NIST Special Publication 1500-201

Framework for Cyber-Physical
Systems:
Volume 1, Overview
Version 1.0

Cyber-Physical Systems Public Working Group
Smart Grid and Cyber-Physical Systems Program Office
Engineering Laboratory

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.1500-201

NIST Special Publication 1500-201

Framework for Cyber-Physical
Systems:
Volume 1, Overview
Version 1.0
Cyber-Physical Systems Public Working Group
Smart Grid and Cyber-Physical Systems Program Office
Engineering Laboratory
This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.1500-201
June 2017

U.S. Department of Commerce
Wilbur L. Ross Jr., Secretary

National Institute of Standards and Technology

Kent Rochford, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

National Institute of Standards and Technology (NIST) Special Publication 1500-201
79 pages (June 2017)
NIST Special Publication series 1500 is intended to capture external perspectives related
to NIST standards, measurement, and testing-related efforts. These external
perspectives can come from industry, academia, government, and others. These reports
are intended to document external perspectives and do not represent official NIST
positions.
Certain commercial entities, equipment, or materials may be identified in this document
in order to describe an experimental procedure or concept adequately. Such
identification is not intended to imply recommendation or endorsement by the National
Institute of Standards and Technology, nor is it intended to imply that the entities,
materials, or equipment are necessarily the best available for the purpose.

National Institute of Standards and Technology Special Publication 1500-201
Natl. Inst. Stand. Technol. Spec. Publ. 1500-201, 79 pages (June 2017)
CODEN: NSPUE2This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.1500-201

Framework for Cyber-Physical Systems: Volume 1, Overview

Revision Tracking
Version1.0

Date20170320

Editor
Edward Griffor

Changes
First Release Version

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Framework for Cyber-Physical Systems: Volume 1, Overview

Table of Contents
Table of Contents ..............................................................................................................i
Table of Figures ................................................................................................................ ii
Table of Tables ................................................................................................................ iii
Disclaimer ....................................................................................................................... iv
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Acknowledgement ........................................................................................................... v
Executive Summary ......................................................................................................... vi
1

2

Introduction ..............................................................................................................1
1.1

Overview...................................................................................................................... 1

1.2

Purpose ........................................................................................................................ 4

1.3

Scope ........................................................................................................................... 6

1.4

Organization of This Document................................................................................. 10

The CPS Framework ................................................................................................. 11
2.1

Overview.................................................................................................................... 11

2.2

Derivation of the Framework .................................................................................... 13

2.3

Uses of the CPS Framework ...................................................................................... 22

2.4

The Description of the CPS Framework..................................................................... 24

2.5

Related Standards and Activities............................................................................... 35

2.6

Summary ................................................................................................................... 38

Appendix A.

References ............................................................................................. 39

Appendix B.

Definitions and Acronyms ....................................................................... 42

B.1

Selected terms used in this document are defined below. ...................................... 42

B.2

Selected acronyms used in this document are defined below. ................................ 49

Appendix C.

Applying the CPS Framework: An Emergency Response Use Case ............ 52

C.1

Perspective for Applying the Framework .................................................................. 52

C.2

Workflow for Analyzing the Emergency Response Use Case .................................... 52

C.3

Emergency Response Use Case Original ................................................................... 53

C.4

Determine Scope of Analysis ..................................................................................... 54

C.5

Tailor Framework Facet Activities, Aspects & Concerns ........................................... 55

C.6

Perform Conceptualization Activities and Apply Concerns....................................... 57

C.7

Perform Realization Activities ................................................................................... 64

C.8

Perform Assurance Activities .................................................................................... 65iFramework for Cyber-Physical Systems: Volume 1, Overview

Table of Figures
Figure 1: CPS Conceptual Model ............................................................................................... 6
Figure 2: Segmentation of M2M Market .................................................................................. 7
Figure 3: Smart Transportation................................................................................................. 8
Figure 4: CPS Framework – Domains, Facets, Aspects ........................................................... 14
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 5: Analysis of CPS and Derivation of Framework ......................................................... 15
Figure 6: Model of a Facet ...................................................................................................... 16
Figure 7: Three Primary Framework Facets ............................................................................ 16
Figure 8: Facets and Aspects................................................................................................... 17
Figure 9: CPS Enhanced Cognitive Cycle ................................................................................. 18
Figure 10: Elements of Assurance........................................................................................... 19
Figure 11: Evidence ................................................................................................................. 19
Figure 12: Argumentation ....................................................................................................... 20
Figure 13: The Property Tree of a CPS .................................................................................... 21
Figure 14: Workflow for Framework Application Sample ...................................................... 53ii

Framework for Cyber-Physical Systems: Volume 1, Overview

Table of Tables
Table 1: Examples of CPS Domains ......................................................................................... 25
Table 2: Facets ........................................................................................................................ 25
Table 3: Aspects ...................................................................................................................... 26
Table 4: Concerns.................................................................................................................... 26
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Table 5: Conceptualization Facet: Activities and Artifacts ..................................................... 33
Table 6: Realization Facet: Activities and Artifacts ................................................................. 34
Table 7: Assurance Facet: Activities and Artifacts .................................................................. 34
Table 8: Tailoring the Analysis ................................................................................................ 54
Table 9: CPS Application Domains Relevant to Use Case ....................................................... 55
Table 10: Tailoring the Conceptualization Facet .................................................................... 55
Table 11: Tailoring the Realization Facet ................................................................................ 56
Table 12: Tailoring the Assurance Facet ................................................................................. 56
Table 13: Tailoring of Aspects ................................................................................................. 57
Table 14: Emergency Response Use Case Steps ..................................................................... 59
Table 15: Emergency Response Requirements Analysis ........................................................ 60
Table 16: Realization Activity .................................................................................................. 65iii

Framework for Cyber-Physical Systems: Volume 1, Overview

Disclaimer
This document has been prepared by the Cyber-Physical Systems Public Working Group(CPS PWG), an open public forum established by the National Institute of Standards andTechnology (NIST) to support stakeholder discussions and development of a framework forcyber-physical systems. This document is a freely available contribution of the CPS PWG andis published in the public domain.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Certain commercial entities, equipment, or materials may be identified in this document inorder to describe a concept adequately. Such identification is not intended to imply
recommendation or endorsement by the CPS PWG (or NIST), nor is it intended to imply thatthese entities, materials, or equipment are necessarily the best available for the purpose.
All registered trademarks or trademarks belong to their respective organizations.

iv

Framework for Cyber-Physical Systems: Volume 1, Overview

Acknowledgement
We would like to acknowledge the valuable leadership of the following individuals whohelped guide the participants through the framework activity:
NIST Leadership:
Edward Griffor, David Wollman, Christopher Greer
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Reference Architecture:
Industry Co-chairs:

Stephen Mellor, Shi-Wan Lin

Academic Co-chairs:

Janos Sztipanovits

NIST Co-chairs:

Abdella Battou

Security:
Industry Co-chairs:

Claire Vishik, Larry John

Academic Co-chairs:

Bill Sanders

NIST Co-chairs:

Victoria Pillitteri, Stephen Quinn

Use Cases:
Industry Co-chairs:

Stephen Mellor

Academic Co-chairs:

John Baras

NIST Co-chairs:

Eric Simmon

Data Interoperability:
Industry Co-chairs:

Peggy Irelan, Eve Schooler

Academic Co-chairs:

Larry Lannom

NIST Co-chairs:

Martin Burns

Timing:Industry Co-chairs:

Sundeep Chandhoke

Academic Co-chairs:

Hugh Melvin

NIST Co-chairs:

Marc Weiss

Additionally, we would like to express our appreciation to all the participants from industry,
government and academia that, through their generous donation of their intellect,
experience and precious time, made this effort a success.

v

Framework for Cyber-Physical Systems: Volume 1, Overview

Executive Summary
Cyber-physical systems (CPS) are smart systems that include engineered interacting
networks of physical and computational components. CPS and related systems (including
the Internet of Things (IoT) and the Industrial Internet) are widely recognized as having
great potential to enable innovative applications and impact multiple economic sectors in
the worldwide economy.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

In mid-2014, NIST established the CPS Public Working Group (CPS PWG) to bring together abroad range of CPS experts in an open public forum to help define and shape key
characteristics of CPS, so as to better manage development and implementation within andacross multiple “smart” application domains, including smart manufacturing,transportation, energy, and healthcare.
The objective of the CPS PWG is to develop a shared understanding of CPS and its
foundational concepts and unique dimensions (as described in this “CPS Framework”) topromote progress through exchanging ideas and integrating research across sectors and tosupport development of CPS with new functionalities. While in principle there are multiple
audiences for this work, a key audience is the group of CPS experts, architects, andpractitioners who would benefit from an organized presentation of a CPS analysis
methodology based on the CPS Framework presented as facets and aspects in thisdocument. The identified key concepts and issues are informed by the perspective of thefive expert subgroups in the CPS PWG: Vocabulary and Reference Architecture,
Cybersecurity and Privacy, Timing and Synchronization, Data Interoperability, and Use
Cases. The CPS analysis methodology is designed as a framework to support theunderstanding and development of new and existing CPS, including those designed tointeract with other CPS and function in multiple interconnected infrastructure
environments. This foundation also enables further use of these principles to develop acomprehensive standards and metrics base for CPS to support commerce and innovation.
As an example, the CPS Framework could support identification of the commonalities andopportunities for interoperability in complex CPS at scale. The broader audience for thiswork includes all CPS stakeholders, who may be interested in broadening individual domain
perspectives to consider CPS in a holistic, multi-domain context.
The first stage in the three-stage work plan of the CPS PWG was to develop initial“Framework Element” documents in each of the five expert subgroups. In the second stage,these documents were combined into an initial draft CPS Framework and then revised andimproved to create this draft document. The documented discussions of the subgroups
have been included here as Appendices A through C. After public review and finalization of
the CPS Framework Release 1, the applicability of this approach will be assessed in selected
CPS domains, leading to a planned future road mapping activity to both improve the CPS
Framework and develop understanding and action plans to support its use in multiple CPS
domains.

vi

Framework for Cyber-Physical Systems: Volume 1, Overview
With respect to this draft CPS Framework, the first goal was to derive a unifying frameworkthat covers, to the extent understood by the CPS PWG participants, the range of uniquedimensions of CPS. The second goal is to populate a significant portion of the CPS
Framework with detail, drawing upon content produced by the CPS PWG subgroups andleadership team. It is important to note that there are sections of this draft CPS Frameworkthat are not fully developed at this time. It is anticipated that additional content will be
included in the future revisions to this document.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The diagram below shows this analysis proceeding in a series of steps as undertaken within
the reference architecture activity:
1. Identify domains of CPS; these are the areas of deployment of CPS in whichstakeholders may have domain-specific and cross-domain concerns.
2. Identify cross-cutting concerns, like societal, business, technical, etc. Stakeholders
can have concerns that overlap or are instances of broader conceptual concerns.
3. Analyze cross-cutting concerns to produce aspects, or grouping of conceptuallyequivalent or related concerns.
4. Address concerns (aspects) through activities and artifacts organized within threefundamental facets of conceptualization, realization, and assurance.

Two iterations of integration and analysis produced the following Framework elements:
Domains. It is intended that the Framework can be applied to concrete CPS application
domains, e.g., manufacturing, transportation, and energy, as both a specialization of thesecommon conceptions and descriptions and a means for integrating domains for coordinatedfunctions. Conversely, these specializations may validate and help to enhance thevii

Framework for Cyber-Physical Systems: Volume 1, Overview
overarching CPS conceptions and descriptions. Within and across these domains,stakeholders have a variety of concerns or interests.
Facets. Facets are views on CPS encompassing identified responsibilities in the systemengineering process. They contain well-defined activities and artifacts (outputs) for
addressing concerns. There are three identified facets:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201•

The conceptualization facet captures activities related to the high-level goals,
functional requirements, and organization of CPS as they pertain to what a CPS or its
components should be and what they are supposed to do. It provides as its
overarching output a conceptual model of the CPS.

•

The realization facet captures the activities surrounding the detailed engineering
design, production, implementation, and operation of the desired systems. These
activities include tradeoff analyses, detailed engineering design and simulation(s),and more, that drive towards and are responsible for realization of a CPS.

•

The assurance facet deals with obtaining confidence that the CPS built in therealization facet satisfies the model developed in the conceptualization facet. Its
activities include evaluating the claims, argumentation, and evidence as required toaddress important (and sometimes mandatory) requirements of design, policy, law,and regulation.

Aspects. Aspects are high-level groupings of cross-cutting concerns. Concerns are interests
in a system relevant to one or more stakeholders. The identified aspects are listed below:
•
•
•
•
•
•
•
•
•

Functional
Business
Human
Trustworthiness 1
Timing
Data
Boundaries
Composability
Lifecycle

Using the concepts of facets and aspects, this draft CPS Framework describes a CPS analysis
methodology, in which the activities identified in the facets are implemented in acoordinated approach to address concerns throughout the entire life cycle, using a range ofdevelopment approaches, such as waterfall, agile, spiral and iterative.

1

Trustworthiness includes security, privacy, safety, reliability, and resilience.

viii

Framework for Cyber-Physical Systems: Volume 1, Overview
In summary, this draft CPS Framework takes the foundation-building work done within the
CPS PWG and integrates and reorganizes that work to form a cohesive document based on
the identified concepts of facets and aspects.
It is hoped that this Framework will satisfy the need for a reference CPS description
language on which tools, standards, and documented applications can be based.
Further input and comments from a broad audience will inform CPS PWG efforts to build
out and improve this CPS Framework.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

ix

Framework for Cyber-Physical Systems: Volume 1, Overview

1 Introduction

This section provides an introduction for the document. It comprises the following:• Section 1.1 provides a brief overview of cyber-physical systems.
• Section 1.2 defines the purpose of the document.
• Section 1.3 explains the scope of the document.
• Section 1.4 explains the organization of the rest of the document.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

1.1 Overview
1.1.1 Background
Cyber-physical systems (CPS) are smart systems that include engineered interacting
networks of physical and computational components. These highly interconnected andintegrated systems provide new functionalities to improve quality of life and enable
technological advances in critical areas, such as personalized health care, emergency
response, traffic flow management, smart manufacturing, defense and homeland
security, and energy supply and use. In addition to CPS, there are many words andphrases (Industrial Internet, Internet of Things (IoT), machine-to-machine (M2M), smart
cities, and others) that describe similar or related systems and concepts. 2 There issignificant overlap between these concepts, in particular CPS and IoT, such that CPS andIoT are sometimes used interchangeably; therefore, the approach described in this CPS
Framework should be considered to be equally applicable to IoT.
The impacts of CPS will be revolutionary and pervasive; this is evident today in emerging
autonomous vehicles, intelligent buildings, smart energy systems, robots, and smart
medical devices. Realizing the full promise of CPS will require interoperability among
heterogeneous components and systems, supported by new reference architecturesusing shared vocabularies and definitions. Addressing the challenges and opportunities
of CPS requires broad consensus in foundational concepts, and a shared understandingof the essential new capabilities and technologies unique to CPS. NIST has established
the CPS Public Working Group (CPS PWG) as an open forum to foster and capture inputs
from those involved in CPS, both nationally and globally.
The CPS PWG was launched in mid-2014 with the establishment of five subgroups(Vocabulary and Reference Architecture, Use Cases, Cybersecurity and Privacy, Timing
and Synchronization, and Data Interoperability) 3 Initial CPS PWG “Framework Element”
documents were produced by each of the subgroups in December 2014, thenintegrated, reorganized, and refined to create this draft CPS Framework. The CPS
2

CPS will be the focus of this document; however, terminology distinctions may be introduced to aid thereader where beneficial or informative.

