,h ∈ [θq,h, Θq,h], and the value of the signal on the output channel o of the controller C((q,h),(q′,m)) is equal to 1.
Besides, from the definition of the controller C((q,h),(q′,m)) it follows that the signal 0 can be produced on its output channel o if and only if this controller is activated, and some fault in the analyzed physical process in CPS reveals itself. In this case the physical device S((q,h),(q′,m)) is deactivated.
Due to the inequality (
Thus, it can be guaranteed that the controller C((q,h),(q′,m)) carries out correct on-line checking of the analyzed switching in the analyzed CPS.
Let us suppose that the inequality (
T|x−y|≤ε + Ty∈[βq,h,Bq,h] + TR ≥ τ holds.
From the definition of the controller C((q,h),(q′,m)) it follows that it is possible such situation that some fault reveals itself on the controller C((q,h),(q′,m)) on the expiration of time τ . In this case the physical device S((q,h),(q′,m)) is deactivated later than in the analyzed CPS has occurred, perhaps incorrect, switching between the considered physical processes.
Thus, there is no guarantee that the controller C((q,h),(q′,m)) carries out correct on-line checking of the analyzed switching in the analyzed CPS.
Q.E.D. 4
The given paper is a theoretic one. Its main aim consisted in the developing some structure of a completely distributed system intended for on-line monitoring and fault components isolation in CPS. The proposed system is developed on the model-based approach under the supposition that 1-dimensional HA of special type is used as the mathematical model for the analyzed CPS. The use for the analyzed CPS of different controllers for checking the dynamics of physical processes and for checking switching between dynamics, gave the possibility to establish the necessary and sufficient conditions guaranteeing correct on-line checking of faults in the analyzed CPS.
The detailed analysis of the structure of these controllers shows that the offered completely distributed system intended for on-line monitoring and fault components isolation in CPS can be easily generalized on the more general case of CPS, when multi-dimensional HA are used. To achieve this aim, it is sufficient to demand that the restrictions on the time spent by the controllers on their calculations that are similar to the restrictions that have been established in theorems 1 and 2 were carried out.
The main direction of further researches is the specification of the proposed general completely distributed system for on-line monitoring and fault components isolation in specific CPS.