En97 web

Also in this issue:

Keynote:

The Importance of Cyber-Physical

Systems for Industry

by Clas Jacobson

Research and Innovation:

Big Data in Healthcare: Intensive

Care Units as a Case Study

Joint ERCIM Actions:

“Alain Bensoussan”

Fellowship Programme

ERCIM NEWSwww.ercim.eu

Number 97 April 2014

Cyber-Physical

Systems

Special theme

ERCIM News is the magazine of ERCIM. Published quar-

terly, it reports on joint actions of the ERCIM partners, and

aims to reflect the contribution made by ERCIM to the

European Community in Information Technology and

Applied Mathematics. Through short articles and news

items, it provides a forum for the exchange of information

between the institutes and also with the wider scientific com-

munity. This issue has a circulation of about 6,500 printed

copies and is also available online.

ERCIM News is published by ERCIM EEIG

BP 93, F-06902 Sophia Antipolis Cedex, France

Tel: +33 4 9238 5010, E-mail: [email protected]

Director: Jérôme Chailloux

ISSN 0926-4981

Editorial Board:

Central editor:

Peter Kunz, ERCIM office ([email protected])

Local Editors:

Austria: Erwin Schoitsch, ([email protected])

Belgium:Benoît Michel ([email protected])

Cyprus: Ioannis Krikidis ([email protected])

Czech Republic:Michal Haindl ([email protected])

France: Thierry Priol ([email protected])

Germany: Michael Krapp

([email protected])

Greece: Eleni Orphanoudakis ([email protected]),

Artemios Voyiatzis ([email protected])

Hungary: Erzsébet Csuhaj-Varjú ([email protected])

Italy: Carol Peters ([email protected])

Luxembourg: Thomas Tamisier ([email protected])

Norway: Truls Gjestland ([email protected])

Poland: Hung Son Nguyen ([email protected])

Portugal: Joaquim Jorge ([email protected])

Spain: Silvia Abrahão ([email protected])

Sweden: Kersti Hedman ([email protected])

Switzerland: Harry Rudin ([email protected])

The Netherlands: Annette Kik ([email protected])

W3C: Marie-Claire Forgue ([email protected])

Contributions

Contributions should be submitted to the local editor of your

country

Copyright Notice

All authors, as identified in each article, retain copyright of

their work

Advertising

For current advertising rates and conditions, see

http://ercim-news.ercim.eu/ or contact [email protected]

ERCIM News online edition

The online edition is published at

http://ercim-news.ercim.eu/

Subscription

Subscribe to ERCIM News by sending an email to

[email protected] or by filling out the form at the

ERCIM News website: http://ercim-news.ercim.eu/

Next issue

July 2014, Special theme: Smart Cities

Editorial Information Contents

JOINT ERCIM ACTIONS

5 ERCIM “Alain Bensoussan” Fellowship Programme

5 Cor Baayen Award 2014

5 ERCIM Working Group Workshops in 2014

KEYNOTE

4 The Importance of Cyber-Physical Systems for Industry

by Clas Jacobson

SPECIAL THEME

The special theme section “Cyber-Physical Systems” hasbeen coordinated by Maria Domenica Di Benedetto,University of L’Aquila, Center of Excellence DEWS, FrançoiseLamnabhi-Lagarrigue, CNRS, Laboratoire des Signaux etSystèmes, and Erwin Schoitsch, AIT Austrian Institute ofTechnology/AARIT.

Introduction to the Special Theme6 Cyber-Physical Systems

by Françoise Lamnabhi-Lagarrigue, Maria Domenica DiBenedetto and Erwin Schoitsch

8 Cyber-Physical Systems: Theoretical and Practical

Challenges

by Ezio Bartocci, Oliver Hoeftberger and Radu Grosu

9 Modelling, Analysis and Co-Design of Wireless Control

Networks

by Maria Domenica Di Benedetto and AlessandroD’Innocenzo

11 Observers for Nonlinear Systems with Delayed

Measurements

by Tarek Ahmed-Ali, Iasson Karafyllis and FrançoiseLamnabhi-Lagarrigue

12 Platform-Aware Design of Embedded Controllers

by Dip Goswami, Twan Basten and Samarjit Chakraborty

14 Designing Cyber-Physical Systems for Smart

Infrastructures: The Rainbow Platform

by Andrea Giordano, Giandomenico Spezzano and AndreaVinci

15 Cloud-Based Industrial Cyber-Physical Systems

by Armando Walter Colombo and Stamatis Karnouskos

17 DEECo: Software Engineering for Smart CPS

by Tomáš Bureš, Ilias Gerostathopoulos and Rima Al Ali

18 The Software-Defined Network Revolution

by Marco Canini and Raphaël Jungers

20 Securing Interconnected Cyber-Physical Systems

through Strategic Information Sharing

by Florian Skopik and Thomas Bleier

21 A European Roadmap on Cyber-Physical Systems of

Systems

by Michel Reniers and Sebastian Engell

23 Linking Design Disciplines in Cyber-Physical System

Development: The DESTECS/Crescendo Technology

by John Fitzgerald, Peter Gorm Larsen and Marcel Verhoef

ERCIM NEWS 97 April 2014


25 Cassting: Synthesizing Complex Systems Using Non-

Zero-Sum Games

by Nicolas Markey

26 Dependable System of Systems Engineering: the

COMPASS Project

by John Fitzgerald, Steve Riddle, Paolo Casoto and KlausKristensen

27 Towards a Unified Theory for the Control of CPS: A

Symbolic Approach

by Alessandro Borri, Maria Domenica Di Benedetto andGiordano Pola

29 Information Assurance System in the Arrowhead

Project

by Sandor Plosz, Markus Tauber and Pal Varga

30 Non-Asymptotic Estimation for Online Systems: Finite-

Time Algorithms and Applications

by Jean-Pierre Richard and Wilfrid Perruquetti

32 Soft Real-Time Scheduling Approaches in Embedded

Control Systems

by Daniele Fontanelli, Luca Greco and Luigi Palopoli

34 Requirements Engineering Patterns for Cyber-Physical

Systems

by Christophe Ponsard, Jean-Christophe Deprez andRobert Darimont

35 Management of the Interconnection of Intermittent

Photovoltaic Systems through a DC Link and Storage

by Alessio Iovine, Sabah Benamane Siad, AbdelkrimBenchaib and Gilney Damm

36 Multi-Terminal High Voltage Direct Current Networks

for Renewable Energy Sources

by Miguel Jiménez Carrizosa, Yijing Chen, Gilney Damm,Abdelkrim Benchaib and Françoise Lamnabhi-Lagarrigue

38 Smart Water Management: Key Issues and Promises

from a Distributed Control and Observation

Perspective

by Christopher Edwards, Prathyush Menon and Dragan Savic

40 SEAM4US: Intelligent Energy Management for Public

Underground Spaces through Cyber-Physical Systems

by Jonathan Simon, Marc Jentsch and Markus Eisenhauer

41 A Comprehensive Port Operations Management

System

by Christophe Joubert, Miguel Montesinos and Jorge Sanz

43 Safety Criticality Analysis of Multi-Agent Air Traffic

Management Systems: A Compositional Hybrid

Systems’ Approach

by Elena De Santis, Maria Domenica Di Benedetto andGiordano Pola

44 Security in the Era of Cyber-Physical Systems of

Systems

by Stamatis Karnouskos

46 Optogenetics to Unravel the Mechanisms of Parkinsonian

Symptoms and Optimize Deep Brain Stimulation

by Antoine Chaillet, Diane Da Silva, Georgios Detorakis,Christophe Pouzat and Suhan Senova

EvENTS/IN BRIEF

Report60 MediaEval 2013 Evaluation Campaign

by Gareth J. F. Jones and Martha Larson

Announcements62 NAFEMS European Conference: Multiphysics Simula-

tion 2014

62 FMICS’14 - 19th International Workshop on Formal

Methods for Industrial Critical Systems

62 IEEE Cluster 2014

63 W3C Workshop on the Web of Things

In Brief63 CWI joins Sino-European research network LIAMA

63 MonetDB Solutions Newest CWI Spin-off

RESEARCH AND INNOvATION

This section features news about research activities andinnovative developments from European research institutes

48 Big Data in Healthcare: Intensive Care Units as a Case

Study

by Ioannis Constantinou, Andreas Papadopoulos, MariosD. Dikaiakos, Nicolas Stylianides and TheodorosKyprianou

50 SEMEOTICONS: Face Reading to Help People stay

Healthy

by Sara Colantonio, Daniela Giorgi and Ovidio Salvetti

51 DYMASOS - Dynamic Management of Physically

Coupled Systems of Systems

by Radoslav Paulen and Sebastian Engell

52 3DHOP: A Novel Technological Solution for the

Development of Online Virtual Museums

by Marco Potenziani, Marco Callieri and RobertoScopigno

54 The Entity Registry System: Publishing and

Consuming Linked Data in Poorly Connected

Environments

by Christophe Guéret and Philippe Cudré-Mauroux

55 Spin-Up: A European Project Aimed at Propelling

University Spin-off Growth

by Manuel Au-Yong-Oliveira, João José Pinto Ferreira,Qing Ye and Marina van Geenhuizen

56 A System for the Discovery and Selection of FLOSS

Projects

by Francesca Arcelli Fontana, Riccardo Roveda and MarcoZanoni

58 VITRO – Vision-Testing for Robustness

by Oliver Zendel, Wolfgang Herzner and MarkusMurschitz

59 Building Systems of Aerial Drones

by Luca Mottola, Niklas Wirström and Thiemo Voigt

Keynote

The Importance

of Cyber-Physical Systems

for Industry

by Clas Jacobson

The presence and importance of Cyber Physical Systems isintended as the orchestration of networked computationalresources with multi-physics (e.g., mechanical, chemical,electrical) systems in industry cannot be overemphasized.The engineering problems faced daily is managingdynamics, time, and concurrency in heterogeneous (inter-connected) systems where the amount and complexity ofintelligence (the cyber part) is growing rapidly and wheresoftware implementations are a major portion of systemdesign, validation and ultimately verification. Research andeducation in this field is of strategic importance for businessfor years to come. Industry and Government in United Stateshave posed CPS at the center of the engineering researchagenda since 2007 when the President’s Council of Advisorson Science and Technology (PCAST) highlighted CPS as the“number one” Priority for Federal Investments inNetworking and Information Technology). Since 2010, theEuropean research and industrial community has focused onCPS as paradigms for the future of systems. Acatech(German National Academy of Science and Engineering)developed an Integrated Research Agenda for Cyber-Physical Systems published in 2011.

To witness the importance placed on CPS by US industry,UTC together with Applied Material, Global Foundries,IBM, Intel, Micron, Raytheon and Texas Instruments is par-ticipating in an important research initiative in the US underthe DARPA-SRC-SIA Semiconductor TechnologyAdvanced Research Network (STARnet): The TerraSwarmcenter (http://www.terraswarm.org/) which is one of the sixcenters sponsored by the program consists of nine universi-ties, 92 students, 22 faculty researchers, and 19 industry

associate personnel. TerraSwarm, headquartered atUniversity of California at Berkeley, is addressing the hugepotential—and associated risks—of pervasive integration ofsmart, networked sensors and actuators into our connectedworld. The center aims to enable the simple, reliable, andsecure deployment of a multiplicity of advanced distributedsense and control applications on shared, massively distrib-uted, heterogeneous, and mostly uncoordinated platformsthrough an open and universal systems architecture.

IBM and UTC are the founding members of another initia-tive: the industrial cyber-physical systems center (iCyPhy,http://www.icyphy.org/), a research consortium built as apartnership between the University of California at Berkeley(UC Berkeley), the California Institute of Technology(Caltech), and the member companies. iCyPhy has beenformed to identify and develop new engineering techniquesthat will make it easier to successfully build products andservices that combine complex software, hardware andmechanical components. The iCyPhy team aims to identifyrepeatable, standardized and measurable processes to ensurehigh-performing systems, and to uncover new product devel-opment methods that can help companies reduce costs,increase reliability and innovate more quickly.

The interest demonstrated by industry in general is strong,but for UTC it is even stronger. United TechnologiesCorporation (UTC) is a global conglomerate with interest inElevators (Otis) and Climate, Controls and Security, and inaerospace businesses (Pratt&Whitney gas turbine engines,Sikorsky rotorcraft and Aerospace Systems including airmanagement, electric power distribution and landing sys-tems). In addition to the research initiatives above, the UTCInstitute for Advanced Systems Engineering at UConn with$10 million in planned investments, is a significant invest-ment in educating the next generation of engineering leaders.The Institute focuses on methods for the design of CPS ofinterest to business such as aircraft, buildings and otherhighly engineered solutions that include numerous intelli-gent components and sub-systems. As we look to the future,this expertise will be crucial for engineers who want todesign and create the most advanced products and solutions.

CPS are essential for the future of the system industry world-wide and collaboration at all levels, from practicing engi-neers to product architects, from tool makers to technologyproviders, from service to research, is necessary.


Clas Jacobson,

Chief Scientist for the

United Technologies

Systems & Controls

Engineering, USA


Call for Nominations

Cor Baayen Award

2014

The Cor Baayen Award is awarded each year to apromising young researcher in computer science andapplied mathematics.

The award consists of 5000 Euro together with anaward certificate. The selected fellow will be invitedto the ERCIM meetings in autumn. A short article onthe winner, together with the list of all candidatesnominated, will be published in ERCIM News.

Nominees must have carried out their work in one ofthe 'ERCIM countries': Austria, Belgium, Cyprus,Czech Republic, Finland, France, Germany, Greece,Hungary, Italy, Luxembourg, Norway, Poland,Portugal, Spain, Sweden, Switzerland, TheNetherlands and the United Kingdom. Nomineesmust have been awarded their PhD (or equivalent)after 30 April 2011.

The award was created in 1995 to honour the firstERCIM President.

Detailed information and online nomination

form:

http://www.ercim.eu/activity/cor-baayen-award

ERCIM “Alain Bensoussan”

Fellowship Programme

ERCIM offers fellowships for PhD

holders from all over the world.

Topics cover most disciplines inComputer Science, InformationTechnology, and AppliedMathematics.

Fellowships are of 12-month duration, spent in one ERCIM memberinstitute.

ConditionsApplicants must:• have obtained a PhD degree during the last 8 years (prior to the

application deadline) or be in the last year of the thesis work withan outstanding academic record

• be fluent in English• be discharged or get deferment from military service• have completed the PhD before starting the grant (a proof will be

requested).

Application deadlines30 April and 30 September

More information and application form:

http://fellowship.ercim.eu/

5

Joint ERCIM Actions

The purpose of an ERCIM Working Group is to build andmaintain a network of ERCIM researchers in a particular sci-entific field. The working groups are open to any researcherin the specific scientific field. Their main activities are theorganization of workshops and the preparation of commonproject proposals. The meetings and workshops planned for2014 inlcude:

• ERCIM/EWICS/ARTEMIS Special Session of the ERCIMDependable Embedded Systems Working Group atEuromicro SEAA on “Teaching, Education and Trainingfor Dependable Embedded and Cyber-physical Systems”,Verona, Italy, 27-29 August 2014http://esd.scienze.univr.it/dsd-seaa-2014/?page_id=200

• 2014 Security and Trust Management workshop co-loacated with the European Symposium on Research inComputer Security (ESORICS), Wroclaw, Poland, 7-11September 2014 http://esorics2014.pwr.wroc.pl/

• ERCIM/EWICS/ARTEMIS Workshop of the ERCIMDependable Embedded Systems Working Group onDependable Embedded and Cyber-Physical Systems and

Systems-of-Systems at SAFECOMP 2014, Florence, Italy,8-12 September 2014http://www.safecomp2014.unifi.it/decsos

• FMICS 14 - 19th International Workshop on FormalMethods for Industrial Critical Systems, September 11-12,2014, Florence, Italy http://fmics2014.unifi.it/

• MUSCLE International Workshop on ComputationalIntelligence for Multimedia Understanding, Paris, 1-2November 2014 http://iwcim.isep.fr/index.html

• 7th International Conference of the ERCIM WG onComputational and Methodological Statistics, jointly heldwith CFE 2014, Pisa, Italy 6-8 December 2014http://www.cmstatistics.org/ERCIM2014/

More information:

http://www.ercim.eu/activity/workgrouphttp://www.ercim.eu/activity/f-events

ERCIM Working Group Workshops in 2014


Special Theme: Cyber-Physical Systems

Introduction to the Special Theme

Cyber-Physical Systems

by Françoise Lamnabhi-Lagarrigue, Maria Domenica Di Benedetto and Erwin Schoitsch

Embedded systems - some visible, others integratedinto every day equipment and devices – arebecoming increasingly pervasive, and increasinglyresponsible for ensuring our comfort, health, serv-ices, safety and security. In combination and closeinteraction with the unpredictable real-world envi-ronment and humans, they become “Cyber-PhysicalSystems” (CPS), which act independently, co-opera-tively or as “systems-of-systems” composed ofinterconnected autonomous systems originally inde-pendently developed to fulfill dedicated tasks. Someof these systems may be older legacy systems.

The elements of the physical system are connectedby the exchange of material or energy, while the ele-ments of the control and management system areconnected by communication networks which some-times impose restrictions on the exchange of infor-mation, with software as a critical core element.Dependability - particularly resilience, safety andsecurity - is a more complex issue than ever beforefor embedded distributed systems in the conven-tional sense. Prototype systems are the electricalgrid, a power plant, an airplane or a ship, a manufac-turing process with many cooperating elements, e.g.,robots, machines, warehouses, conveyer belts, alarge processing plant with many process units, abuilding with advanced distributed HVAC control,etc.

From the German Agenda CPS, IntermediateResults, Acatech, 2010: “Cyber-physical systemstypically comprise embedded systems (as parts ofdevices, buildings, vehicles, routes, productionplants, logistics and management processes etc.) that • use sensors and actuators to gather physical data

directly and to directly affect physical processes • are connected to digital networks (wireless, wired,

local, global) • use globally available data and services • possess a range of multi-modal human-machine

interfaces (dedicated interfaces in devices, orunspecific interfaces accessed through browsers,etc.).”

The extreme importance of CPS for industrializedcountries was highlighted in the August 2007 Reportof the President's Council of Advisors on Scienceand Technology (PCAST) presenting a formalassessment of the Federal Networking andInformation Technology R&D (NITRD). This reportled the National Science Foundation to create theCyber-Physical Systems Program in 2009, a majorcross-cutting initiative at NSF. CPS-related confer-ences have been integrated into a major annual

event, CPS WEEK, which rotates between theUnited States and Europe.

During the Workshop on Control of Cyber-PhysicalSystems held at the University of Notre DameLondon Centre, 20-21 October 2012, organized byPanos Antsaklis, Vijay Gupta and Karl HenrikJohansson, the following definition was adopted:“Cyber-Physical Systems (CPS) are physical, chem-ical, biological and engineered systems whose oper-ations are monitored, coordinated, controlled andintegrated by a computing and communicationcore.” Desired characteristics or descriptive wordsof well-designed and engineered Cyber-PhysicalSystems include: coordinated, distributed, con-nected, heterogeneous, robust and responsive, pro-viding new capability, adaptability, resiliency,safety, security, and usability, with feedback loopsincluding often humans and the environment andrelated systems. This intimate coupling between thecyber and physical will be manifested across abroad range of length scales, from the nano-world tolarge-scale wide-area systems of systems.Correspondingly, CPSs will often have dynamics ata wide range of time-scales, such as at the discreteclock scale for some computational aspects to multi-day or even year-long time scales for system-wideproperties and evolution.

Applications with enormous societal impact andeconomic benefit will be created. Cyber-PhysicalSystems will transform how we interact with thephysical world just as the Internet transformed howwe interact with one another. After several FP7related projects or supporting actions, CPSs are nowa targeted research area in Horizon 2020(http://ec.europa.eu/programmes/horizon2020/) andpublic-private partnerships such as ECSEL(Electronic Components and Systems for EuropeanLeadership (http://ec.europa.eu/digital-agenda/en/time-ecsel), which integrates the formerARTEMIS (http://www.artemis-ju.eu), ENIAC(http://www.eniac.eu) and EPoSS (http://www.smart-systems-integration.org), which are dedicating greateffort to this area of research. The importance of“Systems of Cyber-Physical Systems” is high-lighted by EU-Roadmap activities such as theCPSoS project (see article on page 21), developinga strategic policy document “European Researchand Innovation Agenda on Cyber-Physical Systemsof Systems” (http://www.cpsos.eu/).

The design of such systems requires understandingthe joint dynamics of computers, software, net-works, physical, chemical and biological processes

and humans in the loop. It is this study of jointdynamics that sets this discipline apart.Increasingly, CPSs are autonomous or semi-autonomous and cannot be designed as closed sys-tems that operate in isolation; rather, the interactionand potential interference among smart compo-nents, among CPSs, and among CPSs and humans,requires coordinated, controlled, and cooperativebehaviour. Very difficult challenges are posed forcontrol of CPS owing to a variety of factors, such asvery broad time and length scales, the presence ofnetwork communication and delays, coordination ofmany components (with an associated increasedrisk of component failure as the number of compo-nents grows to be very large), model reduction,tractability, etc.

Cyber-physical systems (of systems) cannot bedesigned and managed using theories and tools fromonly one domain, see the FP7 NoE HYCON2 deliv-erable D3.4.1 “Roadmap: From distributed andcoordinated control to the management of cyber-physical systems of systems”. The behaviour of thelarge coupled physical part of the system must bemodelled, simulated and analysed using methodsfrom continuous systems theory, e.g. large-scalesimulation, stability analysis, and the design of sta-bilizing control laws. On the other hand, methodsand tools from computer science for the modellingof distributed discrete systems, for verification andtesting, assume-guarantee methods, contract-basedassertions etc. are indispensable to capture both thebehaviour on the low level (discrete control logic,communication, effects of distributed computing)and global effects, in the latter case based onabstract models of complete subsystems. Logisticmodels as well as models and tools for performanceanalysis of discrete systems will be useful forsystem-wide performance analysis. Finally, theoriesfrom physics, e.g. structure formation in large sys-tems, and from economics and social science(market mechanisms, evolution of beliefs andactivity in large groups) may also prove to be useful.

The emphasis of this special issue is on an inte-grated perspective of real-time computing, commu-nication, dynamics, and control of CPS, particularlyof non (extra-) functional properties. A first set ofcontributions are dedicated to the representation andfoundations of CPS including:• Analysis, estimation, synthesis, design, and veri-

fication of CPS • Platforms for smart infrastructure connecting the

three layers : the Cloud layer, the Middle layerand the Physical layer

• Dependability (safety, security, reliability etc.)and resilience of CPS, including the Systems ofSystems aspects

• Specification formalisms, including languagesand software tools

• Real-time computing and resource-aware controlfor CPS

• Networks and protocols for CPS

Several contributions are dedicated to specificapplications:• Smart Electric Grid • Water Management • Autonomous Vehicles and Smart Transportation • Next-generation Port and Air Traffic Manage-

ment • Security• Smart Medical Technologies

As stated in the previous cited NoE HYCON2Deliverable, “the size of cyber-physical systems ofsystems and their ‘multimodality’ or hybrid natureconsisting of physical elements as well as quasi-continuous and discrete controls, communicationchannels, and local and system-wide optimizationalgorithms and management systems, implies thathierarchical and multi-domain approaches to theirsimulation, analysis and design are needed. Thesemethods are currently not available. In individualdomains, e.g. dynamic modelling and simulation,verification of discrete systems, design of con-trollers for guaranteed system stability on differentsystem levels, and optimization of flows across thesystem, further progress can be expected that willhave a high impact on the engineering of systems ofsystems. However, the simultaneous use and theintegration of heterogeneous models and tools tocapture system-wide properties reliably and withfirm guarantees are currently completely openissues. The critical properties of cyber-physical sys-tems of systems go beyond what can be analysedand designed systematically today: dynamic recon-figuration of complex systems, large-scaledynamics, waves of events or alarms, interaction ofautonomous, selfish systems, and coupling of phys-ical and computational elements via communicationchannels.”

Please contact:

Maria Domenica Di BenedettoUniversity of L’Aquila, Center of ExcellenceDEWS, EECI, Italy E-mail: [email protected]

Francoise Lamnabhi-LagarrigueCNRS-Laboratoire des Signaux et Systèmes,EECI, France E-mail: [email protected]

Erwin SchoitschAIT Austrian Institute of Technology/AARIT,Austria E-mail: [email protected]

ERCIM NEWS 97 April 2014 7

Most modern computing devices areubiquitous embedded systems employedto monitor and control physicalprocesses: cars, airplanes, automotivehighway systems, air traffic manage-ment, etc. In the past, research onembedded systems tended to focus onthe design optimization problems ofthese computational devices. In recentyears, the focus has shifted towards thecomplex synergy between the computa-tional elements and the physical envi-ronment with which they interact. Theterm Cyber-Physical Systems (CPS) wascoined to refer to such interactions. InCPS, embedded computation and com-munication devices, together with sen-sors and actuators of the physical sub-stratum, are federated in heterogeneous,open, systems-of-systems. Examplesinclude smart cities, smart grids, med-ical devices, production lines, automo-tive controllers, and robotics.

Here we discuss some of the researchproblems that we are addressing on boththe theory and practical application sce-narios of CPS, such as automotive andmedical systems.

Theoretical foundations andchallenges The behaviour of CPS is characterizedby the nonlinear interaction between dis-crete (computing device) and contin-uous phenomena (the physical sub-stratum). For this reason, research onhybrid systems plays a key role in mod-elling and analysing CPS. CPS are usu-ally spatially distributed and they exhibitemergent behaviours (i.e. traffic jams,cyber-attacks), which result from inter-actions among system components, andwhich cease to exist when specific com-ponents are removed from the systems.Owing to their ubiquity and impact onevery aspect of our life, one of thegreatest challenges of this century is toefficiently predict the emergent behav-iours of these systems. The complexityof their models, however, often hinders

any attempt to exhaustively verify theirsafe behaviour.

An alternative method is to equip CPSwith monitors and to predict emergentbehaviours at runtime. This approachmakes CPS self-aware, opening up newapproaches to designing systems thatcan dynamically reconfigure them-selves in order to adapt [1] to differentcircumstances. However, monitoringintroduces a runtime overhead that may

alter the timing-related behaviour of thesystem under scrutiny. In applicationswith real-time constraints, overheadcontrol strategies may be necessary toreduce the overhead to acceptable levelsby, for example, turning on and off themonitoring. Gaps in monitoring, how-ever, introduce uncertainty in the moni-toring results. Hence, our currentresearch [1] also focuses on efficienttechniques to quantify this uncertaintyand compute an estimate of the currentstate of the system.

Automotive scenario The extensive integration of sensor net-works and computational power intoautomotive systems over recent yearshas enabled the development of varioussystems to assist the driver duringmonotonous driving conditions, and toprotect the passenger from hazardoussituations. This trend will inevitablylead to autonomous vehicles. In order toplan actions and reliably negotiatetraffic, these vehicles need sensors

capable of fault tolerant observation oftheir environment. Additionally,vehicle to vehicle (V2V) and vehicle toinfrastructure (V2I) communicationtechnology – also known as V2X com-munication – will be integrated intofuture automotive systems. V2X com-munication allows exchange of infor-mation between vehicles and roadsideunits about position and speed of vehi-cles, driving conditions on a particularroad, accidents, or traffic jams.Information exchange thereby allows



Cyber-Physical Systems:

Theoretical and Practical Challenges

by Ezio Bartocci, Oliver Hoeftberger and Radu Grosu

Cyber-Physical Systems (CPS) are the next generation of embedded ICT systems that are becoming

pervasive in every aspect of our daily life. In this article we discuss some of the theoretical and

practical challenges that we are currently facing in this area.

Figure 1: Multi-level CPS in the automotive domain.

traffic load to be distributed among sev-eral roads during rush hour, as well aspreventing accidents and multiple colli-sions and sending automated emer-gency calls. Figure 1 schematizes dif-ferent levels of an automotive system-of-systems consisting of sensor net-works within a car, and the interactionof vehicles on a higher system level.