3

Additional information on the NIST CPS PWG is available at https://pages.nist.gov/cpspwg/ andhttp://www.nist.gov/cps/.

1

Framework for Cyber-Physical Systems: Volume 1, Overview
Framework is intended to be a living document and will be revised over time to address
stakeholder community input and public comments; some sections of the document areincomplete and will be developed and extended over time.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The core of the CPS Framework is a common vocabulary, structure, and analysis
methodology. As a process method, the CPS analysis methodology should enable andfacilitate CPS systems engineering using a range of development approaches, such as
waterfall, agile, spiral, and iterative. There are many well-documented systemengineering process documents and flows – e.g., TOGAF [1] and CMMI [2]. This
Framework, however, focuses on the detailed scope of CPS and the specific concerns
implementers and analysts have in designing and understanding them. The concepts
described in this document map cleanly to the more general methods and therefore arecomplementary to them rather than competitive.
The purpose of this CPS Framework is to allow for a comprehensive analysis of CPS. The
CPS Framework captures the generic functionalities that CPS provide, and the activities
and artifacts needed to support conceptualization, realization, and assurance of CPS.
This analysis methodology includes addressing concerns that are specific to CPS andthose that are applicable to any device or system. By this means, a complete
methodology is proposed with common vocabulary and structure, which emphasizes
CPS concerns but not to the exclusion of others.

1.1.2 What Is Different about CPS
CPS go beyond conventional product, system, and application design traditionallyconducted in the absence of significant or pervasive interconnectedness. There aremany reasons for this, including the following:•

The combination of the cyber and the physical, and their connectedness, isessential to CPS. A CPS generally involves sensing, computation and actuation.
CPS involve traditional information technology (IT) as in the passage of data fromsensors to the processing of those data in computation. CPS also involve
traditional operational technology (OT) for control aspects and actuation. The
combination of these IT and OT worlds along with associated timing constraints
is a particularly new feature of CPS.

•A CPS may be a System of Systems (SoS). As such, it may bridge multiple
purposes, as well as time and data domains, hence requiring methods oftranslation or accommodation among these domains. For example, different
time domains may reference different time scales or have different granularities
or accuracies.

•

Emergent behaviors are to be expected of CPS, due the open nature of CPS
composition. Understanding a behavior that cannot be reduced to a single CPS
subsystem, but comes about through the interaction of possibly many CPS
subsystems, is one of the key analysis challenges. For example, a traffic jam is a2

Framework for Cyber-Physical Systems: Volume 1, Overview
detrimental emergent behavior; optimal energy distribution by the smart gridwhere power consumers and producers work together is a desirable positive
emergent effect.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201•

CPS need a methodology to ensure interoperability, managing evolution, anddealing with emergent effects. Especially in large scale CPS such as smart gridand smart city, many of the subsystems are the responsibility of different
manufacturers.

•

CPS may be repurposed beyond applications that were their basis of design.
For example, a cell phone in a car may be used as a mobile traffic sensor, or
energy usage information may be used to diagnose equipment faults.

•

CPS are noted for enabling cross-domain applications. As an example, consider
the intersection of the domains: manufacturing and energy distribution systems,
smart cities, and consumer-based sensing.

•

CPS potential impact on the physical world and their connectedness bring withthem heightened concern about trustworthiness. There is a more urgent needfor emphasis on security, privacy, safety, reliability, and resilience, andcorresponding assurance for pervasive interconnected devices andinfrastructures. As an example, CPS networks may have “brokers” and otherinfrastructure-based devices and aggregators that are owned and managed bythird parties, resulting in potential trust issues – e.g., publish and subscribe
messaging, certificate authorities, type and object registries.

•

CPS should be freely composable. Components are available that may be
combined into a system dynamically, and the system architecture may be
modified during runtime to address changing concerns. There are challenges,
however. For example, timing composability may be particularly difficult. Also, it
may not always be necessary or desirable to purchase assets to build a system;
instead, services can be purchased on a per-use basis, with users only paying forusing the resources needed for a specific application and at the specific time ofusage.

•CPS must be able to accommodate a variety of computational models. EachCPS application has computational and physical components and the range ofplatform and algorithm complexity is broad.

•

CPS must also support a variety of modes of communication. CPS comprisesystems that range from standalone to highly networked. They may use legacy
protocols or anything up to more object exchange protocols. And they may be
anywhere from power constrained to resource rich.

•

The heterogeneity of CPS leads them to display a wide range of complexity.
The complexity associated with the sensing and control loop(s) with feedback3

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

that are central to CPS must be well addressed in any design. This complexity
must be accommodated by any framework for CPS, including sensors that range
from basic to smart; static and adaptive sensors and control; single-mode andmulti-faceted sensors; control schemes that can be local, distributed, federated,or centralized; control loops that rely on a single data source and those that fuse
inputs; and so on. Interactions can be loosely coupled, as in repurposing of
distributed sensing that is part of an existing CPS, as well as tightly coupled, as intelemedicine or smart grid operations. Coupling is both an opportunity to fulfill
the vision of CPS and a challenge to CPS assurance. Emergent behaviors canbecome part of the intent of new services or may be unwanted. To mitigate
complexity, CPS may be a product of co-design. In co-design, the design of the
hardware and the software are considered jointly to inform tradeoffs between
the cyber and physical components of the system.
•

There is typically a time-sensitive component to CPS, and timing is a central
architectural concern. A bound may be required on a time interval, i.e., thelatency between when a sensor measurement event occurred and the time atwhich the data was made available to the CPS. The accuracy of event timestamps
is a constraint on a time value, in this case between the actual time of the eventand the value of the timestamp. Accurate time intervals are useful for
coordinating actions in CPS of large spatial extent. Accurate timestamps in CPS
are typically needed to facilitate better root cause analysis, and sometimes also
for legal or regulatory reasons.

•

CPS are characterized by their interaction with their operating environment (asindicated by the sensing and control loop(s) discussed above). CPS, together orindividually, ‘measure’ and sense and then calculate and act upon theirenvironment, typically changing one or more of the observed properties (thusproviding closed loop control). The CPS environment typically includes humans,and humans function in a different way than the other components of a CPS. The
architecture must support a variety of modes of human interaction with CPS to
include: human as CPS controller or partner in control; human as CPS user;human as the consumer of CPS output; and human as the direct object of CPS to
be measured and acted upon.

1.2 Purpose
The success of this CPS Framework can be assessed by its usefulness as guidance indesigning, building, and verifying CPS and as a tool for analyzing complex CPS. It should
aid users in determining the properties of a CPS, and provide guidance such that two
CPS instance architectures, independently derived or tailored from this Framework, arein substantial alignment. That is, they can be mutually understood through theorganizational and descriptive means of this Framework, and in doing so their real or
potential interactions can be more easily understood.

4

Framework for Cyber-Physical Systems: Volume 1, Overview
By providing a framework for discussion of, design of, and reasoning about CPS, acommon foundation will be established from which a myriad of interoperable CPS canbe developed, safely and securely combined, verified, and delivered to the public,
government, and researchers. If broadly adopted, this Framework will serve to enable
activity in research and development that will produce reliable, well-designed, easilyintegrated CPS-based products and services.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The framework uses many terms that have been defined in many other documents. We
have provided definitions in Appendix B to indicate how we have used language in thisdocument. Where possible we have drawn on documents in other standards, however
some words are used differently in different standards and in different industries. There
are also some words that are commonly used that we have not defined here. An
example is the word precision or precise. This word is used in many contexts and insome cases with different meanings. It is hoped that such words are made clear by thecontext in which they are used.
This document defines a CPS as follows: Cyber-physical systems integrate computation,communication, sensing, and actuation with physical systems to fulfill time-sensitive
functions with varying degrees of interaction with the environment, including humaninteraction.
A CPS conceptual model is shown in Figure 1. This figure is presented here to highlightthe potential interactions of devices and systems in a system of systems (SoS) (e.g., a
CPS infrastructure). A CPS may be as simple as an individual device, or a CPS can consistof one or more cyber-physical devices that form a system or can be a SoS, consisting ofmultiple systems that consist of multiple devices.
This pattern is recursive and depends on one’s perspective (i.e., a device from one
perspective may be a system from another perspective). Ultimately, a CPS must containthe decision flow together with at least one of the flows for information or action. The
information flow represents digitally the measurement of the physical state of thephysical world, while the action flow impacts the physical state of the physical world.
This allows for collaborations from small and medium scale up to city/nation/world
scale.

5

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 1: CPS Conceptual Model

1.3 Scope
The scope of CPS is very broad by nature, as demonstrated in the M2M sector map in
Figure 2. There are large number and variety of domains, services, applications, anddevices. This figure displays CPS focused on the IoT. 4 This broad CPS scope includes
cross-cutting functions (i.e., functions that are derived from critical and overriding CPS
concerns) that are likely to impact multiple interacting CPS domains. The CPS
Framework will facilitate users’ understanding of cross-cutting functions. Examples
include safety, security, and interoperability.

4

Note that the inclusion of Figure 2 is designed only to illustrate the scope of deployed, commercial CPS,
but not a particular or preferred architecture for studying it.

6

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 2: Segmentation of M2M Market 5

The scope of the CPS Framework includes the full dimensionality of CPS and the entire
systems engineering process. That is, rather than address “selected topics,” it intends toprovide a comprehensive tool for the analysis and description of CPS. It is quite possiblethat this initial draft CPS Framework will have missed some important elements of CPS.
With input from stakeholders including through a public review process, these gaps will
be addressed in future releases.
As an example of the scope of CPS, consider the case of smart traffic systems (Figure 3).
Smart traffic systems consist of smart traffic monitoring and control infrastructure,advanced traffic control centers powered by predictive analytics on real-time traffic
data, autonomous vehicles interacting with peer vehicles in proximity, and traffic
control systems. This section provides examples of how the use of CPS can impact asmart traffic system. This section also provides context for Appendix C, in which a5

Courtesy of Beecham Research, used by permission,
http://www.beechamresearch.com/article.aspx?id=4, 20097

Framework for Cyber-Physical Systems: Volume 1, Overview
simplified traffic-related emergency response scenario is used as an analysis example todemonstrate how to exercise the CPS analysis methodology of this CPS Framework.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 3: Smart Transportation 6

CPS controls have a variety of levels of complexity ranging from automatic toautonomic. A prominent example of CPS in smart traffic is autonomous vehicles, which
are themselves systems of CPS. The functions of CPS within an autonomous vehicle areorchestrated, collaborated, and coordinated to achieve the overall autonomous
functions of the vehicle.
Another smart traffic CPS is an on-location smart traffic control system. Such systems
are installed in street intersections to sense and measure local traffic patterns andconditions so they can apply commands to the traffic signals to orchestrate themovement of vehicles passing the intersections based on prescribed objectives. These
on-location smart traffic control systems may be orchestrated by regional traffic control
centers to optimize overall traffic flows.
6

Courtesy of ETSI http://www.etsi.org/technologies-clusters/technologies/intelligent-transport, usedwith permission

8

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

CPS can collaborate with each other to produce effects that are greater than the sum of
the parts. An example of collaboration of CPS is the collaboration of vehicles inproximity to avoid collisions. These vehicles communicate with each other in the cyber
space, dynamically forming ad hoc communities to inform others of the actions each ofthem is taking that may affect the communities of vehicles. Examples of such actions
include applying a brake or changing lanes. They also interact, albeit indirectly, in thephysical space by continuously sensing and measuring the movement and trajectory ofneighboring vehicles. The information gathered from both the cyber and physical spaces
is then synthesized to gain an understanding of the state and intent of the vehicles inproximity. From this understanding, and based on prescribed objectives (e.g., to avoid
collision, a physical effect), control decisions are continuously made to produce thedesired physical effects in the vehicle in question, e.g., to slow down, stop, accelerate,or change course to avoid the undesired effects, such as collisions between vehicles or
between vehicles and other objects.
CPS can be orchestrated by a cyber system that communicates logically with them. An
example of this orchestration is the computational unit in an autonomous vehicle
strongly orchestrating the activities between the steering, braking, and powertrain CPS.
Another example of this is a traffic control unit using wireless signaling to orchestrateautonomous vehicles passing through a street intersection.
The SoS domain enables the complex management of CPS and supports emerging
behavior. In smart traffic, traffic monitoring systems send data to the on-location traffic
control units and to their respective regional traffic control centers. Vehicles also reportdriving data to the traffic Internet, which can in turn be routed to the relevant traffic
control centers. The information component for the regional traffic control centers
analyzes these data to understand the traffic conditions and patterns. The application
component synthesizes this information with other information such as traffic patterns
in the neighboring regions, current and forecast weather conditions, current andpending large public events, and road accident reports. It takes into account in its model
the constraints imposed by the objectives, such as minimizing traffic delay, minimizing
air and noise pollution, increasing safety and enhancing security, and reducing energy
consumption. It optimizes the traffic routing patterns and sends high-level instructions
to on-location traffic control units to orchestrate regional traffic patterns. It coordinates
vehicle traffic flows by broadcasting advice to vehicles to suggest alternative routes. The
application component may assist emergency response in locating accident sites forrescue and recovery. It may interact with the business component to plan road or
facility repairs accounting for either or both material or work crews. It may interact withthe business component to schedule predictive maintenance or repairs on the traffic
control infrastructure based on information provided by the information and entity
management component that manages the CPS in the traffic control infrastructure.
Furthermore, sensory data gathered from the vehicles correlated with geolocation,
climate, and season data, as well as road construction and maintenance records, can beanalyzed to derive information on road and bridge conditions at precise locations, and9

Framework for Cyber-Physical Systems: Volume 1, Overview
their relations to the interworking of climate, season, patterns of usage, construction
materials and procedures, and maintenance frequency. Optimal preventive
maintenance can be planned in relation to usage patterns, season, and cost. New
materials and optimal procedures can be developed for specific usage patterns andclimates.

1.4 Organization of This Document
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Beyond the introductory material in this section, this Framework document is organized
as follows:
Section 2: The CPS Framework – This section describes the CPS environment andstakeholder concerns, and provides an overview of the CPS Framework analysis
methodology with its core concepts of facets (components of the systems engineering
process with associated activities and artifacts) and aspects (groupings of cross-cutting
concerns).
Section 2.2.2 describes facets as an activity-organized analysis of concerns and Section
2.2.3 describes the properties of the facets. Table 2 provides a description of each of
the aspects. Uses of the Framework, an in-depth description, and related standards aredescribed in Sections 2.3, 2.4, and 2.5, respectively.
Appendix A: References – This section provides references to a variety of CPS-related
articles, standards, and other material cited in the text.
Appendix B: Definitions and Acronyms – This appendix provides a set of acronyms anddefinitions applicable to this document.
Appendix C: Applying the CPS Framework – This appendix uses a simplified "Emergency
Response" scenario involving multiple CPS to illustrate how owners, designers,
engineers, and operators can apply the Framework to analyze CPS in an operational
context.

