Towards Scenario-Based Design and Verification of Resilient Cyber-Physical Systems Extended Abstract

A cyber-physical system consists of computing devices communicating with one another and interacting with the physical world via sensors and actuators. Increasingly, such systems are everywhere, from smart buildings to autonomous vehicles to mission-critical military systems. Model-based design offers a promising approach for assisting developers to build cyber-physical systems in a systematic manner. In this methodology, a designer first constructs a model, with mathematically precise semantics, of the system under design, and performs extensive analysis with respect to correctness requirements before generating the implementation from the model [1], [2], [3]. However, as new vulnerabilities are discovered, requirements evolve aimed at ensuring resiliency. Current methodology demands an expensive, and at times infeasible, redesign and reimplementation of the system from scratch. The goal of the proposed methodology and the associated toolkit, which we call REAFFIRM, is to facilitate integration of evolving resiliency requirements in model-based design and verification. Traditionally a model of a cyber-physical system consists of block diagrams describing the system architecture and a combination of state machines and differential equations describing the system dynamics [4]. Building a behavioral model at design time that offers resiliency for all kinds of failures is notoriously difficult. The REAFFIRM solution to design for resiliency is to allow a designer to specify scenarios as a separate part of the model description. A scenario describes a finite execution of the system corresponding to a specific situation, and consists of the sequences of actions by different agents including interaction among them. Such scenarios were first used in design of telecommunication software to specify different features separately, and were formalized. Our insight is that scenarios can be used naturally to describe how a system should respond when a particular sensor fails or a previously unanticipated attack is discovered. Furthermore, negative scenarios can express