## 3 Robustness Analysis Problem Formulation in CPS  
The problem to be studied in this paper is to analyze the impact of resource failures on CPS. To formulate the problem to be addressed in this paper, we summarize a list of notations/symbols that will be used in this paper in Table 1. The cyber world model of a CPS is represented by \(G\). It is used to capture the dynamics of CPS. The nominal cyber world model is an abstraction of the physical world of CPS. The structure of the nominal cyber world model considered in this paper is similar to the S3 PR model and the S4 PR model in the literature [39,40] that can capture sequential processes with shared resources, is extended with time factor and a proper uncertainty model to capture failures of resources and the time intervals during which failures occur. Uncertainties such as machine failures may occur in the physical world of CPS and influence the operations of CPS. In the remainder of this paper, we will use \(\Delta\) to denote the uncertainty model. Given the nominal cyber world model \(G\) and the uncertainty model \(\Delta\), the problem is to study the influence of \(\Delta\) on the operations of CPS. To analyze the influence of \(\Delta\) on the operations of CPS, the nominal cyber world model \(G\) and the uncertainty model \(\Delta\) must be represented properly. In this paper, the nominal cyber world model \(G\) will be presented by a DTPN model. The uncertainty model \(\Delta\) will be characterized based on the failed resources as well as the time intervals during which unexpected events occur. In this section, we first introduce construction of the nominal model \(G\) for CPS and then present the uncertainty model to formulate the problem. We consider a make-to-order manufacturing system in which an order is specified by the quantity of different types of product demands, \(Q_{j}\), where \(j\in J=\{1,2,3,\ldots,J\}\) and the deadline \(\theta\). The production process of each type of product is associated with a type of task. Therefore, the number of different types of tasks is \(J\). The set of indices of all different types of tasks is denoted by \(J=\{1,2,3,\ldots,J\}\) and we refer to a type of task by \(j\in J=\{1,2,3,\ldots,J\}\). We define a task subnet to describe the production process of a type of products. A task subnet can be described by a discrete timed Petri net (DTPN). A DTPN is a five-tuple \(D=(P,T,F,m_{0},\mu)\) in which \(P\) is a set of places, \(T\) is a set of transitions, \(F\subseteq(P\times T)\cup(T\times P)\) is a set of flow relation, \(m_{0}:P\to Z^{|P|}\) is an initial marking, and \(\mu:T\to Z\) is a function that specifies either a lower bound of the firing time of each transition or the firing time of each transition, where \(Z\) is the set of nonnegative integers. **Definition 1**. : _A task subnet is a discrete timed Petri net, \(GJ_{j}=(P_{j},T_{j},F_{j},m_{j0},\mu_{j})\), with sequential structure, where \(j\in J\) and the function \(\mu_{j}:T_{j}\to Z\) is used to specify the lower bound of the firing time of each transition in \(T_{j}\). For a task subnet \(GJ_{j}=(P_{j},T_{j},F_{j},m_{j0},\mu_{j})\) that describes \(N_{j}\) operations in \(GJ_{j}\), there are \(2N_{j}\) transitions in \(GJ_{j}\) as each operation is described by a start transition and an end transition. Therefore, there are \(2N_{j}+1\) places in \(P_{j}\). We assume that the places in \(P_{j}\) are numbered from upstream to downstream. That is, \(P_{j}=\{p_{1}^{j},\,p_{2}^{j},\,p_{3}^{j},\,\ldots,\,p_{2N_{j}+1}^{j}\}\)._Note that for transition \(t\in T_{j}\), \(\mu_{j}(t)\) only specifies a lower bound of the firing time of transition \(t\) by using any resource. Firing a transition relies on the use of a resource. The firing time of transition \(t\in T_{j}\) depends on the type of resource used to fire \(t\). The exact firing time of \(t\) is determined by the firing time of the same transition specified in the corresponding resource subnet of the resource involved.