10

Framework for Cyber-Physical Systems: Volume 1, Overview

2 The CPS Framework

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

This section defines the CPS Framework at a high level. The components of the sectionare:• Section 2.1 provides an overview of CPS and key CPS concepts.
• Section 2.2 explains the derivation of the CPS Framework.
• Section 2.3 describes potential uses of the CPS Framework.
• Section 2.4 contains the complete description of the CPS Framework.
• Section 2.5 discusses related standards and activities.
• Section 2.6 summarizes Section 2.

2.1 Overview
The focus of this Framework is to develop a CPS analysis methodology and a vocabularythat describes it. It includes the identification of CPS domains, facets, aspects, concerns,
activities, and artifacts. These terms are defined in the context 7 of this Framework andare introduced later in this section.
To appreciate the scope of coverage that the CPS Framework addresses, this section
briefly discusses the dimensionality of CPS. This presentation covers the entire scope of
CPS as opposed to Section 1.1.2 which emphasized unique differences of highly
connected systems versus conventional systems.
•

CPS are frequently systems of systems (SoS), and the architectural constructs
should be able to be applied recursively or iteratively to support this nested
nature of CPS. The sensing/control and computational nature of CPS generally
leads to emergent higher levels of behavior and system intelligence.

•

CPS should be characterized by well-defined components. They should provide
components with well-known characteristics described using standardized
semantics and syntax. Components should use standardized component/service
definitions, descriptions, and component catalogs.

•

CPS should support application and domain flexibility. To do this, the definitionof the components should be flexible and open ended. The architecture should
support the provision of accurate descriptions of things to allow for flexibility invirtual system creation and adaption and to promote innovation. It should also
support a large range of application size, complexity, and workload. The same
components that are used in a very simple application should also be usable in avery large, complex, distributed system. Ideally the components can beassembled and scaled quickly, even during runtime. CPS architecture should
allow composition from independent, decoupled components for flexibility,7

In a technology space as broad as CPS, a given term may have more than one meaning when used inpractice by different audiences. Therefore, the definitions and usage in this Framework are intended forthe scope of this Framework and are not proposed for universal meaning.

11

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

robustness, and resilience to changing situations. Decoupling should also exist
between architectural layers, allowing each layer to be modified and replaced
without unwittingly affecting the other layers. In order for the system tointegrate different components, the interfaces to these components should bebased on well-defined, interpretable, and unambiguous standards. Further,standardization of interfaces will allow for easy provisioning of various
components by any systems envisioned today and into the future. By allowinginternal component flexibility while providing external interoperability throughstandardized interfaces, customization can be achieved. This supports desirable
diversity of application and scalability.
•

CPS frequently perform critical applications, so the CPS architecture must
support the level of reliability needed to meet requirements. It should provide
the ability to resist change due to external perturbations or to respond to thosechanges in ways that preserve the correct operation of the critical application.

•

Security is a necessary feature of the CPS architecture to ensure that CPS
capabilities are not compromised by malicious agents, and that the information
used, processed, stored and transferred has its integrity preserved and is kept
confidential where needed. The nature of CPS not only increases theconsequences of a breach but also introduces additional types of vulnerabilities.
For example, timing in a CPS has unique vulnerabilities different from traditional
data vulnerabilities considered in. Security needs to be built into CPS by design inorder to be sufficiently flexible to support a diverse set of applications. Thissecurity should include component security; access control; as well as timing,
data and communications security. Security must be considered in combination
with other prioritized and potentially conflicting concerns, such as privacy,
safety, reliability, and resilience, in a comprehensive risk management
framework.

•

Data exchange is a prominent dimension of CPS operation. The nature of dataand its reliability, type, identity, and discovery are all key attributes that allow for
a common understanding of data conveyed through communications in andamong CPS. Often, data are “fused” or combined with other data to anonymize
or enrich it or to summarize it for the benefit of users. Access to data is often
constrained by “rights” or “privileges.”•

Components that contain sensors and/or actuators should have an appropriate
level of awareness of physical location and time. For example, the accuracy
requirement for location will change based upon the application. To support
such applications, components may need the ability to access and/or report both
location and the associated uncertainty of the location.

•

Additionally, CPS architectures should support legacy component integration andmigration. Legacy devices have physical artifacts, software, protocols, syntax,

12

Framework for Cyber-Physical Systems: Volume 1, Overview
and semantics that exist due to past design decisions, and they may be
inconsistent with the current architectural requirements. New components andsystems should be designed so that present or legacy devices do notunnecessarily limit future system evolution. As even new components will
become legacy in the future, a plan for adaptation and migration of legacy
systems and standards should be created to avoid stranded investments, if
possible. Legacy components should be integrated in a way that ensures that
security and other essential performance and functional requirements are met.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

2.2 Derivation of the Framework
A useful reference for the terminological and definitional conventions relating tosystems architecture and systems architecture frameworks is ISO/IEC/IEEE 42010 [3].
For the purposes of this section, here are a few of these conventions:•

An architecture framework consists of the “conventions, principles and practices
for the description of architectures established within a specific domain of
application and/or community of stakeholders.”•

A concern is an “interest in a system relevant to one or more of its stakeholders.”•

An architecture view consists of “work product expressing the architecture of asystem from the perspective of specific system concerns.”•

An architecture viewpoint consists of “work product establishing the conventions
for the construction, interpretation and use of architecture views to frame
specific system concerns.”

Another key reference relevant to the construction of this Framework is ISO/IEC/IEEE
15288 on System Life Cycle processes [4], which describes processes and outcomes toguide system engineering.
Building on these two references, this CPS Framework derives the core notions of facets,
activities, artifacts, aspects, and concerns. Note that while these are two key references
to general systems engineering principles, the Framework emphasizes the nature andfunction of CPS specifically.

2.2.1 Key Elements of the Framework
The key elements of the Framework are shown in Figure 4 and can be summarized asfollows:

13

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 4: CPS Framework – Domains, Facets, Aspects•

Domains represent the different application areas of CPS as shown in Figure 4.

•

Concerns, as expressed by many different stakeholders in their unique andcollective viewpoints, are a fundamental concept that drives the CPS Framework
methodology. They are addressed throughout the CPS development cycle.
Concerns that are conceptually equivalent or related are grouped into Aspects,
which are addressed by activities within the facets.
Properties are the concrete assertions that address the concerns. They include
requirements, design elements, tests, and judgments.
Aspects consist of groupings of conceptually equivalent or related concerns. A
listing of aspects is provided in Table 2. There may be modifications or othervalid groupings of concerns that may benefit a particular application of the CPS
Framework in a specific context. Note that aspects and concerns are notconsidered orthogonal. There are nine defined aspects: functional, business,
human, trustworthiness, timing, data, boundaries, composition, and lifecycle.
Facets are views on CPS encompassing identified responsibilities in the systems
engineering process. Each facet contains a set of well-defined activities andartifacts (outputs) for addressing concerns. There are three identified facets:
conceptualization, realization, and assurance.

•••

The Framework was developed through an analysis process that followed a definedsequence of steps. Figure 5 shows this analysis, working in the context of identified CPS
domain(s):1. Identify domains of CPS; these are the areas of deployment of CPS in whichstakeholders may have domain-specific and cross-domain concerns.
14

Framework for Cyber-Physical Systems: Volume 1, Overview
2. Identify cross-cutting concerns, like societal, business, technical, etc.
Stakeholders can have concerns that overlap or are instances of broader
conceptual concerns.
3. Analyze cross-cutting concerns to produce aspects, or grouping of conceptuallyequivalent or related concerns.
4. Address concerns (aspects) through activities and artifacts organized within
three fundamental facets of conceptualization, realization, and assurance.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 5: Analysis of CPS and Derivation of Framework

It is intended that the identification and description of the activities, methods, andartifacts in each of the facets can be applied within concrete CPS application domains(e.g., manufacturing, transportation, energy) as a specialization of these common
conceptions and descriptions. Conversely, these specializations may validate and help toenhance these conceptions and descriptions.

2.2.2 The Facet as an Activity-Organized Analysis of Concerns
It is a primary goal of the CPS Framework to be actionable: to be useful to perform
analyses of CPS. With that concern in mind, the prototypical model of a facet is shown in
Figure 6:15

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 6: Model of a Facet

A facet, therefore, is a collection of activities that produce artifacts that are driven by
aspects and their concerns for a CPS.
From this simple model, the three Framework facets are derived as shown in Figure 7:

Figure 7: Three Primary Framework Facets

The three facets comprise the traditional systems engineering process (typified by the“VEE” model [5].) By analyzing each aspect within all facets, all cross-cutting concerns
can be addressed at every stage of the design, creation and operation of a CPSThe .
Figure 8 illustrates this concept:

16

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 8: Facets and Aspects

On the left of the figure, the prism illustrates that aspects must be viewed through eachface of the prism – the facets. Note that analysis of CPS can be viewed from any faceand assembled by navigating one or more times through the faces to obtain thecomplete view of the CPS as shown on the right.
To emphasize that analysis of CPS need not (and is often not) a waterfall process, thefacets should be considered as modes of analysis where transitions are valid at any time
during the lifecycle of CPS concept.

2.2.3 Properties
The conceptualization facet comprises the set of activities and artifacts that produce amodel of a CPS. This model is made up of distinct properties of the CPS. These properties
are expressions of concerns held by the CPS stakeholders. There can be different kindsof such properties, for example, requirements and model elements. These properties
put requirements or constraints on functions and behaviors of the CPS. They represent
as well other attributes of the CPS associated with design and build practices andinclude properties of operation and disposal, i.e., the properties of a CPS span the entire
lifecycle of a CPS.
A realized and assembled “CPS model” is an instance of a CPS. The CPS model is thetheoretical ideal of the CPS. The realization facet and its activities strive to quantitatively
satisfy the aspirational properties of the conceptualization facet. The assurance facet
then provides the assurance that the conceptualization was realized as intended. The
properties of the realization facet are made up of design elements and test elements.
CPS can be seen as extensions of human capabilities, including sensing, decision-making,and action. Many times human beings are more than aware of the limitation of theirabilities, so assurance methodologies frequently provide both an extension of those17

Framework for Cyber-Physical Systems: Volume 1, Overview
abilities and an estimate of the uncertainty inherent in using these extensions. Humans
maintain a certain level of situational awareness and many times need to be protectedfrom errors in judgment.
Human beings’ capabilities are enhanced through CPS, however CPS assurance andestimates of CPS assurance levels will be important to the success and adoption of CPS
and will increase their benefit to mankind.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

High on the list of CPS challenges are topics related to human factors. The assurance
facet is intended to provide a methodology for understanding the scope and limits CPS
capabilities. In doing this the interaction between operator and CPS may also be
improved. Closer consideration of Figure 9 suggests that there is much researchrequired to better understand the relationship between the cognitive cycle of a humanoperator and that of the CPS conceived, built, and operated by humans.

Figure 9: CPS Enhanced Cognitive Cycle

Elements of the assurance case of a CPS, developed using this Framework, consists ofstatements built from data produced during the activities of the first two facets of theframework, conceptualization and realization. The elements, shown in Figure 10, are:••••ClaimsEvidence
Argumentation
Estimate of confidence

The typical statement of assurance takes the form:“The [Evidence] is sufficient to conclude that the [Claims] are true based on the[Argumentation] with this [Estimate of Confidence].”This is an assurance judgment. Judgments are properties of the assurance facet.
Ultimately this relationship between evidence, claims, argumentation, and estimate of18

Framework for Cyber-Physical Systems: Volume 1, Overview
confidence can be formalized. In this formalization a judgment will have assumptions
that are themselves judgments. Derivation rules can be used for deriving new judgmentsfrom given ones, i.e., one can apply formal reasoning to derive assurance judgmentsthat themselves provide a justification for accepting the derived judgment. As an
example, these rules may simply capture the reasoning suggested or dictated by astandard.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

An added value of this approach is that such a derivation contains a mapping of all of
the evidence used in deriving the judgment. It also provides guidance for how to reconstruct the evidence used to conclude that a CPS has the desired properties.

Figure 10: Elements of Assurance

The claims in the assurance facet are formed using the properties of the CPS developed
during the conceptualization facet, i.e., the CPS Model. The CPS Model consists of theproperties of the intended CPS. The claims in the assurance facet are the assertions that
the CPS in question has or satisfies each of these properties. The CPS is said to satisfy
the CPS Model if it satisfies or has each of the CPS Model properties. In thetransportation domain, with ISO 26262 [6] examples, the high-level statement or
judgement is that the CPS meets the requirements of the functional safety standard orthat the processes of the organization that developed the CPS are ISO 26262 compliant.
The evidence in the assurance facet is formed from the artifacts of the realization facet,such as process documentation, design artifacts, test plans, and results, as depicted in
Figure 11. They are determined by the specialization of the realization facet activities
and artifacts to their domain and the applicable aspects.

Figure 11: Evidence

19

Framework for Cyber-Physical Systems: Volume 1, Overview
As shown in Figure 12, the argumentation of the assurance facet is formed from avariety of things, including appeal to:
•
•
•
•
•

Standards
Best practices/consensus
Formal methods
Regulation (proscribed practices)
Expert judgment (including criteria for being an expert in a domain)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 12: Argumentation

Application of the CPS Framework develops this information when each of the facet
activities reviews each of the aspects of the Framework for impact on that activity. The
output of that review is an updating of that activity and its artifacts. It is intended toprovide criteria for evidence and supporting argumentation in the assurance facet toassure that the concerns in that aspect have been adequately addressed in the activity.
To facilitate addressing of the assurance for any of the properties in a CPS Model, we
document the properties of the CPS developed during the conceptualization facet in theform of a tree of properties. Formally a tree is a partially ordered set with a unique root(all nodes trace back ultimately to the same node) and no cycles (a cycle corresponds toa node that can be reached from itself following a non-trivial path in the tree). The
property tree of a CPS, consists of the properties of the CPS Model, ordered under the
traceability ordering. The root is the property PM/BC with the successor relation outlined
above.
Graphically this tree has the appearance shown in Figure 13:

20

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Figure 13: The Property Tree of a CPS

There are two types of assurance arguments, structural and empirical. Which one isapplied depends on the types or sources of properties to be assured.
The ‘branching type’ assurance argument itself has a couple of different flavors, one forassurance of a logically compound property (containing propositional connectives) and
one for properties that are compound due to the componentry of the CPS and its
interactions.
The ‘leaf type’ assurance argument is one that relates to the design D and test T put inplace in order to achieve a property of the CPS.
(1) HBranching(2) HLeaf
The argument, “A”, in this case may take the form that the test itself, the setup for the
test, and the way in which test results are stored and managed is in compliance with astandard, and the argument would make reference to the standard, as an example.
(1) Structural (logical and architectural) for branching properties, P and Q:
A(P*Q) =Def HBranching (A(P), A(Q)),
for logically compound or architecture properties(2) Empirical for the terminating properties or ‘leaves’ of the tree:
A(P, D, T) =Def HLeaf (P, D, T)
Each leaf represents the argumentation that “the design D and test T are
sufficient to conclude that the property P is met.” The argumentation HLeaf
makes reference to a certification, standard, or regulation where the test T is

21

Framework for Cyber-Physical Systems: Volume 1, Overview
recommended or required to establish that property as well as provide anestimate of level of confidence.
The assurance case of a CPS consists of all of the assurance judgments for every
property in the CPS Model.

