ICCPS Program

Welcome and Opening Remarks

by Matt Welsh, OctoML

ICCPS Opening Remarks

As various smart services are increasingly deployed in modern cities, many unexpected conflicts arise due to various physical world couplings. Existing solutions for conflict resolution often rely on centralized control to enforce predetermined and fixed priorities of different services, which is challenging due to the inconsistent and private objectives of the services. Also, the centralized solutions miss opportunities to more effectively resolve conflicts according to their spatiotemporal locality of the conflicts. To address this issue, we design a decentralized negotiation and conflict resolution framework named DeResolver, which allows services to resolve conflicts by communicating and negotiating with each other to reach a Pareto-optimal agreement autonomously and efficiently. Our design features a two-level semi-supervised learning-based algorithm to predict acceptable proposals and their rankings of each opponent through the negotiation. Our design is evaluated with a smart city case study of three services: intelligent traffic light control, pedestrian service, and environmental control. In this case study, a data-driven evaluation is conducted using a large data set consisting of the GPS locations of 246 surveillance cameras and an automatic traffic monitoring system with more than 3 million records per day to extract real-world vehicle routes. The evaluation results show that our solution achieves much more balanced results, i.e., only increasing the average waiting time of vehicles, the measurement metric of intelligent traffic light control service, by 6.8% while reducing the weighted sum of air pollutant emission, measured for environment control service, by 12.1%, and the pedestrian waiting time, the measurement metric of pedestrian service, by 33.1%, compared to priority-based solution.

The increasing penetration level of distributed energy resources (DERs) substantially expands the attack surface of the modern power grid. By compromising DERs, adversaries are capable of destabilizing the grid and potentially causing large-area blackouts. Due to the limited administrative control over DERs, constrained computational capabilities, and possible physical accesses to DERs, current device level defenses are insufficient to defend against malicious attacks on DERs. To compensate the shortcomings of device level defenses, in this paper, we develop a system-level risk-aware DER management framework (RADM) to mitigate the attack impacts. We propose a metric, trust score, to dynamically evaluate the trustworthiness of DERs. The trust scores are initialized with offline trust scores derived from static information and then regularly updated with online trust scores derived from a physics-guided Gaussian Process Regressor using real-time data. The trust scores are integrated into the grid control decision making process by balancing the grid performance and the security risks. Extensive simulations are conducted to justify the effectiveness of the proposed method.

The performance of multimodal mobility systems relies on the seamless integration of conventional mass transit services and the advent of Mobility-on-Demand (MoD) services. Prior work is limited to individually improving various transport networks' operations or linking a new mode to an existing system. In this work, we attempt to solve transit network design and pricing problems of multimodal mobility systems en masse. An operator (public transit agency or private transit operator) determines frequency settings of the mass transit system, flows of the MoD service, and prices for each trip to optimize the overall welfare. A primal-dual approach, inspired by the market design literature, yields a compact mixed integer linear programming (MILP) formulation. However, a key computational challenge remains in allocating an exponential number of hybrid modes accessible to travelers. We provide a tractable solution approach through a decomposition scheme and approximation algorithm that accelerates the computation and enables optimization of large-scale problem instances. Using a case study in Nashville, Tennessee, we demonstrate the value of the proposed model. We also show that our algorithm reduces the average runtime by 60% compared to advanced MILP solvers. This result seeks to establish a generic and simple-to-implement way of revamping and redesigning regional mobility systems in order to meet the increase in travel demand and integrate traditional fixed-line mass transit systems with new demand-responsive services.

A classical problem in city-scale cyber-physical systems (CPS) is resource allocation under uncertainty. Typically, such problems are modeled as Markov (or semi-Markov) decision processes. While online, offline, and decentralized approaches have been applied to such problems, they have difficulty scaling to large decision problems. We present a general approach to hierarchical planning that leverages structure in city-level CPS problems for resource allocation under uncertainty. We use emergency response as a case study and show how a large resource allocation problem can be split into smaller problems. We then create a principled framework for solving the smaller problems and tackling the interaction between them. Finally, we use real-world data from Nashville, Tennessee, a major metropolitan area in the United States, to validate our approach. Our experiments show that the proposed approach out-performs state-of-the-art approaches used in the field of emergency response.