Fast error detection, fault tolerantsystem designs and new planning strate-gies are required to cope with theincreasing failure rates of microchipsowing to continuous shrinking ofdevices, as well as reliance on unreli-able sources of information (e.g., infor-mation sent by other vehicles). Some ofthese problems can be solved by knowl-edge-based techniques, such asautonomous reconfiguration and substi-tution of faulty subsystems and compo-nents by using system ontologies [2].

Medical cyber-physical systems Medical CPS refers to modern medicaltechnologies in which sophisticatedembedded systems equipped with net-work communication capabilities, areresponsible for monitoring and con-trolling the physical dynamics ofpatients’ bodies. Examples includeproton therapy machines, electro-

anatomical mapping and intervention,bio-compatible and implantabledevices, and robotic prosthetics.Malfunctioning of these devices canhave adverse consequences for thehealth of the patient. The verification,validation and certification of theirreliability and safety are extremelyimportant and still very challengingtasks, owing to the complexity of theinvolved interactions. The modellingand efficient simulation of the patientbody will play a key role in the designand validation of Medical CPS and inthe development of personalized treat-ment strategies. To this end, ourresearch has largely focused on model-ling and analysis techniques for car-diac dynamics to predict the onset ofarterial and ventricular fibrillation. In[3] we show that with a normal desktopwith GPU technology, it is possible toachieve simulation speeds in near real-time for complex spatial patternsindicative of cardiac arrhythmic disor-ders. Real-time simulation of organswithout the need for supercomputersmay soon facilitate the adoption ofmodel-based clinical diagnostics andtreatment planning.

Link:

http://ti.tuwien.ac.at/cps

References:

[1] E. Bartocci et al.: “AdaptiveRuntime Verification”, in proc. of RV2012, LNCS, vol. 7687, Springer, pp.168-182, 2012

[2] O. Höftberger, R. Obermaisser:“Ontology-based RuntimeReconfiguration of DistributedEmbedded Real-Time Systems”, inproc. of ISORC 2013

[3] E. Bartocci et al.: “Toward real-time simulation of cardiac dynamics”,in proc. of CMSB '11, New York, NY,USA, pp. 103-112, 2011.

Please contact:

Radu GrosuVienna University of TechnologyE-mail: [email protected]://ti.tuwien.ac.at/cps/people/grosu

Ezio BartocciVienna University of TechnologyE-mail: [email protected]://www.eziobartocci.com

Oliver HoeftbergerVienna University of TechnologyE-mail:[email protected]


The growing relevance of Cyber-Physical Systems (CPS) is due in part tothe development of technologies that areessential for their effective deployment,namely: embedded systems and wirelesscommunication networks. In particular,Wireless Sensor and actuator Networks(WSN) have greatly facilitated andenhanced the automated, remote andintelligent monitoring and control of alarge variety of physical systems. Thesenetworks consist of many tiny, inexpen-sive and low-power devices, each incor-porating sensing, actuation, processing,

and wireless communication capabili-ties. These devices are now used in anumber of application domains fromindustrial and building automation, toenvironmental, wildlife, and healthmonitoring, and disaster relief manage-ment. In these applications, computa-tion and communication devices repre-sent the enabling technology for WSN,while some of the most advanced WSNapplications currently available areused for control tasks. Wireless ControlNetworks (WCN) are WSN applied tocontrol.

The opportunities offered by WCN, andthe increasing computing power of con-trol nodes, are accompanied by sometough challenges. To advance the state-of-the-art in modelling, analysis anddesign of WCNs, classical control prob-lems have to take into account the jointeffect of Control, Computation andwireless Communication, evidencingthe need to solve new theoretical andimplementation problems. Despitesome initial fundamental scientificachievements, the convergence of the“3Cs” has not yet had a significant

Modelling, Analysis and Co-Design of Wireless

Control Networks

by Maria Domenica Di Benedetto and Alessandro D’Innocenzo

In the context of the EU FP7 Network of Excellence HYCON2, DEWS, a Centre of Excellence

established at the University of L’Aquila in 2002, is developing a unifying mathematical framework

that takes into account the joint dynamics of physical systems, control algorithms and wireless

communication protocols. In addition, the framework provides an enabling technology for Cyber-

Physical System (CPS) design and implementation.

impact on society and industry. In somecases, methodologies have beenderived for general models, but theircomputational complexity results areintractable, i.e. they require the solutionof NP-hard or even undecidable prob-lems. In other cases, methodologieshave been developed with an affordablecomputational complexity, but for sim-plified models that neglect the most rel-evant issues arising in real implementa-tions - e.g., critical non-idealities, com-munication protocol dynamics and con-straints, limited resources - renderingthem practically useless. In general,scientific research on WCNs modelsthe network non-idealities as aggre-gated network performance variablesor disturbances, neglecting thedynamics introduced by the communi-cation protocols.

In the context of the EU FP7 NoEHYCON2, multidisciplinary researchat the DEWS Centre of Excellence,University of L’Aquila, Italy, is devel-oping a unifying mathematical frame-work that takes into account the jointdynamics of physical systems and com-munication protocols (see Figure 1). Byformally quantifying the interactionswithin the heterogeneous environmenttypical of WCN, we expect that pow-erful formal methods and tools, devel-oped over decades by different (andoften disconnected) scientific commu-nities, can now be combined to solveproblems arising in a WCN.

In collaboration with Prof. George J.Pappas, University of Pennsylvania,USA, and Prof. Karl H. Johansson,Royal Institute of Technology, Sweden,we proposed to model as a SwitchingLinear System the joint dynamics of aphysical system, an embedded con-troller and of the MAC (scheduling) andNetwork (routing) ISO/OSI layers of atime-triggered communication protocolover a shared multi-hop communicationnetwork [1]. In particular, our frame-work makes it possible to modelrecently developed wireless industrialcontrol protocols such asWirelessHART and ISA-100.

On the basis of this mathematicalframework, we considered WCNs sub-ject to failures and/or malicious attacksin the communication nodes [2]: weaddressed and solved the problem ofdesigning a set of controllers and com-munication protocol parameters,

making it possible to detect and isolatefailures on-the-fly and consequentlyapply an appropriate controller to stabi-lize the closed-loop system. We lever-aged both algebraic and graph theoreticmethods to derive necessary and suffi-cient conditions both on the physicalsystem (i.e., its dynamics) and on thecommunication protocol (i.e., ontopology, scheduling, routing and net-work coding) that guarantee stabiliz-ability and allow failures to be detectedand isolated.

In collaboration with Prof. RaphaëlJungers, Université Catholique deLouvain, Belgium, we recently began tostudy the necessary and sufficient con-ditions for stabilizability for a WCNswitching linear model. Our goal hasbeen to leverage the particular algebraicstructure induced by the networkingcommunication protocol in order toimprove theoretical understanding ofthe dynamics at stake in these systems.This has enabled us to design tailoredcontrollers whose performances arebetter than for classical switching sys-tems. We have also tried to distinguishsituations where exact algebraicmethods are still applicable from situa-tions where the time-varying delaysmake the system hard to control withexact methods, obliging the researcherto resort to conservative Lyapunov-likemethods.

Future activities involve the extensionof our unifying mathematical frame-work to accurately model all theISO/OSI layers of the communicationprotocols for WCNs, as well as thedevelopment of novel control method-ologies and algorithms for this frame-work.

Links:

http://dews.univaq.it/http://www.hycon2.eu/http://www.hartcomm.org/protocol/wihart/wireless_technology.htmlwww.isa.org/isa100

References:

[1] R. Alur, A. D'Innocenzo et al.:“Compositional Modeling andAnalysis of Multi-Hop ControlNetworks”, IEEE TAC, Special Issueon WSN, 56(10):2345-2357, 2011.[2] A. D'Innocenzo, M.D. DiBenedetto, E. Serra: “Fault TolerantControl of Multi-Hop ControlNetworks” IEEE TAC, 58(6):1377-1389, 2013.[3] R.M. Jungers, A. D'Innocenzo,M.D. Di Benedetto: “Feedbackstabilization of dynamical systemswith switched delays”, 51st IEEECDC, pp. 1325-1330, 2012.

Please contact:

Alessandro D’InnocenzoUniversity of Aquila, ItalyE-mail:[email protected]



Figure 1: Control loop over wireless networking protocols.

http://www.hartcomm.org/protocol/wihart/wireless_technology.html


The design of observers for systemswith sampled and delayed measure-ments has been attracting increasingattention. The interest is greatly moti-vated by many industrial applications.From a practical viewpoint, an observeris a software sensor using a model andonline measurements, and providing areal-time estimation of physical quanti-ties which cannot be measured online.Those estimates can then be used for

system control (dynamical output feed-back) or monitoring (fault diagnosis).The most used observer algorithm is thefamous Kalman filter, and its conver-gence is well established for linear sys-tems. Its variant known as ExtendedKalman Filter [1] can be used for non-linear systems, but with the problems ofgain tuning and stability guarantee.After the Luenberger [2] result forlinear time-invariant systems, various

other works have addressed thisproblem for nonlinear systems.

Two main approaches are described inthe literature: one based on optimiza-tion, and one on analysis. In the latterapproach, the most common idea is tocharacterize classes of systems whichcan be turned into another one, bychange of variables (or immersion),allowing for a simpler observer design.The approach thus takes advantage ofexplicit structures, but remainsdependent on the appropriate forms.Our work falls within this secondapproach. Very frequently we meet asystem with: nonlinear characteristics,partial measurements, sampled meas-urements, measurements with errors,measurements with delays or uncertainsampling schedule. In fact, we rarelymeet a system without one of these“annoying features”! The main questionis then: How can we design a globalexponential observer for such a system?

Our team recently proposed new robustobservers with respect to measurementerrors and perturbations of the samplingschedule which use robust global expo-nential state predictors [3]. The globalexponential sampled-data observersdesign is accomplished by using a smallgain approach. Sufficient conditions areprovided, which involve both the delayand the sampling period. The structureof the proposed observer, illustrated inFigure 1 can be described as follows:• A hybrid sampled-data observer is

first used in order to utilize the sam-pled and delayed measurements andprovide an estimate of the delayedstate vector,

• The estimate of the delayed state vec-tor is used by the robust global expo-nential predictor. The predictor pro-vides an estimate of the current valueof the state vector.

For example, for the system x(t) inFigure 2, the designed observer z(t) isgiven in Figure 3, and Figure 4 shows

Observers for Nonlinear Systems

with Delayed Measurements

by Tarek Ahmed-Ali, Iasson Karafyllis and FrançoiseLamnabhi-Lagarrigue

Designing observers for nonlinear systems with communication constraints is a crucial challenge for

Cyber-Physical Systems (CPS). Small gain techniques are used to derive new kinds of robust

sampled-data observers for wide classes of nonlinear systems with delayed measurements.

�

Figure 1: Structure of the observer z(t) given the system x(t).

Figure 2 (left): The System.

Figure 3 (right): Designed observer z(t) for estimating online x(t).

the exponential convergence of theobservation error (x(t) – z(t)) to zero.

Future work will consider the applica-tion of recently proposed controlschemes for which the input is delayed,the measurements are sampled anddelayed and only an output is measured(the state vector is not available). Thesecontrol schemes will consist of anobserver for the delayed state vector, aninter-sample predictor for the output

signal, an approximate predictor for thefuture value of the state vector and thenominal feedback law applied and com-puted for the predicted value of thefuture state vector.

References:

[1] R. E. Kalman: “A New Approachto Linear Filtering and PredictionProblems”, Transactions of the ASME- Journal of Basic Engineering, vol. 82,1960, p. 35-45

[2] D. G. Luenberger: “AnIntroduction to Observers”, IEEETransaction on Automatic Control, vol.16, 1971, p. 596-602

[3] T. Ahmed-Ali, I. Karafyllis, F.Lamnabhi-Lagarrigue: “GlobalExponential Sampled-Data Observersfor Nonlinear Systems with DelayedMeasurements”, Systems and ControlLetters, 2013, 62(7) 539-549.

Please contact:

Tarek Ahmed-Ali LagarrigueENISICAEN-GREYC UMR 6072,France E-mail: [email protected]

Iasson Karafyllis, National TechnicalUniversity of Athens, GreeceE-mail: [email protected]

Françoise Lamnabhi-LagarrigueCNRS-EECI SUPELEC, France E-mail: [email protected]



Figure 4: Time

evolution of the first

component of the

observation error

(x(t) – z(t)).

Embedded Control Applications in domains such as automo-tive, avionics, professional printing, elec-tron microscopy, semiconductor litho-graphy, and medical imaging closelyinteract with physical processes. Thisinteraction between hardware/software(cyber) components and physicalprocesses in this class of cyber-physicalsystems (CPS) is regulated using feed-back controllers. In an embedded imple-mentation (see Figure 1), a feedback con-troller is realized by one or more tasks(e.g., tasks for sensor reading, controlinput computation and actuation) that aremapped onto one or more interconnectedprocessors. Embedded platforms and con-trol applications are typically constrainedin terms of computation and communica-tion resources, size, power, requiredlatency and throughput, etc. Traditionally,the controller design and its implementa-

tion are done in isolation either with ide-alized assumptions such as instantaneouscomputation and communication, equi-distant sampling, guaranteed messagedelivery, etc. or with worst-case assump-tions on the controlled physicalprocesses, the plant. In today’s con-strained embedded realizations for CPS,this may lead to inefficient design solu-tions, suboptimal QoC, and even viola-tions of functional correctness when theidealized assumptions are not met. Toaddress these problems, recent researchat TU/e and TUM advocates the jointdesign of controllers and their implemen-tation platforms. One key idea is to allo-cate platform resources to embeddedcontrollers based on the state of the plant.

State-based Resource AllocationTiming of the feedback signals in a con-trol loop plays a crucial role in QoC.

Through time-triggered communication(e.g., TDMA) with perfectly synchro-nized processors and communicationbus (see Figure 1), it is possible to allo-cate dedicated communication slots.This leads to a predictable communica-tion delay which can potentially betranslated into superior QoC. Therefore,time-triggered communication is inhigh demand in safety-critical applica-tion domains. Pure time-triggered com-munication is, however, typically band-width consuming and hence expensivein terms of resource usage, while theavailability of time-triggered bandwidthis limited. On the other hand, event-trig-gered communication (e.g., CAN)induces a priority-driven sharing ofbandwidth and, therefore, is bandwidthefficient. It results in variable and occa-sionally large communication delays.Delay variability in feedback loops

Platform-Aware Design of Embedded Controllers

by Dip Goswami, Twan Basten and Samarjit Chakraborty

Correctness, implementation efficiency and good quality of control (QoC) are essential for embedded

controllers in cyber-physical systems. Awareness of the implementation platform plays a key role in

achieving these goals. Recent results from Eindhoven University of Technology (TU/e) and Technische

Universität München (TUM) report substantial improvements in the design of embedded controllers.


degrades QoC and may even lead toviolations of functional correctness.

A hybrid communication protocoloffers both time-triggered and event-triggered communication. The widevariety of functional and timing require-ments in modern distributed systems(e.g., automotive E/E architectures)with mixed-criticality applicationsmakes hybrid protocols (e.g., FlexRayin automotive systems) an attractivecommunication medium. By appropri-ately exploiting the advantages of bothtime-triggered and event-triggered par-adigms, it is possible to achieve higherQoC within given constraints on time-triggered bandwidth.

The idea of state-based resource alloca-tion is to map the feedback signals in acontrol loop dynamically to time-trig-gered and event-triggered implementa-tions depending on the state of the plantbeing controlled [1]. Multiple controlloops may share common time-trig-gered bandwidth where each loop hasits own event-triggered bandwidth; onlyone loop can use the time-triggeredbandwidth at any given point in time.The question then is which loop shouldhave access to the time-triggered band-width. Upon the occurrence of a distur-bance (i.e., an unpredicted change inone or more physical parameters), thesystem undergoes a state change,

referred to as a transient. During thistransient state, a control loop needsbetter quality of feedback (i.e., shorterdelay, less jitter) for faster disturbancerejection. Hence, a loop which is in atransient state requests access to thetime-triggered bandwidth. On the otherhand, when the system is in steady state,it uses event-triggered bandwidth. Anumber of experiments conducted atTUM indicate significant improvementin QoC for a given time-triggered band-width [1]. The gains depend on thesetup, in particular the used sharingpolicy and the criticality levels of thecontrol loops.

Research Challenges The need for correct and efficientembedded controllers with good QoCfor cyber-physical systems necessitatesfurther developments. Control theoryneeds to be extended to take intoaccount the platform constraints of theembedded electronics [2]. Platformdesign needs the development of QoC-aware resource-allocation strategies [3].But, most importantly, we need a gen-eral theoretical and conceptual frame-work for multi-objective and multi-domain design with techniques fromboth control theory and real-timeembedded systems.

Links:

http://www.rcs.ei.tum.de/en/research/http://www.es.ele.tue.nl/

References:

[1] Masrur et al.: “Timing analysis ofcyber-physical applications for hybridcommunication protocols” DATE2012, IEEE[2] Heemels et al.: “An introduction toevent-triggered and self-triggeredcontrol” CDC 2012, IEEE.[3] Aminifar et al.: “Control-qualitydriven design of cyber-physicalsystems with robustness guarantees”DATE 2013, IEEE.

Please contact:

Twan BastenTU/e, the NetherlandsTel: +31 40 247 5782E-mail: [email protected]

Samarjit ChakrabortyTUM, Germany Tel: +49 89 289 23551E-mail: [email protected]

Figure 1: Control over hybrid communication bus

The complexity of Cyber-PhysicalSystems (CPS) [1], resulting from theirintrinsically distributed nature, the het-erogeneity of physical elements (i.e.sensors and actuators), the lack of relia-bility in communications, the large-scale[2] and variability of the environmentsin which they are employed, makes dataanalysis and operation planning a verycomplex task. The Rainbow platformhas been designed to address some ofthese issues. Rainbow hides hetero-geneity by providing a virtual objectconcept, and addresses the distributednature of CPS by introducing a distrib-uted multi-agent mechanism. Rainbowaims to keep computation close to thesources of information (i.e., the physicaldevices), thus reducing the need forremote communication. Furthermore, itaddresses the dynamic adaptivityrequirements of CPS by fostering theuse of swarm intelligence algorithms[3]. Rainbow also exploits the Cloud tocarry out heavy computational taskswhen needed.

An approach currently used when imple-menting a CPS architecture involves twolayers: a physical and a remote (cloud)layer. The physical layer sends data to aremote server, which processes themand computes an operational plan. Theremote server then sends the sequence ofoperations that must be executed to eachdevice on the physical layer. The rea-soning is performed in the remote layer.However, this solution cannot be appliedwhen there are constraints on theresponse times, i.e., when a systemneeds to react rapidly to critical eventsthat may compromise its integrity andfunctionality. Communication lags andremote processing can cause intolerabledelays.

Rainbow relies on a new integratedvision that allows the design of a large-scale networked CPS based on thedecentralization of control functions andthe assistance of a remote layer to opti-

mize their behaviour. Decentralizationis obtained using a distributed multi-agent system in which the execution ofa CPS application is carried out throughcooperation among agents. This enablesthe exploitation of swarm intelligencetechniques, where a complex globalbehaviour results from the interactionsof simpler entities, acting solely on thebasis of local knowledge and withoutthe need for a global coordinator. Thesetechniques introduce some appealing

properties, such as adaptivity, fault tol-erance and self-configuration.

Rainbow is a three layer platform com-posed of a Cloud layer, a Middle layerand a Physical layer.

Sensors and actuators immersed in thephysical environment are directly con-nected to computing nodes, which aresingle-board computers like RaspberryPI or BeagleBoard, where they are rep-resented as virtual objects (VOs). TheVO concept aims to hide the hetero-geneity of the physical devices, in termsof capabilities, functionalities and com-munication protocols. VOs offer a

transparent and ubiquitous access to thephysical devices via a well-establishedAPI, and allow agents to connectdirectly without needing to considerproprietary drivers or needing toaddress fine-grained technologicalissues. The networking computingnodes represent the middle layer of theRainbow platform.

Each computational node that hostsVOs also contains an agent server. VOs

and Agent Servers are co-located in thesame computing nodes in order to guar-antee that agents directly exploit thephysical part through VO abstraction.Instead of transferring data to a centralprocessing unit, we transfer processes(injecting fine-grain agents on thenodes) toward the data sources. As aconsequence, less data needs to betransferred over a long distance (i.e.toward remote hosts) and local accessand computation is fostered in order toachieve good performance and scala-bility.

The upper layer of the Rainbow plat-form concerns the Cloud part. This



Designing Cyber-Physical Systems for Smart

Infrastructures: The Rainbow Platform

by Andrea Giordano, Giandomenico Spezzano and Andrea Vinci

Although Cyber-Physical System (CPS) technologies are essential for the creation of smart

infrastructures, enabling the optimization and management of resources and facilities, they

represent a design challenge. The Rainbow platform has been developed to facilitate the

development of new CPS architectures.

Figure 1: The Rainbow Platform

layer addresses all those activities thatcannot be executed in the middle layer,such as tasks that require high computa-tional resources or when a historicaldata storage is mandatory. On the con-trary, all the tasks where real timeaccess to the physical part is requiredare executed in the middle layer. Thedata analysis executed by the remoteserver is used by the middle layer tooptimize its operations and behaviour.

Rainbow has been developed at theInstitute of High PerformanceComputing and Networking (ICAR-CNR) within the RES-NOVAE project,“Buildings, Roads, Networks, NewVirtuous Targets for the Environmentand Energy”, funded by ItalianGovernment. RES-NOVAE aims toimplement new solutions for Smart

Cities, and the Rainbow platform willbe employed in many domainsincluding power grids, water manage-ment, traffic control and environmentalmonitoring.

Link:

http://smartcityexhibition.it/it/partners/expo-partner/progetto-res-novae

References:

[1] A. Lee: “Cyber Physical Systems:Design Challenges”, in proc. of the11th IEEE Symposium on ObjectOriented Real-Time DistributedComputing, IEEE Computer SocietyWashington, DC, USA, 2008.

[2] I. Stojmenovic: “Large scale cyber-physical systems: Distributedactuation, in-network processing and

Machine-to-Machinecommunications”, in proc. of the 2ndMediterranean Conference onEmbedded Computing (MECO), pp.21-24, 2013.

[3] E. Bonabeau, M. Dorigo, G.Theraulaz: “Swarm Intelligence: FromNatural to Artificial Systems” , NewYork, NY: Oxford University Press,Santa Fe Institute Studies in theSciences of Complexity, Paper: ISBN0-19-513159-2,1999.

Please contact:

Andrea Giordano, GiandomenicoSpezzano, Andrea VinciICAR-CNR, Italy,E-mail: [email protected],[email protected], [email protected]


As we move towards an infrastructurethat is increasingly dependent on moni-toring of the real world, timely evalua-tion of data acquired and timely applica-bility of management (control), severalnew challenges arise. Future factories[1] are expected to be complex Systemof Systems (SoS) that will empower anew generation of applications and serv-ices that, as yet, are impossible to realiseowing to technical and financial limita-tions. The European IMC-AESOPproject is a visionary undertaking by keyindustrial players such as SchneiderElectric, SAP, Honeywell andMicrosoft, investigating the applica-bility of cloud-based Cyber-PhysicalSystems (CPS) [2] and Service OrientedArchitectures (SOA) [1] in industrialsystems, such as monitoring of paperproduction machines by FluidHouse(Finland) and lubrication monitoringand control systems in mining industryby LKAB (Sweden).

The Factory of the Future (FoF) [1] willrely on a large ecosystem of systems inwhich large scale collaboration will takeplace. Additionally, it is expected that

CPS will harness the benefits ofemerging Cloud Computing, includingresource-flexibility and scalability. Thisnot only has the potential to enhance thefunctionality of CPS, but will also enablea much wider consumption of CPS’s dataand services. The result will be a highlydynamic flat information-driven infra-structure that will empower the rapiddevelopment of better and more efficientnext generation industrial applicationswhilst simultaneously satisfying theagility required by modern enterprises.

The first step in the infrastructure evo-lution was to empower the individualdevices with Web services, and enablethem to participate in a service-basedinfrastructure [1]. This is achieved byenabling them to: (i) expose their func-tionalities as services, and (ii) empowerthem to discover and call other (web)services to complement their own func-tionalities. The next step is to takeadvantage of modern capabilities insoftware and hardware, such as theCloud and the benefits it offers. CPShave two key parts integrated in bal-ance: the physical part for interacting

with the physical environment (e.g.composed of sensors and actuator con-stellations), and the cyber part, which isthe software part managing andenhancing the hardware capabilities ofthe CPS as well as its interaction withthe cyber-world. The prevalence of theCloud and its benefits enables us toexpand the cyber-part of the CPS anddistribute it on-device and in-Cloud.This gives rise to a new generation ofCloud-Based CPS that may revolu-tionize the Industrial Systems domain.

Cloud-based CPS and SOA may lead toa new information-driven infrastruc-ture. Today, plant automation systemsare composed and structured by severaldomains viewed and interacting in ahierarchical fashion mainly followingthe specifications of standard enterprisearchitectures. However, with theempowerment offered by modern SOA,the functionalities of each system oreven device can be offered as one ormore services of varying complexity,which may be hosted in the Cloud andcomposed by other (potentially cross-layer) services [3]. Hence, although the

Cloud-Based Industrial Cyber-Physical Systems

by Armando Walter Colombo and Stamatis Karnouskos

The domain of industrial systems is increasingly changing as it adopts emerging Internet based

concepts, technologies, tools and methodologies. The rapid advances in computational power,

coupled with the benefits of the Cloud and its services, has the potential to give rise to a new

generation of service-based industrial systems whose functionalities reside in-Cloud (Cyber) and

on-devices and systems (Physical).

traditional hierarchical view coexists,there is now a flat information-basedarchitecture that depends on a bigvariety of services exposed by the CPS[2], and their composition. Next genera-tion industrial applications can now berapidly composed by selecting andcombining the new information andcapabilities offered (as services in theCloud) to realise their goals. The envi-sioned transition to the future Cloud-based industrial systems is depicted inFigure 1.

The Cloud enabled CPS have profoundimplications for the design, develop-ment, and operation of CPS. Althoughthe device-specific part, i.e. the cyber(on-device) and physical part are stillexpected to work closely together andprovide the basic functionalities for theCPS, the in-Cloud cyber part mayevolve independently. Due to its nature,the in-Cloud part will require connec-tivity of the CPS with the Cloud whereadded-value sophisticated capabilitiesmay reside. In contrast, the on-devicecyber-part may consider opportunisticconnections to the Cloud, but in generalshould operate autonomously and in-sync with the physical part. The natureof the functionalities as well as thedegree of their dependence on externalresources, computational power, opera-tional scenarios, network connectivityetc. will be the key factor for hostingthem on-device or in-Cloud. The IMC-AESOP project has proposed an archi-tecture and services [3] that are basedon this vision.

Links:

IMC-AESOP: http://www.imc-aesop.euUpcoming Book on IMC-AESOP vision and results, ISBN 978-3-319-05623-4:http://www.springer.com/engineering/production+engineering/book/978-3-319-05623-4 Cyber-Physical Systems: Uplifting Europe's innovation capacity, EuropeanCommission CPS event: http://www.amiando.com/cps-conference.html

References:

[1] A.W. Colombo, S. Karnouskos: “Towards the factory of the future: A service-oriented cross-layer infrastructure”, in: ICT Shaping the World: A Scientific View,vol 65-81, European Telecommunications Standards Institute (ETSI), John Wileyand Sons, 2009

[2] Acatech: “Cyber-Physical Systems: Driving force for innovation in mobility,health, energy and production”, tech. rep., acatech – National Academy of Scienceand Engineering, 2011, http://kwz.me/fJ

[3] S. Karnouskos et al.: “A SOA-based architecture for empowering futurecollaborative cloud-based industrial automation”, in proc. of IECON 2012,Montréal, Canada.

Please contact:

Armando Walter ColomboSchneider Electric Automation, Hochschule Emden/Leer, GermanyE-mail: [email protected], [email protected]



Figure 1: Industrial Automation Evolution: Complementing the

traditional ISA-95 automation world view (pyramid on the left side)

with a flat information-based infrastructure for dynamically

composable services and applications (right side).