2.2.4 Concerns to Aspects
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The concerns are identified and further analyzed, producing a set of cross-cutting
concern groupings called aspects. These aspects are “factored” from the work of thevarious working groups that produced this Framework – namely, the Vocabulary andReference Architecture, Use Case, Cybersecurity and Privacy, Timing andSynchronization, and Data Interoperability subgroups.
Concerns and aspects are not orthogonal. That is, within the analysis of a given concern,
consideration must also be given to related concerns. For example, in considering thetrustworthiness aspect, the trustworthiness of timing should be considered.

2.2.5 Activities and Artifacts
In using the Framework to analyze and document CPS, a series of activities is performed.
For example, a typical waterfall process includes use case development, functional
decomposition, requirements analysis, design, etc.
These are generic activities and are identified for each facet. These activities can beconsidered activity groups which may be tailored during analyses of the aspects andconcerns. For example, a Conceptualization facet activity “Requirements Analysis” mayinclude a Trustworthiness requirements analysis, a Timing requirements analysis, etc.…
In this Framework, “activities” may refer to individual activities or activity groups.
Each activity produces one or more artifacts, which are the concrete technicalcomponents used to document the results.

2.3 Uses of the CPS Framework
As described in 2.2, the CPS Framework consists of aspects and facets. The aspects are
categories of concerns. Each aspect represents a set of similar concerns and this isreflected in the name of the aspect. For example, the trustworthiness aspect includes
concerns of security, privacy, safety, reliability and resilience. The CPS Framework facets
are described in Section 2.4.2 and the aspects in Section 2.4.3.
Having clarity about the elements of each facet, the activities/artifacts lists, and how
they interrelate is critically important to understanding the approach of this document.
It is important to understand how the activities and their artifacts address concerns andaspects in all three facets.
Facet activities and artifacts are at the outset very general and relate to a generic highlevel process needed to understand CPS conceptualization, realization, and assurance.

22

Framework for Cyber-Physical Systems: Volume 1, Overview
Hence these activities are in essence a template and need to be specialized to a CPS
domain. The specialization of facet activities to a CPS domain involves the following:••This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Defining which of the CPS aspects apply to that domain: People are often
subject matter experts about a certain concern as it relates to a certain domain.
Over time, they have built a consensus that a specific set of processes and tools
must be applied in a specific way to adequately address the concern.
Updating the facet activities and artifacts for each applicable aspect: thisshould be based on a review of the best practices for addressing each concern inthe aspect.

The result of specializing facet activities to a CPS domain, and the attendant concerns, isa set of activities and artifacts that address the concerns that apply to that domain. For
example, if the CPS performs or delivers safety-critical functions in the transportation
domain, then there are multiple safety processes and test regimens that have become
standards. For example, in the area of transportation that has to do with groundvehicles, the ISO/IEC 26262 document [6], has become a standard for shaping theapproach of the commercial ground vehicle industry to establishing the software systemsafety of the vehicle systems.
Thus, the Framework can be used in different processes, depths, and scopes:
Processes:• Waterfall (analyze conceptualization, then realization, then assurance.) This
traditional system engineering flow allows for a requirements-driven processthat leads to assured and verified function. Note that although this indicates alinear sequence through the facets, the ability to iterate and propagate changes
discovered in one facet to the others is typically observed.
• Reverse engineering (analyze realization, then conceptualization, thenassurance.) To understand a deployed CPS and perhaps to extend or enhance it,reverse engineering analyzes the realized CPS for its properties and observes its
documentation to determine assurances. Once it is analyzed, modifications andenhancements can be made starting at any facet.
• Agile (do some conceptualization, then realization, then assurance, then iterate
to greater depths of detail.) Analysis alone sometimes results in a reality otherthan what was originally envisioned at a high level, so an agile process seeks totake a minimal or “core” conceptualization to rapid realization and assurance.
Once confirming initial assumptions about the CPS, the agile development
process fills in additional detail in each facet to iteratively arrive at thecompleted set of artifacts.
•

Service-based (analyze conceptualization, identify/fit advertised realizations,then assurance.) Dynamic services can be envisioned and deployed on top ofexisting CPS.

•

Gap-analysis (analyze a set of CPS including systems of CPS and compare to
discover gaps and overlaps for Pivotal Points of Interoperability (PPI)).
23

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Understanding the opportunities for integration or gap-filling informs holistic
tradeoff decisions about integrating systems and capabilities.
Depths:• Critical tightly-coupled CPS: For critical infrastructures such as the energy grid, adeep and detailed process would be developed using the Framework. Emphasison hard requirements and assurances, along with constraints from most aspects,
would be evidenced.
• Loosely-coupled CPS: Especially appropriate for applications of CPS that
repurpose capabilities of existing CPS and integrate them in new and novel ways,
a lighter emphasis on hard requirements and a greater weight on functional
goals are sought.
• Shallow analysis: For presenting concepts or talking about alternative
approaches to CPS problems, small subsets of the Framework might be used. The
use of the Framework structure and terminology allows the substance of theconcept to be readily understood because the Framework sets a context for the
discussion.
Scopes:• Single CPS device: A device such as a video camera, robot, or thermostat. The
focus of the analysis would emphasize the robustness of the design to enable it
to become a valued component of a CPS.
• System or subsystem: A system of individual cyber, physical, and cyber-physicaldevices such as an HVAC system, which might consist of thermostat, air handler,
compressor, and furnace.
• SoS: A system of interconnected systems, such as a power company demand
response program interacting with individual HVAC systems to achieve abalanced energy system.

2.4 The Description of the CPS Framework
This section presents a detailed description of the CPS Framework. The Frameworkprovides a taxonomy and organization of analysis that allow the complex process ofstudying, designing, and evolving CPS to be orderly and sufficiently encompassing.
A visual representation of the Framework was previously shown in Figure 4 in terms of
domains, facets, and aspects.
The rest of this section presents the elements of the Framework in tabular form,
providing only the taxonomy.

2.4.1 Domains
The domains of CPS are the areas of deployment of CPS in which stakeholders may havedomain-specific and cross-domain concerns. Table 1 provides examples of CPS domains
considered by the Public Working Group in its analysis.

24

Framework for Cyber-Physical Systems: Volume 1, Overview
Table 1: Examples of CPS Domains

Domains

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AdvertisingEntertainment/sports

Aerospace

Environmental monitoring

Agriculture

Financial services

Buildings

Healthcare

CitiesInfrastructure (communications, power,
water)

Communities

LeisureConsumer

Manufacturing

DefenseScience

Disaster resilience

Social networks

Education

Supply chain/retail

Emergency response

Transportation

EnergyWeather

2.4.2 Facets
Table 2 lists and defines the facets.
Table 2: Facets

Facet

Description

Conceptualization What things should be and what things are supposed to do: theset of activities that produce a model of a CPS (includes
functional decomposition, requirements, and logical models.)
Realization

How things should be made and operate: the set of activities that
produce, deploy, and operate a CPS (includes engineering
tradeoffs and detailed designs in the critical path to the creationof a CPS instance.)

Assurance

How to achieve a desired level of confidence that things will work
the way they should: the set of activities that provide confidence
that a CPS performs as specified (includes claims, evidence, andargumentation.)25

Framework for Cyber-Physical Systems: Volume 1, Overview

2.4.3 Aspects and Concerns
Table 3 lists and defines the aspects.
Table 3: Aspects

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectDescription

Functional

Concerns about function including sensing, actuation, control,
communications, physicality, etc.

Business

Concerns about enterprise, time to market, environment,
regulation, cost, etc.

Human

Concerns about human interaction with and as part of a CPS.

Trustworthiness

Concerns about trustworthiness of CPS including security, privacy,
safety, reliability, and resilience.

TimingConcerns about time and frequency in CPS, including thegeneration and transport of time and frequency signals,
timestamping, managing latency, timing composability, etc.

Data

Concerns about data interoperability including fusion, metadata,
type, identity, etc.

Boundaries

Concerns related to demarcations of topological, functional,organizational, or other forms of interactions.

Composition

Concerns related to the ability to compute selected properties of acomponent assembly from the properties of its components.
Compositionality requires components that are composable: they
do not change their properties in an assembly. Timing
composability is particularly difficult.

Lifecycle

Concerns about the lifecycle of CPS including its components.

Table 4 lists and defines the concerns.
Table 4: Concerns

AspectConcern

Description

Functional

actuation

Concerns related to the ability of the CPS toeffect change in the physical world.

Functional

communication

Concerns related to the exchange of
information internal to the CPS and between
the CPS and other entities.

Functional

controllability

Ability of a CPS to control a property of aphysical thing. There are many challenges toimplementing control systems with CPS
including the non-determinism of cybersystems, the uncertainty of location, time andobservations or actions, their reliability andsecurity, and complexity. Concerns related to26

Framework for Cyber-Physical Systems: Volume 1, Overview
AspectConcern

Description
the ability to modify a CPS or its function, if
necessary.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Functional

functionality

Concerns related to the function that a CPS
provides.

Functional

manageability

Concerns related to the management of CPS
function. For example, Managing Timing incomplex CPS or SoS is a new issue with CPS that
did not exist before. It is being developed withnew standards

Functional

measurability

Concerns related to the ability to measure thecharacteristics of the CPS.

Functional

monitorability

Concerns related to the ease and reliability withwhich authorized entities can gain and maintainawareness of the state of a CPS and its
operations. Includes logging and audit
functionality.

Functional

performance

Concerns related to the ability of a CPS to meetrequired operational targets.

Functional

physicalConcerns about purely physical properties of
CPS including seals, locks, safety, and EMI.

Functional

physical context

Concerns relating to the need to understand a
specific observation or a desired action relative
to its physical position (and uncertainty.) While
this information is often implied and not explicitin traditional physical systems, the distributed,
mobile nature of CPS makes this a criticalconcern.

Functional

sensing

Concerns related to the ability of a CPS todevelop the situational awareness required toperform its function.

Functional

statesConcerns related to the states of a CPS. For
example, the functional state of a CPS isfrequently used to allow for variation in the CPS
response to the same set of inputs. Variation in
response based on state is sometimes referred
to as functional modes.

Functional

uncertainty

Managing the effects of uncertainties is afundamental challenge in CPS. Sources of
uncertainty in CPS can be grouped into
statistical (aleatoric), lack of knowledge(epistemic) uncertainty, or systematic
uncertainty. In CPS, statistical uncertainty iscaused by randomness of accuracy of sensing
and actuation, often caused by uncertainty of27

Framework for Cyber-Physical Systems: Volume 1, Overview
AspectConcern

Description
manufacturing processes. Systematic
uncertainty is caused by incomplete knowledge
either due to limits of acquired knowledge or
due to simplification in modeling. Typicalmanifestations of epistemic uncertainty are
limited validity of models of physical processes
or limits of computability of properties ofmathematical models.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

BusinessenterpriseConcerns related to the economic aspects of
CPS throughout their lifecycle.

Business

cost

Concerns related to the direct and indirect
investment or monetary flow or other resources
required by the CPS throughout its lifecycle.

Business

environment

Concerns related to the impacts of theengineering and operation of a CPS on thephysical world.

Business

policyConcerns related to the impacts of treaties,
statutes, and doctrines on a CPS throughout its
lifecycle.

BusinessqualityConcerns related to the ease and reliability ofassessing whether a CPS meets stakeholder(especially customer) expectations.

Businessregulatory

Concerns related to regulatory requirements
and certifications.

Businesstime to market

Concerns related to the time period required tobring a CPS from need realization throughdeployment.

BusinessutilityConcerns related to the ability of a CPS toprovide benefit or satisfaction through its
operation. Utility reflects a business concern,
especially when considered as the numerator
when computing value, which equals utility
divided by costs.

Human

human factors

Concern about the characteristics of CPS withrespect to how they are used by humans.

Humanusability

Concerns related to the ability of CPS to be used
to achieve its functional objectives effectively,
efficiently, and to the satisfaction of users(adapted from ISO 9241-210.) The combinationof physical and cyber into complex systems
creates challenges in meeting usability goals.
Complexity is a major issue. The diversity ofinterfaces creates a significant learning curvefor human interaction.

28

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectConcern

Description

TrustworthinessprivacyConcerns related to the ability of the CPS toprevent entities (people, machines) fromgaining access to data stored in, created by, ortransiting a CPS or its components such that
individuals or groups cannot seclude
themselves or information about themselvesfrom others. Privacy is a condition that resultsfrom the establishment and maintenance of acollection of methods to support the mitigationof risks to individuals arising from theprocessing of their personal information withinor among systems or through the manipulationof physical environments.

Trustworthinessreliability

Concerns related to the ability of the CPS todeliver stable and predictable performance in
expected conditions.

Trustworthinessresilience

Concerns related to the ability of the CPS towithstand instability, unexpected conditions,and gracefully return to predictable, but
possibly degraded, performance.

TrustworthinesssafetyConcerns related to the ability of the CPS toensure the absence of catastrophic
consequences on the life, health, property, ordata of CPS stakeholders and the physicalenvironment.

Trustworthinesssecurity

Concerns related to the ability of the CPS toensure that all of its processes, mechanisms,
both physical and cyber, and services areafforded internal or external protection fromunintended and unauthorized access, change,
damage, destruction, or use.
Confidentiality: Preserving authorized
restrictions on access and disclosure.
Integrity: Guarding against improper
modification or destruction of system, andincludes ensuring non-repudiation andauthenticity
Availability: Ensuring timely and reliable accessto and use of a system.

Timinglogical time

Concerns related to the order in which things
happen (causal order relation) or event driven.

Timingsynchronization

Concerns for synchronization are that all
associated nodes have timing signals traceable
to the same time scale with accuracies as
required. There are three kinds ofsynchronization that might be required: time,phase, and frequency synchronization, although29Framework for Cyber-Physical Systems: Volume 1, Overview
AspectConcern

Description
frequency synchronization is also called
syntonization.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Timingtime awareness

Concerns that allow time correctness by design.
The presence or absence of time explicitly in themodels used to describe, analyze, and design
CPS and in the actual operation of thecomponents. This is a life-cycle concern as well
as a concern for the ability to build devices
without the need for extensive calibration of
the timing properties.

Timingtime-interval and latency

Specifying requirements for timing generally
involves requirements for time-intervals
between pairs of events. A time-interval is theduration between two instants read on thesame timescale. CPS timing requirements are
generally expressed as constraints on the timeintervals (TI) between pairs of system significant
events. These can be categorized in terms ofbounded TIs or latency, deterministic TIs, andaccurate TIs.

Data

data semantics

Concerns related to the agreed and shared
meaning(s) of data held within, generated by,
and transiting a system.

Data

identity

Concerns related to the ability to accurately
recognize entities (people, machines, and data)when interacting with or being leveraged by a
CPS.

Data

operations on data

Concerns related to the ability tocreate/read/update/delete system data andhow the integrity of CPS data and behaviors
may be affected.

Data

relationship between data

Concerns related to how and why sets of data
must, may, or may not be associated with eachother and the value or harm that can be derived
from those associations.

Data

data velocity

Concerns related to the speed with which data
operations are executed.

Data

data volume

Concerns related to the volume or quantity ofdata associated with a CPS’ operation.

Boundaries

behavioral

Concerns related to interdependence among
behavioral domains. Concerns related to theability to successfully operate a CPS in multiple
application areas.

Boundaries

networkability

Concerns related to the ease and reliability withwhich a CPS can be incorporated within a (newor existing) network of other systems.

30

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectConcern

Description

Boundaries

responsibility

Concerns related to the ability to identify theentity or entities authorized to control theoperation of a CPS.