Several recent works consider the personalized route planning based on user profiles, none of which accounts for human trust. We argue that human trust is an important factor to consider when planning routes for automated vehicles. This paper presents the first trust-based route planning approach for automated vehicles. We formalize the human-vehicle interaction as a partially observable Markov decision process (POMDP) and model trust as a partially observable state variable of the POMDP, representing human's hidden mental state. We designed and conducted an online user study with 100 participants on the Amazon Mechanical Turk platform to collect data of users' trust in automated vehicles. We build data-driven models of trust dynamics and takeover decisions, which are incorporated in the POMDP framework. We compute optimal routes for automated vehicles by solving optimal policies in the POMDP planning. We evaluated the resulting routes via human subject experiments with 22 participants on a driving simulator. The experimental results show that participants taking the trust-based route generally resulted in higher cumulative POMDP rewards and reported more positive responses in the after-driving survey than those taking the baseline trust-free route.

A popular metric for measuring progress in autonomous driving has been the "miles per intervention". This is nowhere near a sufficient metric and it does not allow for a fair comparison between the capabilities of two autonomous vehicles (AVs). In this paper we propose Scenario2Vector - a Scenario Description Language (SDL) based embedding for traffic situations that allows us to automatically search for similar traffic situations from large AV data-sets. Our SDL embedding distills a traffic situation experienced by an AV into its canonical components - actors, actions, and the traffic scene. We can then use this embedding to evaluate similarity of different traffic situations in vector space. We have also created a first of its kind, Traffic Scenario Similarity (TSS) dataset which contains human ranking annotations for the similarity between traffic scenarios. Using the TSS data, we compare our SDL embedding -with textual caption based search methods such as Sentence2Vector. We find that Scenario2Vector outperforms Sentence2Vector by 13% ; and is a promising step towards enabling fair comparisons among AVs by inspecting how they perform in similar traffic situations. We hope that Scenario2Vector can have a similar impact to the AV community that Word2Vec/Sent2Vec have had in Natural Language Processing datasets.

Connected Autonomous Vehicles (CAVs) are expected to enable reliable and efficient transportation systems. Most motion planning algorithms for multi-agent systems are not completely safe because they implicitly assume that all vehicles/agents will execute the expected plan with a small error. This assumption, however, is hard to keep for CAVs since they may have to slow down (e.g., to yield to a jaywalker) or are forced to stop (e.g. break down), sometimes even without a notice. Responsibility-Sensitive Safety (RSS) defines a set of safety rules for each driving scenario to ensure that a vehicle will not cause an accident irrespective of other vehicles' behavior. RSS rules, however, are hard to evaluate for merge, intersection, and unstructured road scenarios. In addition, deadlock situations can happen that are not considered by the RSS. In this paper, we propose a generic version of RSS rules for CAVs that can be applied to any driving scenario. We integrate the proposed RSS rules with the CAV's motion planning algorithm to enable cooperative driving of CAVs. Our approach can also detect and resolve deadlocks in a decentralized manner. We have conducted experiments to verify that a CAV does not cause an accident no matter when other CAVs slow down or stop. We also showcase our deadlock detection and resolution mechanism. Finally, we compare the average velocity and fuel consumption of vehicles when they drive autonomously but not connected with the case that they are connected.

This work addresses whether a human-in-the-loop cyber-physical system (HCPS) can be effective in improving the longitudinal control of an individual vehicle in a traffic flow. We introduce the CAN Coach, which is a system that gives feedback to the human-in-the-loop using radar data (relative speed and position information to objects ahead) that is available on the controller area network (CAN). Using a cohort of six human subjects driving an instrumented vehicle, we compare the ability of the human-in-the-loop driver to achieve a constant time-gap control policy using only human-based visual perception to the car ahead, and by augmenting human perception with audible feedback from CAN sensor data. The addition of CAN-based feedback reduces the mean time-gap error by an average of 73%, and also improves the consistency of the human by reducing the standard deviation of the time-gap error by 53%. We remove human perception from the loop using a ghost mode in which the human-in-the-loop is coached to track a virtual vehicle on the road, rather than a physical one. The loss of visual perception of the vehicle ahead degrades the performance for most drivers, but by varying amounts. We show that human subjects can match the velocity of the lead vehicle ahead with and without CAN-based feedback, but velocity matching does not offer regulation of vehicle spacing. The viability of dynamic time-gap control is also demonstrated. We conclude that (1) it is possible to coach drivers to improve performance on driving tasks using CAN data, and (2) it is a true HCPS, since removing human perception from the control loop reduces performance at the given control objective.

