Log In Sign Up

Runtime Composition Of Systems of Interacting Cyber-Physical Components

We introduce a transition system based specification of cyber-physical systems whose semantics is compositional with respect to a family of algebraic products. We give sufficient conditions for execution of a product to be correctly implemented by a lazy expansion of the product construction. The transition system algebra is implemented in the Maude rewriting logic system, and we report a simple case study illustrating compositional specification.


page 1

page 2

page 3

page 4


A Rewriting Framework for Interacting Cyber-Physical Agents

The analysis of cyber-physical systems (CPS) is challenging due to the l...

A Formal Framework for Distributed Cyber-Physical Systems

Composition is an important feature of a specification language, as it e...

Adaptive Testing for Specification Coverage

Ensuring correctness of cyber-physical systems (CPS) is an extremely cha...

Compositional specification in rewriting logic

Rewriting logic is naturally concurrent: several subterms of the state t...

Extended Algebraic State Transition Diagrams

Algebraic State-Transition Diagrams (ASTDs) are extensions of common aut...

A Semantic Model for Interacting Cyber-Physical Systems

We propose a component-based semantic model for Cyber-Physical Systems (...

Compositional Cyber-Physical Systems Theory

This dissertation builds a compositional cyber-physical systems theory t...

1 Introduction

We model a cyber-physical system as a pair consisting of an interface and a behavior. We call such pairs components. The interface is a set of events and the behavior is a set of infinite sequences of observations called Timed-Event Stream (TES), where an observation is a pair of a set of events from the interface and a time stamp.

In previous work, we define a family of parametrized binary products to compose components. The parameters of a product consist of a composability relation on TESs, which says which pairs of TESs can compose, and a composition function, which says how two TESs compose to form a new TES. For instance, the synchronous product of two components with shared events composes pairs of TESs, one from each component behavior, such that shared events occur at the same time. The resulting TES interleaves observations from a pair of composable TESs. In order to bridge the gap between a denotational model and an operational model, we give a co-inductive definition of composability relations on TESs as a lift of composability relations on observations. Such locally defined relations provide a step-wise mechanism to check whether two TESs are composable.

In this paper, we give an operational mechanism to specify components by transition systems labeled with observations, called TES transition systems. Different TES transition systems may denote the same component, as a component is oblivious to internal non-determinism of the machinery that manifests its behavior.

As for components, we introduce a family of parametrized algebraic products on TES transition systems. The parameter here is a composability relation on observations, and each transition in the product is the result of the composition of a pair of transitions with composable labels. We show that the TES transition system component semantics is compositional with respect to such products, i.e., the component resulting from the product of two TES transition systems is equal to the product of the components resulting from each TES transition system. On components, the composability relation is co-inductively lifted from observations to TESs, and the composition function is set union on observations and interleaving on streams.

Because the composability relation on observations is a step-wise operation, it may lead to deadlock states in the product TES transition system, i.e., states with no outgoing transitions. We call two TES transition systems compatible with respect to a composability relation on observations if, for every reachable pair of states, there is at least one pair of transitions whose pair of labels is composable. We give some sufficient conditions for TES transition systems to be compatible, and show that if two TES transitions system are compatible, then their product can be done lazily, i.e., step by step at runtime.

To carry out experiments, we have implemented TES transition systems in the Maude rewriting logic system. We use this implementation to analyze properties of the behavior of a set of self-sorting robots. In this example, each robot has a unique integer identifier, its own battery, and interacts with others via a shared grid. Robots, batteries, and grids are all modeled as TES transition systems. We add a set of swap protocols each of which coordinates a pair of robots to swap their positions when a robot faces another robot with a lower identifier and a higher -axis coordinate. We analyze the resulting system by querying if a robot can reach its sorted configuration on the grid. The interaction among all TES transition systems is captured by a suitable composability relation on observations.

Our work has the following benefits. First, performing lazy composition keeps the representation of an interacting system small. Second, step-wise runtime composition renders our runtime framework modular, where run-time replacement of individual components becomes possible (as long as the update complies with some rules). Finally, the runtime framework more closely matches the architecture of a distributed framework, where entities are physically separated and no party may have access to the whole description of the entire system.

2 Components in interaction

In [DBLP:journals/corr/abs-2110-02214], we give a unified semantic model to capture cyber and physical aspects of processes as components and characterize their various types of interactions as user-defined products in an algebraic framework. Moreover, we show some general conditions for products on components to be associative, commutative, and idempotent. In this section, we recall the basic definitions of a component and product from [DBLP:journals/corr/abs-2110-02214], and introduce in Section 2.2 some instances of product that suit our example in this paper.