Composition

adaptability

Concerns related to the ability of the CPS toachieve an intended purpose in the face ofchanging external conditions such as the need
to upgrade or otherwise reconfigure a CPS tomeet new conditions, needs, or objectives.

Composition

complexity

Concerns related to our understanding of the
behavior of CPS due to the richness andheterogeneity of interactions among its
components, such as existence of legacy
components and the variety of interfaces.

Composition

constructivity

Composition

discoverability

Lifecycle

deployability

Concerns related to the ability to combine CPS
modular components (hardware, software, anddata) to satisfy user requirements.
Concerns related to the ease and reliability withwhich a CPS component can be observed andunderstood (for purposes of leveraging thecomponent’s functionality) by an entity(human, machines). Concerns related to theease and reliability with which a CPS
component’s functions can be ascertained (forpurposes of leveraging that functionality) by anentity (human, machines).
Concerns related to the ease and reliability withwhich a CPS can be brought into productive use.

Lifecycle

disposability

Concerns related to the impacts that may occur
when the CPS is taken physically out of service.

Lifecycle

engineerability

Concerns related to the ease and reliability withwhich a CPS design concept can successfully berealized via a structured engineering process.

Lifecycle

maintainability

Concerns related to the ease and reliability withwhich the CPS can be kept in working order.

Lifecycle

operability

Concerns related to the operation of the CPS
when deployed.

Lifecycle

procureability

Concerns related to the ease and reliability withwhich a CPS can be obtained.

Lifecycle

producibility

Concerns related to the ease and reliability withwhich a CPS design can be successfully
manufactured.

2.4.4 Composition of Concerns
Concerns are applied in the CPS Framework in general to all of the activities of all of the
facets. This is one sense in which they are potentially ‘cross-cutting’. For a particular CPS

31

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

one may decide to apply certain of the concerns and may view others as not being
relevant. This is one of the ways that the CPS Framework can be tailored to thedevelopment of a CPS. At the same time, once the set of relevant concerns has been
determined, the application of a concern must take into account its interactions withother relevant concerns. For example, action taken in a design to address the cybersecurity concern may adversely affect the safety of the CPS. Corrective action thentaken to bolster its safety may then reduce the effectiveness of the actions for cybersecurity, resilience or reliability. In other words, there will be trade-offs between
concerns.
Thus, one needs to explain how a set of more than one concern, deemed as relevant toa CPS, is applied to the CPS in question. This is referred to as the composition ofconcerns and explains how it is to be understood and used.
The effect of applying a concern to a CPS depends on the facet and activity being
considered. Generally, that application can be associated with the set of properties or
requirements that the concern requires of the CPS. Hence applying two or moreconcerns amounts to requiring all of the properties required by the set of concerns.
If one denotes formally the set of properties of a CPS required by a concern as:
𝐶𝐶̅ 𝐶𝐶𝐶𝐶𝐶𝐶 = {𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝 𝑜𝑜𝑜𝑜 𝑡𝑡ℎ𝑒𝑒 𝐶𝐶𝐶𝐶𝐶𝐶 𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟𝑟 𝑏𝑏𝑏𝑏 𝑡𝑡ℎ𝑒𝑒 𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 𝐶𝐶}then the composition of concerns 𝐶𝐶1 and 𝐶𝐶2 can be expressed as follows:
𝐶𝐶𝐶𝐶𝐶𝐶
𝐶𝐶𝐶𝐶𝐶𝐶
𝐶𝐶𝐶𝐶𝐶𝐶���������
𝐶𝐶1 ∗ 𝐶𝐶2
= ���
𝐶𝐶1
∪ ���
𝐶𝐶2 .

The interpretation of the composition of multiple concerns is defined in terms of binary
composition. The composition of a set of concerns is interpreted as the union of theproperties required by each concern in the set. This notion of composition is clearlycommutative and associative.
This set-theoretic semantics of the CPS Framework can be extended to all of theconcepts of the framework and will be worked out in detail in future works.
An example of composition of concerns is timing security. The composition of timing
and security results in the collection of all the properties of CPS that are required by thetiming and the security concerns. Resolving ‘conflicts’ between properties is one of thetasks of requirements analysis.
Consider since timing requires both a physical signal and data about that signal, timing
security includes the security of the data in much the same way as traditional cybersecurity, plus the security of the physical signal. Many CPS will require timing reliability,
both for the local system and for the traceability of the timing. For example, GPSjamming is the timing equivalent of a cyber denial-of-service attack. Resilience willappear as fault-tolerance in timing, whether the fault is intentional or unintentional.
Timing safety will depend on the CPS. Certainly in some systems a timing failure can lead32

Framework for Cyber-Physical Systems: Volume 1, Overview
to a lack of safety. Privacy will not be a timing concern in many systems, because timingis generally intended to be public information. However, there may well be cases where
the timing requires privacy.
So assume that it is desired to present the concerns that apply to the exchange of GNSS(“GPS”) timing. You would simultaneously have to satisfy concerns of the form:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201•

Trustworthiness.Reliability – “message delivery shall be reliable”•

Trustworthiness.Security – “availability shall not be interfered with through
Denial Of Service”•

Trustworthiness.Resilience - ”the system shall be fault-tolerant”•

Trustworthiness.Safety – “message exchange failure shall not lead to hazard or
harm”

•

Trustworthiness.Confidentiality – “message exchange shall only be understoodby the intended recipient”•

Trustworthiness.Privacy – “message shall not contain PII”•

Data.DataSemantics – “shall have a representation of time”•

Trustworthiness.Security.Cybersecurity – “message exchange must not betampered with”

This expresses the above outlined example as a set of concerns which taken together
corresponds to the union of the properties given by each concern.

2.4.5 Activities and Artifacts
Table 5 lists the activities (groups) and artifacts related to the conceptualization facet.
Table 5: Conceptualization Facet: Activities and Artifacts

Activity and Artifacts
Mission and Business Case Development
Artifact: Business use cases
Functional Decomposition
Artifact: Detailed use cases, actors, information exchanges
Requirements Analysis
Artifact: Functional and non-functional requirements
Requirements Allocation
Artifact: HW/SW configuration Items
Interface Requirements Analysis
Artifact: Interface requirements

33

Framework for Cyber-Physical Systems: Volume 1, Overview
Table 6 lists the activities (groups) and artifacts related to the realization facet.
Table 6: Realization Facet: Activities and Artifacts

Activity and Artifacts
Business Case Analysis
Artifact: Trade studies, lifecycle cost analysis, return on investment, and interdependencies withrequirements, regulations, and incentives
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Lifecycle Management
Artifact: Lifecycle management and sustainability plan, integrated lifecycle management monitoring
DesignArtifact: Design documentation, tradeoff analyses, requirement verification, virtual prototypes
Manufacturing/Implementation
Artifact: Manufactured, integrated products, testing plans, and test results
Operations
Artifact: Performance, quality, and product evolution tracking
Disposal
Artifact: Reuse, sustainability and energy recovery assessments, disposal manifests
Cyber-Physical Abstraction Layer Formation
Artifact: Domain (and product)-specific ontologies, modeling languages, and semantics specifications
used in all phases of the lifecycle
Physical Layer Realization
Artifact: Physical substrates of the CPS used in all phases of the lifecycle.

Table 7 lists the activities (groups) and artifacts related to the assurance facet.
Table 7: Assurance Facet: Activities and Artifacts

Activity and Artifacts
Identify Assurance Objectives
Artifact: Assurance objectives/analysis report
Define Assurance Strategy
Artifact: Strategy document/plan
Control Assurance Evidence
Artifact: Control documentation
Analyze Evidence
Artifact: Analysis report
Provide Assurance Argument
Artifact: Assurance argument report
Provide Estimate of Confidence
Artifact: Confidence estimate
Configuration Audit
Artifacts: Product configuration assessment
Requirements Verification
Artifact: Requirements and test results assessment

34

Framework for Cyber-Physical Systems: Volume 1, Overview
Activity and Artifacts
Product Certification and Regulatory Compliance Testing
Artifact: Certifications

2.5 Related Standards and Activities
The purpose of this section is to highlight some, though far from all, related standards,
organizations and working groups that are relevant to the NIST CPS PWG effort.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

From 2010 to 2013, the European Lighthouse Integrated Project “Internet of Things –Architecture” (IoT-A) developed and proposed an architectural reference model for the
IoT, referred to as the IoT Architectural Reference Model (IoT ARM) [7]. The goal of the
project was to introduce a common language for fostering the interoperability between
vertical “silos” (domains) in emerging IoT applications. The IoT ARM introduces topdown architectural principles and design guidelines.
IoT-A explicitly separates itself in scope from CPS. The IoT-ARM’s functional view isorganized in service layers (including communication, services, management, andsecurity) on top of CPS. CPS, in IoT-A’s terminology, are IoT devices (devices) and IoT
resources (software), and their architecting guidelines are not covered by the IoT ARM.
It is important for the NIST CPS PWG Vocabulary and Reference Architecture subgroup
to determine possible interactions with the IoT ARM.
The IEEE P2413 working group [8] was formed in 2014 to promote cross-domaininteraction, aid system interoperability, and provide functional compatibility in the IoT.
The IEEE P2413 also defines an architectural framework for the IoT, including
abstractions and a common vocabulary. It emphasizes a “blueprint for data abstraction
and the quality quadruple (protection, security, privacy, and safety.)”
The IoT ARM and IEEE P2413 share a few important characteristics that are worth
noting. Both initiatives adhere to the ISO/IEC/IEEE 42010 standard, their functionalmodels are inspired by the OSI reference model, and they explicitly take into
consideration architecture divergence. Also, both identify architecture divergence as amajor topic. It is important for the NIST CPS PWG to find similarities and key differences
between the scopes of IoT-related activities and CPS. This will help readers of thisdocument to distinguish between CPS and IoT and use the NIST CPS Reference
Architecture to define CPS-specific architectures that may be compatible with IoT
services and standards.
OneM2M [9] is intended to be an interoperability enabler for the entire CPS, M2M andIoT Ecosystem. The purpose and goal of OneM2M is to develop Technical Specifications
and Technical Reports, which address the need for a common IoT Service Layer that canbe readily realized through an API embedded within various hardware and software,and relied upon to connect the myriad of devices in the field with IoT application servers
worldwide. A critical objective of OneM2M is to enable users to build platforms,
regardless of existing sector or industry solutions, to enable wider integration and cross35

Framework for Cyber-Physical Systems: Volume 1, Overview
system value to be derived than is currently possible. OneM2M aims to attract andactively involve a wide variety of organizations from IoT-related business domains suchas: telematics and intelligent transportation, healthcare, utilities, industrial automation,
smart homes, etc.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Cybersecurity Research Alliance (CSRA) [10] is an industry-led, non-profit consortium
focused on research and development strategy to address evolving cybersecurity
environment through partnerships between government, industry, and academia. Thiseffort was established in response to the growing need for increased public-private
collaboration to address R&D issues in cybersecurity.
CPS Voluntary Organization (supported by the National Science Foundation) [11] is an
online site to foster collaboration among CPS professionals in academia, government,
and industry.
The Networking and Information Technology Research and Development (NITRD) CPS
Senior Steering Committee [12] coordinates programs, budgets, and policy
recommendations for CPS research and development (R&D). This includes identifying
and integrating requirements, conducting joint program planning, and developing joint
strategies for the CPS R&D programs conducted by agency members of the NITRD
Subcommittee. CPS includes fundamental research, applied R&D, technology
development and engineering, demonstrations, testing and evaluation, technology
transfer, and education and training; and "agencies" refers to Federal departments,
agencies, directorates, foundations, institutes, and other organizational entities.
NIST Privacy Engineering [13] focuses on providing guidance that can be used todecrease privacy risks, and to enable organizations to make purposeful decisions about
resource allocation and effective implementation of controls in information systems.
This NIST privacy engineering work targets specifically how government agencies are toaddress privacy and may not be adequate for the private sector.
The goal of making time an integral part of networks is being advanced in foundational
standards that define both wired and wireless networks. IEEE 802.1 [14] [15] 8, 9 has atime sensitive networking (TSN) working group defining various standards that will
enable determinism in local area wired networks using synchronized clocks. The methodof synchronizing clocks is based on the IEEE 1588 standards that have invented thePrecision Time Protocol (PTP) [16]. The Internet Engineering Task Force (IETF) is planningto leverage the building blocks defined by IEEE 802.1 and IEEE 1588 to enable
determinism in wide area networks (routable wired networks). Similar initiatives in theIEEE 802.11 [15] standards body have resulted in the development of Timing
Measurement and Fine Timing Measurement protocols that enable precise clock
8IEEE publications are available from the Institute of Electrical and Electronics Engineers, 445 Hoes Lane, Piscataway, NJ 08854, USA(http://standards/ieee.org/).

9 The IEEE standards or products referred to in this clause are trademarks of the Institute of Electrical and Electronics Engineers, Inc.

36

Framework for Cyber-Physical Systems: Volume 1, Overview
synchronization in WiFi networks. International Telecommunications Union (see ITU-T
standard G.8265.1-July 2014 10) has also leveraged the work done in 1588 and applied it
to telecommunication networks. Enhancements to the IEEE 802.15.4 standards haveresulted in the development of a time-slotted communication model for low power
personal area networks. This work has been created by the IETF task group called
6TISCH, RFC 7554 [17].

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AVnu Alliance [18] is a community for creating an interoperable ecosystem servicing
precise timing and low latency requirements of diverse applications using open
standards like Time-Sensitive Networking (TSN). This alliance focuses on creatinginteroperability tests and certification for products used in applications requiring
bounded latency, reserved bandwidth, and synchronized time.
Industrial Internet Consortium (IIC) [19] brings together the organizations andtechnologies necessary to accelerate growth of the Industrial Internet by identifying,assembling, and promoting best practices. This goal of the IIC is to drive innovation
through the creation of new industry use cases and testbeds for real-world applications;define and develop the reference architecture and frameworks necessary forinteroperability; influence the global development standards process for Internet andindustrial systems; facilitate open forums to share and exchange real-world ideas,
practices, lessons, and insights; and build confidence around new and innovative
approaches to security.
National Security Telecommunications Advisory Committee (NSTAC) [20] brings
together up to 30 industry chief executives from major telecommunications companies,
network service providers, information technology, finance, and aerospace companies.
These industry leaders provide the President with collaborative advice and expertise, as
well as robust reviews and recommendations. The NSTAC’s goal is to develop
recommendations to the President to assure vital telecommunications links through any
event or crisis, and to help the US Government maintain a reliable, secure, and resilient
national communications posture.
The European Telecommunications Standards Institute’s (ETSI’s) standardization groupdedicated to Low Throughput Networks (LTN) [21] technology has released the first
three specifications of an Internet of Things (IoT) network dedicated to low throughput
communications. These new requirements provide a breakthrough in the machine tomachine business, allowing object connection for a few euros per year, with a few
milliwatts for transmission and a modem costing less than 1 euro. The key to the successof IoT standardization and implementation, these assumptions are the basis for many
new and innovative applications. Low Throughput Network (LTN) technology is a wide
area bidirectional wireless network with key differentiators compared to existing
networks. It enables long-range data transmission (distances around 40 km in open
10

ITU-R publications are available from the International Telecommunications Union, Place des Nations, 1211 Geneva 20,
Switzerland (http://www.itu.in/).

