One of the challenges for complex IoT software systems is to increase their safety. A Model Driven Development approach helps in the design and development phase of these systems while runtime checking techniques help to enhance safety. To supervise the status of di erent IoT services that are registered in a local cloud at runtime, the solution that is presented in this work uses the information that it receives from the di erent services registered in a local cloud in model terms. The runtime checker, the new Safety related service of the Arrowhead framework, has prede ned contracts to ensure the correctness of the services at runtime. Based on these contracts and checking the information that it receives at runtime it is able to detect unsafe scenarios. Once an unsafe scenario is detected, it starts a safe process to protect the behaviour of the whole system adapting the wrong service or services to a degraded operation mode at runtime. All these services will be Arrowhead compliant.
In our live, we are surrounded by Cyber Physical Systems (CPSs) and System of CPSs (SoCPS)s due to an increasing number of intelligent systems that involve safety, life and business-critical requirements in domains such as transportation, healthcare or systems for managing aspects of our homes. These systems directly interfere with our physical world which makes their safe, dependable and resilient operation one of their primary requirements.
In recent years, software components have gained importance as controller part of the CPSs. This has led to the control software taking more responsibility and needing mechanisms to enhance correct and safe behaviour. Furthermore, every component of a CPS is a potential point of failure.
Monitoring information related to the internal status of the CPSs at runtime
can anticipate the occurrence of failures. This makes it possible to take corrective
actions earlier and prevent faulty scenarios. This idea is described as a safety
bag in [
Advances in computing and communication are leading to the digitization
of industry. The use of IoT platforms allows the access devices and machines in
a transparent way making possible the digitalization of manufacturing systems.
There are many initiatives around Digital Manufacturing Platforms and IoT
that have been developed in di erent Research and Innovation actions in the
European Community (CREMA [
In the European ECSEL project Productive 4.0 [
Section 2 presents background concepts of the work, and in Section 3 the overall Safety Service Architecture is shown. Section 4 presents an academic example of the solution and nally, Section 5 closes the paper with conclusions and future lines. 2
The proposed work in this position paper is a mix of two di erent approaches. On
the one hand, RE ective State-Machines based observable software COmponents
(RESCO) software components, which have introspection and re ection ability
at runtime are considered. For this end, the work presented in [
The overview of the approach considered in this study to automatically generate software components with introspection and re ection ability at runtime is highlighted in Figure 1. It represents the Model-driven work ow that safety and software engineers must consider when using the methodology we propose.
First, the behaviour of the components is modelled using Uni ed Modeling
Language - State Machines (UML-SMs) by the Papyrus tool [
This rst step is performed by the designer and in order to have the adaptation ability at runtime, the designer has to design two or more annotated UMLSM models: the normal-mode UML-SM and one or more safe-mode (degradedmode) UML-SMs. Thus, when an error is detected, the software component will adapt from normal-mode UML-SM to the safe-mode (degraded-mode) UML-SM.
In a second step, a RESCO metamodel conformant model (instrumented
model) is generated automatically by ATL [
In the last step, a model conforming to the RESCO metamodel is transformed
to code by means of a Model to Text (M2T) transformation by Acceleo [
Having these software components with introspection ability, we can design
a solution that enables the developers to generate software systems able to check
their software components in model terms at runtime.
The Arrowhead project addresses e ciency and exibility on a global scale
through collaborative automation. Thus, Arrowhead's greatest challenges are
to enable: 1) interoperability of services provided by almost any device. 2)
integrity of the services provided by any device. In response to these challenges,
the Arrowhead framework [
The framework aims to normalize the interaction between IoT industrial applications through service-oriented architectures (SOA). Services are exposed and consumed by systems, which run on devices. Figure 2 shows the di erent types of services within the Arrowhead framework. 2.3
In the scope of Models@run.time, di erent solutions to trace the UML-SMs in
order to obtain information about the monitored software components at runtime
have been analyzed. Most of the approaches focus on instrumenting the code and
not the model (e.g., [
There is a similar approach, [
Regarding the IoT platforms, as mentioned before, there are many initiatives
around Digital Manufacturing Platforms and IoT that have been developed in
di erent Research and Innovation actions in the European Community.