The complexity of software in smartCyber-Physical Systems (CPS) meansthat software cannot be developed byad-hoc means; instead, there is a needfor systematic software engineeringmethods to reduce the developmentcomplexity and increase reliability androbustness by using appropriate soft-ware models and abstractions. A distinctchallenge of smart CPS is that their soft-ware architecture undergoes contin-uous modifications: Componentsappear and disappear as CPS devicesenter/exit the system, components formand dissolve cooperation groups as theystart/finish a particular joint activity,and communication links are estab-lished/released depending on the actualavailability of network connectivity.

This is illustrated by the firefighter sce-nario (taken from one of our casestudies), where firefighters (captured asCPS components) coordinate withinand across mission sites and takeadvantage of stationary and mobilenodes (also captured as CPS compo-nents) existing in their vicinity to com-municate with and sense their environ-ment (see Figure 1).

To fulfill the requirements of smartCPS, researchers at Charles Universityin Prague, have developed the DEECoframework [2] for building smart CPS.This framework consists of a compo-nent model, a high-level design method,analyses, and a runtime framework – alltailored to the needs and specifics of

smart CPS. It offers a synergy betweencomponent-based systems, ensemble-based systems, agent systems and con-trol systems.

DEECo FrameworkComponent model - A component inDEECo [2] is the basic software unit ofdevelopment and deployment. It consti-tutes state (referred to as knowledge)and behaviour, materialized intoprocesses. Each process executes cycli-cally similarly to a real-time task. Toachieve component interaction, compo-nents are dynamically assembled intocollaboration groups called ensembles(e.g. a firefighter and all temperaturesensors on the same floor, all fire-fighters active at a mission site). Withinan ensemble, the components interact interms of implicit knowledge exchange,which is handled by the execution envi-ronment.

High-level design - InvariantRefinement Method (IRM) [3] is adesign method for DEECo-based sys-tems. It captures high-level goals andrequirements in terms of invariants,which describe the desired state of thesystem-to-be at every time instant(thus strengthening componentautonomy and reliability). Invariantsare maintained by component coordi-nation. As a design activity, top-levelinvariants are iteratively decomposedinto more fine-grained sub-invariants,essentially yielding a detailed contrac-tual design of system implementation –either in terms of local componentbehaviour, corresponding to a compo-nent process, or in terms of componentinteraction, corresponding to anensemble.

Analysis - Thanks to its well-definedsemantics, DEECo allows timing prop-erties to be quantified via static analysisand simulations. These include end-to-end response time and estimating levelof inaccuracy of perceived knowledge

DEECo: Software Engineering for Smart CPS

by Tomáš Bureš, Ilias Gerostathopoulos and Rima Al Ali

The functionality of smart complex networked Cyber-Physical Systems (CPS) is increasingly reliant

on software. Software dominates to such an extent that smart CPS can be classified as software-

intensive systems [1] – systems in which software is by far the most intricate and extensive

constituent. The complexity of the software is underpinned by the fact that smart CPS are inherently

distributed and need to combine collaborative behaviour with autonomicity, self-awareness and self-

adaptation. The DEECo framework addresses the holistic development of such systems.

Figure 1: Use of components to model a smart CPS consisting of firefighters and other mobile

and stationary nodes in the vicinity.

depending on the communicationlatency and physical model of sensedvalues (given as differential equations).

Runtime Environment - The frameworkis backed by jDEECo, an implementa-tion of DEECo in Java. This runtimeenvironment includes scheduling ofcomponent processes, dynamicgrouping of components into ensem-bles, and distributed knowledgeexchange. Technically, jDEECoemploys gossip-style network commu-nication to uniformly address IP-based,as well as peer-to-peer broadcast-styleWPAN networks.

Case Studies and EvaluationTo date, DEECo has been a successfulpart of the EU FP7 IP project ASCENSand employed in a number of case

studies, including intelligent vehiclenavigation, emergency coordination,and ad-hoc cloud deployment. Casestudies have confirmed that DEECorepresents a significant developmentsimplification while preserving robust-ness and dependability properties of thedesigned system.

Future WorkIn the next research and developmentsteps, we intend to focus on enhancingthe framework of efficient communica-tion means in situations of limited con-nectivity, handling uncertainty ofknowledge, and verification in the pres-ence of dynamicity.

Links:

http://www.d3s.mff.cuni.czhttps://github.com/d3scomp/JDEECo

References:

[1] K. Beetz and W. Böhm:“Challenges in Engineering forSoftware-Intensive EmbeddedSystems”, in Model-BasedEngineering of Embedded Systems,Springer, 2012, 3–14[2] T. Bures et al. “DEECo – anEnsemble-Based Component System”,in proc. of CBSE’13, ACM, 2013,81–90[3] J. Keznikl et al. “Design ofEnsemble-Based Component Systemsby Invariant Refinement,” in proc. ofCBSE’13, ACM, 2013, 91–100.

Please contact:

Tomáš BurešCharles University in Prague, CzechRepublicE-mail: [email protected]



Computer networks, such as theInternet, are playing an increasinglyimportant role in our society. Despitethis, they are too often designed andmanaged using ad-hoc techniques thatare not as mature as other engineeringand scientific disciplines. This is largelya consequence of the dependence onproprietary technologies and lack ofopen interfaces. Today’s networks con-sist of various types of switches, routersand packet-processing middleboxes.Switches and routers are architecturallycomposed of two components: a dataplane and a control plane. The data planehandles line-rate forwarding of packetsthat arrive at the device. The controlplane handles the logic needed to con-figure the forwarding rules in the dataplane. Traditional switches and routershave proprietary firmware and controllogic implementations. This not onlyinhibits vendor interoperability, but alsohampers flexibility, as operators cannotintroduce new control plane function-ality or protocol into a switch.

With the recent emergence of Software-Defined Networking (SDN), the net-

working industry is on the verge of aprofound transformation. SDN is anemerging paradigm that aims to alle-viate these issues by decoupling thedata and control planes. SDN out-sources the control of packet-for-warding switches to a set of softwarecontrollers running on a server cluster.This enables operators to run third-partysoftware or create their own to buildnetworks that meet their specific, end-to-end requirements, such as fine-grained policy enforcement, Quality ofService, and, of course, efficiency [2].In SDN, control applications operate ona global, logically-centralized view,achieving a higher level of abstractionfor managing networks. This viewenables simplified programmingmodels to define a high-level policy(i.e., the intended operational behaviourof the network) that can be compileddown to a collection of forwarding rulesand installed in the data plane. This is instark contrast to today’s manual, error-prone, ad-hoc approaches.

As such, SDN promises to radicallychange the way networks are managed

and operated. Indeed, for the first timesince the early days of computer net-works, it is becoming possible to enablenetwork operators to design and imple-ment their own network-controllingsoftware and develop new functionalityand services for end-users. A pio-neering initiative in this direction is theOpenFlow protocol [3], which allows asoftware controller to dynamicallymanage the state and the behaviour ofnetwork elements.

However, while offering unprecedentedpotential, SDN is still in its infancy andmuch research effort is needed to betterdefine its foundations: What are theabstractions that promote a simple yetexpressive and efficient network-pro-gramming model? How will theseabstractions yield efficient implementa-tions that support rapid reactions tounplanned network events? Is it practi-cally feasible to devise efficient abstrac-tions that may still lend themselves toautomated verification of integratednetwork systems? For instance, is itpossible to prove that a network systemsatisfies key properties that would

The Software-Defined Network Revolution

by Marco Canini and Raphaël Jungers

Thanks to the introduction of Software-Defined Networking (SDN) [1], it is becoming possible, for the

first time since the early days of computer networks, for operators to design and implement their

own software in order to operate and customize the network to specific needs. But this comes with

challenges involving many different disciplines.


ensure smooth network operation? Howto design a logically centralized (i.e.,physically distributed) control platformthat adequately and cost-effectivelyprovides the required levels of avail-ability, responsiveness and scalability?What control functionality can we keepdistributed, what should we centralize?How can we achieve optimal dynamicalresource allocations and fairness amongusers? Also, what methodologies canwe devise to troubleshoot these systemswhen things in practice do not workaccording to theory (e.g., due to hard-ware malfunctioning)? Finally, whatstrategies should we use to deploy SDNinto existing networks? We believe thatthese questions require us to apply prin-ciples and techniques from a large bodyof different disciplines, includingOperations Research, Control Theory,Distributed Systems, ProgrammingLanguages, Software Engineering,Security, and Embedded Systems.

As such, SDN systems share many chal-lenging technical problems with otherCyber-Physical Systems (CPS): (i) theyhave to cope with human and unpre-dictable demand, (ii) they are akin to aSystems-of-Systems structure com-prising a two-tier distributed system, inwhich each node has heterogeneousprocessing capabilities and a large partof their computational resources areembedded (e.g., router firmware, NPUs,FPGAs), and (iii) constraints from thephysical world are strong and various(e.g., link bandwidths and latencies, or

failures due to random errors or mali-cious behaviours). On top of that, SDNsystems constitute an opportunity forother CPS that might need to rely on aprogrammable and modular network ofcomputing and forwarding resources.Perhaps even more than for other CPS,SDN seems to have only one limitationto our ability to control them: our ownimagination.

At UCLouvain, we have built a teamcentred on the new SDN paradigm inorder to leverage its possibilities anddevelop the new generation of computernetworks. Our goal is to build a rigorousand systematic methodology fordesigning and operating SDN systems,and we are convinced that the only fea-sible approach is to combine advancesin Electrical Engineering, ComputerScience and Applied Mathematics,ranging from computer networking tosoftware and requirements engineering,optimization and control theory. Ourresearch group includes faculty, stu-dents, and post-docs from various back-grounds in these disciplines. Moredetails on this project are available atour website: http://sites.uclouvain.be/arc-sdn/. PhD and Post-doc positionsare available within our team.

Link:

http://sites.uclouvain.be/arc-sdn/

References:

[1] N. Feamster, J. Rexford, E.Zegura: “The road to SDN: Anintellectual history of programmablenetworks,” ACM Queue 11, 12(December 2013)

[2] “Ethane: taking control of theenterprise,” in Proceedings of ACMSIGCOMM, 2007

[3] N. McKeown et al.: “OpenFlow:enabling innovation in campusnetworks,” ACM SIGCOMM Comput.Commun. Rev. 38, 2 (March 2008),69–74.

Please contact:

Marco Canini and Raphaël Jungers Université catholique de Louvain,Belgium.E-mail: [email protected],[email protected]

Figure 1: Example Software-defined

network architecture: the control plane is

separated from the data plane and control

applications operate on top of a global

(possibly virtualized) network view.

The smooth operation of critical infra-structures, such as telecommunicationsor electricity supply is essential for oursociety. In recent years, however, opera-tors of critical infrastructures haveincreasingly struggled with cyber secu-rity problems [1]. Through the use ofICT standard products and increasingnetwork interdependencies [2], the sur-faces and channels of attack have multi-plied. New approaches are required totackle this serious security situation.One promising approach is the exchangeof network monitoring data and statusinformation of critical services acrossorganizational boundaries with strategicpartners and national authorities. Themain goal is to create an extensive situa-tional awareness picture about potentialthreats and ongoing incidents, which is aprerequisite for effective preparationand assistance in large-scale incidents.

The Challenges of SensitiveInformation SharingIn practice, security information sharingis usually accomplished via ad-hoc andinformal relationships. Often, nationalComputer Emergency Response Teams(CERTs) assume the role of a contactpoint for coordinating and aggregatingsecurity incidence reports. However, theinformation that is provided is usuallynot targeted to particular verticalindustry sectors, such as power grids.We suggest that sector-oriented views,along with rich information and experi-ence reports are required to make suchplatforms more effective. Furthermore,there is a crucial trade-off to be consid-ered: existing platforms require infor-mation to be verified centrally (in orderto avoid hoaxes); therefore, the speed ofinformation distribution suffers.Timeliness of information is very impor-tant when protecting against aggressiveattackers and zero-day exploits.Consequently, there is a need for newstandards that employ suitable direct

sharing models, which allow the tar-geted exchange of specific informationabout discovered vulnerabilities of ICTsystems utilized in critical infrastruc-ture control systems, as well as currentthreats (such as new SCADA (supervi-sory control and data acquisition)-tar-geted malware) and recent incidents.The application of these standards fur-ther implies the existence of a federatedtrust and reputation model to addressreservations of users, and to attract acritical mass of users. This is also in linewith the objectives of the recently intro-duced European "Network andInformation Security" (NIS) directive[3]. NIS explicitly recommends theimplementation of national cyber secu-rity centres, which are not onlyinformed about the security status of thenational critical infrastructureproviders, but also play a coordinatingrole in the prevention of, or protectionfrom attacks.

The Project “Cyber IncidentInformation Sharing” (CIIS)The research project “Cyber IncidentInformation Sharing” (CIIS) aims todevelop methods and technologies forthe exchange of information on cyberincidents to better defend againstcyber-attacks and to streamline theanalysis of current threats. CIISassumes that preventive mechanismsand resilient architectures for criticalinfrastructures are in place. If, despitethese measures, an attack is successful,a number of counter measures are beingstudied (see Figure 1). In particular, anovel anomaly detection mechanism isbeing developed, which utilizes large-scale event processing and correlationto detect anomalous system behaviour.This anomaly detection approach isspecifically designed to enable incidentinformation sharing on top in a privacy-preserving way. In order to draw con-clusions from exchanged data about



Securing Interconnected Cyber-Physical

Systems through Strategic Information Sharing

by Florian Skopik and Thomas Bleier

Cyber-attacks are becoming increasingly sophisticated, targeted and coordinated. Consequently,

new paradigms are required for detecting attacks in critical cyber-physical systems, such as the

smart grid. Many attack detection tasks are currently performed within individual organizations, and

there is little cross-organizational security information sharing. Information sharing is a crucial step

to acquiring a thorough understanding of large-scale cyber-attack situations, and is necessary to

warn others against threats.

Figure 1: Overview of CIIS Research Efforts

current threats and to enable an assess-ment of current risks and concreteactions to be deployed, further tools forinteractive analysis and visualizationand establishing situational awarenessfor the technical operations personnelare being developed. Exchanging bestpractices to deal with cyber-attacksand providing aid to affected organiza-tions mitigates the impact of successfulcyber-attacks and ensures fastrecovery.

CIIS Project ConsortiumIn order to attain these ambitious goalsand finally ensure the wide applicabilityof developed tools, the project consor-tium consists of a vital mix of expertswith a thorough knowledge of the areaof security (Austrian Institute ofTechnology), visualization and situa-tional awareness (VRVis ForschungsGmbH), and critical infrastructure oper-ation (T-Systems Austria, Energie AG).Additionally, the involvement ofexperts in the field of social sciences(Institute for the Sociology of Law andCriminology, Netelligenz e.U.) is essen-

tial to illuminate issues of trust and pri-vacy in the exchange of sensitive infor-mation and to investigate incentives toparticipate in such initiatives. In addi-tion to the development of scientificmethods, the proper demonstration ofthe applicability in a real-world envi-ronment is of paramount importance inorder to test and evaluate the plannedsystem. Pilot cases are supported on theone hand through operators of criticalinfrastructures, on the other hand bynational authorities (Ministry of theInterior, Ministry of Defence andSports).

Moreover, CIIS consortium membersare actively involved in internationalinitiatives, such as the MultinationalCapability Development Campaign(MCDC) which enables beneficial col-laborations across Austria’s borders.CIIS is a two-year national project run-ning from 2013 to 2015 and is finan-cially supported by the Austrian secu-rity-research program KIRAS and bythe Austrian Ministry for Transport,Innovation and Technology (BMVIT).

Link: http://www.ait.ac.at/ciis

References:

[1] R. Langner: “Stuxnet: Dissecting acyberwarfare weapon”, Security &Privacy, IEEE, 9(3), 49-51, 2011

[2] S. M. Rinaldi: “Modeling andsimulating critical infrastructures andtheir interdependencies”, IEEE HICSS,2004

[3] Commission Proposal for aDirective concerning measures toensure a high common level ofnetwork and information securityacross the Union; http://ec.europa.eu/digital-agenda/en/news/commission-proposal-directive-concerning-measures-ensure-high-common-level-network-and, 07/02/2013.

Please contact:

Florian Skopik and Thomas BleierAustrian Institute of Technology,AIT/AARIT, AustriaE-mail: [email protected],[email protected]


Cyber-Physical Systems of Systems(CPSoS) is a 30-month Support Action,funded by the EU (under FP7), that pro-vides an exchange platform for Systemsof Systems (SoS) related projects andcommunities. It focuses on the chal-lenges posed by the engineering and theoperation of technical systems in whichcomputing and communication systemsinteract with large complex physicalsystems ([1], [2], [3]). Its approach issimultaneously integrative - aiming tobring together knowledge from differentSoS related communities - and applica-tions driven. It will integrate the dif-ferent approaches to the design, analysisand control of systems of systems thatare pursued by different communities intheory and application, and relate themethods and tools proposed for dealingwith SoS to key application domains

which are important for Europe’s com-petiveness as well as for the well-beingof its citizens. The project will conductan in-depth examination of application-specific issues, capture cross-industryand cross-application findings and pro-pose new avenues for SoS analysis,design and control. This will contributeto the development of a science of sys-tems of systems and a European R&Iagenda on SoS, involving different sci-entific communities, applicationdomain experts, end-users and vendors.

The final outcomes of the project willbe: • Analysis of industrial and societal

needs and of the state-of-the art oftools, theories, and methods forcyber-physical SoS, and identifica-tion of synergies, open issues and

promising transdisciplinary researchdirections,

• Definition of a research agenda forcyber-physical systems of systemsand their engineering needs,

• Contribution to coordination of SoSrelated projects, building up a net-work of key researchers and applica-tion domain experts in the area, andraising public awareness of the impactof research on systems of systemsengineering, analysis and control.

The contributions will be summarizedin a strategic policy document“European Research and InnovationAgenda on Cyber-physical Systems ofSystems”, supported by a set of in-depthtechnical papers. The project will pre-pare the EU stakeholders for extractinga competitive advantage from the recent

A European Roadmap on Cyber-Physical

Systems of Systems

by Michel Reniers and Sebastian Engell

We are developing a strategic policy document “European Research and Innovation Agenda

on Cyber-Physical Systems of Systems”

http://ec.europa.eu/digital-agenda/en/news/commission-proposal-directive-concerning-measures-ensure-high-common-level-network-and

and the future developments in the areaof SoS. The project’s approach is sum-marized in Figure 1, which shows sev-eral of the steps taken in the project toachieve the above outcomes.

Three working groups have been cre-ated on:1. Systems of Systems in Transportation

and Logistics (Chair: Prof. HaydnThompson, Haydn Consulting),

2. Physically Connected Systems ofSystems (Chair: Prof. SebastianEngell, TU Dortmund),

3. Tools for Systems of Systems Engi-neering and Management (Chair:Prof. Wan Fokkink, TU Eindhoven).

On 31 January 2014, a first meeting ofthe members of the working groups washeld in Düsseldorf, Germany. The dis-cussions addressed the following mainquestions:• What are typical use cases of cyber-

physical systems of systems?• What are the main difficulties

encountered in the engineering, real-ization and operation of CPSoS?

• What are the specific demands andchallenges for advanced methods andtools for CPSoS engineering andoperation?

• What are the most important openresearch questions for CPSoS overthe next five years?

Numerous examples for cyber-physicalsystems of systems were presented anddiscussed, and the three Working

Groups provided prioritized lists offuture topics for research and develop-ment in the area of CPSoS. These willbe discussed with domain experts,within the consortium, and elaboratedin more detail with the help of the mem-bers of the working groups in order toprovide a first draft of a strategy docu-ment by June 2014.

A first draft of the roadmap paper willbe presented to the EuropeanCommission in July 2014. The roadmappaper will then be further discussed inworkshops with external participationin the autumn of 2014 to obtain feed-back and further input. A Workshop onTools and Methods for Cyber-PhysicalSystems of Systems is planned to takeplace on September 12, 2014, co-located with iFM 2014 in Bertinoro,Italy.

More information, including the com-position of the consortium, the mem-bers of the working groups, papers ofimportance to the domain and discus-sion papers and final outcomes can befound on the project website.

Researchers and industrial stakeholderswith an interest in cyber-physical sys-tems of systems are invited to con-tribute in the following ways:• send suggestions via the short ques-

tionnaire (http://www.cpsos.eu/?page_id=462)

• send any other suggestions to theproject coordinator Prof. Sebastian

Engell (via Web site, "Contact" page,or via email [email protected])

• subscribe to the project events'announcements and newsletters.

The CPSoS project has receivedfunding from the European Union’sSeventh Framework Programme forresearch, technological developmentand demonstration under grant agree-ment No 611115.

Link: http://www.cpsos.eu

References:

[1] M.W. Maier: “ArchitectingPrinciples for System of Systems”,Systems Engineering, Vol. 1, No. 4,1998 pp. 267‐284

[2] A. Lee: “Cyber Physical Systems:Design Challenges”, in proc. of the 11thIEEE Symposium on Object OrientedReal-Time Distributed Computing,IEEE Computer Society WashingtonDC, USA, 2008, pp. 363-369

[3] J. Fitzgerald et al.: “Model-basedEngineering for Systems of Systems:the COMPASS Manifesto”,COMPASS Technical Report, 2013.

Please contact:

Sebastian EngellCPSoS project coordinator Technische Universität Dortmund,GermanyE-mail: [email protected]



Figure 1: Workflow of the CPSoS project.


Cyber-Physical Systems (CPSs) arechallenging to develop because thecyber and physical parts have differentkinds of semantic foundation, thus acommunication hurdle exists betweenthe engineering disciplines [1]. CPSmethods and tools must bridge this gapin order to create a common basis fordesign and analysis. Various approacheshave been suggested to overcome thischallenge [2]. In the DESTECS project,we demonstrated how model-basedtechniques could support multidiscipli-nary design by bringing togetherContinuous Time (CT) models of phys-ical systems with Discrete Event (DE)models of the embedded controllerbehaviour. Instead of requiring controland software engineers to adopt a newcommon design notation, we focused onharnessing models of physics and soft-

ware within a common framework witha sound formal semantics, enabling theresulting co-model to be simulated as awhole. The project resulted in the devel-opment of the Crescendo technology[3], which enables stakeholders fromdifferent engineering backgrounds tocontinue using the methods that arefamiliar to them, while jointly engagingin holistic analysis and tradeoff acrossthe disciplinary divide. This enablescross-discipline dialogue in the earlystages of design, often exposing hidden(domain specific) assumptions thatwould otherwise be found during inte-gration and test. This not only reducescost and improves time-to-market andproduct quality, but it also promotes theimpact analysis of design alternatives,providing a better basis for decisionmaking during product development.

In Crescendo, the coupling between dis-crete and continuous models is formal-ized in a “contract” that describes thestate variables and events that areexchanged between the connectedmodels, as well as the shared designparameters and model variables. Allthese artifacts are described and man-aged in a single place and automaticallyshared among models, which improvesconsistency. Model variables are setfrom a script, enabling engineers toundertake sensitivity analysis on themodel by performing a parametersweep or to perform fault resilienceanalysis by enabling or disabling partsof the model that represent error behav-iours. Providing the co-simulation con-tract is maintained, the participatingmodels can be modified at will, so thatengineers can explore the design space,

Linking Design Disciplines in Cyber-Physical

System Development: The DESTECS/Crescendo

Technology

by John Fitzgerald, Peter Gorm Larsen and Marcel Verhoef

A new generation of innovative products is emerging that link computing elements – hardware and

software – with physical processes. They surround us in our daily life and we are becoming

dependent upon their embedded intelligence, as well as their interconnections. Successful design of

these “Cyber-Physical Systems” (CPSs) requires close collaboration between all engineering

disciplines involved, and rapid innovation is often required in order to meet short windows of

opportunity under economically volatile circumstances. The DESTECS consortium has developed co-

modelling technology to support cooperative working, and has delivered methods validated in

industry case studies. These results are embodied in a new tool set that reduces the effort required

to perform design iterations, and improves their impact, right from the outset of design.

Figure 1: The ChessWay Prototype Figure 2: Co-simulation of the Verhaert Excavator model

for example examining different con-troller strategies on the same physicalsystem model, or to subject a singlecontroller to a set of physical systemmodels with different fidelity.

Our collaborative modelling and simu-lation approach has been implementedin the Crescendo tool, which currentlyuses 20-sim, a commercially availabletool, for the CT models of the physicalsystem, coupled with DE controllermodels expressed using the VDM nota-tion. 20-sim supports several textualand graphical methods to describe CT

models which are automatically con-verted into sets of differential equationsthat are numerically solved. A library ofdomain-specific sub-models describesmechanical, pneumatic, hydraulic andelectrical components. A 3-Dmechanics editor allows a virtual mock-up to be created to support visualiza-tion. On the DE side, VDM is an object-oriented formal modelling techniquethat supports abstract data types, con-stants, functions, operations and addi-tional integrity constraints such asinvariants and pre- and post-conditions.The language enables the specificationof distributed and embedded systems,with asynchronous operations, time andan explicit notion of the computationand communication architecture ontowhich the software is deployed. Thecyber-side engineer can thus specifywhich software runs where, and assessthe impact of that chosen deploymenton overall performance and timing.

Several companies have applied andevaluated the technology. During theproject, CHESS (NL) developed a per-sonal transporter akin to the famousSegway, with a distributed safety mon-itor (Figure 1). Verhaert (B) developed anovel controller for a dredging exca-vator, enabling even novice operators todig perfectly straight trenches (Figure2). Neopost (NL) modelled a newsystem design for automatically foldingstacks of documents and placing themin envelopes at high speed (Figure 3).Other smaller-scale applications basedon industry-specified challenges

included a tilting conveyor belt system,an aircraft flare dispensing unit andmovement control for an interplanetaryrover. The industrial case studies haveshown that co-simulation is a valuabletool to support the multi-disciplinarydesign dialogue from the initial (con-ceptual) stages of product development.We used 20-sim and VDM-RT inDESTECS, but the Crescendo tool hasan open architecture and is built upon awell-defined semantics that is essen-tially technology-agnostic.

Of course, simulation is not a “silverbullet”, but our industry case studiesshowed that it is possible – and indeedvery cost-effective – to create abstractand competent co-models of CPSs inearly development phases. Thesemodels remain lightweight and com-pact, allowing developers to play“what-if” scenarios at relatively lowcost. The insight gained by these simpleexperiments raises the confidence in the

models quickly, because design deci-sions are continuously validated.Implicit choices and hidden assump-tions are immediately exposed,replacing “gut feeling” by credible,objective and quantitative informationthat now can be assessed by all thedesigners involved, regardless of their“home” discipline. This typically givesdirection, depth and momentum to thedesign effort because the potential ofcertain designs and the likelihood andimpact of potential risks can be deter-mined very rapidly, without largeupfront investments. Because co-models can be subjected to advancedverification or form the basis of imple-mentations, they have a utility farbeyond initial multidisciplinary design.

Links:

http://www.destecs.org http://www.crescendotool.org

References:

[1] T.A. Henzinger, J. Sifakis: “TheEmbedded Systems DesignChallenge”, FM 2006: FormalMethods, pp. 1-15, 2006

[2] E.A. Lee: “Cyber PhysicalSystems: Design Challenges” in proc.of ISORC 2008, pp. 363-369, 2008

[3] J. Fitzgerald, P. Gorm Larsen, M.Verhoef (eds): “Collaborative Designfor Embedded Systems - Co-modellingand Co-simulation”, Springer, April2014, ISBN 978-3-642-54117-9

Please contact:

John FitzgeraldNewcastle University, UKE-mail:[email protected]

Peter Gorm Larsen, Aarhus University, DenmarkE-mail: [email protected]

Marcel VerhoefChess, the NetherlandsE-mail: [email protected]



Figure 3: The Neopost document insertion system


Formal methods for verifying comput-erised systems offer a powerfulapproach for validating the adequacy ofthe systems against their requirements.Based on deep theoretical results inlogics and automata, model checking isone such approach. This approachinvolves modelling a system as a mathe-matical object (a finite-state automatonin the basic case), and applying algo-rithms for comparing the behaviour ofthat model against a logical property.Model checking has now reached matu-rity [1] through the development of effi-cient symbolic techniques, state-of-the-art tool support, and numerous suc-cessful applications to various areas.