Plug-in Electric Vehicles Demand Modeling in Smart Grids: A Deep Learning-based Approach

Demo Abstract: SRAM Optimized Porting and Execution of Machine Learning Classifiers on MCU-based IoT Devices

Robust Out-of-distribution Motion Detection and Localizaton in Autonomous CPS

Machine Learning Assisted Propeller Design

A Smart City Simulation Platform with Uncertainty

Safer Adaptive Cruise Control for Traffic Wave Dampening

by Bruno Sinopoli, Washington University in St. Louis

Monitoring of hybrid systems attracts both scientific and practical attention. However, monitoring algorithms suffer from the methodological difficulty of only observing sampled discrete-time signals, while real behaviors are continuous-time signals. To mitigate this problem of sampling uncertainties, we introduce a model-bounded monitoring scheme, where we use prior knowledge about the target system to prune interpolation candidates. Technically, we express such prior knowledge by linear hybrid automata (LHAs)---the LHAs are called bounding models. We introduce a novel notion of monitored language of LHAs, and we reduce the monitoring problem to the membership problem of the monitored language. We present two partial algorithms---one is via reduction to reachability in LHAs and the other is a direct one using polyhedra---and show that these methods, and thus the proposed model-bounded monitoring scheme, are efficient and practically relevant.

In system analysis, conformance indicates that two systems simultaneously satisfy the same set of specifications of interest; thus, the results from analyzing one system automatically transfer to the other, or one system can safely replace the other in practice. In this work, we study the probabilistic conformance of cyber-physical systems (CPS). We propose a notion of (approximate) probabilistic conformance for sets of complex specifications expressed by the Signal Temporal Logic (STL). Based on a novel statistical test, we develop the first statistical verification methods for the probabilistic conformance of a wide class of CPS. Using this method, we verify the conformance of the startup time of the widely-used full and simplified model of Toyota powertrain systems, the settling time of model-predictive-control-based and neural-network-based automotive lane-keeping controllers, as well as the maximal voltage deviation of full and simplified power grid systems.

We develop optimal control strategies for Autonomous Vehicles (AVs) that are required to meet complex specifications imposed by traffic laws and cultural expectations of reasonable driving behavior. We formulate these specifications as rules, and specify their priorities by constructing a priority structure, called Total ORder over eQuivalence classes (TORQ). We propose a recursive framework, in which the satisfaction of the rules in the priority structure are iteratively relaxed based on their priorities. Central to this framework is an optimal control problem, where convergence to desired states is achieved using Control Lyapunov Functions (CLFs), and safety is enforced through Control Barrier Functions (CBFs). We also show how the proposed framework can be used for after-the-fact, pass/fail evaluation of trajectories - a given trajectory is rejected if we can find a controller producing a trajectory that leads to less violation of the rule priority structure. We present case studies with multiple driving scenarios to demonstrate the effectiveness of the proposed framework.

We consider the decentralized controller synthesis problem for multi-agent systems with global reach-avoid specifications. Each agent is modeled as a nonlinear dynamical system with disturbances. The objective is to synthesize local feedback controllers that guarantee that the overall multi-agent system meets the global specification despite the influence of disturbances. On the one hand, existing techniques based on planning or trajectory optimization usually ignore the effects of disturbances and produce open-loop nominal trajectories that are not generally sufficient in the presence of disturbances. On the other hand, techniques based on formal synthesis, which guarantee satisfaction of temporal specifications, do not scale as the number of agents increases. We address these limitations by proposing a two-level solution approach that combines fast global nominal trajectory generation and local application of formal synthesis. At the top level, we ignore the effect of disturbances and obtain a joint open-loop plan for the system using a fast trajectory optimizer. At the lower level, we use abstraction-based controller design to synthesize a set of decentralized feedback controllers that track the high level plan against worst-case disturbances, thus ensuring satisfaction of the global specification. We provide the implementation of our approach in an open-source tool called GAMARA. We demonstrate the effectiveness of GAMARA on several multi-robot examples using two particular classes of control specifications. In the first type, we assume that the robots need to fulfill their own reach-avoid tasks while avoiding collision with each other. In the second type, we require the robots to fulfill reach-avoid tasks while maintaining certain formation constraints. The experiments show that GAMARA produces formally guaranteed feedback controllers while scaling to many robots. In contrast, nominal open-loop controllers do not guarantee the satisfaction of the specification, and global formal approaches run out of memory before synthesizing a controller.