However, these platforms have not led to a successful and e cient digitisation of
all aspects and resources of manufacturing industry. There are also commercial
IoT platforms being used in industry such as Amazon's AWS IoT, Microsoft's
Azure IoT Suite, IBM's Watson IoT or MathWorks' ThingSpeak. These
solutions are closed solutions based on speci c technologies making interoperability
between di erent solutions di cult. In response to these challenges, the
Arrowhead framework [
This work, aims to ll the gap identi ed in the above de ned two research lines. On the one hand, RESCO based software are able to provide software components information in model element terms at runtime and, on the other hand, if we are able to serve this information as services, we can use them as Arrowhead compliant services with the aim to detect hazardous scenarios in IoT based solutions (e.g. industrial plants). This is the main objective of this work: proof of concept of the Arrowhead Safety Manager based on RESCO software components. 3
The main objective of the Safety service is to supervise the status of di erent Arrowhead compliant services that are registered in a local cloud. Based on de ned contracts, it will ensure the reliable and safe operation of these services.
Its role can be de ned as unsafe scenarios detector. When it detects an unsafe scenario, it starts a safe process to protect the behaviour of the system.
The approach or concept developed has the following characteristics: { Arrowhead Local cloud has a Safety related service. { Di erent services are monitored by the Safety Monitor. { These services are based on the RESCO software components. they have to be o ered as Arrowhead compliant services and they provide information about the status of the controlled system in model terms at runtime. { The monitored information is checked by the Safety Manager. For doing that, safety rules or properties common language is de ned and the safety rules will be de ned using this common language in each use case. { When an unsafe scenario is detected, a safe process starts and the services involved in the use case are updated to a graceful mode. 4
In this section we will present a proof of concept example developed in the
Productive 4.0 [
Both RESCO based services are providing their internal status at runtime and in model terms (using the UML-SM formalism). Every time that the transition is going to be performed, they send the related information to the Safety service of the Arrowhead framework. In addition, the Temperature service provides the value of the temperature sensor that is installed in the engine.
In addition, di erent contracts that de ne the not allowed unsafe scenarios are de ned. Thus, at runtime, when the Safety service receives new updates, it checks if these contracts are ful lled or not. In case they are not, it starts a process to adapt the RESCO services to a safe state.
Figure 3 shows the example that has been developed to check the concept we are presenting in this work. We have done the rst evaluation of the demonstrator presented in this work obtaining successful results. We inserted faulty temperature values to force non-safe scenarios and the Safety Manager service detected the situations and started the adaptation process in the involved services sending the system to a safe scenario. 5
In this paper we have presented the rst concept of a Safety Service that could be added to the Arrowhead framework. Its main aim is to check the correct and safe operation of the di erent controls by this IoT platform. For doing this, we suggest to develop RESCO based Arrowhead compliant software services. These software components have the ability to o er their internal status in models terms at runtime. Thus, we may reuse the models used in design and development phases also at runtime for correctness veri cation purposes.
In order to check that the concept is achievable, we have developed an simple toy example. We have mixed both approaches, RESCO and Arrowhead framework, and the result has been that it is possible to check the correctness of software controllers in model terms at runtime. In the future, we would like to expand the evaluation using more realistic industrial cases and environments.
The project has been developed by the Embedded System Group of MGEP and supported by the Department of Education, Universities and Research of the Basque Government under the projects Ikerketa Taldeak (Grupo de Sistemas Embebidos) and TEKINTZE (Elkartek 2018) and the European H2020 research and innovation programme, ECSEL Joint Undertaking, and National Funding Authorities from 19 involved countries under the project Productive 4.0 with grant agreement no. GAP-737459 - 999978918.
References