Given , let be the finite prefix of size of and let be an equivalence relation on such that if and only if . Let be the set of left factors of a set , defined as . We write for the -th derivative of , i.e., the stream such that for all .

A timed-event stream over a set of events is an infinite sequence of observations, where an observation consists of a pair of a subset of events in , called observable, and a positive real number as time stamp. A timed-event stream (TES) has the additional properties that consecutive time stamps are increasing and non-Zeno, i.e., for any TES and any time , there exists an element in the sequence such that . We use to denote the derivative of the stream , such that for all .

We recall the greatest post fixed point of a monotone operator, that we later use as a definition scheme and as a proof principle. Let be any set and let be the set of all its subsets. If is a monotone operator, that is, implies for all and , then has a greatest fixed point satisfying:

This equality can be used as a proof principle: in order to prove that , for any , it suffices to show that is a post-fixed point of , that is, .

2.1 Components

Components are the parts that forms cyber-physical systems. Therefore, a component uniformly models both cyber and physical aspects through sequence of observables.

Definition 1 (Component)

A component is a pair of an interface , and a behavior .

The product of two components defines a new component whose behavior is function of the behavior of both components, under some constraints. We call a composability relation such constraint, and say that are two composable TESs if . Furthermore, two TESs may then compose to form a new TES. We call a composition function such function, and write for the composition of and .

Let and be two components. Let be a composability relation and be a composition function.

Definition 2 (Product)

The product of and under is the component where

While the behaviors of a component are streams, it is natural to consider termination of a component. We express a terminating behavior of component as an element such that there exists with . In other words, a terminating behavior is such that, starting from the -th observation, all next observations are empty.

Given a component , we define to be the component that may terminate after every sequence of observables. Formally, is the component whose behavior is the prefix closure of , i.e., the component , where

In [DBLP:journals/corr/abs-2110-02214], we give a co-inductive definition for some and given a composability relation on observations, and a composition function on observations. We use to range over composability relation on observations. Let be a parametric composability relation on observations, and let be such that, for any :

The lifting of on TESs, written , is the parametrized relation obtained by taking the greatest post fixed point of the function for arbitrary pair , i.e., the relation .

Then, let be a relation on observables. We say that two observations are synchronous under if, intuitively, the two following conditions hold:

  1. every observable that can compose (under ) with another observable must occur simultaneously with one of its related observables; and

  2. only an observable that does not compose (under ) with any other observable can happen before another observable, i.e., at a strictly lower time.

To formalize the conditions above, we use the independence relation where .

The synchronous composability relation on observations is the smallest set such that, for and :

  • if and and then, for all time stamps , .

  • if then for all and , . Reciprocally, if then for all and , ;

Let be the product defined as where with the universal set of events. Intuitively, synchronizes all observations that contain events shared by the interface of two components. We recall that the composition of two TESs and is such that it interleaves, in order, all observations with distinct time stamps, and takes the union of two observations with the same time stamp, i.e., the lifting of set union to TESs, written , is such that, for where with :

As a result of [DBLP:journals/corr/abs-2110-02214], is associative and commutative. Section 2.2 introduces a motivating example in which robots, roaming on a shared physical medium, must coordinate to sort themselves. We define algebraically the system consisting of 5 robots and a grid, to which we then add some coordinating protocol components.

2.2 Self-sorting robots

Consider a robot component , that moves on a grid and reads its position. Its interface consists of the coordinates that it reads and the direction of its moves, i.e., . The robot freely moves and observes its position at anytime, then its behavior is a subset . We use to refer to an arbitrary robot component with interface .

We aim to model the physical constraints explicitly. Thus, the grid on which the robot moves is another component. Its interface is parametrized by a set of robot identifiers, and by a pair for its size on the -axis and -axis respectively, i.e., . The behavior of a grid is a set such that, for any and for any element , if then for every : two robots cannot share the same location. Note that the physics has some internal constraints (no two robots can share the same cell) that no robot a priori is aware of. Typically, the move of a robot coincides with a change of state of the grid: if a robot is at position and does a move , then the next observable position for robot will be . We give in Example 1 an operational definition of the grid component. We use to refer to an arbitrary grid component with set of events .