Building on this framework, automaticsynthesis techniques have recently beenproposed. These techniques allow amodel of a system (that is correct in con-struction) to be built automatically basedon certain specifications. This modelcan then be refined to produce a vali-dated implementation, thereby avoidinga trial-and-error approach of modelchecking. It is usual - and convenient -to rephrase the problem of automaticsynthesis in the framework of gametheory. In this metaphor, the system tobe synthesized is then represented as astrategy, which should win against anybehaviour of the system's environment,represented by the other player. Thewinning condition is used to express thecorrectness properties that we want thesystem to satisfy. This game-basedapproach to the synthesis of systemsinteracting with their environment hasbeen greatly developed over the lasttwenty years, and is approaching matu-rity [2].

It should be noted, however, that up untilnow, formal methods have mostlyfocused on two-player zero-sum games,which only encompass the purely antag-

onist setting and may only model cen-tralized control. Multiple-player gameswith non-zero-sum objectives havebeen considered, e.g., in algorithmicgame theory, but they were strategicgames, as opposed to the infinite-dura-tion games on graphs that apply particu-larly well to synthesis.

Within the Cassting project, we aredesigning a game-based framework formodelling and reasoning about cyber-physical systems. This is much morethan just a minor extension of theexisting framework: while the basicconcept of using game models is pre-served, radically new concepts andtechniques have to be developed inorder to build a powerful formalism,equipped with efficient algorithms andtools for modelling and synthesizingsuch complex systems. In particular,while winning strategies are the centralconcept in adversarial games, multiple-player games come with a full range ofequilibria for globally characterizingthe admissible behaviours of the

players. Understanding how this can beadapted to infinite duration games rep-resenting cyber-physical systems isalready an important part of our work[3]. Setting up a complete framework,with powerful formalisms and efficientalgorithms for synthesizing the relevantstrategies and the corresponding sys-tems, is thus the main focus of ourresearch. In order to fit to the systemswe model, quantitative constraints (inparticular on time or energy consump-tion) are a must-have feature of ourmodelling formalism: components ofcyber-physical systems are often smallindependent devices with limitedresources. Perturbations and imperfectcommunications are also part of ourframework.

To validate our approach, our industrialpartners have selected several casestudies for us. These cases come fromareas of smart buildings and smartgrids, trying to optimize energy con-sumption and harvesting at differentlevels of scale. In the first case study,

Cassting: Synthesizing Complex Systems

Using Non-Zero-Sum Games

by Nicolas Markey

The design of complex systems such as those used in transportation, mobile communication and

home automation, raises fundamental challenges: these systems are made of heterogeneous

components that interact continuously with each other (collaboratively or as adversaries) and with

their environments. Available methods (such as model-based verification, quantitative model-

checking, or controller synthesis) only address specific aspects of complex systems. The FP7

project “Cassting” is developing a novel approach for analysing and designing complex systems in

their totality, using non-zero-sum games to model their behaviours.

Figure 1: Home automation is one of our target applications.

we aim at designing distributed, robustcontrollers for a floor heating system, inorder to improve the efficiency of thecurrently implemented centralized con-troller. The second case focuses on ahome-automation system, with adynamic set of devices, includingHVAC (climate-control) appliances,lighting, etc., with the aim of makingthe whole system easily reconfigurable.Finally, a third case study is concernedwith optimizing energy harvesting andconsumption of a whole set of housesequipped with solar panels and heatpumps, taking care of weather forecastsand varying energy prices.

The Cassting project includes five aca-demic partners: CNRS/LaboratorySpecification and Verification, France(Coordinator); University of Mons,Belgium; Université Libre deBruxelles, Belgium; University ofAalborg, Denmark; RWTH Aachen,

Germany. It also has two industrialpartners: Seluxit, Denmark (an SMEspecialized in home automation) andEnergi Nord, Denmark (an energyprovider). The project started in April2013, and will run for three years, witha total budget of approximately 2.7 mil-lion euros. Cassting is part of theCoordination Action FoCAS(Fundamentals of Collective AdaptiveSystems).

Links:

Cassting project: http://www.cassting-project.eu/FoCAS coordination action:http://www.focas.eu/

References:

[1] M. Edmund et al.: “Turing Lecture:Model Checking: AlgorithmicVerification and Debugging”,Communications of the ACM52(11):74-84 ACM, 2009

[2] C-H. Cheng et al.: “MGSyn:Automatic Synthesis for IndustrialAutomation”, in proc. of CAV'12,LNCS 7358, Springer, 2012

[3] J. Y. Halpern: “Beyond NashEquilibrium: Solution Concepts for the21st century” In K. R. Apt, E. Grädel(eds.), Lectures in Game Theory forComputer Scientists, chapter 8,Cambridge, 2011.

Please contact:

Nicolas MarkeyCNRS & ENS Cachan, FranceE-mail: [email protected]



Systems of Systems (SoSs) are syner-gistic collaborations between separatelyowned and managed systems thattogether deliver an emerging behaviouron which people come to rely. Forexample, the collective response of theemergency services in responding to anatural disaster comes as a result of theco-working of authorities that are nor-mally – sometimes fiercely – inde-pendent. As we come to depend on thecollective behaviour of these SoSs, weneed to engineer them so that reliance onthem is justified, even in the face of theircapacity to change goals and functions.

Comprehensive Modelling forAdvanced Systems of Systems (COM-PASS) is an EU FP7 ICT project, now inits third year. Our vision is providing

systems engineers with well-foundedengineering notations, methods andtools that allow them to build models ofSoSs and analyse their collective prop-erties well ahead of commitments tocostly design decisions.

Three specific challenges must beaddressed to achieve the benefits of SoSengineering [1]:1. Verification of emergent behaviour.

We do not assume that emergentbehaviour is unanticipated: it may bethe intended outcome of building theSoS. Verification requires the compo-sition of Constituent System (CS)properties.

2. Collaboration through contracts. Fullinformation about each CS is unlike-ly to be visible to the SoS engineer.

The CS must agree a contract speci-fying the range of behaviours thateach CS can rely on (and guarantee).We need to be able to verify CSbehaviour conforms to the contract.

3. Semantic heterogeneity. CSs mayhave a combination of componentsthat are specified with discrete orcontinuous state or time, or at differ-ent levels of abstraction. This hetero-geneity must be addressed in order tobe able to verify emergent properties.

Throughout the project, there has beenclose collaboration between the tech-nology developers and case studyowners. This co-operative developmenthas improved the COMPASS tool chainmaturity and the industrial deploya-bility of COMPASS technology.

Dependable System of Systems Engineering:

the COMPASS Project

by John Fitzgerald, Steve Riddle, Paolo Casoto and Klaus Kristensen

In many areas of life, from buying holidays to organising the national defence, we are coming to

depend on systems that are composed of several independently owned and managed, pre-existing

systems. How can we engineer such Systems of Systems (SoSs) so that they merit the trust we place

in them? A consortium of European and Brazilian researchers and practitioners are developing

semantically sound languages and tools for Model-based SoS Engineering, integrated with well-

established systems engineering practice. Industry case studies in areas including smart homes and

emergency response have driven the requirements for our methods and tools, and have provided a

basis for their evaluation.


An emergency response case study isdeveloped by project partner INSIEL,who observe: “The COMPASS projectis going to provide INSIEL several ben-efits from both methodological andtechnological points of view, the mostsignificant being the ability to model,by means of executable CML models,properties emerging from the architec-ture of our System of Systems. Suchrequirement is, in fact, really critical forthe specific domain where INSIEL'sproducts work; each product needs tosatisfy a set of constraints concerningquality of service and response time. Inparticular, by means of model checking,fault tolerance modelling and CML exe-cution INSIEL will be able to evaluateif constraints will be respected at designtime. CML modelling also allows us toanalyze how SoSs will behave when adifferent context appears, or when thetopology of the SoS may change.”

A smart homes audio/video case studyis developed by project partner Bang &Olufsen (B&O), who observe:“Significant results have been achievedin the field of SoS requirements engi-neering, SoS architectural level model-ling and SoS model simulations. Therequirements engineering methods andtechniques have improved requirementconsistency and stakeholder impactanalysis for B&O’s development organ-isation. A Streaming ArchitecturalFramework (SAF) has been produced,which has enabled communicationregarding integration challenges of thedifferent CS’s streaming architecturesin the B&O SoS.

As part of early verification improve-ments, a formal CML (COMPASSModelling Language) model for a newB&O distributed Leadership algorithmwas developed. The algorithm enablesdesired emergent properties in the SoS.The correctness of the algorithm is vitalfor the end-users’ experience in an SoSmulti-product setup. B&O was able tofind errors by analyzing the model, andcorrect the C++ implementation, beforethe algorithm was deployed in the prod-ucts.”

The identified specific challenges willcontinue to be the focus of further workin Cyber-Physical Systems of Systems.

Project partners are NewcastleUniversity, UK; Aarhus University,Denmark; University of York, UK;

Bremen University, Germany;Universidade Federal de Pernambuco,Brazil; Bang & Olufsen, Denmark;Insiel, Italy; Atego, UK

Link:

http://www.compass-research.eu

Reference:

[1] John Fitzgerald et al,"Model-basedEngineering for Systems of Systems:the COMPASS Manifesto".COMPASS Technical Report, 2013. http://www.compass-research.eu/Project/Whitepapers/COMPASS_Manifesto.pdf

Please contact:

Steve RiddleNewcastle University, UKE-mail: [email protected]

Figure 1: The COMPASS Toolset.

Cyber-Physical Systems (CPS) areattracting particular attention in theresearch and industrial communitiesgiven their impact on the future ofInternet of Things, Systems of Systems,wearable electronics, brain-machineinteraction and swarm systems, andother fields that require the integrationof different, complementary compe-

tences. We focus on the role of controland in particular of Networked ControlSystems (NCS) [1] and embedded con-trol software synthesis [2] in buildingthe foundations of CPS.

Particular emphasis is given in NCS tothe non-idealities affecting communica-tion among plants and controllers. The

relevant ones are quantization errors,variable sampling/transmission inter-vals, time-varying delay in deliveringmessages through the network, limitedbandwidth, packet dropouts, and sched-uling protocols. Given the generality ofthe NCS model, results for the analysisand control design are difficult toobtain. Researchers, thus, typically

Towards a Unified Theory for the Control

of CPS: A Symbolic Approach

by Alessandro Borri, Maria Domenica Di Benedetto and Giordano Pola

We present a general framework for the efficient synthesis of control algorithms enforcing complex

logic specifications on Cyber-Physical Systems (CPS).

http://www.compass-research.eu/Project/Whitepapers/COMPASS_Manifesto.pdf

focus only on subsets of these non-ide-alities. Results available in the literaturemostly concern stability and stabiliz-ability issues [1]. However, emergingrequirements for CPS address differentand perhaps more complex controlobjectives, for example: obstacle avoid-ance, synchronization specifications,enforcement of limit cycles and oscilla-tory behaviour.

The computer science community hasdeveloped methodologies for the con-trol design of discrete systems withcomplex logic specifications. Thesetechniques are general enough toaddress issues arising from CPS appli-cations. However, this methodologycannot be directly applied to NCS,which include continuous dynamics.The focus of this article is an approachto deal with this class of systems byapplying “correct-by-design embeddedcontrol software synthesis”.

Central to this approach is the construc-tion of symbolic models, which areabstract descriptions of continuous sys-tems where a symbol corresponds to an"aggregate" of continuous states. Oncea symbolic model is constructed, whichis equivalent to or approximates theoriginal continuous dynamics, then thetechniques developed for discretemodels can be applied. Several classesof dynamical and control systems admitsymbolic models, see for example [2]and the references therein.

In particular, we considered a generalmodel of NCS comprising all the abovementioned non-idealities in the commu-nication infrastructure. The proposedmodel is flexible enough to includeother relevant features of CPS, such asspecific communication protocols, datacompression and encryption in the mes-sage delivery, and scheduling rules inthe computing units. Under mildassumptions on the boundedness of thetime-varying delays involved in theNCS, and of the incremental forwardcompleteness on the plant, a symbolicmodel is constructed and proven toapproximate the given NCS in the senseof alternating approximate simulation[2], for any desired accuracy. Whilebeing sound, this result exhibits the fol-lowing drawback: if a controller,designed on the basis of the symbolicmodel for enforcing a given specifica-tion, fails to exist, there is no guaranteethat a controller, enforcing the same

specification, does not exist for the orig-inal NCS model. When alternatingapproximate simulation is replaced byalternating approximate bisimulation[2], the above drawback is overcome:we showed that if the plant of the NCSenjoys the stronger property of globalasymptotic stability, a symbolic modelcan be constructed which approximatesthe NCS in the sense of alternatingapproximate bisimulation for anydesired accuracy.

Once symbolic models are constructed,the symbolic control design of NCS canbe addressed. We consider the fol-lowing control problem: given a specifi-cation expressed in a fragment of LinearTemporal Logic, find a symbolic con-troller so that the closed-loop NCSsystem matches the specification withany desired accuracy. We solved thiscontrol problem by extending computerscience results to metric transition sys-tems. The resulting symbolic controllerhas been proven to be the approximateparallel composition of the symbolicmodel and of the specification. Thisapproach is computationally intensive.We have developed efficient algorithmsbased on “on-the-fly” techniques to mit-igate computational complexity. The methodology proposed here isreported in detail in [3], which alsoincludes an example of application ofthe techniques to the control design of apair of nonlinear control systemssharing a common communication net-work. Since the requested symboliccontrollers would exhibit a large spacecomplexity (more than 1020 integers),we applied the aforementioned “on-the-

fly” algorithm and designed symboliccontrollers with a total space com-plexity of just 25,239 integers, stillsolving the original control problem.The closed-loop NCS obtained has beenvalidated through the OMNeT++ net-work simulation framework, thusshowing the effectiveness of theapproach.

To the best of our knowledge, this is thefirst contribution where a general modelof NCS is considered and where com-plex control problems are addressed.However these results are still theoret-ical and more work is needed to be rele-vant for industrial CPS.

Link: http://dews.univaq.it/

References:

[1] A. Bemporad et al. (Eds.):“Networked Control Systems”, LNCIS406.[2] P. Tabuada: “Verification andControl of Hybrid Systems: ASymbolic Approach”, Springer 2009.[3] A. Borri et al.: “A symbolicapproach to the design of nonlinearnetworked control systems”, HSCC’12.

Please contact:

Alessandro Borri,IASI-CNR BiomathematicsLaboratory, Rome, ItalyE-mail: [email protected]

Maria Domenica Di Benedetto andGiordano PolaUniversity of L’Aquila, Italy. E-mail: {mariadomenica.dibenedetto,giordano.pola} @univaq.it



Figure 1: Example of control over networks in a cyber-physical system.


The Arrowhead project consortium com-prises 78 partners, including the AustrianInstitute of Technology and AITIAInternational, Inc., as well as a number ofmanufacturers, energy providers, energygrid maintenance companies and com-munication system providers.

The investigated domains and use casesindicate that the integration of (legacy)sensors and M2M communication com-ponents into an automation system facil-itates improved efficiency of operations.

The Arrowhead frameworkAn important task within the ARROW-HEAD project is to design a genericframework to achieve interoperabilityof various sub systems, which often

derive from legacy applications. Theconcept of this framework is based onservice oriented architectures (SOA).For each system, an interface descrip-tion must be provided (black boxdesign) which can be made accessibleto other systems through the coresystem functions. Each system mayhave multiple instances for differentapplication areas, which are repre-sented as System of Systems. Systemfunctions are derived from System ofSystems Design Description (SoSDD)template. The structure of the frame-work is depicted in Figure 1.

A system may provide four core func-tionalities that are defined within theSystem of Systems Design (SoSD):

Information Infrastructures, InformationAssurance, System Management andApplication related functionalities.These functionalities comprise services,such as service discovery, orchestration,authorization, and status, which arerequired to be defined for every system.Each partner involved in an individualuse case publishes a list of functionali-ties that their (automation) system canprovide and requirements for theirsystem to accomplish particular goalsthat have been defined at the start of theproject. Requirements may relate todependability, safety, reliability, integra-bility, interoperability, architectural andcommunication. Based on these, theframework will be refined, and finallythe procedure on how to integrate legacysystems into the arrowhead frameworkwill be described and disseminated inproject deliverables.

Information assuranceIn the information assurance coresystem a security assessment method-ology is designed which makes thesecurity assessment of systems andapplications straightforward for thedevelopers and system designers priorto integration into the Arrowheadframework. This method is based onthreat modelling [1] and risk assessment[2] techniques which can be appliedfrom the early stages of development.Additionally, applications can make useof dependability analysis methods,where additional factors are consideredfor evaluation, such as socio-technicalaspects, safety and reliability and main-tenance support. Despite their poten-tially large impact on security, socio-technical aspects - such as user expecta-tions and goals, and how users use theirsystems - are often neglected [3].

Security requirements are outlinedduring application design. Importantsecurity assurance services will bedeveloped within the information assur-ance core system. These include: key

Information Assurance System

in the Arrowhead Project

by Sandor Plosz, Markus Tauber and Pal Varga

A common communication language is the key element for interoperation of systems. Defining such

a common language can be a formidable task, particularly in legacy and industrial systems. This

problem is addressed within the Arrowhead project, which focuses on the automation of industrial

systems with the goal of achieving energy efficiency and flexible use of energy.

Figure 1: Structure of the Arrowhead framework.

Figure 2: Arrowhead Information assurance framework.

distribution for authentication, creatingsecure tunnels between systems for safecommunication, certificate distributionsecurity monitoring and security proxyfor maintaining autonomy. Within theArrowhead project we will initially col-lect the security requirements of dif-ferent systems. Services will be devel-oped accordingly to meet these require-ments. Ways of integrating additionalfunctionalities into the system will alsobe analysed and described.

An important use case for achievingenergy efficiency within the inter-framework communication infrastruc-ture is provided by cost-of-securityanalysis. Robust security solutions areaccompanied by large processingdemands in terms of speed and energyefficiency. In the security assessmentmethodology we address this issue byexamining individual applicationrequirements and common securityassurance methods, which will enableus to suggest best methods for applica-tions in terms of energy efficiency.

Main research questionAssuring security in the M2M commu-nication domain requires much forwardplanning to make sure no interruptionwill be inflicted on a deployed serviceduring operations, especially if novel ITsystems are interoperating with tradi-tional/legacy M2M components.Security assessment needs to be revis-ited to get the best of both the IT andM2M worlds. This planning requires thesecurity assurance framework to be flex-ible, allowing security services to beupdated or replaced, and new services tobe installed on-the-fly. To achieve this,we need to detach security assurancefrom the applications themselves. Thisis a new approach which differs fromtraditional IT trends. We will addressthese issues as part of our work for theArrowhead framework. This approachwill enable application designers to con-centrate on the task at hand withouthaving to worry about interoperability,efficiency and security, which will beassured by well-tested systems throughthe Arrowhead framework.

Link:

http://www.arrowhead.eu

References:

[1] M N. Johnstone:, “ThreatModelling with Stride and UML”, inproc. of the 8th Australian InformationSecurity Management Conference,2010[2] P. Saripalli, B. Walters: “QUIRC: AQuantitative Impact and RiskAssessment Framework for CloudSecurity”, 2010 IEEE 3rd InternationalConference on Cloud Computing[3] P. Masci et al.: “TowardsAutomated Dependability Analysis ofDynamically Connected Systems”,International Symposium onAutonomous Decentralized Systems(ISADS) 2011

Please contact:

Sandor PloszAIT Austrian Institute of TechnologyTel: +3614633402E-mail: [email protected]



For engineers, a wide variety of infor-mation is not directly obtained throughmeasurement. Some parameters (e.g.constants of an electrical actuator, timedelays in communication) or internalvariables (torques applied to a robotarm, posture and localization of amobile, detection of impacts or angles inbiped walk, etc.) are unknown or are notmeasured. Similarly, more often thannot, signals from sensors are distortedand tainted by measurement noises. Tocontrol such processes, and to extractinformation conveyed by the signals,one often has to estimate parameters orvariables.

Estimation can concern parameters(identification), states (observation),derivatives (differentiation), inputs (leftinversion) or noisy data (filtering).Consequently, a vast number of results

have already been produced in this area,concerning either control or signal pro-cessing. However, unlike traditionalmethods, the majority of which pertainto asymptotic statistics, the particularityof Non-A is to develop algorithmswhich converge after a finite-time. Thisis summarized in the project’s name:“Non-Asymptotic estimation for onlinesystems”.

The Non-A project-team is a jointaction of Inria with Ecole Centrale deLille, University of Lille 1 and CNRS(LAGIS UMR 8219). It also involvesmembers from ENSEA Cergy,University of Reims and University ofLorraine. It is located at the Inriaresearch centre Lille North-Europe andinvolves 23 people (Researchers, PhDstudents, Post-Doc, Engineers) from 13countries. It was created in January

2011 in the continuity of a previousproject ALIEN (led by Michel Fliess).After having successfully undergone itsevaluation in 2013, Non-A is being sup-ported by Inria until the end of 2017.

Why do we develop finite-time algo-rithms? In most fields of application,the time response constraint is crucial.Using our algorithms, computations areperformed in real-time (i.e. as the appli-cation is running). Finite time conver-gence can benefit both the engineer whohas to fulfill design specifications priorto certification, and the controlresearcher looking for a mathematicalproof of their “separation principle”.

Application fields are plentiful and pastresults have concerned robotics, vehiclecontrol, aeronautics, hydroelectricpower plants, shape-memory or mag-

Non-Asymptotic Estimation for Online Systems:

Finite-Time Algorithms and Applications

by Jean-Pierre Richard and Wilfrid Perruquetti

Finite-time estimation is a way to perform real-time control and achieve specified time performance.

The Inria project-team Non-A is focusing on designing such “non-asymptotic” algorithms; combining

mathematics (algebra, homogeneity) with real-time applications (robotics, energy, environment, etc.).


netic actuators, power electronics,secured communications, financialengineering and image/video pro-cessing. Currently, the team is focusinglargely on the networked control sys-tems, including WSAN (WirelessSensors and Actuators Networks), butother applications range from circadianrhythms to high precision machining.Our ''model-free control'' also attractsvarious industrial contracts and hasgiven birth to AL.I.E.N. SAS, a com-pany created in Nancy.

Two complementary alternatives forfinite-time estimation are considered.The first develops an algebraic frame-work for identification initiated in 2003(Fliess, Sira-Ramirez, ESAIM COCV,9, 151-168). Recent results concern thefast estimation of time-delay systems

[1], of frequencies in noisy periodic sig-nals [2], of modes and states in switchedsystems [1], of impulsive systems, aswell as the differentiation of multi-variate signals. The other develops theconcept of homogeneous nonlinear sys-tems and observers: roughly speaking,homogeneity [3] allows for extendinglocal results, on a sphere, to global ones,in the whole space. Very recently wegeneralized this concept to time delaysystems. Homogeneity applies to con-trol, input-to-state stability and finite-time observers, and also to fixed-timestabilization [3], where the convergencetime is fixed independently of thesystem’s initial conditions (Figure 1).

Rather than being oriented to a specificdomain of application, Non-A is amethod-driven project (namely, algebra

and homogeneity for fast estimation andcontrol). However, one must not forgetthat applicability remains a guideline inall our research. In the long term we willbe concentrating our engineering efforton the Internet of Things, and more par-ticularly the self-deployment of WSAN.Various packages are being developedwithin the ROS environment, to assistwith robot cooperation: e.g., coopera-tive SLAM, path-planning and path-tracking and localization with a reducednumber of landmarks. In a more ad-hocway, some work also has an environ-mental focus: biology (rhythms ofbivalve molluscs for pollution detec-tion), meteorology (sunshine predictionfor solar energy management), fluidmechanics (limit flow control forenergy saving).

Non-A is a partner of European grantsFP7 HYCON2: “Highly-complex andnetworked control systems” andInterreg IVA 2 Seas SYSIASS:“Autonomous and IntelligentHealthcare System”.

References:

[1] L. Belkoura, J.P. Richard, M. Fliess:“Parameters estimation of systems withdelayed and structured entries”,Automatica, 45(5), 1117-1125, 2009;http://hal.inria.fr/inria-00343801 [2] R. Ushirobira et al: “Algebraicparameter estimation of a biasedsinusoidal waveform signal from noisydata” in proc. of SYSID'2012, 16thIFAC Symp. on System Identification,Brussels, 2012, http://hal.inria.fr/hal-00685067[3] E. Bernuau et al.: “Onhomogeneity and its application insliding mode control”, J. of theFranklin Institute, 2014,http://hal.inria.fr/hal-00942326

All the project’s publications areavailable at http://www.inria.fr/en/teams/non-a/(section)/publications

Links:

http://www.inria.fr/en/teams/non-a http://alien-sas.com/

Please contact:

Jean-Pierre Richard and WilfridPerruquetti École Centrale de Lille, FranceE-mail: [email protected],[email protected] 2: Frequency estimation for noisy signals, taken from [2] –

Blue = our algebraic method, Black & Red = Prony-like methods.

Figure 1: Increasing constraints on the convergence performance

http://www.inria.fr/en/teams/non-a/%28section%29/publications

An ever growing number of controlapplications utilize sophisticatedsensing devices that can extract multipleinformation from each measurement.For instance, visual sensors are in chargeof device localization, people detectionand the extraction of features of interestfor control purposes (e.g., the linesdelimiting a lane in an automateddriving system).

The price paid for the adoption of suchcomplex devices is a large and highlyvariable processing time. Indeed, in a“clean” environment, the amount of com-putation required to extract the relevantfeatures can be very low, while it sky-rockets in the presence of a large numberof artifacts or under dim illumination.

The need for sharingEqually important is a different require-ment of modern control systems: tomaximize hardware sharing between thedifferent control functions. In a moderncar, for instance, the complexity of thecommunication infrastructure is cur-rently measurable in kilometres ofcopper cables and hundreds of kilo-grams of weight. The same applies toElectronic Control Units (ECU) used toexecute computations, whose numbereasily exceeds 100.

Positioning and interconnecting of thesedevices has a tremendous impact on thecomplexity of system engineering.Hardware complexity has reached thecritical point where it becomes impera-tive for new or more advanced controlfunctions to exploit the existing compu-tation and communication infrastructure.

Limits of classic approachesWith strong fluctuations in the com-puting workload on one side, and theneed for intense hardware sharing onthe other, the designer is confronted

with problems that can hardly beaddressed by traditional designapproaches. The classic mandate is togrant to each control function hardwareresources commensurate to its worstcase demand (e.g., a dark and clutteredscene for visual sensors). This way, itwill be executed with regular timingand with constant delays, thus allowingcontrol designers to formulate andenforce guarantees on control perform-ance. The rigid application of this oldparadigm to the new context naturallyleads to a massive waste of resources(which lie unused for most of the time)and to a drastic reduction in hardwaresharing opportunities. On the contrary,if the control function receivesresources proportionate only to itsaverage requirements, there can poten-tially be large intervals of time whenthe system is not properly controlled:performance and even stability couldbe lost!

A stochastic approachThe University of Trento and theUniversity of Paris Sud, within theframework of the FP7 HYCON2 project(running from 2010 to 2014), hasstarted a research activity which aims atreconciling performance guarantees andhardware sharing. The key idea under-lying this research is that the limits ofclassic methods can be overcome by asuitable stochastic description of thecomputation requirements. Clearly thenew approach calls for new perform-ance metrics (e.g. Almost-Sure Stabilityand Second Moment Stability), whichare themselves stochastic in nature.Broadly speaking, system trajectoriesare allowed to have stochastic fluctua-tions, but eventually they will behaveproperly (except for a small and statisti-cally irrelevant set of them). The appli-cation of these notions to our contextneeded a formal mathematical model todescribe the stochastic evolution of the



Soft Real-Time Scheduling Approaches

in Embedded Control Systems

by Daniele Fontanelli, Luca Greco and Luigi Palopoli

Two trends can be recognized in the recent development of embedded control systems: the adoption

of sophisticated sensing systems (which require large and highly variable processing times) and the

proliferation of control applications that are deployed on the system. The combination of the two

trends has caused an obsolescence of hard real-time design techniques, which allocate computing

resources based on the worst case demand of the application. There exists an effective

replacement, however, that allows us to reconcile performance guarantees and efficiency in

resource management.