Deep neural network (DNN) models have proven to be vulnerable to adversarial digital and physical attacks. In this paper, we propose a novel attack- and dataset-agnostic and real-time detector for both types of adversarial inputs to DNN-based perception systems. In particular, the proposed detector relies on the observation that adversarial images are sensitive to certain label-invariant transformations. Specifically, to determine if an image has been adversarially manipulated, the proposed detector checks if the output of the target classifier on a given input image changes significantly after feeding it a transformed version of the image under investigation. Moreover, we show that the proposed detector is computationally-light both at runtime and design-time which makes it suitable for real-time applications that may also involve large-scale image domains. To highlight this, we demonstrate the efficiency of the proposed detector on ImageNet, a task that is computationally challenging for the majority of relevant defenses, and on physically attacked traffic signs that may be encountered in real-time autonomy applications. Finally, we propose the first adversarial dataset, called AdvNet that includes both clean and physical traffic sign images. Our extensive comparative experiments on the MNIST, CIFAR10, ImageNet, and AdvNet datasets show that VisionGuard outperforms existing defenses in terms of scalability and detection performance. We have also evaluated the proposed detector on field test data obtained on a moving vehicle equipped with a perception-based DNN being under attack.

In recent years, the digital twin has been one of the active research areas in modern Cyber-Physical Systems (CPS). Both the digital twin and its physical counterpart, called a plant, are highly intertwined such that they continuously exchange data to reveal useful information about the overall system. Such class of CPSs need to be robust to various types of disturbances, such as faulty sensors and model discrepancies, since the interplay between the physical plant's operation and digital twin's simulation may lead to undesirable or even destructive effect. To address this problem, this paper introduces a flexible anomaly detection framework for monitoring anomalous behaviours in digital twin based CPSs. In particular, our approach integrates both the digital twin and data-driven techniques that detect and classify anomalous behaviours due to modelling errors (e.g. incomplete models) and sensor and physical system's faults. The framework can be deployed to any general CPSs without the full knowledge of the digital twin's internal model. Therefore, our method is amenable to various types of digital twin implementations that enhance the traditional data-driven anomaly detection mechanism. We demonstrate the performance of our approach using the Tennessee Eastman Process model. The experimental result shows our approach is able to effectively detect and classify anomaly sources from the physical plant, sensor and digital twin, even in the situation when a certain combination of multiple anomalies occur simultaneously.

Advances in computing resources have resulted in the increasing complexity of cyber-physical systems (CPS). As the complexity of CPS evolved, the focus has shifted to deep reinforcement learning-based (DRL) methods for control of these systems. This is in part due to: 1) difficulty of obtaining accurate models of complex CPS for traditional control 2) DRL algorithms' capability of learning control policies from data which can be adapted and scaled to real, complex CPS. To securely deploy DRL in production, it is essential to examine the weaknesses of DRL-based controllers (policies) towards malicious attacks from all angles. This work investigates targeted attacks in the action-space domain (actuation attacks), which perturbs the outputs of a controller. We show that a black-box attack model that generates perturbations with respect to an adversarial goal can be formulated as another reinforcement learning problem. Thus, an adversarial policy can be trained using conventional DRL methods. Experimental results showed that adversarial policies which only observe the nominal policy's output generate stronger attacks than adversarial policies that observe the nominal policy's input and output. Further analysis revealed that nominal policies whose outputs are frequently at the boundaries of the action space are naturally more robust towards adversarial policies. Lastly, we propose the use of adversarial training with transfer learning to induce robust behaviors into the nominal policy, which decreases the rate of successful targeted attacks by approximately 50%.

3D printing constructs physical objects by building and stacking layers according to the CAD (Computer-aided Design) information. Attackers target a printing object by manipulating the printing parameters such as nozzle movement and temperature. The existing research on secure 3D printing mostly focuses on nozzle-kinetics, while attacks on filament-kinetics and thermodynamics can also damage the printed object. The detection of these attacks mainly relies on creating master-profile and machine learning by printing every unique object in a protected environment. In the fourth industrial revolution, such an approach is not suitable due to mass-customization rather than bulk production. This paper presents Sophos, a framework to detect nozzle-kinetic, filament-kinetic and thermodynamic attacks on the fused deposition modeling (FDM)-based 3D printing process. Sophos design does not require any prior learning for every unique object. It can detect the attacks on the first print using spatiotemporal G-code modeling, aligning it with the Industry 4.0 vision. Sophos is scalable and supports modular upgrades to suit different printing requirements. Its design allows the detection threshold to be reduced conveniently to as low as the 3D printer's resolution, shifting the game to a more interesting study of attack patterns than attack magnitudes.