Figure 1 shows five robot instances, each of which has a unique and distinct natural number assigned, positioned at an initial location on a grid. The goal of the robots in this example is to move around on the grid such that they end up in a final state where they line-up in the sorted order according to their assigned numbers.

Figure 1: Initial state of the unsorted robots (left), and final state of the sorted robots (right).
N - - - -
W - - - -
- - - -
N - - - -
W E N - -
S E - -
N - - - N
W E - W E
S - - - S
Table 1: Each table displays the three first observables at times , , and for three TESs in the behavior of the product of components , , , , and on the grid of Figure 1. We omit the subscript and use the column to identify the events. The symbol - represents the absence of observation in the TES.

We write the composite cyber-physical system consisting of robot components interacting with a shared grid as the following expression:

Three first observations for three behaviors are displayed in Table 1. Each behavior exposes different degrees of concurrency, where in the left behavior, only robot moves, while in the middle behavior, robots and swap their positions, and in the right behavior both and swap their positions with and , respectively.

2.3 Properties of components and coordination

A component may satisfy some properties on its behavior. We consider trace properties and say that satisfies if and only if , i.e., all the behavior of is included in the property .

For the set of robots and the grid, we consider the following property: eventually, the position of each robot is , i.e., every robot successfully reaches its place.

This property is a trace property, which we call and consists of every behavior such that there exists an with and for all robots . As shown in Table 1, the set of behaviors for the product of robots is large, and the property does not (necessarily) hold a priori: there exists a composite behavior for the component such that .

Robots may beforehand decide on some strategies to swap and move on the grid such that their composition satisfies the property . For instance, consider the following strategy for each robot :

  • swapping: if the last read of its location is such that , then move North, then West, then South.

  • pursuing: otherwise, move East.

Remember that the grid prevents two robots from moving to the same cell, which is therefore removed from the observable behavior. We emphasize that some sequences of moves for each robot may deadlock, and therefore are not part of the behavior of the system of robots. Consider Figure 2, for which each robot follows its internal strategy. Because of non-determinism introduced by the timing of each observations, one may consider the following sequence of observations: first, move North, then West; in the meantime, moves West, followed by , , and . By a similar sequence of moves, the set of robots ends in the configuration on the right of Figure 2. In this position and for each robot, the next move dictated by its internal strategy is disallowed, which corresponds to a deadlock. While behaviors do not contain finite sequences of observations, which makes the scenario of Figure 2 not expressible as a TES, such scenario may occur in practice. We give in next Section some analysis to prevent such behavior to happen.

Figure 2: Initial state of the unsorted robot (left) leading to a possible deadlock (right) if each robot follows its strategy.

Alternatively, the collection of robots may be coordinated by an external protocol that guides their moves. Besides considering the robot and the grid components, we add a third kind of component that acts as a coordinator. In other words, we make the protocol used by robots to interact explicit and external to them and the grid; i.e., we assume exogenous coordination. Exogenous coordination allows robots to decide a priori on some strategies to swap and move on the grid, in which case their external coordinator component merely unconditionally facilitates their interactions. Alternatively, the external coordinator component may implement a protocol that guides the moves of a set of clueless robots into their destined final locations. The most intuitive of such coordinator is the property itself as a component. Indeed, let be such that with and . Then, and as shown in [DBLP:journals/corr/abs-2110-02214], the coordinated component trivially satisfies the property . While easily specified, such coordination component is non-deterministic and not easily implementable. We provide an example of a deterministic coordinators.

Given two robot identifiers and , we introduce the swap component that coordinates the two robots and to swap their positions. Its interface contains the following events:

  • start(S(,)) and end(S(, )) that respectively notify the beginning and the end of an interaction with and . Those events are observed when the swap protocol is starting or ending an interaction with either or with .

  • and that occur when the protocol reads, respectively, the position of robot and robot ,

  • and for all that occur when the robots and move;

  • locked(S(,)) and unlocked(S(,)) that occur, respectively, when another protocol begin and end an interaction with either and .

The behavior of a swapping protocol is such that, it starts its protocol sequence by an observable start(S()), then it moves North, then East, then West and South. The protocol starts the sequence only if it reads a position for and such that is on the cell next to on the -axis. Once the sequence of moves is complete, the protocol outputs the observable end(S(, )). If the protocol is not swapping two robots, or is not locked, then robots can freely read their positions.