Figure 1: The actual robot adopted for the case study.

delays incurred in control computation.In [1,2] we met this requirement bycombining a soft real-time scheduler [3]with an appropriate programming disci-pline. The former guarantees that thedifferent computing tasks will havetimely access to the computationresources, while the latter forces inter-actions between computers and envi-ronment to take place on well definedinstants. Leveraging these ideas, it waspossible to establish a connectionbetween the stochastic control proper-ties and the fraction of computingresources to allocate.

A concrete case studyWe considered a mobile robot (Figure1) that was required to follow a blackline drawn on the ground. The vari-ability in the scene background deter-mines a similar variability in the com-putation time (Figure 2). In the worstcase, the computation time is beyond40ms; if the system is operated at 25frames per second this corresponds to aworst-case utilization beyond 100%.With the classic approach, the controlfunction would require the allocation ofthe entire CPU. Our methodology hasrevealed that 21% of CPU utilization isin fact sufficient to stabilize the system.

In Figure 3 we show the experimentalresults achieved with different band-width values. The top plot reports theintegral of the root mean square of thedeviation from the desired position,while the middle plot reports the timethe robot succeeds to remain on thetrack (the duration of the experiment is40s). The performance dramaticallyimproves when we allocate more thanthe minimal 21%, but there is noapparent advantage in exceeding 30%.In the bottom plot, we report the per-centage of task executions that com-plete within a deadline equal to theperiod and the percentage of executionscancelled because of time-out. In theclassic setting these figures would be100% and 0% respectively. In contrast,the plot reveals that the system canoperate with provable performance faraway from this regime with substantialresource savings.

ConclusionThe experiments here presented showthat the stochastic scheduling approachis a viable solution for real-time controlof systems, in which the desired controlperformance can be achieved even withlimited computing resources.

References:

[1] D. Fontanelli, L. Greco, L.Palopoli: “Soft RealTime Schedulingfor Embedded Control Systems”,Automatica, 49:2330-2338, July 2013.[2] D. Fontanelli, L. Palopoli, L.Greco: “Deterministic and StochasticQoS Provision for Real-Time ControlSystems”, in proc. or RTAS 20111,Chicago, IL, USA, p. 103-112 [3] R. Rajkumar et al.: “Resourcekernels: A resource-centric approach toreal-time and multimedia systems”, inproc. of the SPIE/ACM Conference onMultimedia Computing andNetworking, 1998.

Please contact:

Daniele Fontanelli, Luigi Palopoli,Università di Trento, ItalyE-mail: [email protected],[email protected]

Luca Greco, L2S Supélec, Paris,FranceE-mail: [email protected]


Figure 3: Experimental results achieved with different bandwidth values: root mean square of

the deviation from the desired position (top); time the robot succeeds to remain on the track

(middle); percentage of task executions that complete within a deadline or that are cancelled

(bottom).

Figure 2: Probability mass function of the computation times observed during the experiments

Cyber-physical systems are complexsystems with intertwined computation,communication and physical elements,often including human interactions inthe loop. The design of such systemsgoes well beyond traditional embeddedsystem controllers and exhibits charac-teristics of multi-agent systems. This isquite challenging for the engineeringrequirements process as it must be ableto deal with multiple agents either under(co-)design or located in the environ-ment (including physical processes,devices and human interactions). It alsorequires software design to be mixedwith physical system design, and thesetwo design processes rely on differentsets of modelling languages (e.g. logicfor computational elements and differ-ential calculus for physical elements).Moreover, CPS are increasingly manip-ulating critical infrastructure such as thepower grid, transportation systems,medical devices, security systems,which means they must satisfy a wholeset of challenging non-functionalrequirements about safety, security, pri-vacy, usability, energy-efficiency andadaptability.

In the scope of the SYLIS CORNETproject (involving the CETIC andFraunhofer IESE Research Centres), itis important to help companies to dealwith the design of such complex sys-tems, especially from the requirementsengineering phase (RE). From a REpoint of view, the most adapted methodsable to deal with such complexity aregoal-oriented methods, such as KAOS,which is able to capture and reasonabout multiple agents both within theenvironment and the system underdesign of hardware/software/humannatures. KAOS also enables capturingof global system properties that areachieved as a result of the global collab-oration of all CPS elements.Furthermore, KAOS enables the refine-ment of high level system goals into

specific requirements or expectationsplaced on each kind of agent [1].

Based on those premises, in SYLIS, werevisited a set of key requirementsfound in a collection of CPS systems(such as [2]) with the aim of reusingthem based on the successful techniqueof pattern (e.g. OO design patterns,security patterns, cloud patterns). Thepurpose of these patterns is to capture

specific knowledge related to thedesign of CPS systems, such as:

• Accuracy: This is a key property ofCPS systems and it can only beachieved through the proper collabo-ration of many components. Typical-ly, the goal of feedback loops is tomaintain a specific controlled vari-able at some target value level. Onthe dynamic side there are a numberof typical behaviours to control sys-tems that are generally managed bythe control designer. These controlcharacteristics should also be madevisible to the requirements analyst tounveil possible impact on system orsub-system goals: for example: howfast should a target value be reached,

what is the permitted overshot(occurring on step transition), whatamplitude of oscillation is acceptable,etc.

• Human interaction: different patternsare possible: humans can be in a par-tial control loop (which should beadapted to the individual’s reactiontime); a human agent responsible fora specific requirement can be moni-

tored by the system and their actionsoverridden by the system if thehuman fails at the duty. On the inter-face side, different modalities can beimagined with different kinds ofergonomics and cognitive loads.

• Cyber-security: CPS are composed oftightly interconnected elementswhich may be connected to the Inter-net either permanently or periodical-ly. Consequently, exposing these ele-ments to cyber threats with potential-ly high impact (e.g. SCADA systemscontrolling power grids, transporta-tion system networks, connectedcars, etc.). Reasoning based on anti-goals patterns on security threats isespecially relevant to capture knowl-



Requirements Engineering Patterns

for Cyber-Physical Systems

by Christophe Ponsard, Jean-Christophe Deprez and Robert Darimont

Engineering Cyber-Physical Systems (CPS) is challenging in many respects, including at the

Requirements Engineering (RE) stage. In addition to generic RE techniques that already

encompass the system dimension of CPS, such systems can benefit from domain knowledge

related to specific requirements, such as accuracy, dependability and security. This knowledge

can be structured as a reusable requirements pattern library.

Figure 1: Structure of the CPS pattern library and instantiation to an adaptive cruise control

system.

edge about how malicious agents canpotentially attack a CPS, e.g. physicalCPS element attack, denial of service,wrong command to controller. Anumber of security patterns can beenriched for the cyber-security con-text such as a secure controller or asecure communication channel.

The Objectiver tool is currently used tomodel our CPS patterns. The tool sup-ports the full KAOS methodology andincludes support for pattern manage-ment and instantiation. Figure 1 illus-trates the structure of our pattern librarymodel (package view on the left) as wellas a simple instantiation to an adaptivecruise control system including mul-

tiple agents such as a car under control,a driver, and other cars in the environ-ment (goal diagram on the right). Weplan to deploy it in a more specifictooling, already successfully applied tothe smartcard domain [3], and furtherenrich it. We also plan to release ourpattern catalogue in a tool independentcollaborative knowledge oriented web-site.

Links:

http://www.objectiver.comhttps://www.cetic.be/SYLIS-1934http://cloudpatterns.org

References:

[1] A. van Lamsweerde:

“Requirements Engineering - FromSystem Goals to UML Models toSoftware Specifications”, Wiley, 2009.[2] M. Heimdahl, et al.: “Modeling andRequirements on the Physical Side ofCyber-Physical Systems”, SecondInternational Workshop on the TwinPeaks of Requirements andArchitecture, San Francisco, 2013[3] N. Devos et al.: “Efficient Reuse ofDomain-Specific Test Knowledge : AnIndustrial Case in the Smart CardDomain”, in proc. of 34th ICSE,Zurich, June, 2012

Please contact:

Christophe Ponsard, CETIC, BelgiumE-mail: [email protected]


Renewable energy can play a key role inproducing local, clean and inexhaustibleenergy to supply the world’s increasingdemand for electricity. Photovoltaicconversion of solar energy is a prom-ising way to meet the growing demandfor energy, and is the best fit in severalsituations. However, its intermittentnature remains a real disability that cancreate voltage instability for large scalegrids. In order to offer an answer to thenew constraints of connection to the net-work (Grid-Codes) it is possible to con-sider a storage system; the whole systemwill be able to inject the electric powergenerated by photovoltaic panels to thegrid in a controlled and efficient way. Asa consequence, a strategy for managingenergy in relation to the load and the bat-tery constraints will be needed.

The approach is based on a “Plug andPlay” philosophy: the global control willbe carried out at local level by each actu-ator, according to the distributed controlparadigm. The control objective is todevelop a distributed method for stabi-

lizing each part of the whole system,while performing power managementin real time to satisfy the productionobjectives and assuring the stability ofthe interconnection to the main grid.Furthermore, this system may bringsupport (voltage and frequency) to themain grid by additional controlschemes.

The whole control objective is then splitin several tasks; the first is to increasethe efficiency of the photovoltaic array,which should work in its maximumpower point for delivering the max-imum amount of energy. MaximumPower Point Tracking (MPPT) algo-rithms are used to compute the desiredvoltage that assures this maximumpower production. A drawback is theuncertainty of doing this without irradi-ance and temperature sensors. An adap-tive control scheme that is capable ofachieving maximum power pointtracking for changing environmentalconditions can be used instead [1]. Thissystem estimates parameters that

depend on irradiance and temperature,increasing the robustness of the systemand eliminating the need for a sensor.

A second step is to stabilize the DC/DCboost converter that connected the solararray to the DC network, calculating theoptimal value of the duty cycle [2].Lyapunov theory is used in this task,taking into account the parameters' esti-mator dynamics.

The focus then moves to the storagesystem and its connection to the DC net-work. Lead-acid batteries are com-monly chosen as a storage system, and aDC/DC bidirectional converter is nec-essary to enable the two modes of func-tioning (charge and discharge) [2]. Theregulation of the battery current andvoltage consists of a cascade control;again, Lyapunov theory is used for pro-viding stability. An algorithm that helpsto manage power by defining prioritiesin relation to the load and the con-straints of battery operation is alsorequired.

Management of the Interconnection

of Intermittent Photovoltaic Systems

through a DC Link and Storage

by Alessio Iovine, Sabah Benamane Siad, Abdelkrim Benchaib and Gilney Damm

New connection constraints for the power network require more flexible and reliable systems, with

robust solutions to cope with uncertainties and intermittence from renewable energy sources

(renewables), such as photovoltaic arrays. The interconnection of such renewables with storage systems

through DC links can fulfill these requirements. A “Plug and Play” approach based on the “System of

Systems” philosophy using distributed and adaptive control methodologies is being developed.

With this structure, the DC grid is ableto provide a continuous supply of goodquality energy. Finally, the DC networkmust be interconnected with the ACgrid, and must be controlled in such away that it offers support (ancillaryservices) to the grid.

The final management system can beconfigurable and adaptable as needed.The battery is assimilated as a reservoirwhich acts as a buffer between the flowrequested by the network and the flowsupplied by the production sources, andits voltage is controlled by the DC/DCcurrent converter. The three converterspresent in this system must, in a decen-tralized way, keep the stability of theDC network interconnecting all parts.

The whole system provides protectionagainst faults and suppresses interfer-ence, and has a positive impact on thebehaviour of the complete electricalsystem.

Link: http://www.hycon2.eu/

References:

[1] F. Jaramillo-Lopez, G. Damm, G.Kenne, F. Lamnabhi-Lagarrigue:“Adaptive control scheme formaximum power point tracking of a

photovoltaic system connected to thegrid”, 2013 European ControlConference (ECC), Zürich,Switzerland.[2] S. Benamane Siad: “Gestion desflux énergétique dans un systèmephotovoltaïque avec stockage connecteau réseau”, Master thesis report,Alstom-Cnam, July 2012.

Please contact:

Alessio IovineUniversity of L’Aquila, ItalyE-mail: [email protected]

Sabah Benamane SiadBouygues Energies et Services, France E-mail: [email protected]

Abdelkrim Benchaib ALSTOM GRID, R&D Department,FranceE-mail:[email protected]

Gilney Damm Université d'Evry Val d'Essonne, FranceE-mail: [email protected]



Figure 1: Photovoltaic system with storage.

Multi-Terminal High voltage Direct Current Networks

for Renewable Energy Sources

by Miguel Jiménez Carrizosa, Yijing Chen, Gilney Damm, Abdelkrim Benchaib and Françoise Lamnabhi-Lagarrigue

The control of Multi-Terminal High Voltage Direct Current (MT-HVDC) networks is still an open problem.

Communication within this wide-span network is a very delicate matter: the time delay and possible loss of

information must be taken into account. We are aiming to develop and control a hierarchical stable structure

that manages such a network.

Power systems’ networks are among thelargest and most complex physical man-made systems. They connect hundreds ofmillions of producers and consumers,cover continents and exhibit very com-plicated behaviours. Many poorly-under-stood phenomena result from the interac-tions between such a large number ofdevices and the large spatial dimension,and as a consequence their managementand stabilization may be very chal-lenging. At the same time, the depend-ence of modern societies on electricity isgrowing, with our reliance on pervasive

computers, embedded systems and cel-lular devices. This dependence will mostlikely continue to grow if a lot of electricvehicles become a reality. For these rea-sons the impact of disturbances andblackouts has become astronomic.

Major changes are putting the powergrid under great stress; in particular thelarge scale introduction of renewableenergy sources is a major cause. Thegoal of reducing carbon dioxide emis-sions and creating a greener world willlead to an increased use of renewable

energy sources (RES) in the form ofwind farms or solar plants. Two distinc-tive features of these energy sourcespresent an important challenge: mostRES are dispersed over a very widegeographical area, and most RES areintermittent. Since further developmentof the classical Alternative Current(AC) Grid will not be possible owing toeconomic (in the offshore case) andenvironmental issues, the only foresee-able solution becomes the use of DirectCurrent (DC) links, and most probably anew DC off-shore Grid interconnecting


AC grids or other DC grids [1], con-structing a new SuperGrid. Integratingthese new technologies into the existingAC grid and introducing new tools forhandling specific control problemsrelated to the distributed control of largeoffshore wind farms interconnected by aDC network, as well as the connectionof this DC network to the AC grid is cur-rently under investigation.

Recently, multi-terminal HVDC (MT-HVDC) networks which consist of morethan two converter stations have drawnmore and more attentions. The MT-HVDC network offers a larger transmis-sion capacity than the AC network andprovides a more flexible, efficient trans-mission method. The main applicationsof MT-HVDC networks include powerexchange among multi-points, connec-tion between asynchronous networks,and integration of scattered power plantslike offshore renewable energy sources.The control of a Multi-Terminal HighVoltage Direct Current (MT-HVDC)network, as shown in Figure 1, is still anopen problem. We are developing a hier-archical structure to manage such a net-work. The wide-span makes communi-cation a very delicate matter. The timedelay and possible loss of informationmust be taken into account when man-aging the network. It is therefore neces-sary to rely on lower level local onlycontrollers [2], which will stabilize thesystem against changes and disturbancesin the network.

Local controllerThe lower level focuses on designing alocal controller on each node in an MT-HVDC system, without using remoteinformation. Its first objective is tomake the converter accurately track itsreference values which are provided bya higher level controller. In addition, incase of disturbances such as powerimbalance, the system must be alwayskept stable and quickly converge to anew steady state condition. Finally, in asecond step, the local controller shouldbe driven by the higher level controller,which maintains sustainable operatingconditions.

Most current research is based onVoltage Source Converters (VSC), andin particular with MMC (ModularMultilevel Converters) technology. Thebehaviour of a VSC terminal can usu-ally be characterized by its DC and ACsubsystems, which constitute its state

vector (in particular the AC currents andDC voltage). Numerous control strate-gies for VSC-HVDC systems have beendeveloped recently. Most, however (forexample [3]), are based on intuitiveassumptions without rigorous mathe-matical demonstrations.

Our group is investigating several con-trol approaches to improve system per-formance via different control theoriesand rigorous model-based analysis.

There are three on-going approaches:1. Nonlinear control based on feedback

linearization: although some linear sys-tem properties can be applied to regu-late the behaviours of the system, themain drawback is that the system canonly operate in unidirectional mode.

2. Nonlinear control based on static anddynamic feedback linearization: thisnovel controller has been developedbased on a static and on a dynamic feed-back linearization structure in order tooperate in bidirectional mode. Forexample, when the terminal absorbs thepower from the DC grid it uses a staticpart; otherwise it uses the dynamic part.However, this method involves a switchsystem according to the power direc-tion, which could present undesirablebehaviours such as chattering and theappearance of large peaking values.

3. Globally stable passive control [1]:the main advantage of this controlleris that global stability is guaranteed.In addition, the VSC terminal canoperate more smoothly than the otherapproaches.

Primary (Droop) controllerDroop control reacts to a power imbal-ance, and can be explained as follows.When there is a power variation in oneor several nodes, the other nodes willadjust the amount of generated/con-sumed power via droop control, byadjusting their voltages, see Figures 2(a)and 2(b). This control is implemented asa set of local proportional controllerswith gains called the droop gain. Theselocal gains are represented by the slopeshown in Figures 2(a) and 2(b). Thisvalue, which depends on several vari-ables, such as the size of each node andits available (primary) energy reserve,indicates how much power each gener-ator provides when a variation occurs, infunction of its capabilities.

Secondary controllerThe main objectives of the secondarycontrol are: to follow the tertiary levelreferences; and to make a periodic powerflow in order to guarantee the properbehavior of the system. The secondarycontrol is also responsible for predictingand avoiding congestion in the lines.

When a disturbance occurs in the grid, itis the job of the secondary control torestore the equilibrium, taking into con-sideration the current energy reserves.To achieve this, communicationbetween nodes is necessary. In thisrespect, the secondary control differsfrom the primary control, in which nocommunication occurs. The secondarycontrol is a critical element in the proper

Figure 1: An MT-HVDC system (left) and an offshore converter station.

Figure 2(a) (left) and 2(b): Droop technique for primary control strategy.



functioning of the system because ittakes into consideration disturbances aswell as load forecast. It has informationon the current and future short-term stateof the system, and it creates the linkbetween the physical system, in the time-frame of milliseconds, and the economicforecast that is in the order of hours. Itsrole is then to calculate voltage values tooptimize the power flow to minimizetransmission losses, for example, subjectto all the constraints. These voltagevalues are then transmitted as referencesfor the primary level.

To develop the secondary controller wehave used Model Predictive Control(MPC), because it can provide an optimalsolution taking into account these con-straints whilst also considering forecasts,such as weather, load, or even prices.

In summary, the lower level controllersstabilize the system in the face ofchanges within the system as well aslarge disturbances, while higher levelintercommunicating controllers steer theoverall system to reliable and optimaloperating conditions.

Link:

http://www.eeci-institute.eu/WINPOWER

References:

[1] M. Jiménez Carrizosa, et al.:“Bilinear and nonlinear controlalgorithms for a DC/DC converter formulti-terminal HVDC networks”, IFACWorld Congress 2014[2] Y. Chen, et al.: “A globally stablepassive controller for a VSC terminalin a multi-terminal HVDC grid”, inproc. of ACC’14, Portland, USA

[3] J. L. Thomas , S. Poullain, A.Benchaib: “Analysis of a robust DC-bus voltage control system for a VSCtransmission scheme”, in proc. of the7th Int. Conf. AC-DC PowerTransmiss., 2001.

Please contact:

Gilney DammLaboratory IBISC, FranceE-mail: [email protected]

Abdelkrim BenchaibALSTOM GRID, FRANCEE-mail: [email protected]

Françoise Lamnabhi-LagarrigueLSS-SUPELEC, FranceE-mail: franç[email protected]

Smart Water Management: Key Issues and Promises

from a Distributed Control and Observation Perspective

by Christopher Edwards, Prathyush Menon and Dragan Savic

The capability of modern utility distribution networks to exchange large amounts of data offers huge advantages

in terms of efficiency of operation and optimization. On the other hand, the inherent communication network

component exposes the overall system to the possibility of malicious cyber-attacks. The resilient operation of

such distribution networks presents challenges to control theorists and practitioners alike.

New technologies are revolutionizing tra-ditional water distribution systems.Currently, “smart methods” based onnovel ICT technologies are beingemployed to deliver integrated supply-demand side management for improvedefficiency. Although perhaps less wellpublicized than similar developments inthe area of Smart Grids in power distribu-tion networks, the aim of incorporatingthese new and smart methodologies intowater distribution networks is to con-tribute to the delivery of a sustainable,low-carbon society, thus helping achieveprogress towards the European 2020 tar-gets on Climate and Energy. Figure 1 pro-vides an example and an overview of atypical smart water network.

The primary source of information isreal-time and near-real-timemeter/sensor data, reporting pressures,flows and water levels at selected pointsthroughout the water supply/distributionnetwork This is based principally oninstantaneous flow, pressure and/or levelmonitoring at major physical structures

(i.e., intakes, treatment works, servicereservoirs, pump stations, etc) deliveredthrough a "supervisory control and dataacquisition" system (SCADA). Thisinformation is augmented by flow andpressure measurements from meters atthe entry to District Metered Areas(DMAs) along with selected pressuremonitoring points elsewhere within theDMA, with data typically transmittedevery 30-60 minutes, principally over acellular communication network. Thusthe intelligent water distribution net-work above comprises computing/mon-itoring facilities, valves/pumps (actua-tors), sensors (measurements), a phys-ical commodity flow (water), reservoirs(source), consumers (sinks) and infor-mation flow (associated with actuatorcommands and sensors). See forexample [1]. Such an infrastructure isoften referred to as a Cyber-Physical-System (CPS) [2].

Modelling challengesModels of a cyber-physical infrastruc-ture can be developed based on the

underlying physics of the problem: typi-cally there are sources and sinks, andmass/flow/energy balance constraints.At a local level, components and sub-systems can be modelled as individuallumped systems to be represented asgeneric, continuous/discrete time ordi-nary differential equations. The model-ling of the interconnections betweenthese local or node level elements, mustcapture both the exchange of informa-tion as well as the underlying topologyof the physical and commodity flowrealization, so that graph theoreticmethods [3] can be exploited. Whilstsuch large-scale systems offer greatpotential and flexibility in terms of effi-cient operation, it is extremely impor-tant to have an effective monitoringmechanism in place so thatfailures/threats/risks can be swiftlyidentified, and suitable decisions can bemade to contain and mitigate theireffect. For example, timely detection ofpipe burst events provides opportunitiesfor water companies not only to savewater but also money and energy, and


reduce their carbon footprint, andimprove their operational efficiency andcustomer service.

Control ChallengesFor efficient functioning of such infra-structure, in addition to optimizingnormal fault-free operation, associatedsecurity aspects must also be taken intoaccount. Hence the physical layer’scontrol must be resilient and robusttowards cyber-attacks and other mali-cious behaviour. A highly complex dis-tribution network comprising manyinteracting, heterogeneous distributedsystems, each under autonomous con-trol and reacting to the environment andto cyber and/or physical signals of other

systems, requires coordination/control– often in a decentralized or distributedmanner - to accomplish a global objec-tive/performance.

Monitoring challengesOne approach to developing monitoringschemes to detect failures/threats is toattempt to extend existing observer-based fault detection and reconstructionideas to the CPS. In contrast to conven-tional observer problems, including acopy of the system being monitoredinternally requires a plethora of actua-tion and measurement signals fromthroughout the entire network. This is atbest cumbersome and may not even bepractical. Different architectures for the

observer can be considered dependingon which signals are realistically avail-able. These could be classified as cen-tralized (where global information isrequired), decentralized (only localinformation is required) and distributed(which involves an exchange of infor-mation amongst the observers them-selves). Arguably, a scalable and dis-tributed monitoring solution would bebest suited to this problem. This is bene-ficial in terms of the sensor resourcesrequired, and hence the overall energyconsumption.

Once a monitoring scheme has identi-fied failures or cyber-attacks within thenetwork, it is imperative to take perti-nent timely decisions to isolate which ofthe sub-systems/elements is the rootcause. Once isolated within the net-work, further decisions need to be madeso that the operation of the remaining“healthy” part of the infrastructureexperiences minimal impact and theeffects of the failures/threat contained.However, since cyber as well as phys-ical interconnections are present, anattack/fault on one sub-system mayhave an impact on the performance ofother sub-systems and thereby globallywithin the network. Owing to possibleredundancy within the network it maybe possible to recover acceptableoverall performance through reconfigu-ration and thereby achieving self-healing and providing resilience.

References:

[1] D. A. Savić, J. K. Banyard (Eds.):“Water Distribution Systems”, ThomasTelford Limited, 2011[2] P. Derler, E. A. Lee, A.Sangiovanni-Vincentelli: “ModelingCyber-Physical Systems”, in proc. ofthe IEEE (special issue on CPS),100(1):13-28, 2012[3] M. Mesbahi, M. Egerstedt: “GraphTheoretic Methods in Multi-agentNetworks”, Princeton Series inApplied Mathematics, 2010.

Please contact:

Dragan Savic, Christopher Edwards,Prathyush MenonUniversity of Exeter, United KingdomE-mail: [email protected],[email protected],[email protected]

Figure 2: A simple example of a monitoring architecture.

Figure 3: Signal corruption in the network and a reconstructed corruption signal.

Figure1: Description of the architecture.

Within the FP7 project SEAM4US, asystem for intelligent energy manage-ment of public underground spaces hasbeen developed, integrating cyber-phys-ical systems to monitor the physicalstate of the station, passenger flow andenergy consumption of all subsystems,as well as to control lights, fans andescalators. The system prototype hasbeen deployed in the Passeig de Gràciametro station in Barcelona. During itsdevelopment, we have focused onbuilding upon existing infrastructurethat was not designed for energy effi-ciency while adding just as much addi-tional technology as is necessary.

The SEAM4US system employs pas-senger density models and thermalmodels, integrating sensors and controlalgorithms in a model predictive controlarchitecture that grants the optimal oper-ation of the station plants under differentoccupancy and thermal conditions [1].In this architecture, environmentalparameters of the models are fed withsensor data, allowing the system to pre-dict the environmental state dependingon the chosen control policy. The resultsof this prediction determine the actualcontrol output, while the effects of thiscontrol are also monitored to contributeto the calibration and learning process ofthe models.

A large wireless sensor network hasbeen developed and deployed in the sta-tion, providing the thermal model withthe current thermal state of the under-ground space. It has been designed tominimize energy consumption andmaintenance work, specifically opti-mizing the operation of wireless sensornodes in order to reduce battery replace-ment intervals, and providing self-diag-nostics and self-configuration capabili-ties to ensure correct operation without

human intervention. The positions ofwireless sensor nodes and the frequencyof sensor readings have been defined toallow the system to adapt to changes inenergy consumption, user and environ-mental models. Existing CCTV cam-eras are enhanced with image pro-cessing to detect current and predictfuture levels of passenger density.Privacy of passengers is protected byperforming all processing locally, fil-tering the image data to avoid recognis-ability of individuals, and transmittingonly density levels in terms of integernumbers. In addition, an extensive net-work of smart meters has been installed

to monitor energy consumption duringthe operation of the system and feedingit back to the model.

Control components have been devel-oped to dynamically control the stationlighting system, passenger transport,and ventilation. Based on a number ofcomplex station models, combininginput from the monitoring componentswith predictions about the state of the

underground space, fan speed isadjusted proactively to optimize bothair quality and energy consumption.Installation of a dedicated PLC and con-trol logic allow for stepless control ofthe fan frequency while leaving theoperation of this safety-critical systemunimpeded by ensuring that the existingSCADA system, accessible by opera-tors in the station or the OperationsControl Center (OCC), always has pri-ority and automatically takes over con-trol if the SEAM4US system fails. Bychanging the escalator speed accordingto the predicted passenger density level,setting it to a slightly lower level for

most of the time, escalator energy con-sumption can be reduced. Full speed isonly required during peak times toensure maximum capacity for pas-senger transport. Additional presencesensors ensure the safety of passengers,allowing the escalator to stop when nopassengers are using it and to start whena person is approaching. As a compli-mentary approach, but integrated withinthe overall framework, a strategy for



SEAM4US: Intelligent Energy Management

for Public Underground Spaces through

Cyber-Physical Systems

by Jonathan Simon, Marc Jentsch and Markus Eisenhauer

Public transport operators suffer from the high energy consumption of their underground stations.