Awards and Closing Remarks

by Rupak Majumdar, Max Planck Institute for Software Systems

ICCPS Awards and Closing Remarks

The COVID-19 pandemic has severely affected many aspects of people's daily lives. While many countries are in a reopening stage, some effects of the pandemic on people's behaviors are expected to last much longer, including how they choose between different transport options. Experts predict considerably delayed recovery of the public transport options, as people try to avoid crowded places. In turn, significant increases in traffic congestion are expected, since people are likely to prefer using their own vehicles or taxis as opposed to riskier and more crowded options such as the railway. In this paper, we propose to use financial incentives to set the tradeoff between risk of infection and congestion to achieve safe and efficient transportation networks. To this end, we formulate a network optimization problem to optimize taxi fares. For our framework to be useful in various cities and times of the day without much designer effort, we also propose a data-driven approach to learn human preferences about transport options, which is then used in our taxi fare optimization. Our user studies and simulation experiments show our framework is able to minimize congestion and risk of infection.

Cardiac Ablation is an effective treatment of arrhythmia in which physicians terminate fast heart rate by transecting abnormal electrical conduction pathways in the heart with RF energy. During the procedure, physicians diagnose the condition of the heart and locate ablation sites by analyzing electrical signals sensed by catheters inserted into the heart. Due to the limited observation of the patient's heart, there may exist multiple heart conditions that can explain historical observations, causing ambiguities in the patient's heart condition. During the procedure, physicians have to visualize and continuously update these suspected heart conditions in their mind, causing heavy mental burden on the physicians. In this paper, cardiac electrophysiology is formalized using a physiological model of the heart, such that the diagnosis problem during cardiac ablation can be formalized as parameter identification and state estimation problems with the heart model. We then propose a model-based clinical assist system which partially solves the diagnosis problem during cardiac ablation. The system enumerates suspected heart conditions by creating "digital twins" of the patient's heart with heart models. The heart models are used to represent and visualize suspected heart conditions, and are systematically updated and removed with new information during the ablation procedure. The system provides more rigorous and intuitive interpretation of current understanding of the patient's heart, and improves the accuracy and efficiency of cardiac ablation procedures by relieving the physicians from demanding low-level reasoning.

Atrial fibrillation is a heart rhythm disorder that affects tens of millions people worldwide. The most effective treatment is catheter ablation. This involves irreversible heating of abnormal cardiac tissue facilitated by electroanatomical mapping. However, it is difficult to consistently identify the triggers and sources that may initiate or perpetuate atrial fibrillation due to its chaotic behavior. We developed a patient-specific computational heart model that can accurately reproduce the activation patterns to help in localizing these triggers and sources. Our model has high spatial resolution, with whole-atrium temporal synchronous activity, and has patient-specific accurate electrophysiological activation patterns. A total of 15 patients data were processed: 8 in sinus rhythm, 6 in atrial flutter and 1 in atrial tachycardia. For resolution, the average simulation geometry voxel is a cube of 2.47 mm length. For synchrony, the model takes in about 1,500 local electrogram recordings, optimally fits parameters to the individual's atrium geometry and then generates whole-atrium activation patterns. For accuracy, the average local activation time error is 5.47 ms for sinus rhythm, 10.97 ms for flutter and tachycardia; and the average correlation is 0.95 for sinus rhythm, 0.81 for flutter and tachycardia. This promising result demonstrates our model is an effective building block in capturing more complex rhythms such as atrial fibrillation to guide physicians for effective ablation therapy.

Digital microfluidic biochips (DMFBs) are a class of software-programmable laboratories-on-a-chip capable of automating and miniaturizing biochemical assays. Many assays feature time-sensitive interactions which are not supported by existing programming languages or compilers. This paper presents high-level language annotations to allow programmers to specify assays that feature time-sensitive dependencies between operations. To provide compiler support, this paper also presents a new formulation of a microfluidic scheduling problem for DMFBs that enforces timing constraints. To solve the problem, which is NP-complete, the paper introduces an efficient heuristic, along with an optimal Integer Linear Programming (ILP) formulation. Experiments demonstrate that existing methods for the traditional scheduling problem often do not yield solutions that satisfy time-sensitive constraints, while the proposed methods can do so while also effectively minimizing the total execution time of a scheduled assay.