37

Framework for Cyber-Physical Systems: Volume 1, Overview
field) and/or communication with buried underground equipment and operates withminimal power consumption allowing several years of operation even with standard
batteries. This technology also implements advanced signal processing that provides
effective protection against interference.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The Internet of Things (IoT) is one of the new, convergent technologies addressed byOpen Platform 3.0™ [22] The Open Group IoT standards aim to do for the IoT what
HTML/HTTP did for the Web, enabling everything to be connected on the fly. Vendors
will be able to collect information from products in the field throughout their lifecycle.
This will allow the optimization of maintenance operations, providing increased safetyat lower cost. Enterprises will be able to monitor and control installed equipment, andintegrate it into intelligent solutions, for example, to ensure the health of buildings andmachinery, or to improve energy efficiency.

2.6 SUMMARY
The CPS Framework presents a set of high-level concepts, their relationships, and a
vocabulary for clear communication among stakeholders (e.g., architects, engineers,
users). The ultimate goal of the CPS Framework is to provide a common language fordescribing interoperable CPS architectures in various domains so that these CPS caninteroperate within and across domains and form systems of systems.
The CPS Framework includes the identification of foundational goals, characteristics,
common roles, and features across CPS domains, while considering cybersecurity,
privacy, and other cross-cutting concerns. The CPS Framework is an abstract framework,or meta-model, for understanding and deriving application domain-specific CPS
architectures. Work remains to be done to further specify this high-level architecture
independent from specific application domains, problems, standards, technologies,
protocols, and implementations, and to identify interfaces to facilitate cross-sector CPS
interoperability.
The CPS Framework consists of three facets – conceptualization, realization, andassurance. Each facet is presented and understood from its set of activities and artifacts.
The activities in turn address aspects and concerns throughout the CPS development
cycle.
The artifacts consist of properties discovered and modeled in the conceptualization
facet, implemented and deployed in the realization facet, and verified and validated in
the assurance facet.

38Framework for Cyber-Physical Systems: Volume 1, Overview

Appendix A. References
This section provides references to a variety of CPS-related articles, standards, and othermaterial cited in the text.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201[1]

TOGAF, The Open Group Architecture Forum, Open Group Standard Version 9.1,
2011, http://pubs.opengroup.org/architecture/togaf9-doc/arch/[2]

CMMI, Capability Maturity Model Integration, Version 1.3, November 2010,https://resources.sei.cmu.edu/asset_files/TechnicalReport/2010_005_001_1528
7.pdf

[3]

ISO/IEC/IEEE 42010, “Systems and software engineering – architecture
description,” 2011,
http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=6129467[4]

ISO/IEC/IEEE FDIS 15288:2014(E), “Systems and software engineering - System
life cycle processes,”
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=699419
6[5]

Forsberg, K. and Mooz, H. “The Relationship of System Engineering to the Project
Cycle,” in Proceedings of the First Annual Symposium of National Council on
System Engineering, link, October 1991.

[6]

ISO 26262-1:2011(en), Road vehicles – Functional safety,
https://www.iso.org/obp/ui/#iso:std:iso:26262:-1:ed-1:v1:en[7]

Internet of Things – Architecture (IoT-A), “Final architectural reference model for
the IoT v3.0,” http://www.iot-a.eu/public/public-documents/d3.1, 2013.

[8]

IEEE P2314, “Standard for an Architectural Framework for the Internet of Things(IoT),” Webinar, June 13, 2014.
http://standards.ieee.org/develop/project/2413.html[9]Standards for M2M and the Internet of Things, OneM2M,
http://www.onem2m.org/technical/published-documents[10]

The Cybersecurity Research Alliance,
http://www.cybersecurityresearch.org/about_us.html[11]

The Cyber-Physical Systems Virtual Organization, http://cps-vo.org/[12]

The Networking and Information Technology Research and Development(NITRD) Program,
https://www.nitrd.gov/nitrdgroups/index.php?title=Cyber_Physical_Systems_(CPS_SSG)#title

39

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201[13]Computer Security Division Computer Security Resource Center, NIST,
http://csrc.nist.gov/projects/privacy_engineering/index.html[14]IEEE 802.1 Time Sensitive Networking Task Group,
http://www.ieee802.org/1/pages/tsn.html[15]IEEE 802.11, “Wireless Local Area Networks,” Working Group for WLAN
Standards, http://www.ieee802.org/11/[16]

IEEE Instrumentation and Measurement Society, IEEE 1588-2008 IEEE Standard
for Precision Clock Synchronization Protocol for Networked Measurement andControl Systems, 24 July 2008,.
https://standards.ieee.org/findstds/standard/1588-2008.html[17]

6TISH, “RFC 7554 on Using IEEE 802.15.4e Time-Slotted Channel Hopping (TSCH)
in the Internet of Things (IoT): Problem Statement,” IETF, 14th May 2015,
https://tools.ietf.org/html/rfc7554[18]

The Avnu Alliance, www.avnu.org[19]

The Industrial Internet Consortium,
http://www.industrialinternetconsortium.org/[20]

The National Security Telecommunications Advisory Committee, Department ofHomeland Security, http://www.dhs.gov/nstac[21]

ETSI specification for Internet of Things and Machine to Machine Low
Throughput Networks, ETSI, http://www.etsi.org/news-events/news/827-201409-news-etsi-new-specification-for-internet-of-things-and-machine-to-machinelow-throughput-networks[22]

The Open Group Internet of Things (IoT) Work Group,
http://www.opengroup.org/getinvolved/workgroups/iot[23]

ISO/IEC 27000:2014, Information technology — Security techniques —Information security management systems — Overview and vocabulary
https://www.iso.org/standard/63411.html[24]

ISO/IEC 16500-8:1999, Information technology -- Generic digital audio-visualsystems -- Part 8: Management architecture and protocols and concepts,
https://www.iso.org/standard/31016.html[25]

ISO/IEC 24760-1:2011 , Information technology — Security techniques — A
framework for identity management — Part 1: Terminology and Concepts,
https://www.iso.org/standard/57914.html[26]

ISO/IEC DIS 18834-1:2016, RA SOA – Information technology -- Reference
Architecture for Service Oriented Architecture (SOA RA) -- Part 1: Terminology
and concepts for SOA, https://www.iso.org/standard/63104.html
40

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201[27]

ISO TS 19104:2008, Geographic information – Terminology,
https://www.iso.org/standard/45020.html[28]

ISO 9000:2015, Quality management systems – Fundamentals and vocabulary,
https://www.iso.org/obp/ui/#iso:std:iso:9000:ed-4:v1:en[29]

Industrial Internet Reference Architecture v1.8, Industrial Internet Consortium,
https://www.iiconsortium.org/IIRA.htm[30]

ISO/IEC 24791-1:2010, Information technology — Radio frequency identification(RFID) for item management — Software system infrastructure — Part 1:
Architecture, https://www.iso.org/standard/46137.html[31]

CNSSI 4009 Committee on National Security Systems (CNSS) Glossary, Release
Date: 04/06/2015, https://www.cnss.gov/CNSS/issuances/Instructions.cfm[32]

ISO/IEC 2382-1:1993, Information technology -- Vocabulary -- Part 1:
Fundamental terms, https://www.iso.org/standard/7229.html[33]

European Commission Community Research and Development Information
Service, Internet of Things Architecture [IOT-A] project,
http://cordis.europa.eu/project/rcn/95713_en.html[34]

ISO/TR 14252:1996, Information technology -- Guide to the POSIX Open System
Environment (OSE), https://www.iso.org/standard/23985.html[35]

ISO 7498-2:1989, Information processing systems — Open Systems
Interconnection — Basic Reference Model — Part 2: Security Architecture
https://www.iso.org/standard/14256.html[36]

ISO/IEC 14814:2006, Road transport and traffic telematics — Automatic vehicle
and equipment identification — Reference architecture and terminology,
https://www.iso.org/standard/37046.html

41

Framework for Cyber-Physical Systems: Volume 1, Overview

Appendix B. Definitions and Acronyms

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The following definitions and acronyms are presented as a ready reference to theintended meaning of their use in the text of this document. It is recognized that withinvarious technical domains, many of these terms and acronyms have multiple meanings.
The intent is to provide clarity for the interpretation of this framework and not to makea definitive statement about the “universal” definition of the terms and acronyms. In
some cases, canonical references were not identified and the “source” column lists “thisdocument” as the context for the definition.
B.1

Selected terms used in this document are defined below.

Term

Definition

Sourceaccess control

A means to ensure that access to assets is authorized andrestricted based on business and security requirements
Note: Access control requires both authentication andauthorization[23]

accuracy

Closeness of the agreement between the result of a measurement
and the true value of the measurand.

ITU-R Rec.
TF.686

actorsA person or system component who interacts with the system as
a whole and who provides stimulus which invoke actions.

[24]

ageing

The systematic change in frequency with time due to internalchanges in the oscillator.
NOTE 1 – It is the frequency change with time when factors
external to the oscillator (environment, power supply, etc.) are
kept constant.

ITU-R Rec.
TF.686architecture viewAn ‘architecture view’ consists of ‘work product expressing thearchitecture of a system from the perspective of specific system
concerns’.

[3]architecture
viewpointAn ‘architecture viewpoint’ consists of work product establishing
the conventions for the construction, interpretation and use ofarchitecture views to frame specific system concerns’.

[3]

aspectConceptually equivalent concerns, or major categories ofconcerns. Sometimes called “cross-cutting” concerns.

This document

assurance

The level of confidence that a CPS is free from vulnerabilities,
either intentionally designed into it or accidentally inserted during
its lifecycle, and that the CPS functions in the intended manner.

This document

attribute

A characteristic or property of an entity that can be used todescribe its state, appearance, or other aspects.

[25]

calibration

The process of identifying and measuring offsets between theindicated value and the value of a reference standard used as thetest object to some determined level of uncertainty.
NOTE 1 – In many cases, e.g., in a frequency generator, thecalibration is related to the stability of the device and therefore its

ITU-R Rec.
TF.68642

Framework for Cyber-Physical Systems: Volume 1, Overview
Termcertificate

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

clock

collaboration

Definition

Sourceresult is a function of time and of the measurement averaging
time.
A set of data that uniquely identifies an entity, contains theentity’s public key and possibly other information, and is digitally
signed by a trusted party, thereby binding the public key to theentity. Additional information in the certificate could specify how
the key is used and its cryptoperiod.
A device that generates periodic signals for synchronization.
Note: Other definitions are provided in different references thatare tailored to particular applications. Suitable references include
ITU-T Rec. G.810, ITU-R Rec. TF.686 and IEEE Std. 1377-1997.
Type of composition whose elements interact in a non-directedfashion, each according to their own plans and purposes without
a predefined pattern of behavior.

SP 800-21

IEEE Std. 13771997[26]

component

Modular, deployable, and replaceable part of a system that
encapsulates implementation and exposes a set of interfaces.

[27]

composition

Result of assembling a collection of elements for a particularpurpose.

[26]

CPS architecture

A concrete realization of a reference CPS architecture designed tosatisfy use-case-specific constraints.

This document

CPS Framework

Abstract framework and analysis methodology for understanding
and deriving application-domain-specific CPS architectures.
Activities and outputs to support engineering of CPS.

This document

CPS network
manager

A work-station or CPS node connected to a CPS domain thatmanages and monitors the state and configuration of all CPS
nodes in one or more CPS domains.

This document

CPS time domain

A CPS time domain is a logical group of CPS nodes and bridges
which form a network with their own timing master.

This document

cross-cutting
concern

See aspect

This document

cryptographic(encryption)
certificate

A certificate containing a public key that is used to encrypt
electronic messages, files, documents, or data transmissions, or toestablish or exchange a session key for these same purposes

SP 800-32

cryptographic key

A value used to control cryptographic operations, such as
decryption, encryption, signature generation, or signature
verification

SP 800-63

cyber-physicaldeviceA device that has an element of computation and interacts withthe physical world through sensing and actuation.

This document

data

Re-interpretable representation of information in a formalizedmanner suitable for communication, interpretation, or processing.
NOTE Data can be processed by humans or by automatic means.

[28]

deviceA physical entity embedded inside, or attached to, anotherphysical entity in its vicinity, with capabilities to convey digital
information from or to that physical entity.

[29]

43

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Term

Definition

Sourceelement

Unit that is indivisible at a given level of abstraction and has aclearly defined boundary.
Note: An element can be any type of entity[26]

endpoint

One of two components that either implements and exposes aninterface to other components or uses the interface of anothercomponent.

[30]

entityItem inside or outside an information and communication
technology system, such as a person, an organization, a device, asubsystem, or a group of such items that has recognizably distinct
existence

[25]

epoch

Epoch signifies the beginning of an era (or event) or the reference
date of a system of measurements.

ITU-R Rec.
TF.686

facet

Facets are perspectives on CPS that each express a distinct set ofwell-defined processes, methods and tools to support the CPS
development process and for expressing the architecture of asystem. The Framework identified facets are conceptualization,
realization and assurance.
If T is the period of a repetitive phenomenon, then the frequency
f = 1/T. In SI units the period is expressed in seconds, and thefrequency is expressed in hertz (Hz).
Functional requirements define specific behavior (functions) or
particular results of a system and its components, what thesystem is supposed to accomplish.
Value computed on data to detect error or manipulation. See
Checksum.
A process of recognizing an entity in a particular identity domain
as distinct from other entities.
Identity information that unambiguously distinguishes one entity
from another one in a given identity domain.
Formalized process of identity verification that, if successful,
results in an authenticated identity for an entity.

This document

An environment where an entity can use a set of attributes for
identification and other purposes.
A set of values of attributes optionally with any associatedmetadata in an identity.
Note: In an information and communication technology system an
identity is present as identity information.
An Internet of things, machines, computers and people, enabling
intelligent industrial operations using advanced data analytics fortransformational business outcomes.
Knowledge concerning objects, such as facts, events, things,
processes or ideas, including concepts, that within a certain
context has a particular meaning
The short-term phase variations of the significant instants of atiming signal from their ideal position in time (where short-term
implies here that these variations are of frequency greater than orequal to 10 Hz). See also “wander”.

[25]frequency
functional
requirement
hash
identification
identifier
identityauthentication
identity domain
identity informationindustrial internet
information
jitter44

ITU-R Rec.
TF.686This document
[31]
[25]
[25]
[25]

[25]

[29]
[32][32]
ITU-R Rec.
TF.686

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Term
latency

Definition

SourceThe latency of a device or process is the time delay introduced by
the device or process.

This document

master data

Data held by an organization that describes the entities that areboth independent and fundamental for that organization, andthat it needs to reference in order to perform its transactions.