Lighting, ventilation and vertical transport are crucial systems for the safety and comfort of

passengers, but they represent the largest part of the non-traction energy required in metros.

Intelligent control of these subsystems, however, can significantly reduce their energy consumption

without impacting passenger comfort or safety or requiring expensive refurbishment of existing

equipment.

Figure 1: The SEAM4US approach

involving passengers in the energy-saving effort has also been developedby Fraunhofer FIT. By the use of asmartphone application, passengers arerewarded for taking the stairs instead ofthe escalators. This allows theSEAM4US system to run the escalatorsin energy-saving mode for longerperiods of time. Dimmable LED lightshave been deployed in the station, thebrightness of which is controlled reac-tively according to current occupancy.While passenger safety requires morelight when fewer people are present,luminosity can be reduced during peaktimes, however this level is obviouslydetermined by legal and passenger com-fort constraints. The system supervisioncomponent maximizes the reliability ofthe system and monitors the level ofconfidence of the system’s predictions.

System development was coordinatedby Fraunhofer FIT and is based on theLinkSmart middleware for networkingheterogeneous devices and subsystems[2]. By means of its publish-subscribemechanism, it enables efficient inter-

facing of architecturally independentcomponents. In order to provide bettersupport for energy efficiency applica-tions of public transport spaces, it wasenhanced with specific services for spa-tial modelling and handling of largeamounts of event data. New componentshave been developed to integrate theexisting station hardware as well as thenewly installed sensors and actuators.

The result of this project is a completeprototypical solution for intelligentenergy management of public under-ground spaces that integrates bothexisting and new infrastructure. Theconsortium consists of nine partners:• Cofely Italia (Italy), energy service

company – coordinator• Marche Polytechnic University

(Italy) – scientific coordinator• Polytechnic University of Catalonia

(Spain)• Fraunhofer FIT (Germany), research

institute – system development coor-dinator

• VTT (Finland), research centre• University of Kassel (Germany)

• Almende (Netherlands), SME• CNet Svenska (Sweden), SME• TMB (Spain), metro operator.

Links:

http://www.fit.fraunhofer.de/en/fb/ucc/projects/seam4us.htmlhttp://www.seam4us.euhttp://linksmart.eu

References:

[1] R. Ansuini, et al.: “Models for TheReal-time Control Of SubwayStations”, in proc. of BS2013[2] M. Eisenhauer, P. Rosengren, andP. Antolin: “A Development Platformfor Integrating Wireless Devices andSensors into Ambient IntelligenceSystems”, in SECON 2009 workshops

Please contact:

Jonathan Simon, Marc Jentsch, MarkusEisenhauerFraunhofer FIT, GermanyE-mail:[email protected],[email protected],[email protected]


A Comprehensive Port Operations

Management System

by Christophe Joubert, Miguel Montesinos and Jorge Sanz

Galileo, the global navigation satellite system funded by the EU, will soon provide highly accurate and

precise position measurements on Europe's roads. But the primary mode of international trade, the

maritime industry - responsible for nearly 90 percent of world trade - still relies on outdated

technology with limited precision capacity whilst being relatively expensive and inefficient, namely:

Electronic Chart Display Information Systems (ECDIS) or paper charts in conjunction with GPS receiver

and laser-based Berthing Aid Systems (BAS). Improvements in port traffic management and

operational efficiency, as well as reductions in operating expenses, CO2

emissions and the

environmental impact of shipping can all be achieved by providing the necessary centimetre

positioning/speed accuracy based on WiMAX and PDGNSS technologies. We have developed a set of

built in devices and solutions on top of existing maritime embedded devices to form a safer integrated

cyber-physical system for maritime transport.

The aim of the European projectDOCKINGASSIST (FP7 - 286828,November 2011-October 2013) was todevelop a novel wireless network basedon IEEE 802.16-2009 [1], WiMAX, inorder to create a centralized, cost-effec-tive, real-time, accurate vessel locationand monitoring system for harboursusing a Precise Differential GlobalNavigation Satellite System (PDGNSS)[2] with increased accuracy to less than10 cm, based on Real Time Kinematic(RTK) positioning (see Figure 1).

Within this project, we have beenworking on the continuous monitoringof position, speed and direction of ves-sels with high accuracy throughout allphases of the approach, allowing shipsto be precisely located in the harbourzone, taking into account the dimen-sions of the ship. The system allows forenhancements to the trajectory throughearly adjustments from the rate of turnwhen entering in the port if required, aswell as assisting in the approachtowards the berth. The harbour is

equipped with a differential GNSS basestation and wireless technologyoffering a range of several kilometres,in order to send the DGPS correctionsdata to the vessels.

We specified the architecture and con-tributed to the development of theDockingAssist base station softwaresystem. The system allows a port tooptimize the operational maritimeactivities related to the vessel flowwithin the service area of the port, inte-

http://www.fit.fraunhofer.de/en/fb/ucc/projects/seam4us.html

grating all stakeholders and all the rele-vant information systems. In particular,it integrates information available at theport, such as weather data and specificfeatures with vessel positions providedby AIS systems and accurate vesselpositions provided by theDockingAssist device. This complexsystem also includes a real time analysisengine (Decision Support SystemModule) that can be configured todetect anomalous events such as unau-thorized vessel positions, early detec-tion of vessel collision and challengingweather conditions.

Working in parallel with the DockingAssist project, the Prodevelop geospa-tial research team extended the DSSmodule to a real time analysis enginebased on spatial information (Geo-Decision Support System Module) todetect geospatial events. This tech-nology has been included in a port man-agement GIS module that automatesrelevant operational events, such as

anchoring, berthing/unberthing, pilotand tug operations, bunkering, entryand exit of areas such as the port servicearea, waypoints or inner harbour, portexit with pending requested anchoring,etc. Detected events are published inreal-time to a web GeographicalInformation System (GIS) application[3], available to all connected clients, asshown in Figure 2.

The event display includes an event list,warning icons, map warnings, locationof events on the map, integration withoperations register, and query of events.

In order to process massive data streamscoming from port and location sensors,in real time, the architecture makes useof the eXtreme Transaction ProcessingPlatform (XTPP), message distributionmiddleware implementing DataDistribution Service (DDS) interna-tional OMG standard, Non-SQL reposi-tory, trajectory simplification, pushnotifications, eXtensible Messaging

Presence Protocol (XMPP) IETF stan-dard RFC 6120 and communicationover WebSockets / Bidirectional-streams Over Synchronous HTTP(BOSH).

The results to date are very encour-aging: “Posidonia Operations” hasbeen built upon the experience acquiredin Docking Assist to provide a solutionfor managing the sea-side operations ofvessels. The system has built in andcomprehensive integration capabilitywith security management systems,building management systems,SCADA, AIS/VTS systems, gate oper-ating systems, terminal operating sys-tems, port community and data inter-change packages.

In our research on the Docking Assistproject we collaborated with severalSMEs and research centres, namelyATEKNEA and ASCAMM (Spain),VTT (Finland), Port of Cork (Ireland),Marimatech (Denmark), NetTechnologies (Greece) and RuncomTechnologies (Israel).

This research is also part of the strategicgoals and recommendations for the EUMaritime Transport Policy until 2018(IP/09/84), namely to ensure the longterm performance of the European mar-itime transport system as a whole. Ourwork is partially supported by theSpanish MEC INNCORPORA-PTQ2011 program.

Links:

http://www.dockingassist.euhttp://www.prodevelop.es

References:

[1] IEEE 802.16 Working Group:“IEEE Standard for Local andMetropolitan Area Networks, Part 16:Air Interface for Fixed and MobileBroadband Wireless Access Systems”,IEEE Standard 802.16-2009, May 2009[2] L. Jiang et al: “DockingAssist: Anovel vessel navigation system designbased on WiMAX and DGNSS”, IEEEWPNC 2013, 1-6[3] C. Joubert et al.: “Real-TimeVisualization of MV/LV EnergyAlarms on GIS Web Applications”,ERCIM News 2013(92).

Please contact:

Christophe JoubertProdevelop, SpainE-mail: [email protected]



Figure 1: WiMAX-based PDGNSS location system improving port traffic management.

Figure 2: Event display to operators in the Posidonia Operations port system.


Air Traffic Management (ATM) is animportant application domain exhibitingmany features of CPS such as hetero-geneity, complexity, and human opera-tors in-the-loop.

Several disciplines are being used toassist ATM experts in the design of robustprocedures; among these, of particularrelevance is Resilience Engineering [3].Resilience indicates that operations andorganizations are capable of resisting avariety of demands and capable of recov-ering from variations, degradations, dis-ruptions, and any condition affecting thestability of the operation or organization.In other words, Resilience Engineeringaddresses the design of joint cognitivesystems, both in nominal and non-nom-inal conditions. However, because of thecomplexity of ATM joint cognitive sys-tems, Resilience Engineering as appliedto ATM is at an early stage of develop-ment. Formal mathematical models andanalysis methods offer a key complemen-tary approach that is needed to renderResilience Engineering effectively appli-cable to ATM systems. MakingResilience Engineering applicable toATM was the main goal of the SESARWP-E Research Project “MathematicalApproach towards ResilienceEngineering in ATM (MAREA)”.

Among the topics included in MAREA,of fundamental importance in theanalysis of novel ATM procedures wasthe study of the impact of non-nominaloperating modes on the safety of theoverall system. To tackle this importantproblem we proposed in [2] a formalapproach that is based on the use of anumber of relevant hybrid systems’techniques, including compositionalhybrid systems’ modelling and hybridobservers’ synthesis.

While aircraft dynamics is commonlydescribed by differential equations,

pilots’ and air traffic controllers’ behav-iours are well modelled by finite statemachines, whose discrete states andtransitions mimic the procedure theagents are requested to follow. Hybridsystems’ formalism, featuring both dis-crete and continuous dynamics, is char-acterized by an expressive power thatwe proved to be general enough to ade-quately describe ATM systems, both innominal and non-nominal conditions.While nominal modes of operation are

dictated by the procedure the agents arerequested to follow, non-nominalmodes may originate from severalcauses, including malfunction or dis-ruption of technical devices or unpre-dictable behaviour of human operatorsin-the-loop. To study the impact of non-nominal operating modes on the safetyof the ATM procedures we used thenotion of critical observability [1]. Thisnotion corresponds to the possibility ofdetecting whether the current discretestate of a hybrid system is in a criticalset, representing unsafe, un-allowed or

non–nominal situations. When a hybridsystem exhibits this property, a hybridobserver can be constructed which auto-matically detects the criticality of thecurrent discrete state.

Our first investigation of criticalobservability considered each agent ofATM systems in isolation. However, inmulti-agent ATM scenarios, agentscannot be considered in isolationbecause their interaction is responsible

for the occurrence of unsafe situationsthat cannot be captured in isolation. Forthis reason, we proposed a composi-tional hybrid systems framework thatdescribes the behaviour of each agent aswell as their interaction. This frame-work can be viewed as a generalizationof the classical notion of serial compo-sition to a multi-agent setting, and pro-vides a systematic way to study criticalobservability of multi-agent systems.More precisely, models are first createdof each agent with a hybrid system,then, by applying the compositional

Safety Criticality Analysis of Multi-Agent

Air Traffic Management Systems:

A Compositional Hybrid Systems’ Approach

by Elena De Santis, Maria Domenica Di Benedetto and Giordano Pola

We present a formal framework for analysing the impact of non-nominal operating modes on the

safety of next generation ATM procedures under study in the SESAR 2020 Concept of Operation.

Efficient complexity reduction algorithms are also derived for applying the proposed methodology

to realistic large-scale ATM systems.

Figure 1: A possible scenario of the TMA T1 operation. Standard instrument departure routes

are depicted in green, standard terminal arrival routes in red, and cruise routes at a lower flight

level in blue.

rules, a unique hybrid system isobtained. A critical relation is thendefined which describes the occurrenceof safety-critical situations in the com-posed hybrid system. Studying safety inmulti-agent ATM scenarios then trans-lates to studying critical observability ofthe obtained (composed) hybrid systemwith respect to the critical relation.

Although formally sound, this approachis hardly applicable to realistic sce-narios because of the large number ofvariables involved. To overcome thesedifficulties we proposed algorithmsbased on bisimulation theory, widelyused in the area of formal methods tomitigate software verification.

We analysed the Terminal ManeuveringArea (TMA) T1 operation, a procedureselected within the MAREA consortiumas a benchmark, exhibiting most rele-vant features arising in the novel

SESAR 2020 Concept of Operation. Weconsidered a scenario involving 25agents, comprising more than 1.68 x1018 discrete states. We showed that thisprocedure is not critically observable.This implies that there are safety-crit-ical configurations which cannot bedetected by pilots or air traffic con-trollers. In other words, in some situa-tions, not only is the human operator’sawareness of a safety critical situationincorrect, but furthermore, it cannot beimproved before a safety-critical situa-tion occurs. This analysis also proposedalternative solutions which ensuresafety of the procedure.

We wish to thank Henk Blom andMariken Everdij (NLR) for fruitful dis-cussions on this paper.

Link:

http://dews.univaq.it/

References:

[1] E. De Santis et al: “CriticalObservability of a Class of HybridSystems and Application to ATMsystems”, in “Stochastic HybridSystems: Theory and Safety CriticalApplications”, LNCIS 337[2] E. De Santis et al: “Final modellingand analysis of SESAR 2020ConOps”, Report MAREA D4.4,http://complexworld.eu/wiki/File:D4.4-v1.0.pdf[3] Resilience Engineering Perspec-tives, Preparation and Restoration, Vol.2, Ashgate, England, 2009.

Please contact:

Elena De Santis, Maria Domenica DiBenedetto and Giordano Pola, Centerof Excellence for Research DEWS,University of L’Aquila, Italy. E-mail: {elena.desantis,mariadomenica.dibenedetto,giordano.pola} @univaq.it



The existence and utilization of highlycomplex tools such as Stuxnet, Duqu,Flame, and the Mask in real-worldattacks demonstrate that we haveentered the era of sophisticated cyberwarfare. The concern is that the Cyber-Physical Systems (CPS) [1] monitoringand controlling critical infrastructuressuch as the smart grid [2] may be sus-ceptible to cyber-terrorism, and thateven small criminally inclined groupswould be able to create attacks withasymmetrical impact. Since the majorityof the world’s SCADA/DCS and PLCsystems can be found in high-tech indus-trial facilities in Europe, US and Japan,it is imperative to invest in security as aprocess. Adequately addressing securityin the cyber-physical system era, how-ever, poses a significant challenge.

Attacks such as that of Stuxnet relied ona number of existing vulnerabilities,some of which dated back two years [3].Updates should have been appliedduring that time, but owing to the “air-gap” isolation they were consideredunnecessary. Additionally, many of theindustrial infrastructures that employCPS are long-lived with life times of10+ years. This means updates are notalways possible (for older systems), orare not implemented as often owing tothe lengthier testing time and the fear ofunwanted side effects. However, thesepoorly defended, poorly patched andpoorly regulated systems will be thefirst ones that will be used as Trojanhorses to attack the more modern sys-tems with zero-day attacks. ``Don’ttouch a running system'' may not applyin the CPS era.

Modern CPSs do not constitute a mono-lithic platform and are not developed bya single stakeholder. On the contrary,they consist of various hardware andsoftware parts “glued” together to per-form the required tasks. Hence the firstproblem that arises is how to trust theindividual parts of the CPS and how toguarantee a deterministic behaviour.Addressing security only at hardware orsoftware levels is not enough. The oper-ational context also needs to be consid-ered for safety and dependability rea-sons. Even if both are fully certified andaddressed, there is still no guaranteethat actions that compromise a CPS willnot occur during its lifetime – henceadequate security measures also need tobe taken in the operational context.

Trust is a fundamental issue to consider.As an example, CPS hardware compo-

Security in the Era of Cyber-Physical

Systems of Systems

by Stamatis Karnouskos

Critical infrastructures are increasingly equipped with modern Cyber-Physical Systems (CPS) and

Internet-based services that enhance their functionalities and operation. However, traditional

security practices fall short when it comes to addressing the multitude of security considerations,

not only at individual system but also at system-of-system level. The creation of recent sophisticated

tools, such as Stuxnet, Duqu, Flame, and the Mask, is the prequel to a nightmare in a CPS-

dominated future.


nents can be used as carriers of attacksand entry points to a system. Commonattacks utilize “trusted” parts of asystem, such as USB ports, the Ethernetcard, the battery etc. to host and executemalicious code that bypasses the oper-ating system’s guards. Digitally signedsoftware should not be blindly trustedeither. As an example, Stuxnet installedtwo kernel drivers that were digitallysigned by valid certificates that werestolen from two different issuing com-panies. Real time online validation ofcertificates may limit the exposurewindow.

Software and hardware security are notthe only issues to be considered; humanusers must be included in the process.Security clearance on people does notimply security on their accompanyingassets. In the Stuxnet case [3], a trust-worthy employee with an unknowinglyrootkited laptop or an infected USBflash drive would be enough to spreadthe malware. This could be, forinstance, a contractor carrying a per-sonal device, who is assigned to domaintenance on a facility.

Lack of security-considerations at CPSdevelopment time may lead to insecuresoftware with bugs that may result inunpredictable system behaviour or,even worse, a controllably maliciousoperational behaviour. Other pitfallsmay also be possible, as demonstratedby the Stuxnet [3], which was able totake advantage of something that shouldnever have existed in the first place, i.e.,default hard-coded access accounts andpasswords in industrial PLCs.

It is interesting that we place so muchtrust on CPS systems even when someof their complex operational stages maynot be secure. Stuxnet impersonated thenormal behaviour of the PLC, and anynetwork management system or controlroom operator would have beenunlikely to see a rogue PLC as its sig-nals were faked [3]. As such, only theindependently observed physicalprocess and that reported by theStuxnet-infected PLC data would mis-match. Hence, safeguards need to be inplace, not only on individual CPS, butalso on the processes in which they par-ticipate. This requires system-of-systemwide behaviour monitoring and checksfor anomalies. Heuristics for estimatingbehaviour deviation may provide hints,which should be assessed and analysed

in conjunction with other metrics. Thisis challenging but probably achievableto some degree if the process is underthe control of a limited number of stake-holders. However, in the envisionedwidely collaborative CPS systems-of-systems this is a daunting task.

In CPS system-of-systems it will be dif-ficult to do holistic code reviews, sys-tematic testing and checks at design andruntime [2]. Hence, software “bugs”which may have a tangible impact onthe physical world will happen moreoften, while their impact will be hard toassess. It is not clear how much effortwill need to be invested in designingand integrating software for such com-plex system of systems versus testing it.Additionally, the range of qualificationsthat will be required by future engineersto perform these tasks will have to bebroader and more in-depth which ischallenging. Automatic tools that do themodel checking as well as detect poten-tial safety-critical issues on large scalemulti-dimensional applications will beneeded.

CPSs control real-world infrastructuresand thus have a real-world impact.Dependability in CPS and their ecosys-tems will be the key factor for theirapplication in critical systems; it willdetermine to what extent our core crit-ical infrastructure will be vulnerable inthe future. The CPS era is in need ofsolutions that will support it at device,system, infrastructure and applicationlevel [1]. This includes the whole life-cycle from cradle-to-grave of its com-ponents and services. This is a grandchallenge and includes multi-discipli-nary engineering, modelling, emergentbehaviour, human interaction etc.Finally, it has to be kept in mind thatsecurity is a multi-angled process inwhich vulnerability and risk analysismay dictate what is an acceptable level.Solutions focusing asymmetrically onparticular aspects, whilst neglectingothers, may give a false sense of safetyand security, which will be shattered byreality as Stuxnet, Duqu, Flame, and theMask have recently demonstrated.

References:

[1] “Cyber-Physical Systems: Drivingforce for innovation in mobility,health, energy and production”. Tech.rep., Acatech – German NationalAcademy of Science and Engineering,2011

[2] S. Karnouskos: "Cyber-PhysicalSystems in the SmartGrid", in IEEE9th International Conference onIndustrial Informatics (INDIN),Lisbon, Portugal, 2011

[3] S. Karnouskos: "Stuxnet WormImpact on Industrial Cyber-PhysicalSystem Security", in 37th AnnualConference of the IEEE IndustrialElectronics Society (IECON),Melbourne, Australia, 2011.

Please contact:

Stamatis KarnouskosSAP, GermanyE-mail: [email protected]

Neuronal synchronization plays a cen-tral role in brain functioning. It is linkedto memory, cognition and movementpath generation. Abnormal synchroniza-tion in certain cerebral zones can alsolead to pathological states such asParkinson’s disease, essential tremor, orepilepsy. In particular, Parkinsoniansymptoms are known to be linked to per-sistent beta band (13-30Hz) oscillationsin deep brain structures called basal gan-glia.

Deep brain stimulation (DBS) is a symp-tomatic treatment of several synchro-nization-related neurological diseases[1]. It consists of electrical stimulationof deep brain structures through perma-nently implanted electrodes. In mostexisting DBS techniques, the stimula-tion is a square signal (1 to 5V amplitudeat around 120 to 180Hz) whose preciseparameters are derived primarily by

trial-and-error on each patient. It oper-ates in an open loop: no cerebral infor-mation or models of the dynamicsinvolved are exploited.

Despite its strong success and impres-sive efficacy in most cases, current DBStreatment still suffers from considerablelimitations, including: the spread ofelectrical stimulation within non-tar-geted brain tissues; and the low level ofknowledge about the exact functioningof DBS. More importantly, a number ofside effects have been reported, such ascognition issues, depression, speechdisturbances, and balance impairment.Moreover, the permanent stimulation ofdeep brain structures leads to anoveruse of embedded electricalresources, which in turn imposes furthersurgical operations for battery replace-ment. Finally, the trial-and-error selec-tion of the present DBS parameters has

been effective because of the almostimmediate effects of DBS onParkinsonian motor symptoms; newtherapies utilizing DBS technology willnot allow such a tuning (for instance,the beneficial effects of stimulation cantake weeks to manifest in dystonia orobsessive compulsive disorders).

These limitations seem strongly linkedto the disproportionate signal amplitudeand the open-loop nature of the currentDBS signals. Control engineering toolsmay contribute to a better under-standing of basal ganglia circuitry andthe adaptation of DBS signals to real-time cerebral activity. These are thekeys for the development of more adap-tive and parsimonious stimulation poli-cies.

The recent technique of optogeneticsprovides unprecedented neurophysio-



Optogenetics to Unravel the Mechanisms

of Parkinsonian Symptoms

and Optimize Deep Brain Stimulation

by Antoine Chaillet, Diane Da Silva, Georgios Detorakis, Christophe Pouzat and Suhan Senova

By allowing a precise stimulation of targeted neurons through light impulses, optogenetics is

revolutionizing our understanding of the brain. Its recent use in primate deep brain structures

promises unprecedented data to model the mechanisms underlying Parkinson’s disease symptoms

and to improve their treatment by electrical stimulation.

Figure 1: Schematic description of the SynchNeuro strategy. Electrical measurements of single spike recordings in specific

brain structures, thanks to permanently implanted electrodes, allow to estimate the firing rate of the whole neuronal

population after spike sorting and probabilistic identification. The estimated firing rate is then used off-line to identify the

dynamical properties of the neuronal activity and to deduce the optimal tuning of the control gains. It is also used on-line

to provide a real-time photostimulation feedback, using optogenetics, to reduce the magnitude of pathological oscillations.

logical data, which may improve ourunderstanding of basal ganglia interac-tion. It relies on a gene transfer tech-nology to make targeted neurons sensi-tive to photostimulation by visiblewavelengths after the selective transferof genes coding for the expression ofphotosensitive ionic channels on neu-ronal membrane [2](Boyden et al.2005). Thus, simple pulses of intenselight, for instance through implantedoptical fibers, can induce the responseof the photosensitized selected neuronsonly, while not affecting neighbouringneurons. This technique enables anaccurate spatiotemporal neuromodula-tion at the level of the millisecond andof one targeted neural network.Combined with electrode measure-ments, optogenetics offers unprece-dented possibilities to dissect basal gan-glia mechanisms in health and disease,and thus to optimize DBS treatment.

The SynchNeuro project, started in2013 and co-financed by the FrenchANR and the Digiteo research network,proposes a multidisciplinary researcheffort to investigate methodologies forthe analysis and control of neuronalsynchronization and their application tothe treatment of neurological diseasesby closed-loop DBS, based on optoge-netics data. The aim is to understand theunderlying neurological phenomenaand to develop closed-loop real-timeDBS controllers that intelligently andautonomously alter pathological oscil-lations.

More precisely, four objectives will beaddressed. First, a firing-rate model ofbasal ganglia under photostimulationwill be developed based on in vivo pri-mate data. This modelling and identifi-cation will be performed on bothhealthy and Parkinsonian primates. Inorder to interpret the neurophysiolog-ical data acquired by optogenetics andin vivo extracellular recordings, the rawdata needs to be processed andanalysed. This involves the implemen-tation of a spike sorting method [3] andthe development of a stochastic modelfor parameter identification. Thoseparameters will later be used to developa more precise model of the neural pop-ulations, including the specificity ofphotostimulation. Second, based on thisfiring-rate model, analytical conditionsfor the pathological oscillations onsetwill be developed using tools from non-linear control theory. Third, innovative

closed-loop DBS signals that adapt inreal-time to the recorded brain activitywill be designed in order to attenuatethe pathological oscillations. TheseDBS signals are expected to be moreefficient and more respectful thanexisting open-loop DBS strategies.Finally, both the population model andthe developed DBS signals will be vali-dated numerically and in vivo. Theoverall setup is reported in Figure 1.

By adapting control techniques and the-oretical background to the specific con-straints imposed by DBS (model impre-cision, limited measurements and actua-tion, nonlinearities), decisive improve-ments in terms of adaptation, sideeffects and energy consumption can beexpected. The optimization of the DBStechnique is a perfect illustration of thegains that can be achieved through acloser interaction between control engi-neering and neuroscience.

Acknowledgement: R. Aron-Badin(CEA MIRCen) and P. Hantraye (CEAMIRCen), L. Greco (L2S) and S. Palfi(APHP H. Mondor hospital) are alsopartners of the SynchNeuro project andhave contributed to this article. Thiswork has received support from theFrench ANR project SynchNeuro, theFrench Digiteo project NEURO-SYNCH, the French institute iCODE,and the European FP7 Network ofExcellence HYCON2.

References:

[1] A.L. Benabid et al.: “Long-termsuppression of tremor by chronicstimulation of the ventral intermediatethalamic nucleus”, The Lancet,337(8738), pp.403–406, 1991[2] E.S. Boyden et al.: “Millisecond-timescale, genetically targeted opticalcontrol of neural activity”, NatureNeuroscience, 8(9), pp.1263–1268,2005. [3] C. Pouzat, O. Mazor, G. Laurent:“Using noise signature to optimizespike-sorting and to assess neuronalclassification quality”, journal ofneuroscience methods, 122, pp.43–57,2005.

Please contact:

Antoine ChailletL2S, University Paris Sud 11, Supélec, FranceE-mail: [email protected]


Big Data in Healthcare:

Intensive Care Units

as a Case Study

by Ioannis Constantinou, Andreas Papadopoulos, MariosD. Dikaiakos, Nicolas Stylianides and TheodorosKyprianou

Traditional medical practice is moving from relatively

ad-hoc and subjective decision making to modern

evidence-based healthcare. Evidence is based on data

collected from: electronic health record (EHR) systems;

genomic information; capturing devices, sensors, and

mobiles; information communicated verbally by the

patient; and new medical knowledge. These resources

produce a collection of large and complex datasets,

which are difficult to process using common database

management tools or traditional data processing

applications.

Currently, the data generated in the process of medical carein intensive care units (ICUs) are rarely processed in real-time, nor are they collected and used for data analysis. Theexistence of user-friendly platforms for accessing and ana-lyzing such massive volumes of data could leverage an era ofmedical knowledge discovery and medical care qualityimprovement. The current absence of such platforms is duepartly to the difficulty of accessing, organizing, and vali-dating voluminous health care data produced with high time-varying arrival rates by various types of sensors, and notablyto the variability of proprietary software solutions in use. Theneed for fast computationally-intensive scientific analysis ofthe data generated in ICUs thwarts the use of traditional data-bases and data processing applications and demands thedevelopment of cloud based solutions.