Swapping protocols interact with each others by locking other protocols that share the same robot identifiers. Therefore, if S(,) starts its protocol sequence, then S(, ) synchronizes with a locked event locked(S(,)), for . Then, cannot swap with other robots unless S(,) completes its sequence, in which case end(S(, )) synchronizes with unlocked(S(,)) for . We extend the underlying composability relation on observables such that, for all and :


For each pair of robots , such that , we introduce a swapping protocol S(, ). As a result, the coordinated system is given by the following composition:

Note that the definition of and of impose that, if one protocol starts its sequence, then all protocols that share some robot identifiers synchronize with a lock event. Similar behavior occurs at the end of the sequence.

The study of the coordinated system, and the analysis of its possible deadlock is the object of Section 3. We give an operational specification of components using TES transition systems. We define the possibility for such operational components to deadlock, and give some conditions to prevent deadlock from occurring given a composition of deadlock free components.

3 An operational specification of components

In Section 2.1, we give a declarative specification of components, and considers infinite behaviors only. We give, in Section 3.1, an operational specification of components using TES transition systems. We relate the parametrized product of TES transition systems with the parametrized product on their corresponding components, and show its correctness. The composition of two TES transition systems may lead to transitions that are not composable, and ultimately to a deadlock, i.e., a state with no outgoing transitions.

3.1 TES transition systems.

The behavior of a component as in Definition 1 is a set of TESs. We give an operational definition of such set using a labelled transition system.

Definition 3 (TES transition system)

A TES transition system is a triple where is a set of states, is a set of events, and is a labeled transition relation, where labels are observations.

We present two different ways to give a semantics to a TES transition system: inductive and co-inductive. Both definitions give the same behavior, as shown in Theorem 3.1, and we use interchangeably each definition to simplify the proofs of, e.g., Theorem 3.2.

Semantics 1 (runs).

Let be a TES transition system. Given , we write for the sequence of transitions . We use and to denote, respectively, the set of finite and infinite sequences of consecutive transitions in . Then, finite sequences of observables form the set and infinite ones, the set where, as introduced above, is the prefix of size of . The semantics of such a TES transition system , starting in a state , is the component .

Semantics 2 (greatest post fixed point)

Alternatively, the semantics of a TES transition system is the greatest post fixed point of a function over sets of TESs paired with a state. For a TES transition system , let . We introduce as the function:

We can show that is monotonous, and therefore has a greatest post fixed point . We write for any . Note that the two semantics coincide.

Theorem 3.1 (Equivalence)

For all , .


Let and .

In the fourth equivalence, we state that the infinite sequence has, as sequence of labels, the sequence of observations in . We prove the step by induction. Let , and let be such that, for all , with and . Then, given that , there exists a transition and there exists such that, for all , and , which proves the implication. The other direction of the equivalence is simpler. If there exists such that for all , , then we have a witness, for every , that is an element of . ∎

Remark 1 (Deadlock)

Observe that which, in the case of strict inclusion, captures the fact that some states may have no outgoing transitions and therefore deadlock.

Remark 2 (Expressivness)

There may be two different TES transition systems and such that , i.e., a set of TESs is not uniquely characterized by a TES transition system.

Example 1

The behavior of a robot introduced earlier is a TES transition system where for abitrary and in and .

Similarly, the behavior of a grid is a TES transition system where:

  • ,

  • for abitrary and in , such that

    • implies is updated according to the direction if the resulting position is within the bounds of the grid;

    • implies and ;

    • , otherwise.

The behavior of a swap protocol S(,) with is a TES transition system where, for with :

  • ;

  • ;

  • ;

  • ;

  • ;

  • ;

The product of two components is parametrized by a composability relation and a composition function and syntactically constructs the product of two TES transition systems.

Definition 4 (Product)

The product of two TES transition systems and under the constraint is the TES transition system such that:

Observe that the product is defined on pairs of transitions, which implies that if or has a state without outgoing transition, then the product has no outgoing transitions from that state. The reciprocal is, however, not true in general.

Theorem 3.2 states that the product of TES transition systems denotes (given a state) the set of TESs that corresponds to the product of the corresponding components (in their respective states). Then, the product that we define on TES transition systems does not add nor remove behaviors with respect to the product on their respective components.

Theorem 3.2 (Correctness)

For all TES transition systems and , and for all composability relation :


Let and . The proof goes in two directions:

  1. We first show that, for any in the behavior of , there exist and such that and .

  2. We then show that, for any and such that , we have .

We recall the definition of