[28]

network time
protocol (NTP)

The network time protocol (NTP) is used to synchronize the timeof a computer client or server to another server or reference timesource, such as a terrestrial or satellite broadcast service ormodem. NTP provides distributed time accuracies on the order of
one millisecond on local area networks (LANs) and tens of
milliseconds on wide area networks (WANs). NTP is widely usedover the Internet to synchronize network devices to national timereferences. See www.ntp.org. See also IETF documents (e.g., RFC5905).
Non-functional requirements specify criteria useful to evaluate
the qualities, goals or operations of a system, rather than specificbehaviors or functions of a system.
The type of composition where one particular element is used by
the composition to oversee and direct the other elements.
Note: the element that directs an orchestration is not part of theorchestration.
An electronic device producing a repetitive electronic signal,
usually a sine wave or a square wave.
Phase coherence exists if two periodic signals of frequency M and
N resume the same phase difference after M cycles of the firstand N cycles of the second, where M/N is a rational number,
obtained through multiplication and/or division from the same
fundamental frequency.
The term phase synchronization implies that all associated nodes
have access to reference timing signals whose significant eventsoccur at the same instant (within the relevant phase accuracy
requirement). In other words, the term phase synchronizationrefers to the process of aligning clocks with respect to phase(phase alignment).
NOTE 1 – Phase synchronization includes compensation for delay
between the (common) source and the associated nodes.
NOTE 2 – This term might also include the notion of frame timing(that is, the point in time when the timeslot of an outgoing frame
is to be generated).
NOTE 3 – The concept of phase synchronization (phase alignment)
should not be confused with the concept of phase-locking wherea fixed phase offset is allowed to be arbitrary and unknown.
Phase alignment implies that this phase offset is nominally zero.
Two signals which are phase-locked are implicitly frequency
synchronized. Phase-alignment and phase-lock both imply thatthe time error between any pair of associated nodes is bounded

ITU-R Rec.
TF.686

non-functional
requirement
orchestration

oscillator
phase coherence

phase
synchronization

45

This document[26]

ITU-R Rec.
TF.686
ITU-R Rec.
TF.686

ITU-T Rec.
G.8260Framework for Cyber-Physical Systems: Volume 1, Overview
Term
precision time
protocol (PTP)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

reference timing
signalsecondsensorservicestability
subsystem
systemsystem function
time awarenesstime interval
time scale(timescale; timescale)Definition

SourceA time protocol originally designed for use in instrument LANs
now finding its way into WAN and packet based Ethernet network
applications. PTP performance can exceed NTP by several ordersof magnitude depending on the network environment. See IEEE
1588.
A timing signal of specified performance that can be used as atiming source for a slave clock.

ITU-R Rec.
TF.686The SI unit of time, one of the seven SI base units. The second isequal to the duration of 9 192 631 770 periods of the radiation
corresponding to the transition between the two hyperfine levelsof the ground state of the cesium-133 atom.
Note: The symbol for second, the SI unit of time, is s.

found inIEEE Std 2702006 (Revisionof IEEE Std
270-1966);
IEEE Standard
Definitions for
Selected
Quantities,
Units, andRelated ... |[33]

A sensor is a special device that perceives certain characteristicsof the real world and transfers them into a digital representation.
A distinct part of the functionality that is provided by an entity
through interfaces.
Property of a measuring instrument or standard, whereby its
metrological properties remain constant in time.
A discrete part of a system that groups some functionality that ispart of the whole.
A system is a composite set of logical components that together
satisfy a concrete set of Use Cases.
What the system does. Formalized requirements.
The extent to which a device or system has an appropriate ability
to sense and response to timing signals and information. Also theextent to which a model can appropriately use time accurately fordesign, including time semantics, visual design, and timecorrectness once applied to operational systems.
The duration between two instants read on the same timescale.
A system of unambiguous ordering of events.
NOTE – This could be a succession of equal time intervals, withaccurate references of the limits of these time intervals, which
follow each other without any interruption since a well-definedorigin. A time scale allows to date any event. For example,
calendars are time scales. A frequency signal is not a time scale(every period is not marked and dated). For this reason "UTCfrequency" must be used instead of "UTC".

46

ITU-T Rec.
G.810

[34]
ITU-R Rec.
TF.686This document
This document
This document

ITU-R Rec.
TF.686
ITU-T Rec.
G.810

Framework for Cyber-Physical Systems: Volume 1, Overview
Termtimingtiming signal

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

traceability

universal time (UT)

Definition

SourceA general term for the field or discipline, including time andfrequency sources, signals, measurement methods, timestamp
methods, specification methods, and metrics.
A nominally periodic signal, generated by a clock, used to control
the timing of operations in digital equipment and networks. Dueto unavoidable disturbances, such as oscillator phase fluctuations,actual timing signals are pseudo-periodic ones, i.e., time intervals
between successive equal phase instants show slight variations.
The property of a result of a measurement whereby it can be
related to appropriate standards, generally international or
national standards, through an unbroken chain of comparisons.
(ISO/IEC 17025:2005).
Ability to compare a calibration device to a standard of evenhigher accuracy. That standard is compared to another, until
eventually a comparison is made to a national standards
laboratory. This process is referred to as a chain of traceability.

This document

Universal time is a measure of time that conforms, within a close
approximation, to the mean diurnal motion of the sun as
observed on the prime meridian. UT is formally defined by amathematical formula as a function of Greenwich mean sidereal
time. Thus UT is determined from observations of the diurnalmotions of the stars. The timescale determined directly from suchobservations is designated UT0; it is slightly dependent on theplace of observation See Recommendation ITU-R TF.460.
UT0: UT0 is a direct measure of universal time as observed at agiven point on the Earth’s surface. In practice, the observer’s
meridian (position on Earth) varies slightly because of polar
motion, and so observers at different locations will measuredifferent values of UT0. Other forms of universal time, UT1 andUT2, apply corrections to UT0 in order to establish more uniform
timescales. See “universal time”, “UT1” and “UT2” andRecommendation ITU-R TF.460.
UT1: UT1 is a form of universal time that accounts for polar
motion and is proportional to the rotation of the Earth in space.
See “universal time” and Recommendation ITU-R TF.460.
UT2: UT2 is a form of universal time that accounts both for polar
motion and is further corrected empirically for annual and semiannual variations in the rotation rate of the Earth to provide amore uniform timescale. The seasonal variations are primarily
caused by meteorological effects. See “universal time” andRecommendation ITU-R TF.460.
NOTE 1 – The UT2 timescale is no longer determined in practice.

47

ITU-T Rec.
G.810

found inIEEE Std 11591995;
IEEE
Recommended
Practice for
Monitoring
Electric Power
Quality; also
ITU-R Rec.
TF.686
ITU-R Rec.
TF.686

Framework for Cyber-Physical Systems: Volume 1, Overview
Term
UTC : coordinateduniversal time

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

wanderDefinition

Source

The time scale, maintained by the Bureau International des Poids
et Mesures (BIPM) and the International Earth Rotation Service(IERS), which forms the basis of a coordinated dissemination ofstandard frequencies and time signals. See Recommendation ITU
R TF.460.
It corresponds exactly in rate with TAI, but differs from it by an
integer number of seconds. The UTC scale is adjusted by theinsertion or deletion of seconds (positive or negative leap
seconds) to ensure approximate agreement with UT1. See“universal time” and Recommendation ITU R TF.460.
The long-term phase variations of the significant instants of atiming signal from their ideal position in time (where long-term
implies here that these variations are of frequency less than 10Hz). See “jitter”.
Note: there is work in ITU-T SG15/Q13 to address wander/jitter
associated with time signals such as 1PPS where the 10Hz
breakpoint is not meaningful.

ITU-T Rec.
G.810 and ITUR Rec. TF.686

48

ITU-R Rec.
TF.686

Framework for Cyber-Physical Systems: Volume 1, Overview
B.2

Selected acronyms used in this document are defined below.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Acronym

Expansion

ACM

Association for Computing Machinery

ANSI

American National Standards InstituteAPI

Application programming interface

ARINC

Aeronautical Radio, Incorporated

BIPM

Bureau International des Poids et Mesures

CHESS

Center for Hybrid and Embedded Software

COAST

Copper/Optical Access, Synchronization, and Transport Committee

CPS PWG

Cyber-Physical Systems Public Working Group

CRIS

Critical Infrastructures

DIS

Draft International Standard

EMI

Electromagnetic interference

EPRI

Electric Power Research Institute

ERM

Enterprise resource management

EU

European Union

FDIS

Final Draft International Standard

FIPP

Fair Information Practice Principles

GNSS

Global navigation satellite system

GPS

Global positioning system

HIPAA

Health Insurance Portability and Accountability Act

HTTPSHypertext Transfer Protocol over TLS

HVAC

Heating, ventilating, and air conditioning

HW

Hardware

I/O

Input/output

ICNRG

Information Centric Networking

IEC

International Electrotechnical Commission

IEEE

Institute of Electrical and Electronics Engineers

IETF

Internet Engineering Task ForceIF-MapInterface for Metadata Access Points

IIC

Industrial Internet ConsortiumIJSWISInternational Journal on Semantic Web and Information Systems

IoT

Internet of Things

IoT ARM

Internet of Things Architectural Reference Model

IoT-AInternet of Things – Architecture

IPInternet Protocol

IPsec

Internet Protocol Security49

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Acronym

Expansion

IPv6

Internet Protocol version 6

ISOInternational Organization for Standardization

ISPCS

International IEEE Symposium on Precision Clock Synchronization for
Measurement, Control, and Communication

IT

Information technology

ITU

International Telecommunication Union

ITU-R

International Telecommuncation Union – Radiocommunication Sector

ITU-TInternational Telecommunication Union – Telecommunication Standardization
SectorJDL

Joint Director of Laboratories

KPI

Key performance indicator

LNCS

Lecture Notes in Computer Science

M2M

Machine-to-machine

MAC

Media Access Control

MACsecMedia Access Control Security

NISO

National Information Standards Organization

NIST

National Institute of Standards and Technology

NITRD

Networking and Information Technology Research and Development

NSTAC

National Security Telecommunications Advisory Committee

NTP

Network Time Protocol

OEM

Original equipment manufacturer

OMG

Object Management GroupOT

Operational technology

OWL

Web Ontology Language

PALS

Physically-Asynchronous Logically-Synchronous

PII

Personally identifiable information

PKI

Public key infrastructure

POSIX

Portable Operating System Interface

PROFINET

Process Field Net

PTIDES

Programming Temporally Integrated Distributed Embedded Systems

PTP

Precise Time Protocol

R&D

Research and development

RA

Reference architecture

RDF

Resource Description Framework

RFC

Request for Comments

RFID

Radio-frequency identification

SDH

Synchronous digital hierarchy

SOA

Service-oriented architecture50

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Acronym

Expansion

SoS

System-of-systems

SPARQLSPARQL Protocol and RDF Query Language

SW

Software

TAIInternational Atomic Time (Temps Atomique International)

TLS

Transport Layer Security

TNC

Trusted Network Communications

TTA

Time-Triggered Architecture

UAV

Unmanned Aerial Vehicle

URL

Universal Resource Locator

US

United States

UTC

Coordinated Universal Time

W3C

World Wide Web ConsortiumXEP

XMPP Extension Protocol

XML

Extensible Markup Language

XMPP

Extensible Messaging and Presence Protocol

51

Framework for Cyber-Physical Systems: Volume 1, Overview

Appendix C. Applying the CPS Framework: An
Emergency Response Use CaseIn this appendix, as a simplified example to illustrate the use of the CPS Framework
concepts, the CPS Framework is applied to analyze an example CPS use case for
Emergency Response. The use case has been limited in scope in order to make thisexample use of the Framework more clearly expressed.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

C.1

Perspective for Applying the Framework

There are many variations, alternative scenarios, and critical features that would makethis a comprehensive use case. However, the purpose of the exercise is to demonstrate
how to use the Framework, as opposed to how to design emergency response.
The activity, therefore, limited the scope to the initial use case with no elaborations
beyond a refinement of the success criteria. It can be expected that this constrained
scope will result in significant limitations to the actual value of the analysis to offer
insight into emergency response. On the other hand, the concepts presented will bereadily recognized by the reader and should enhance the understanding of how the
Framework was applied.
The goals for analyzing this problem are to convey an understanding of the mechanics of
the CPS Framework. To this end the discussion is further limited to:

C.2•

The interfaces to the CPS devices and systems involved in the scenario and not
the architecting of these systems and devices.

•

The properties exposed during the Framework analysis of this CPS. For thecomplete analysis the reader should refer to section 2 of the CPS Framework. A
complete analysis of this and its component systems would include all theproperties, full design, and full assurance cases of the component systems andthis system.

•

As offered in section 2.3 Uses of the CPS Framework, this analysis will be of“shallow depth.”
Workflow for Analyzing the Emergency Response Use Case

The Framework section 2.4, The Description of the CPS Framework, suggests a workflowthat starts with the development of a template containing theDomains/Facets/Activities/Aspects/Concerns and allows for a tailoring based on theidentified use of the framework from section 2.3.
With a decision to follow a waterfall process, the work in analyzing a use case using the
CPS Framework has the following high-level steps:

52Framework for Cyber-Physical Systems: Volume 1, Overview

Figure 14: Workflow for Framework Application Sample
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

C.3

Emergency Response Use Case Original

The following is the use case that was the basis of the exercise. The input provided tothe exercise as a starting point is as follows:“Injured person needs help – 1st responders on the way”
A person has been injured. The injured person sends a text to e-911 for help. An
ambulance is dispatched. A smart GPS combines map data with traffic flow data
to route the ambulance. Traffic signals are triggered to assist ambulance innavigation (or negotiating) the route.
Systems
•
•
•
•
•
•

Smart phone
E-911 system (includes dispatch system)
Ambulance (includes smart GPS subsystem)
Traffic Control System
GPS System
Cellular Phone Network

Steps
•
•
•
•
•
•
•
•
•

A person becomes injured.
Person uses cell phone to text for help.
The E-911 system gets the person’s location from the GPS if available andCell Tower if not.
The cell phone provides the location through the cellular system to the E911 system.
A request is sent to the closest ambulance.
The ambulance uses map data + traffic flow data to determine bestroute.
The route is sent to the traffic control system.
Traffic control system changes the lights to green as the ambulance
proceeds towards the destination (based on ambulance GPS).
Light status is fed back to the ambulance (including intersections with nolights).

53

Framework for Cyber-Physical Systems: Volume 1, Overview•

The ambulance progress is sent by text to the injured person and thedispatch system (i.e. E-911 system)

Success•

Ambulance arrives at injured person in a timely fashion and in line withthe urgency indicated by the injury information.

Variations (not analyzed in this Appendix but noted for future work)
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

•
•
C.4

A power line falls while the ambulance is on route, and the ambulanceneeds to take a different route.
A UAV drone support system is used to augment the "smart GPS" of theambulance.