Our platform, shown in Figure 1, is able to collect data fromproprietary used software solutions, such as the ClinicalInformation System (CIS) or via the Intensive Care Window(ICW) framework [1]. Data are produced by specializedmedical equipment, or - in the case of laboratory test resultsand medication records - manually entered to the hospitaldatabase system by healthcare professionals. Monitors arecapable of monitoring about 95 vital signs measured bydevices such as patient monitors, patient ventilators, smartinfusion pumps and laboratory test databases. In particular: • The ICU patient monitor device (Philips IntelliVue MP

70) measures about 30 vital signs such as Heart Rate, EGGand SpO2.

• The patient ventilator device (Puritan Bennett 840 ventila-tor) measures about 20 parameters and vital signs such usventilator mode, minute volume and tidal volume.

• The smart infusion pump allows the persistent storage oftwo values: (a) the instant flow of drugs at the time theyhave been validated by a caregiver (typically a nurse) and(b) the total amount of drugs administered during the lasthour.

Table 1 illustrates the measurement rates of each of the vitalsign type, laboratory test and medication. Vital signs aremeasured more frequently than medication and laboratory


European

Research and

Innovation

Research and Innovation


tests. In a small 20-bed ICU, 2.8 millionrecords with a capacity of about 11.6 MBare stored in the platform’s data repositoryper day, which is equivalent to an annualdata production of about 1.058 billionrecords with capacity of about 4.2GB.

Using data collected through our platform,we: (a) evaluated 12 different GlucoseVariability (GV) indexes for mortality pre-diction; and (b) deployed a multivariatelogistic regression model, enriched withpatient characteristics and laboratory tests,such as age, gender, BMI, CRE, etc, inorder to raise the prediction accuracy [2].Specifically, data collected through ourplatform, for about 1000 patients for aperiod of 12 months, have been consid-ered and analyzed using Matlab. We con-cluded that the majority of the GV indexesexhibit high accuracy for predicting mor-tality, with GVI achieving the best accu-racy (72%). Furthermore, our model,based on multiple patient characteristics,achieved an 82% success rate in predictingmortality.

Our goal is to integrate our current plat-form to a cloud-based platform for storingand analyzing ICU medical data. Ourfuture platform would comprise threelevels (Figure 2). The first level is respon-sible for data extraction, anonymizationand validation [1]. The second level isresponsible for data storage and the thirdlevel includes the tools and the interfacesfor retrieval, processing and analysis ofthe data. We plan to extend the third levelby integrating an R (a powerful opensource statistical analysis software) con-nector for Hadoop, optimizing andexpanding the various components as wellas testing it on ICU patients’ vital signs forreal time analysis and pattern matching.

References:

[1] N. Stylianides et al.:"Intensive CareWindow: Real-Time Monitoring andAnalysis in the Intensive Care Environ-ment", IEEE Transactions on InformationTechnology in Biomedicine, Vol. 15, pp.26-32, 2011.[2] S. Kokkoris, et al.: "The ability ofvarious glucose variability metrics formortality prediction in critically illpatients: a comparative study", 27thAnnual Congress CCIB – Barcelona,ESICM, 2013.

Please contact:

Marios D. DikaiakosUniversity of CyprusE-mail: [email protected]

49

Figure 1: Platform interconnection diagram. Medical devices store data to CIS automatically.

Healthcare professionals manually enter laboratory test and medication data to the system. Our

platform is interconnected to CIS and ICW for automated data retrieval.

Figure 2: The future platform architecture. The platform consists of seven modules and

three levels. The first level consists of Data Extractor, Data Anonymizer and Data

Validator. The Data Extractor module is responsible for the interconnection between CIS

and ICW. The Data Anonymizer is responsible for anonymizing critical private patient

data. The Data Validator discards invalid values of vital signs, laboratory test and

medication based on strictly predefined rules. At the second level is the storage module.

The Data Storage module is a cloud NoSQL database. The third level is responsible for

data retrieval, data processing and data analysis. The Data Retrieval module is an

interface for retrieving data from the cloud. The Data Processing module is responsible

for data processing and, finally, the Data Analyzer is responsible for the data analysis. The

Data Analysis module will provide the powerful functionality of R statistical package.

Description Capture rate

Patient Monitor 31 Vital Signs (ECG,Heart Rate, SpO2, etc)

Every 30 seconds

Patient Ventilator 20 Vital Signs andparameters (ventilator mode, minutevolume, tidal volume, etc)

Every 30 seconds

27 Laboratory Tests (glucose, urea,creatinine, potassium, etc)

Thirteen of the 27 tests are captured 5times/day. The remaining 14 are cap-tured 24 times/day.

19 Drugs (Thiopental, acetylcesteine,Furosemide, dexamethasone, etc)

Hourly

Table 1: Capture rates for different vital signs, lab test and drug data.


SEMEOTICONS:

Face Reading to Help

People stay Healthy

by Sara Colantonio, Daniela Giorgi and Ovidio Salvetti

The European project SEMEOTICONS offers a fresh

perspective on educational programs and lifestyle

intervention for the prevention of cardiovascular

diseases. SEMEOTICONS will develop a multisensory

platform, in the form of a mirror, to be integrated into

daily-life settings. The mirror will be able to detect and

monitor over time facial signs correlated with cardio-

metabolic risk, and give personalized advice to end-

users on how to improve their habits.

The face is the pre-eminent channel of communication amonghumans: it is a mirror of status, emotions, mood. This is thebase principle of Medical Semeiotics, which looks at the faceas a revealer of the healthy status of an individual, through acombination of physical signs (e.g., skin colour, subcutaneousfat) and facial expressions. Medical Semeiotics dates back asfar as Aristotle’s times. Nevertheless, it is still used by med-ical practitioners today, who rely on their ability to read theface of patients to steer the medical examination and decideon diagnostic investigations.

SEMEOTICONS, funded by the EC (FP7), began inNovember 2013 with the objective of moving MedicalSemeiotics to the digital realm. SEMEOTICONS proposesthe translation of the semeiotic face code into computationaldescriptors and measures, which can be automaticallyextracted from videos, images, and 3D scans of the humanface. In particular, SEMEOTICONS addresses signs relatedto cardio-metabolic risk as cardiovascular diseases are theleading cause of mortality worldwide.

SEMEOTICONS also aims to bring semeiotic analysiscloser to everyday life, ie, from the surgery to the home, thegym, the pharmacy, etc. This will enable people to self-assess and self-monitor the status of their well-being overtime. A multisensory platform in the form of an interactivesmart mirror, called the Wize Mirror, will be developed. TheWize Mirror is designed to fit into daily-life settings, bymaximizing non-invasiveness and natural interaction modal-ities, according to the Ambient Intelligence paradigm. It willseamlessly integrate contactless sensors (3D optical sensors,multispectral cameras, gas detection sensors, microphones)with a user-friendly touch-screen interface (Figure 1).

The heterogeneous data collected by the Wize Mirror ̶videos, images, 3D scans, and gas concentration of individ-uals standing in front of the mirror ̶ will be processed bydedicated algorithms, which will extract a number of bio-metric, morphometric, colorimetric, and compositionaldescriptors [1]. The descriptors will be integrated to define avirtual individual model and an individual wellness index tobe traced over time. The Wize Mirror will also offer sugges-tions and coaching messages, with a personalized user guid-

ance, aimed at the achievement and the maintenance of a cor-rect life-style.

The empowerment of individuals, in terms of their ability toself-monitor their status and improve their life-style, isexpected to have a great impact on the reduction of healthexpenditure and disease burden. It is well-known that thecost of health systems grows exponentially with the aging ofthe population, together with the widespread use of complex,and sometimes inappropriate, diagnostic procedures.Prevention is the best strategy to limit the spread of cardio-metabolic diseases. SEMEOTICONS offers a fresh perspec-tive on educational programs and lifestyle intervention.

SEMEOTICONS will address significant scientific and tech-nological challenges. It promises touch-less data acquisitionvia a low-cost platform; temporal and spatial data synchro-nization; real-time processing of multimodal data; and intel-ligent solutions to map iconic facial signs to repeatable, reli-able computational measures correlated with risk factors.The project consortium has been built to strike a good bal-ance between innovation and technology-driven research. Itcomprises six research organizations (with competence inboth ICT and medical areas), two industrial partners, and twoSMEs, from seven European countries (France, Greece,Italy, Norway, Spain, Sweden, United Kingdom). The projectcoordinator is the Istituto di Scienza e Tecnologiedell’Informazione (ISTI) of the National Research Councilof Italy (CNR), located in Pisa.

Link: http://www.semeoticons.eu/

Reference:

[1] E. Vezzetti and F. Marcolin: “3D human face descrip-tion: landmark measures and geometrical features”, Imageand Vision Computing 30 (2012), 698 - 712

Please contact:

Sara Colantonio - ISTI-CNR, Pisa, ItalyTel.: +39 050 621 3141E-mail: [email protected]


Figure 1: The Wize Mirror is a multisensory platform which collects

videos, images, 3D scans of the human face and gas concentration

signals, looking for signs correlated with cardio-metabolic risk.


DYMASOS - Dynamic

Management of

Physically Coupled

Systems of Systems

by Radoslav Paulen and Sebastian Engell

We are developing new tools for the management

of large physically-interconnected production and

distribution systems.

The well-being of the citizens of Europe depends on the reli-able and efficient functioning of large interconnected sys-tems, such as electric power systems, air traffic control,railway systems, large industrial production plants, etc. Suchlarge systems consist of many interacting components, suchas generation plants, distribution systems, and large andsmall consumers. Those subsystems are usually managedlocally and independently, according to different policies andpriorities. The dynamic interaction between the locally man-aged components gives rise to complex behaviour and canlead to large-scale disruptions, such as power black-outs.Large interconnected systems with autonomously actingsub-units, such as these, are called “systems of systems”.

DYMASOS addresses the issues associated with managingsystems of systems, where the elements of the overall systemare coupled by flows of physical quantities, such as electricpower, steam or hot water, materials in a chemical plant, gas,potable water, etc. DYMASOS, initiated in October 2013, isa three-year research project funded by the European

Commission under the 7th Framework Programme forResearch & Technological Development in the “Informationand Communication Technologies” theme.

DYMASOS focuses on the theoretical approaches fordynamic management of physically coupled systems of sys-tems driven by and validated on real-world use cases andsupported by eventual deployment of prototyped methodolo-gies and toolsets. The DYMASOS consortium comprisesacademic partners, industrial partners, small and mediumenterprises and a large provider of engineering and techno-logical solutions.

The project will develop new methods for the distributedmanagement of large physically connected systems withlocal management and global coordination. The exploredapproaches involve:• Modelling and control of large-scale systems analogously

to the evolution of the behaviour of populations in biolog-ical systems,

• Market-like mechanisms to coordinate independent sys-tems with local optimization functions,

• Coalition games in which agents that control the subsys-tems dynamically group to pursue common goals.

The developed approaches will be validated in large-scalesimulations of case studies provided by the industrial part-ners or already involved supporters from the industry. Fromthe validation, general conclusions will be drawn about thesuitability of the proposed distributed management and con-trol mechanisms for certain classes of systems of systems.This will provide guidelines for the design of evolving largephysically coupled systems of systems with respect to theinterplay of local autonomy and global management. Theseguidelines, developed in close collaboration with industrial

Figure 1: A schematic representation of a physically-coupled system of systems using a chemical production site as a case study.

partners, will influence the next generation of software andhardware development for optimal management of largeinterconnected systems.

The industry-driven case studies of real applications that areconsidered in the project include: • The balancing and stabilizing of the electricity distribution

grid of the city of Koprivnica that is a highly-automatedcomplex system involving multiple electricity producersand consumers (households, charging stations of electricalvehicles, etc.).

• The dynamic management of charging of electric vehiclesin the city of Malaga that involves the management of thenetwork of electrical vehicles and power station with vehi-cle-to-grid charging capabilities.

• The energy management of a large chemical productionsite that seeks the right balance for an operation of thepower plant (steam network) to satisfy the demands of theproduction subunits and to minimize the amount ofimported energy resources.

• The cross-plant process management in an integratedchemical production complex. This case study is con-cerned with managing a network of parallel reactors thatshare a flare system and limited cooling power.

For the usability of the results, it is essential that the engi-neering, implementation and long-term maintenance of suchadvanced solutions are taken into account. The project willdevelop prototypical tools that facilitate development,testing, deployment and maintenance of these solutions. Akey element of these engineering tools is an open simulationplatform that enables dynamic management and controlmethods to be tested with accurate models of the overallsystem and the connection to external models that are avail-able in the application domains.

The expected technical outcomes of the project are: • Innovation in distributed management methods for com-

plex interconnected systems,• Progress in methods for the rigorous analysis and valida-

tion of systems of systems,• Improvements in the management of electric grids and of

large production complexes,• Tools for the engineering of management systems for sys-

tems of systems,• Identification of technology gaps in advanced manage-

ment and coordination methods.

The developed coordination methods will lead to improvedsystem stability and lower resource consumption in indus-trial production, and in electric power generation and distri-bution. This will result in a reduction of the CO2 emissions,increased competitiveness of European industry and lowerprices for consumers. DYMASOS is thus contributing to thegoal of a greener and more competitive Europe.

Link: http://www.dymasos.eu

Please contact:

Sebastian EngellTechnische Universität Dortmund GermanyE-mail: [email protected]



3DHOP: A Novel

Technological Solution

for the Development of

Online virtual Museums

by Marco Potenziani, Marco Callieri and RobertoScopigno

The interactive visualization of 3D content on the Web

has gained momentum in recent years, thanks to the

release of ad-hoc technology as part of HTML5.

However, so far, few products fully exploit this

opportunity for the easy and quick embedding of high-

resolution 3D models in a Web page. 3DHOP (3D

Heritage Online Presenter) is an advanced solution for

easy publishing of 3D content on the Web.

3DHOP allows anyone with basic webpage-creation skills tosetup an HTML page displaying a scene composed by high-resolution 3D models. This free tool is essentially a viewerthat can stream and render effectively 3D data over the net,letting the user interact with high-resolution 3D content (seeFigure 1). It is oriented towards the Cultural Heritage (CH)field, where the need to handle highly detailed digital repre-sentations of cultural artefacts is often mandatory; however,it may also be useful in other contexts requiring high per-formance and interactive visualization of high-resolution 3Dcontent.

3DHOP has been developed by the Visual Computing Lab,ISTI-CNR, in the framework of several EU projectsaddressing the management of large collections of 3D digitalmodels: the EC IP project "3DCOFORM”, the EC NoE “V-MusT” and the EC pilot project “3D-ICONS”. It is the resultof 10 years of R&D focused on the design and implementa-tion of easy-to-use tools that enable CH professionals topresent, visualize and enrich high-quality digital 3D models(the first important result of which was the Inspector system[1]).

The rationale underlying 3DHOP was the lack of tools tomanage the interactive visualization on the Web of high-res-olution 3D geometries in a simple way. While there are var-ious products (both free and commercial) that can re-createcomplex virtual scenes made of simple 3D entities, they arenot suitable for the management of complex 3D geometry,

Figure1: A collection of 3D models presented with 3DHOP (an

example of layout)


With 3DHOP, we hope to offer a novel and versatile solutionfor publishing 3D content on the Web, facilitating deploy-ment and access to high-resolution 3D resources by non-experts in 3D programming. This new technology, particu-larly suitable for Online Virtual Museums, should encouragethe global dissemination and deployment of high-quality 3Dcultural heritage content via the Internet.

Links:

3DHOP: http://vcg.isti.cnr.it/3dhopNexus: http://vcg.isti.cnr.it/nexusSpiderGL: http://vcg.isti.cnr.it/spidergl

References:

[1] M. Callieri et al.: “Virtual Inspector: a flexible visualiz-er for dense 3D scanned models”, IEEE Computer Graph-ics and Applications, 2008[2] M. Di Benedetto et al.: “SpiderGL: a JavaScript 3DGraphics Library for next-generation WWW”, Web3DConference, 2010[3] G. Palma et al.: “Dynamic Shading Enhancement forReflectance Transformation Imaging”, ACM Journal onComputing and Cultural Heritage, 2010.

Please contact:

Marco Potenziani, Marco Callieri, Roberto Scopigno,ISTI-CNR, ItalyE-mail: [email protected],[email protected], [email protected]

and are mainly aimed at expert Computer Graphics (CG)developers.

3DHOP can be used by anyone with simple webpage-cre-ation skills, without the need for specific CG expertise; thegoal was to be easy-to-use and easy-to-learn. For this reason,3DHOP uses general web programming mechanisms(declarative programming). The various components of thevisualization page (the 3D models, the Trackball, theCanvas, the Scene) are treated like HTML entities in thesame way as the rest of the structural elements of the webpage, and are declared and customized using simple parame-ters. A developer can just pick a starting example and modifyit by simply changing some parameters of the entities (seeFigure 2).

3DHOP has been created using standard Web technologies(like JavaScript and HTML5), without relying on externalcomponents; it can run on all the most widely used browsers(Chrome, Firefox, Opera and soon IE) and all the principalOS (Win, Mac-OS and Linux) without the need for plugins.It must be stressed that although 3DHOP has been designedfor the Web, it only needs a Web browser to work; this meansthat it can also run locally, to implement museum kiosks, forexample. Unlike similar tools, the 3DHOP viewer is totallyclient side, and does not require a specialized server.

3DHOP currently supports two types of 3D models: single-resolution (PLY and soon OBJ) and multi-resolution(NEXUS). In particular, the multiresolution Nexus tech-nology (another achievement of ISTI-CNR), supports thestreaming of high-resolution 3D meshes over the HTTP pro-tocol, enabling the exploration of very large models (millionsof triangles, like in Figure 3) on commodity computers withstandard internet connections. 3DHOP is based on WebGL(the standard API for the CG on the Web developed as theJavaScript equivalent to OpenGL|ES 2.0), and on SpiderGL,a JavaScript utility support library for WebGL (again devel-oped by the Visual Computing Lab [2]), which provides anAPI with the typical structures and algorithms for real-timerendering in the development of 3D web applications.

The evolution of 3DHOP will be focused on the integrationof visualization components for other multimedia layers, likeimages, audio, video, etc. Work is already underway for themanagement of large 3D terrains and RTI (ReflectanceTransformation Imaging) images [3].

Figure2: Declarative programming in 3DHOP: the virtual scene is

defined using different text fields, easily modified by the user with

different values to build a similar small scene (fully textual

approach).

Figure3: Handling a large 3D mesh (about 20M triangles) in

3DHOP using the Nexus technology.



The Entity Registry

System: Publishing and

Consuming Linked Data

in Poorly Connected

Environments

by Christophe Guéret and Philippe Cudré-Mauroux

Sixty-five percent of the world's population is deprived

of ICT-enhanced data-sharing because of poor access to

digital technology. The ExaScale Infolab and Data

Archiving and Networked Services (DANS) have

designed a new framework, the "Entity Registry

System" (ERS), and produced a reference

implementation making it possible to publish and

consume Linked Open Data in poorly connected

environments.

There is no longer any doubt about the social and economicvalue of accessible, open data. Leveraging the pervasivepresence of the Web, Linked Data principles and Web-basedportals are promising technologies for implementing data-sharing applications. But the trivial architectural assump-tions around data connectivity and availability of large-scaleresources keeps ICT-enhanced data sharing out of reach forabout 65% of the world's population. The majority of theworld's population is digitally disconnected from the rest ofthe world, and are thus deprived of (Linked) Open Data, andits associated benefits [1].

Work on the Entity Registry System (ERS) started in 2012 asa joint project between the ExaScale Infolab and DataArchiving and Networked Services (DANS) with a generousgrant from Verisign Inc. This work is placed in the context ofthe World Wide Semantic Web initiative aimed at ensuringthat the Semantic Web becomes a reality for everyone (seehttp://worldwidesemanticweb.org). Out of the three chal-lenges - infrastructures, interfaces and relevancy - that theWorld Wide Semantic Web initiative encompasses, ERStackles the first one.

In contrast to established economies and city dwellers,developing economies and rural populations typically do nothave a high speed and stable access to the internet. They alsolack access to Web-based data portals where they could pub-lish their new data and consume third-party datasets. Theneed for sharing open data in such environments is real, how-ever. Monitoring environmental hazards, online medicalhelp, emergency response, and remote education are but afew examples of data sharing scenarios that are essential tothe development of emerging countries [1,2]. Technology isincreasingly available to such populations, though still inlimited forms: solar-powered access to low-speed Internet,local mesh networks, community radio, usb-sticks to carrydata, low-cost computers, basic mobile phones, etc. In thiscontext, our goal is to design an approach to publish and con-sume Linked Open Data using such technologies. Morespecifically, we decided to focus on existing and relatively

cheap equipment such as XO-1 laptops, RaspberryPis, andmesh networks.

In a nutshell, ERS creates global and shared knowledgespaces through series of statements. For instance,"Amsterdam is in the Netherlands" is a statement made aboutthe entity "Amsterdam" relating it to the entity "theNetherlands". Every user of ERS may want to either de-ref-erence an entity (for instance, by asking for all pieces ofinformation about "Amsterdam") or contribute to the contentof the shared space by adding new statements. This is madepossible via "Contributors" nodes, one of the three types ofnode defined in our system. Contributors can interact freelywith the knowledge base. They are responsible for pub-lishing their own statements but cannot edit third-party state-ments. Every set of statements about a given entity con-tributed by a single author is wrapped into a unique namedgraph to avoid conflicts and enable provenance tracking. In atypical ERS deployment, the end-user machines (eg, the XO-1 laptops) work as Contributor nodes. Two Contributors in a

closed P2P network can freely create and share Linked OpenData. In order for them to share data with another closedgroup of Contributors, we introduce "Bridges". A Bridge is arelay between two closed networks using the internet or anyother form of direct connection to share data. Two closedcommunities, for example two schools that are willing toshare data, can each set up one Bridge and connect these twonodes to each other. The Bridges will then collect andexchange data coming from the Contributors. These bridgesare not Contributors themselves, they are just used to shipdata (named graphs) around and can be shut-down orreplaced without any data-loss. Lastly, the third componentwe define in our architecture is the "Aggregator". This is aspecial node every Bridge may push content to. As its namesuggests, an Aggregator is used to aggregate entity descrip-tions that are otherwise scattered among all the Contributors.When deployed, an aggregator can be used to access and

Figure 1: An example of ERS deployment that could be in a school.

The four XO laptops are Contributors using the RaspberryPi as a

Bridge to asynchronously exchange data with another school.


expose the global content of the knowledge space or a subsetthereof.

An ERS deployment may contain any number ofContributors, Bridges and Aggregators depending on thedata-sharing scenario at hand. The system is, however,always "offline by default", relying only on Contributors aspersistent data stores, and taking advantage of data flows thatare biased towards locally relevant and potentially crowd-sourced data. Figure 1 shows a complete test deploymentusing four Contributors (XO-1 laptop) and a bridge(RaspberryPi model B) connected through a mesh network.

ERS has been developed in Python and Java. It usesCouchDB and CumulusRDF to store the RDF data serializedas JSON-LD. The code of our reference implementation isfreely available under an open source license (see http://ers-devs.github.io). We are currently working on extending it tosupport further data sharing scenarios and to make it usableon more hardware.

Links:

http://ers-devs.github.iohttp://dans.knaw.nlhttp://exascale.infohttp://worldwidesemanticweb.org

References:

[1] F. Estefan, C. Spruill, S. Lee: “Bringing Open Contract-ing Data Offline”, Open Contracting Blog, 2013, [Online],http://www.open-contracting.org/bringing_open_contract-ing_data_offline

[2] T. Unwin: “ICT4D: Information and CommunicationTechnology for Development”, Cambridge UniversityPress, 2009, ISBN 9780521712361.

Please contact:

Christophe GuéretData Archiving and Networked Services (DANS), TheNetherlandsE-mail: [email protected]

Spin-Up: A European

Project Aimed at

Propelling University

Spin-off Growth

by Manuel Au-Yong-Oliveira, João José Pinto Ferreira,Qing Ye and Marina van Geenhuizen

The “Spin-Up” project investigated what sort of

entrepreneurship training and coaching program will

contribute to the development of key entrepreneurial skills.

Entrepreneurial endeavours with roots in academia, alsoknown as University spin-off firms (USOs), tend to haveslow growth rates compared to corporate spin-offs and otherhigh-technology start-ups. The project, called “Spin-Up” -reflecting its aim to improve the growth (or “spin upwards”)of USOs - addressed the question: “What sort of entrepre-neurship training and coaching program will contribute tothe development of key entrepreneurial skills, both technicaland behavioural, essential to enable and leverage universityspin-off growth?” “Spin-Up” involved a EuropeanConsortium of organizations, comprising: AdvancisBusiness Services and INESC TEC (both in Portugal),Leaders2Be and the Technical University of Delft (theNetherlands), and the Lappeenranta University ofTechnology (Finland). The University of Porto and theTechnology Transfer Centre at the University of Lodz alsoparticipated. The main findings of the project were presented[1] at the European Conference on Entrepreneurship andInnovation (ECIE) 2013, in Brussels.

The research, which took place between 2011 and 2013, wasfunded by the European Commission – Lifelong Learning /Erasmus Program (Enterprise and University cooperation).Ninety-nine USO firms from four countries (Finland,Poland, Portugal and the Netherlands) made up the sample offirms from which in-depth data was gathered, in face-to-faceinterviews or via questionnaires answered electronically.This data was then processed and the results published in VanGeenhuizen and Ye’s Spin-Up Research Report [2], thisreport thus representing the main thrust of the research effort,which revealed that USOs’ growth is hampered by missingentrepreneurial skills, such as skills in innovation, mar-keting, sales, strategy, internationalization, leadership,human resource management, financial literacy and gainingfinancial capital. These areas were thus the focus of the pilottraining course, which was supported by training manualsand case studies developed by the consortium partners, andwhich tested the Spin-Up training approach and course con-tent in three countries – Finland, Portugal, and theNetherlands.

Notably, work was divided amongst the consortium mem-bers according to expertise and knowledge. Van Geenhuizenand Ye [2] produced the following spider diagrams illus-trating the research findings on the entrepreneurial skills(Figure 1a-d – for the Netherlands, Finland, Poland andPortugal)

http://www.open-contracting.org/bringing_open_contracting_data_offline



Figure 1a-d show that trends differed among the four coun-tries included in the research. Specific areas requiringimprovement include: financial management (particularly inPoland and the Netherlands) and gaining financial capital(Portugal, and to a lesser extent, Poland and Finland); humanresource management (Poland) and intellectual ownership(Netherlands, Poland and Portugal). For all countriesinvolved, stronger areas included technology managementand product/process innovation. Leadership skills were simi-larly strong in all four countries, though managers in theNetherlands tended to provide more opportunities to collabo-rators, while also giving more information to employees.

The pilot training program revealed that in addition to theneed for basic entrepreneurial skills, entrepreneurs wouldbenefit from customized, problem-oriented and interactivecoaching or training. The involvement of specialists, such asa venture capitalist and a business angel, in the program, wasgreatly appreciated. In terms of organization, a modularstructure was preferred, allowing USOs to participate perblock, and participants expressed a preference for blocks tobe scheduled outside of working hours.

The Spin-Up project enhanced the sharing of knowledgebetween project partners and with USOs, and longer termbenefits will doubtless be observed as a consequence.Further work in this area is needed – in Europe as well asbetween Europe and other continents.

Link: http://www.spin-up.eu

References:

[1] M.A. Oliveira et al.: “Spin-Up: A Comprehensive Pro-gram Aimed to Accelerate University Spin-Off Growth”, inproc. of ECIE 2013, vol. 1, pp.34-44, Brussels, Belgium [2] M. Van Geenhuizen, Q. Ye: “Spin-Up ResearchReport”, final version – July 2012.