Determine Scope of Analysis

Section 2.3 provides for the tailoring of the overall analysis. The following table wasused to choose among the possibilities (note that an ‘x’ in the left column selects anitem for inclusion):
Table 8: Tailoring the Analysis

What kind of analysis is this?
Processes
x Waterfall
Reverse Engineer
Agile
Service-Based

Depth
Critical-tightly coupled
Loosely coupledx Shallow analysis

ScopesSingle CPS Device
System or subsystem
x System of systems

Then, the CPS Application Domains directly related to the use case are identified:

54

Framework for Cyber-Physical Systems: Volume 1, Overview
Table 9: CPS Application Domains Relevant to Use Case

DomainAdvertising
Aerospace
Agriculture
Buildings
CitiesCommunities
Consumer
DefenseDisaster resilience (includes preparedness and crisis management
activities)
Education
Emergency response
Energy (included in “infrastructure”, but this is a very broad category)Entertainment/sports
Environmental monitoring (e.g., weather, greenhouse gas emission
tracking)
Financial services
Healthcare
Infrastructure (communications, power, water)
LeisureManufacturing
Science
Social networks
Supply chain/retailTransportationx
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

x

x

x

x

C.5

Tailor Framework Facet Activities, Aspects & Concerns

The Conceptualization Facet was tailored to three activities:
Table 10: Tailoring the Conceptualization Facet

Conceptualization Facetxx

Activities and Artifacts
Mission and Business Case Development
Artifact: Business use cases
Functional Decomposition
Artifact: Detailed use cases, actors, informationexchanges

55

Framework for Cyber-Physical Systems: Volume 1, Overview
Conceptualization Facetx

Requirements Analysis
Artifact: Functional and non-functional
requirements
Interface Requirements Analysis
Artifact: Interface requirements

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

The Realization Facet was tailored to a single activity. Also note that this activity was
limited to resolving two Conceptualization properties that arose from concerns.
Table 11: Tailoring the Realization Facet

Realization Facet
Activities and Artifacts
Business Case Analysis
Artifact: Trade studies, lifecycle cost analysis, return on investment, andinterdependencies with requirements, regulations, and incentives
Lifecycle Management
Artifact: Lifecycle management and sustainability plan, integrated lifecycle
management monitoringx

DesignArtifact: Design documentation, requirement verification, virtual prototypes
Manufacturing/Implementation
Artifact: Manufactured, integrated products, testing plans, and test results
Operations
Artifact: Performance, quality, and product evolution tracking
Disposal
Artifact: Reuse, sustainability and energy recovery assessments, disposal manifests
Cyber-Physical Abstraction Layer Formation
Artifact: Domain (and product)-specific ontologies, modeling languages, andsemantics specifications used in all phases of the lifecycle
Physical Layer Realization
Artifact: Physical substrates of the CPS used in all phases of the lifecycle.

The Assurance Facet was tailored to two activities:
Table 12: Tailoring the Assurance Facet

Assurance Facet
Activities and Artifacts
Configuration Audit
Artifacts: Product configuration assessment

56

Framework for Cyber-Physical Systems: Volume 1, Overview
Assurance Facet
Requirements Verification
Artifact: Requirements and test results assessment
Product Certification and Regulatory Compliance Testing
Artifact: Certifications

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

x

Identify Assurance Objectives
Artifact: Assurance objectives/analysis reportxDefine Assurance Strategy
Artifact: Strategy document/plan
Control Assurance Evidence
Artifact: Control documentation
Analyze Evidence
Artifact: Analysis report
Provide Assurance Argument
Artifact: Assurance argument report
Provide Estimate of Confidence
Artifact: Confidence estimate

The Aspects were tailored as follows:
Table 13: Tailoring of Aspects

Aspects
x
x
x
x
x
x
x

C.6

Functional
Business
Human
Trustworthiness
Timing
Data
Boundaries
Composition
Lifecycle

Perform Conceptualization Activities and Apply Concerns

The Conceptualization Facet has as its artifact the CPS Model which consists of theproperties of the intended CPS.
C.6.1 Conceptualization Activity 1: Mission and Business Case Development
This activity involved the analysis of the Use Case and the derivation of an overarchingbusiness case and key assumptions and success metrics. The materials started with werebroken down into “properties” for further use in the functional decomposition and therequirements analysis.
57

Framework for Cyber-Physical Systems: Volume 1, Overview
Note that each of the following could be further broken down into more primitive
components. However, that will be left to a future activity.
PBC Business Case:
The goal of this service is to provide medical attention to an injured person. It is
assumed for this exercise that the value of human life justifies the expenditures needed
to make this service viable.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

PUC Use Case:
A person has been injured. The injured person sends a text to E-911 for help. An
ambulance is dispatched. A smart GPS combines map data with traffic flow data toroute the ambulance. Traffic signals are triggered to assist the ambulance in navigation(or negotiating) the route.
PASSN Assumptions:
The existence of a set of system components is assumed (see below). They are assumed
to be functioning as expected. Organizational responsibilities are pre-existing andfunctioning as expected. No other extraordinary event is occurring at the same time.
PSUCC Success Metric:
The ambulance arrives at the injured person in a timely fashion and in line with theurgency indicated by the injury information.
C.6.2 Conceptualization Activity 2: Functional Decomposition
The use case is analyzed to identify additional properties: system components,
information exchanges, and general information about the networks they utilize.
PSC System Components
•
•
•
•
•

Smart phone [cell]
E-911 system (includes dispatch system) [E911]
Ambulance (includes smart GPS subsystem) [ambulance]
Traffic Control System [TCS]
GPS System [GPS]PNW Assumptions••

Person’s cell phone and ambulance are on a cellular network.
The TCS and E911 are on a high speed enterprise network.

PARCH Use Case Steps (how the system should function)

58

Framework for Cyber-Physical Systems: Volume 1, Overview
Table 14: Emergency Response Use Case Steps

Data Exchange Messaging for Use Case
Step

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

from
Actor

to Actor

data

cell
GPS

E911
cell

text help message
location

4 The cell phone provides the location throughthe cellular system to the E-911 system

cell

E911

location

5 A request is sent to the response (closest)
ambulance
6 The ambulance uses map data + traffic flow
data to determine best routeE911

ambulance

dispatchTCS

ambulance

TCS status

7 The route is sent to the traffic control systemambulance TCS

route

8 Traffic control system changes the lights togreen as the ambulance proceeds towards
the destination (based on ambulance GPS).

ambulance TCS

location

9 Other vehicles move out of the way
10 Light status is fed back to the ambulance(including intersections with no lights)

TCS
TCS

emergency statuslight status

11 The ambulance progress is sent by text to theinjured person and the dispatch system (i.e.
E-911 system)

ambulance cell, TCS, E911

1 A person becomes injured
2 Person uses cell phone to text for help
3 The cell phone gets the person's locationfrom the GPS if available and Cell Tower ifnotother vehicles
ambulance

progress

C.6.3 Conceptualization Activity 3: Requirements Analysis
The results of Activity 1 and 2 were studied with respect to each Aspect and theirsubsidiary Concerns to identify the properties that would comprise the CPS Model. Each
property discovered is listed in the corresponding cell for an aspect/concern. Multiple
properties are separated by semicolon/line feeds. Aspects that were profiled out (seeearlier section) or had no elucidated properties are indicated by ‘N/A’.
It is likely additional property elaboration would be appropriate to be a complete result
to the depth of this CPS analysis. However, the properties identified provide a good
guide to the nature and abstraction of such properties for this kind of effort.

59

Framework for Cyber-Physical Systems: Volume 1, Overview
Table 15: Emergency Response Requirements Analysis

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201
11

AspectConcern

Requirements Analysis

Functional

actuation

ambulance gets sent; ambulance proceeds unimpeded;
vehicles move out of the way;

Functional

communication

Functional

controllability

Functional

functionality

Functional

measurability

successful arrivals of the ambulances;
average time to get to person;

Functional

monitorability

timestamped sequence of events;
status of all systems;

Functional

performance

ambulance arrives within target time;
vehicles are informed in time to move;

Functional

physical

Functional

physical context

Functional

sensingFunctional

uncertainty

Businessenterprisedeliver text message to E911;
location delivered;texting (cell to E911);
E911 to ambulance;
GPS identification of cell location;
GPS sends cell location to ambulance;
ambulance sends route to TCS;
TCS to all vehicles;
E911 identify and dispatch ambulance;
TCS light control;
E911 monitors progress;
optimal route;
Use Cases; Business Cases; success criteria; assumptions;N/A 11location of ambulance relative to traffic, intersections anddestination at a given time;location of person;
location of ambulance, person;
time for stamping;traffic flows;route uncertainty better less than road dimension;
location uncertainty small enough to determine location of
person and ambulance;systems are time synchronized to establish reliablesequence of events;
N/A

N/A indicates concerns that were profiled out or had no elucidated properties.

60

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectConcern

Requirements Analysis

Business

cost

Business

environment

Business

policyBusinessqualityBusinessregulatory

Businesstime to market

Human

human factors

Humanusability

Humanutility

Trustworthi
nessprivacy

personally identifiable information (PII) from theemergency response is protected in flight;

Trustworthi
nessreliability

ambulance, cell, TCS, E911, and GPS have an acceptablecombined reliability (e.g. 95% assurance that theambulance arrives in the timely fashion).

Trustworthi
nessresilience

Trustworthi
nesssafety

N/A

N/A

N/A

N/A

N/A
N/A
N/A
emergency text should be sent from a simple
unambiguous behavior (no dialog/navigation/typing);
other vehicle interpretation of guidance to get out of
ambulance way should be unambiguous;
N/Afailure of ambulance is detected and another ambulancedispatched;in order to maintain the acceptable combined
performance, redundant or backup systems are available
to maintain timely response for any emergency response;
the ambulance, TCS, E911 timing physical and messaging
signals have resilience;
TCS avoids creating hazardous conditions in managing
lights with respect to cross streets;
E911, TCS, GPS are designed to fail functional;
Directions to the ambulance does not create hazard to theambulance operation;
Route should convey the ambulance safely;61

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectConcern

Requirements Analysis

Trustworthi
nesssecurity

Timinglogical time

Timingmanaging timing
and latency

Timingsynchronization

Timingtime awareness

Timingtime-interval andlatency control

Data

data semantics

time interval from sending text message to E911 andambulance arrival is timely (e.g. <6 minutes);
timing of TCS must perform relevant to the movement of
the ambulance, and other vehicles and cross-traffic toeffect rapid progress of ambulance and minimize impact
to cross-traffic (e.g. predicted progress of the ambulance
accurate to 1s);
text help message;
location;
dispatch;
TCS status;
route;
emergency status;
light status;
progress;
text help message is encoded as a "text message";Data

identity

personal phone, ambulance, TCS system(s), E911 system,
intersections, response event;Data

operations on
datafuse data from various sources to determine best route;evaluate ambulance characteristics and availability to
optimize allocation;Data

relationshipbetween data

Messaging is not confidential;
Records of the emergency response are protected at rest;
Source and destination of messages are validated;
Messages received have not been tampered with;All messaging with guaranteed delivery;
All components protect against physical tamper;
The ambulance, TCS, and E911 timing, physical andmessaging signals have integrity;
The ambulance, TCS, and E911 timing, physical andmessaging signals have availability;
The sequence of events is as described in the Use Case;
cell network delivers text message in a timely manner (e.g.
<10 seconds);
TCS/E911 network have minimum message latency (e.g.
<1 seconds);
TCS, E911, ambulance must have a common time scale(e.g. UTC)
TCS, E911, ambulance can give a timely response;

locations of ambulances, person, route, traffic must be
analyzed and correlated;

62

Framework for Cyber-Physical Systems: Volume 1, Overview

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

AspectConcern

Requirements Analysis

Boundaries

cross-domain

emergency response interacting with traffic control and, …
see domain list

Boundaries

connectivity

cell phone can connect with cell phone towers -- one hop
to cell tower, GPS network receive broadcast

Boundaries

responsibility

Compositionadaptability

Compositioncomplexity

Compositionconstructivity

Compositiondiscoverability

Lifecycle

deployability

Lifecycle

disposability

Lifecycle

engineerability

Lifecycle

maintainability

Lifecycle

operatability

Lifecycle

procureability

Lifecycle

producibility

TCS is the responsibility of municipal government traffic
management;
The holder of the phone has the ability to participate in
the scenario;
The E911 is the responsibility of the government eresponse;
The ambulance is part of the emergency response function
and may be fire/police/private;work with different cell phone technologies;
use cell towers or GPS for location;
work with older (flip phones);
deal with different kinds and managements of ambulanceservices;"green lighting" can cause impact on other existing flows;
Emergency response requires E911 system, the diversity ofcell phones, cell phone networks, and ambulance services;
coordination between neighbor TCS;
ambulance location and capability;
cellphone location;
traffic need to be determined;
pertinent TCS identity and capability;
N/A
N/A

N/A

N/A
N/A
N/A
N/A

63

Framework for Cyber-Physical Systems: Volume 1, Overview
C.7

Perform Realization Activities

This exercising of the realization activities produced two example design/test pairs.
During this analysis, an accelerated design process reviewed some on-line literature andderived a first level design for two properties enumerated in the Conceptualization
activities.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

These designs were provided with hypothetical test plans that could verify the
successful performance of the design.

64Framework for Cyber-Physical Systems: Volume 1, Overview
Table 16: Realization Activity

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

Aspect/Concern:
Property

DesignTest
Format: Test ID (TID) Test
Description

Functional/Performance:

Dscenario timing

Tscenario timing

2.6.1.1

Steps 121 – start
2 – 10 s high confidence thatSMS gets through to target
3 – 60 s maximum GPS
location acquisition time
4 – 10 s same as 2
5 – 10 s E911 has situationalawareness of all ambulances
locations and metrics
6 – 3 s ambulance is enabled
to rapid routing
7 – 3 s high quality of service
to TCS from ambulance
8 – 4.5 m drive time to cellphone

TID 1. Measure SMS propagation over1000 messages and verify <10 s

6 minutes target response
timelocation accuracy 50-300 m
maximum distance forambulance to travel 5, 35 mph

TID 5. From a set of 100 test locations
and different traffic conditions, verify
that test response driving times are < 4.5
minutesComposition/Adaptability

Dcell phone technologies

Tcell phone technologies

2.6.1.2

Rely on SMS and cellularlocation as a minimum
requirement

TID1. Measure SMS transfer andlocational accuracy for each available cell
phone on the market and several legacy
phones including flip phones. Verify 10 s
SMS. Verify 30 m location accuracy

C.8

ambulance
arrives withintarget time

work withdifferent cellphonetechnologies

TID 2. Measure GPS location acquisition
time from a selected set of locations andcell phone start conditions and verify <60s in all cases
TID 3. Measure ambulance routing
capability and verify < 3 s over 100
random locations within 4 mile radius
TID 4. Measure transit time of message
from ambulance to TCS and verify <3 sover 100 locations throughout territory.

Perform Assurance Activities

The conceptualization facet produces the CPS Model that consists of properties of the
CPS. Some of these properties result from interpreting the initial business case and theimpact of the relevant aspects and concerns on the business case.

12

Some metrics presented in this analysis were obtained from the following article:
http://www.ncbi.nlm.nih.gov/pmc/articles/PMC4288957/

65

Framework for Cyber-Physical Systems: Volume 1, Overview
Two of the activities of the Assurance Facet were undertaken. Refer to Section 2 fordefinition of terminology.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1500-201

To identify Assurance Objectives, we turn back to the properties that were defined as
the artifacts of the Conceptualization Facet and we identify as an objective theassurance of those properties. There were two properties defined in the requirements
analysis activity for which all three facets were exercised – corresponding to theperformance concern of the functional aspect and the adaptability concern of thecomposition aspect:
Functional Aspect/Performance Concern driven property:
PAmbulance shall arrive within target time
Composition Aspect/Adaptability Concern driven property:
PShall function with different cell phone technologies
These two properties comprise the assurance objective.
The assurance strategy for these two properties makes use of the design and test
artifacts called out in the Realization Facet. The strategy is to provide argumentation to
the effect that the successful execution of the test suffices to make the judgment thatthe properties are met:
HLeaf is the argumentation that says that the test, design, and tracing to the property is
sufficient to conclude that the property in question has been met:
A(P, D, T) =Def HLeaf (PAmbulance shall arrive within target time, Dscenario timing, Tscenario timing)
A(P, D, T) =Def HLeaf (PShall function with different cell phone technologies, Dcell phone technologies, Tcell phone
technologies)66