Please contact:

Manuel Au-Yong-Oliveira, INESC TEC, University ofPorto, and University of Aveiro, PortugalE-mail: [email protected]

Figure 1a-d: Entrepreneurial

skills map of spin-off firms in

four countries (reproduced

from [2])

A System for the

Discovery and Selection

of FLOSS Projects

by Francesca Arcelli Fontana, Riccardo Roveda andMarco Zanoni

Developing software systems by reusing components is

a common practice. FLOSS (Free, Libre and Open

Source Software) components represent a significant

part of the reusable components available. The

selection of suitable FLOSS components raises

important issues both for software companies and

research institutions. RepoFinder supports a keyword-

based discovery process for FLOSS components, and

applies well-known software metrics and analyses to

compare the structural aspects of different

components.

FLOSS (Free, Libre and Open Source Software) componentsare widely used in industry. They are managed on dedicatedweb platforms, called Code Forges, designed to collect, pro-mote, and categorize FLOSS projects, and to support devel-opment teams. Some examples are Launchpad, GoogleCode, Sourceforge, Github, Bitbucket and Gnu Savannah.Code Forges provide tools and services for distributed devel-opment teams, eg, version control systems, bug tracking sys-tems, web hosting space. Currently, Github hosts more thanten million software components, and is probably the largest.Sourceforge is one of the first Code Forges, created in 1999,with more than 425,000 components, all of them well cate-gorized, while Google Code hosts about 250,000 compo-nents.


The overall architecture of RepoFinder is represented inFigure 1.

We aim to apply and extend RepoFinder in the followingdirections:• Analysis of software history. Software repositories contain

important information about the development team andsystem maturity. Many analyses can be performed in thiscontext; for example, to understand whether the quality ofa software has been improved over time, and if new releas-es tend to be corrected quickly, evidencing a low maturity.This kind of data can be evaluated for an individual proj-ect or compared for different projects.

• Language support. Currently, RepoFinder analyzes Javasystems configured to be built by Maven. Many other lan-guages and build systems are available and widely exploit-ed in open source development. Examples of other buildsystems for Java are Eclipse, Ant, Gradle, Ivy, Grape andBuildr. Analyzing additional languages could require theintegration of further analysis tools. Other tools also existthat could retrieve useful information, like Cobertura (forsystems with large test suites), or FindBugs and other codesmell detection tools.

Other applications exist with similar functionalities, such asSonarQube and Ohloh. However, RepoFinder differs in thatit combines discovery functionalities, more related to Ohloh,with analysis functionalities, which is the domain ofSonarQube. There are a number of datasets that gather datacoming from different Code Forges, which could be inte-grated in the crawling and analysis processes of RepoFinder.However, their availability is variable and, unfortunately,some of these data-collection projects are closed.

Please contact:

Francesca Arcelli Fontana and Marco ZanoniUniversity of Milan Bicocca, ItalyE-mail: {arcelli, zanoni}disco.unimib.it

To find a component satisfying specific requirements, we canstart from a simple query on a generic search engine or oneach Code Forge. The risk is that we receive many uselessanswers, because FLOSS project names are often ambiguousand difficult to recover. Even retrieving the source code of aparticular project can be difficult, because it may be man-aged by different portals, with different versioning technolo-gies (e.g., Git, SVN, Mercurial (HG), CVS, GNU Bazaar).

RepoFinder is implemented in a web application and hasbeen designed to retrieve and analyze the source code fromopen source software repositories. It performs these tasksthrough the following steps:• Crawling of widely known Code Forges (Github, Source-

forge, Launchpad and Google Code) through their APIs orby parsing of HTML pages; during this step, projects aretagged with labels extracted from the web pages crawledand the other available metadata (e.g., tags, forks, stars).

• Analysis of the components, by integrating external soft-ware for the computation of metrics and the detection ofcode smells in Java code. We integrated the followingtools: Checkstyle, JDepend, NICAD, PMD, Understandand another tool for metrics computation, called DFMC4J,developed at our Lab.

• Integration of data gathered by the code analyzers in adataset, to be used for statistical analyses.

• Browsing of the data through a search engine based onsimple google-like queries.

We have indexed more than 90,000 projects usingRepoFinder, and found more than 2,000 labels. Analyses canonly be applied to Java systems with a working Maven con-figuration. Maven ensures that all relevant sources areincluded in the analyses. It also retrieves all dependenciesneeded to compile the systems and to gather the requiredmetrics correctly. In fact, Maven automatically downloadslibrary dependencies, and depending on the configuration,can execute code generation tools (e.g., ANTLR, JOOQ),only selecting source code without test cases and, if required,can compile the system. RepoFinder can also visualize theresults gathered for one system and compare the results ofdifferent systems.

Figure 1: RepoFinder

Architecture


vITRO – vision-Testing

for Robustness

by Oliver Zendel, Wolfgang Herzner and MarkusMurschitz

VITRO is a methodology and tool set for testing

computer vision solutions with measurable coverage of

critical visual effects such as shadows, reflections, low

contrast, or mutual object occlusion. Such “criticalities”

can cause the computer vision (CV) solution to

misinterpret observed scenes and thus reduce its

robustness with respect to a given application

Usually, a large numbers of recorded images are used fortesting in order to cover as many of these “criticalities” aspossible. There are several problems with this approach:• Even with a very large set of recorded images there is no

guarantee that all relevant criticalities for the target appli-cation are covered. Hence, this approach is inappropriatefor certification.

• Recording large numbers of images is expensive. Addi-tionally, several situations cannot be arranged in realitydue to reasons of safety or effort.

• For evaluating test outputs, the expected results (called“ground truth” or GT, see Figure 1) are needed. Usually theseare generated manually, which is expensive and error prone.

A number of test data sets are currently publicly available,but mostly are not dedicated to specific applications. Theirutility for assessing a computer’s vision solution with respectto a target application is limited. Overall, the use of recordedtest data does not provide a satisfactory solution.

ApproachTo address this situation, AIT is developing VITRO, amodel-based test-case generation methodology and tool setthat produces test data with known coverage of application-specific typical and critical scenes. This development wasstarted in the ARTEMIS project R3-COP (ResilientReasoning Robotic Co-operating Systems). Figure 2 gives aschematic overview of all VITRO components.

Modelling: The “domain model” describes the objects(geometry, surface appearance etc.), which can occur in ren-dered scenes, together with relationships between and con-straints on them, as given by the application (e.g. on theirsize and relative positioning). It also contains informationabout background, illumination, climatic conditions, andcameras, i.e. the used sensors. For certain families of objects,such as clouds, generators are available or can be developedon demand.

Criticalities: A catalogue comprising over one thousandentries has been created by applying the risk analysis methodHAZOP (Hazard and Operability Study) to the realm of com-puter vision (CV). This process considered light sources,media (e.g. air phenomena), objects with their interactionsand observer effects. The latter include artifacts of the optics(e.g. aberration), the electronics (e.g. noise), and the soft-

ware. Only application-relevant entries of this catalogue areselected for the actual testing.

Scene generation: The parameters defined in the domainmodel, (e.g. object positions) establish a parameter space.This space is sampled with so-called “low discrepancy”which achieves an optimal coverage. Criticalities areincluded by means of further constraints or their occurrenceis checked. Specific scenarios can be defined for the genera-tion of characteristic curves or diagrams (see Figure 3).


Figure 1: Examples of test images and ground truths generated by

VITRO.

Figure 2: VITRO – schematic application process.

Figure 3: Example of test results visualization.


Building Systems

of Aerial Drones

by Luca Mottola, Niklas Wirström and Thiemo Voigt

SICS researchers are investigating how to equip aerial

drones with service-oriented interfaces and ways to

facilitate the programming of a fleet of drones.

Aerial drones, such as the one in Figure 1, are formidablemobile computing platforms. Their ability to move in analmost unconstrained manner allows them to sense from, andact on, areas that cannot be reached by traditional devices. Asthe cost of aerial drones drops (see Links 1 and 2) and dronetechnology progressively moves into the mainstream (SeeLinks 1,3), aerial drones are expected to add to the arsenal oftechnology that allows Cyber-Physical Systems to bridge thegap between the digital and physical worlds. This will enableapplications that are currently unfeasible, such as pollutionmonitoring at altitude (see Links 4 and 5) and autonomouslast-mile deliveries [3], while reducing costs compared withcurrent practices.

SICS researchers are currently investigating, for example,how to equip aerial drones with service-oriented interfaces,allowing existing business process and web mash-ups totransparently integrate the functionality provided by aerialdrones. These devices are thus perceived as “mobile” webservices providing sensory data that can be later input tostandard online services at company back-ends or in thecloud. The ability to seamlessly blend aerial drones withexisting IT practice will facilitate their large-scale adoptionwithin industry and the public sector.

To complement the efforts above, SICS is researching waysto facilitate the programming of fleets of drones, unveilingthe potential available when multiple such devices can coop-eratively carry out a higher-level mission. This is achievedby means of a custom programming abstraction that gives

Test data selection and generation: The previous step canyield redundant test images that are very similar to others.Therefore, test image candidates are characterized with prop-erties derived from their original scenes, e.g. visual fractionof certain objects. These are used to group candidates andselect representatives, which are rendered, and finally GT isgenerated for them.

Application: Generated test data can be applied to existingCV solutions for assessing their robustness with respect tothe modelled application. But VITRO can already be usedduring development (e.g. test-driven development). In thiscase, simple scenes are generated first. Once these areprocessed robustly, increasingly challenging test data followiteratively. Finally, adaptive and learning approaches canalso be trained and tested.

An Application ExampleFigure 3 shows just one of the possible visualizations of testresults. The ability of a home service robot to locate a certainbox depending on object distance and orientation was tested.Each dot represents a test case. Coloured dots denote suc-cessful detection, with colour corresponding to the algo-rithm’s own confidence measure, and with size representingthe location error against GT. Grey dots denote no detection.From this test run and its visualization we can derive that theconfidence measure is good (no large green dots), but theobject is detected only in few orientations.

ConclusionVITRO provides test data sets perfectly tailored to specificapplications with maximum expressive power about therobustness of the user’s computer vision solution. Generatedfrom models, the data are intrinsically consistent and pre-cisely evaluable. Its use provides the following benefits:• verifiable coverage of typical and critical situations• automatic test data generation and test evaluation• strongly reduced recording effort for real test data • no manual definition of expected results• testing of dangerous situations without risks• applicable even during development• support for adaptive/learning computer vision solutions• results usable for future certification.

Link: http://www.ait.ac.at/vitro/

References:

[1] O. Zendel, W. Herzner, M. Murschitz: "VITRO –Model based vision testing for robustness." ISR 2013 -44th International Symposium on Robotic (2013)[2] W. Herzner, E. Schoitsch: “R3-COP – Resilient Reason-ing Robotic Co-operating Systems”; DECS-Workshop atSAFECOMP 2013; in proc. of SAFECOMP 2013 Work-shops, ISBN 2-907801-09-0, pp.169-172[3] W. Herzner, M. Murschitz, O. Zendel; “Model-basedTest-Case Generation for Testing Robustness of VisionComponents of Robotic Systems“; in proc. of SAFECOMP2013 Workshops, ISBN 2-907801-09-0, pp.209-212

Please contact:

Wolfgang Herzner; AIT Austrian Institute of TechnologyGmbH/ AARITE-mail: [email protected]

Figure 1: Aerial drone


programmers the illusion that the drone fleet can be pro-grammed as a single device [1]. Such design hides the intri-cacies stemming from explicitly managing the communica-tion and coordination among drones, greatly easing their pro-gramming.

In addition to designing and implementing the solutionsabove, SICS is also creating actual prototypes using com-mercially available drone technology. Based on a customizedversion of the widespread AR.Drone 2.0, SICS is applyingthe results of these efforts in multiple real deployments. Forinstance, in Aquileia (Italy) the programming systems aboveare helping archeologists at the “Domus dei putti danzanti”obtain aerial maps of the site. The 32,000 m2 area, partlyshown in the picture, hosts the ruins of an ancient Romanhouse dating back to the fourth century BC. A video of one ofthe custom AR.Drone 2.0 in action in Aquileia can be viewedat youtube.com/watch?v=PPDGO-jc0Is.

Another area in which SICS is applying drone technology isin localization of wireless sensor networks (WSNs). Dronescan be used as mobile anchor-points to localize stationarysensor nodes that are deployed over a given area. SICS hasperformed experiments by connecting a small IEEE 802.15.4radio chip to a commercially available low-cost drone. Theradio was used to perform range and signal-strength meas-urements to a set of stationary sensor nodes. After fusing themeasurements, a median position accuracy of approximately1.5 m was measured. This is considered appropriate for awide range of WSN applications.

Links:

1. goo.gl/SPOIR2. goo.gl/n292Bw3. goo.gl/1qP8Jx4. goo.gl/stvh85. goo.gl/3bjByr

Reference:

[1] L. Mottola et al.: “LiftOff: Spatio-temporal Program-ming of Multiple Coordinating Aerial Drones”, Technicalreport 2013.46 – Politecnico di Milano, Italy.

Please contact:

Luca MottolaSICS, Sweden, and Politecnico di Milano, ItalyE-mail: [email protected]

MediaEval

2013 Evaluation

Campaign

by Gareth J. F. Jones and Martha Larson

MediaEval is an international multimedia benchmarking

initiative offering innovative new tasks to the

multimedia research community. MediaEval 2013

featured tasks incorporating video analysis, speech

search, music recommendation, analysis of affect and

location placing of images.

MediaEval is an international multimedia benchmarking ini-tiative that offers innovative new content analysis, indexingand search tasks to the multimedia community. MediaEvalfocuses on social and human aspects of multimedia andstrives to emphasize the ‘multi’ in multimedia, including theuse of image, video, speech, audio, tags, users, and context.MediaEval seeks to encourage novel and creative approachesto tackling these new and emerging multimedia tasks.Participation in MediaEval tasks is open to any researchgroup who signs up. MediaEval 2013 was the fourth evalua-tion campaign in its current form, which follows on from theVideoCLEF track at CLEF 2008 and CLEF 2009.

MediaEval 2013 offered 6 Main Tasks and 6 Brave NewTasks coordinated in cooperation with various researchgroups in Europe and elsewhere. The following Main Taskswere offered in the 2013 season:

• Placing Task: Geo-coordinate Prediction for Social Multi-media. The Placing Task required participants to estimatethe geographical coordinates (latitude and longitude) ofimages, as well as to predict how “placeable” a media itemactually is. The Placing Task integrated all aspects of mul-timedia: textual meta-data, audio, image, video, location,time, users and context.

• Search and Hyperlinking of Television Content Task: Thistask required participants to find relevant video segmentsto an information need and to provide a list of usefulhyperlinks for each of these segments. The task focused ontelevision data provided by the BBC and real informationneeds created by volunteer home users.

• Spoken Web Search: Spoken Term Detection for LowResource Languages The task involved searching foraudio content within audio content using an audio contentquery. This task is particularly interesting for speechresearchers in the area of spoken term detection or low-resource speech processing.

• Violent Scenes Detection in Film (Affect Task) This taskrequired participants to automatically detect portions ofmovies depicting violence. P Violence is defined as "phys-ical violence or accident resulting in human injury orpain". Participants were encouraged to deploy multimodalapproaches (audio, visual, text) to solve the task.


Events

goo.gl/SPOIR

goo.gl/n292Bw

goo.gl/1qP8Jx

goo.gl/stvh8

goo.gl/3bjByr


• Social Event Detection Task: This task required partici-pants to discover social events and organize the relatedmedia items in event-specific clusters. Social events ofinterest were planned by people, attended by people andthe social media captured by people.

• Visual Privacy: Preserving Privacy in Surveillance VideosFor this task, participants needed to propose methods forprotection of privacy sensitive elements (i.e., obscuringidentifying elements on people) in videos so that theywere rendered unrecognizable in a manner that is suitablefor computer vision tools and is perceived as appropriateto human viewers of the footage.

The MediaEval 2013 Brave New Tasks are incubators ofpotential Main Tasks for future years, and typically havesmaller numbers of participants. The MediaEval 2013 BraveNew Tasks were: Searching Similar Segments of SocialSpeech, Retrieving Diverse Social Images, CharacterizingEmotion in Music, Crowdsourcing for Social Multimedia,Question Answering for the Spoken Web, and SoundtrackSelection for Commercials (MusiClef Task).

The MeviaEval 2013 campaign culminated in the annualworkshop which was held at Reial Acadèmia de BonesLletres in Barcelona, Spain from 18th-19th October. Theworkshop brought together the task participants to report ontheir findings, discuss their approaches and learn from eachother. MediaEval participation increased again in 2013 witha total of 95 papers appearing in the Working Notes, and 100participants attending the workshop. In addition to organizerand participant presentations, the workshop featured invitedpresentations by Jana Eggink, BBC Research andDevelopment, London and Frank Hopfgartner, TechnischeUniversität Berlin, Germany. The Working Notes proceed-ings from the MediaEval 2013 workshop have again beenpublished by CEUR workshop proceedings.

MediaEval 2013 received support from a number of EU andnational projects and other organizations including: AXES,Chorus+, CUbRIK, COMMIT/, Promise, Social Sensor,

Media Mixer, MUCKE, Quaero, FWF, CNGL, Technicolorand CMU. We are also happy to acknowledge the support ofACM SIGIR for providing a grant to support internationalstudent travel.

The MediaEval 2014 campaign is currently gettingunderway with task resgistration opening in March 2014.The tasks will run through the spring and summer, with par-ticipants invited to present results of their work at theMediaEval 2014 Workshop which will again be held inBarcelona, Spain in October.

Further details of the MediaEval campaigns are availablefrom the MediaEval website.

Links:

MediaEval: http://www.multimediaeval.orgMediaEval 2013 online proceedings: http://ceur-ws.org/Vol-1043/

Please contact: Martha LarsonTU Delft, The NetherlandsE-mail: [email protected]

61

MediaEval 2013 participants.

Photo: John Brown.

Call for Participation

IEEE Cluster 2014

Madrid, 22-26 September 2014

Clusters have become the workhorse forcomputational science and engineeringresearch, powering innovation and dis-covery that advance science and society.They are the base for building today’srapidly evolving cloud and HPC infra-structures, and are used to solve some ofthe most complex problems. InSeptember, Madrid will be the meetingpoint of all these efforts thanks to theIEEE Cluster Conference.

The IEEE Cluster Conferences are oneof the greatest initiatives of TFCC andserve as a major international forum forpresenting and sharing recent accom-plishments and technological develop-ments in the field of cluster computing,as well as the use of cluster systems forscientific and commercial applications.

This year, the IEEE Cluster Conferencewill be held in Madrid from 22-26September at the School of IndustrialEngineering, Universidad Politécnica deMadrid. The organizing committee wel-comes paper submissions on innovativework that describe original research anddevelopment efforts in the area ofcluster computing.

Major topics of interest:• system design, configuration and

administrations• system software, middleware and tools• storage and file systems• algorithms, applications and perform-

ance.

As the evolution of cluster technologiesis expected to substantially impactemerging research areas like DataScience, the conference will offer spe-cific tracks, tutorials and workshops onprocessing and storage within this keyarea. And for the first time, a “StudentMentoring Track” is planned.

Important dates: • 24 April: Abstracts (required) due• 2 May: Full papers due• 19 May: Tutorial proposals due

More information:

http://www.cluster2014.org/


FMICS’14

19th International

Workshop on Formal

Methods for Industrial

Critical Systems

Florence, Italy, 11-12 September 2014

The aim of the FMICS workshop seriesis to provide a forum for researcherswho are interested in the developmentand application of formal methods inindustry. In particular, FMICS bringstogether scientists and engineers thatare active in the area of formal methodsand interested in exchanging their expe-riences in the industrial usage of thesemethods. The FMICS workshop seriesalso strives to promote research anddevelopment for the improvement offormal methods and tools for industrialapplications.

Topics of interest include:• design, specification, code generation

and testing based on formal methods• methods, techniques and tools to sup-

port automated analysis, certification,debugging, learning, optimizationand transformation of complex, dis-tributed, real-time systems andembedded systems

• verification and validation methodsthat address shortcomings of existingmethods with respect to their indus-trial applicability (e.g., scalabilityand usability issues)

• tools for the development of formaldesign descriptions

• case studies and experience reportson industrial applications of formalmethods, focusing on lessons learnedor identification of new researchdirections

• impact of the adoption of formalmethods on the development processand associated costs

• application of formal methods instandardization and industrialforums.

The workshop is organised by theERCIM Working Group on FormalMethods for Industrial Critical Systems

More information:

http://fmics2014.unifi.it/


Events

Call for Presentations

NAFEMS European

Conference:

Multiphysics

Simulation 2014

Manchester, U.K., 21-22 October2014

The NAFEMS conference will providean overview of state-of-the-art-methodsfor coupled and multiphysics simula-tions, mainly within the context ofindustrial applications and CAE.

The need for more realistic and accuratenumerical simulations, coupled with theincreasing availability of high-perform-ance computing, continues to drive thedemand for multiphysics simulations.Keeping up with this development ischallenging both for the software ven-dors, who have to implement increas-ingly complex tools for evermorediverse applications, and for the users ofthe software, who are being asked towork with new physical models outsidetheir main field of competence. It alsoposes a challenge to universities toinclude more interdisciplinary knowl-edge in the curriculum.

The conference brings togetherresearchers, developers, teachers, andusers of multiphysics simulationmethods to present new results,exchange ideas and discuss the chal-lenges. It is an excellent opportunity tomeet other practitioners in the field ofmultiphysics and coupled simulations.

Topics include:• industrial applications of multiphysics• collaborations of industry with aca-

demia• multiphysics and HPC• optimization in multiphysics• teaching multiphysics• validation of multiphysics simulations

The conference is organized jointly byNAFEMS Multiphysics WorkingGroup, MULTiPHYSICS, theInternational Society of Multiphysicsand Fraunhofer SCAI.

More information:

http://www.nafems.org/events/nafems/2014/mp2014/

http://www.nafems.org/events/nafems/2014/mp2014/


W3C Workshop

on the Web of Things

Berlin 25–26 June 2014

The Internet of Things is a hot topic in technical circles withmany potential domains of applications, for instance, homeautomation, security, healthcare, manufacturing, smart citiesand many more. The market potential is currently held backby fragmentation in the communication technologies and alack of shared approaches to services.

W3C is holding a workshop in Berlin on 25-26 June, hostedby Siemens. We are hoping to encourage discussion on awide range of topics, and to examine the potential for openstandards as a basis for services, either between devices, atthe network edge, e.g. in home hubs, or in the cloud. Thecombination of the Web of devices and the Web of data isexpected to enable open markets of services with sweepingeconomic and societal impact.

The workshop is funded by the EU Compose (CollaborativeOpen Market to Place Objects at your Service) project.W3C/ERCIM is a partner of the project.

The workshop is free, but participants need to submit a briefexpression of interest or a position paper.

More information:

http://www.w3.org/2014/02/wot/


In Brief

CWI joins Sino-European

Research Network LIAMA

Centrum Wiskunde & Informatica (CWI) has officiallyjoined research network LIAMA. The Sino-EuropeanLaboratory in Computer Science, Automation and AppliedMathematics (LIAMA) is a research lab consisting ofEuropean and Chinese research institutes in the field ofmathematics and computer science. LIAMA conductsresearch, training and transfer projects in these fields. CWIjoined the lab as one of the founding members.

CWI will join two projects within LIAMA: CRYPT, aimedat studying secret-key and public-key cryptanalysis, andTEMPO, focusing on the development of safer and morereliable embedded systems.

Jos Baeten (general director CWI): “Joining LIAMA givesour researchers the opportunity to expand their internationalcooperation in Asia and work with fellow top researchers atChinese universities. I believe that our membership will bemutually beneficial and I am looking forward to our futurecooperation.”

LIAMA was founded in 1997 by Inria and the ChineseAcademy of Sciences (CAS). In 2008 the lab was opened forother European research institutes. Another foundingmember is CNRS. Also in 2008, LIAMA became a NationalCentre for International Research of the Chinese Ministry ofScience and Technology. It currently consists of 11 Chineseand 12 European research institutes.

More information:

LIAMA website: http://liama.ia.ac.cn/

MonetDB Solutions

Newest CWI Spin-off

CWI’s 22nd spin-off company was recently launched:MonetDB Solutions. This consulting company is specializedin the development of database technologies for businessanalytics. It is established by the founders of MonetDB, theworld's first and most widespread open-source column-storedatabase management system, and led by Ying Zhang.Bundling the expertises of world-leading researchers andengineers, its core services involve technical consultancy,architectural review, performance assessment, migrationand upgrade services and training.

The Web of Things workshop topics.

ERCIM is the European Host of the World Wide Web Consortium.

Institut National de Recherche en Informatique et en AutomatiqueB.P. 105, F-78153 Le Chesnay, Francehttp://www.inria.fr/

Technical Research Centre of FinlandPO Box 1000FIN-02044 VTT, Finlandhttp://www.vtt.fi/

Austrian Association for Research in ITc/o Österreichische Computer GesellschaftWollzeile 1-3, A-1010 Wien, Austriahttp://www.aarit.at/

Norwegian University of Science and Technology Faculty of Information Technology, Mathematics and Electri-cal Engineering, N 7491 Trondheim, Norwayhttp://www.ntnu.no/

Universty of WarsawFaculty of Mathematics, Informatics and MechanicsBanacha 2, 02-097 Warsaw, Polandhttp://www.mimuw.edu.pl/

Consiglio Nazionale delle Ricerche, ISTI-CNRArea della Ricerca CNR di Pisa, Via G. Moruzzi 1, 56124 Pisa, Italyhttp://www.isti.cnr.it/

Centrum Wiskunde & InformaticaScience Park 123, NL-1098 XG Amsterdam, The Netherlandshttp://www.cwi.nl/

Foundation for Research and Technology – HellasInstitute of Computer ScienceP.O. Box 1385, GR-71110 Heraklion, Crete, Greecehttp://www.ics.forth.gr/FORTH

Fonds National de la Recherche6, rue Antoine de Saint-Exupéry, B.P. 1777L-1017 Luxembourg-Kirchberghttp://www.fnr.lu/

FWOEgmontstraat 5B-1000 Brussels, Belgiumhttp://www.fwo.be/

F.R.S.-FNRSrue d’Egmont 5B-1000 Brussels, Belgiumhttp://www.fnrs.be/

Fraunhofer ICT GroupAnna-Louisa-Karsch-Str. 210178 Berlin, Germanyhttp://www.iuk.fraunhofer.de/

SICS Swedish ICTBox 1263, SE-164 29 Kista, Swedenhttp://www.sics.se/

University of GenevaCentre Universitaire d'Informatique Battelle Bat. A, 7 rte de Drize, CH-1227 Carougehttp://cui.unige.ch

Magyar Tudományos AkadémiaSzámítástechnikai és Automatizálási Kutató IntézetP.O. Box 63, H-1518 Budapest, Hungaryhttp://www.sztaki.hu/

University of CyprusP.O. Box 205371678 Nicosia, Cyprushttp://www.cs.ucy.ac.cy/

Spanish Research Consortium for Informatics and MathematicsD3301, Facultad de Informática, Universidad Politécnica de Madrid28660 Boadilla del Monte, Madrid, Spain,http://www.sparcim.es/

Science and Technology Facilities CouncilRutherford Appleton LaboratoryChilton, Didcot, Oxfordshire OX11 0QX, United Kingdomhttp://www.scitech.ac.uk/

Czech Research Consortium for Informatics and MathematicsFI MU, Botanicka 68a, CZ-602 00 Brno, Czech Republichttp://www.utia.cas.cz/CRCIM/home.html

Subscribe to ERCIM News and order back copies at http://ercim-news.ercim.eu/

ERCIM – the European Research Consortium for Informatics and Mathematics is an organisa-

tion dedicated to the advancement of European research and development, in information

technology and applied mathematics. Its member institutions aim to foster collaborative work

within the European research community and to increase co-operation with European industry.

Portuguese ERCIM Groupingc/o INESC Porto, Campus da FEUP, Rua Dr. Roberto Frias, nº 378,4200-465 Porto, Portugal

I.S.I. – Industrial Systems InstitutePatras Science Park buildingPlatani, Patras, Greece, GR-26504 http://www.isi.gr/

Universty of WroclawInstitute of Computer ScienceJoliot-Curie 15, 50–383 Wroclaw, Polandhttp://www.ii.uni.wroc.pl/

University of SouthamptonUniversity RoadSouthampton SO17 1BJ, United Kingdomhttp://www.southampton.ac.uk/

Documents

En97 web