Thomas Boulay
email: thomas.boulay@thalesgroup.com

Ali Mohammad-Djafari
email: ali.mohammad-djafari@lss.supelec.fr

Nicolas Gac

Julien Lagoutte

High-Dimensional Range profile geometrical visualization and performance estimation of radar target classification via a Gaussian mixture model

In this paper, a method of data visualization and classification performance estimation applied to target classification is proposed. The objective of this paper is to propose a mathematical tool for data characterization. The principle is to use a non linear dimensionality reduction technique to describe our data in a low-dimensional space and to model embedding data by Gaussian mixture model (GMM) to estimate classification performance graphically and analytically.

Introduction and context

During major conflicts, cooperative classification techniques are not enough reliable enough and Non Cooperative Target Recognition (NCTR) [START_REF] Moruzzis | Radar target recognition by Fuzzy Logic[END_REF] is increasingly seen as essential. High Range Resolution (HRR) [START_REF] Wehner | High Resolution Radar[END_REF] offers a rapid way to characterise a target through the use of radar range profile. A range profile is essentially a one-dimensional radar image of the target.

The HRR profile is a representation of temporal response of target to an high resolution radar impulse. Range resolution obtains with this kind of radar signature is less than a meter, which allows to take into account very small fluctuation of Radar Cross Section (RCS) along the target. As consideration, high resolution involves range profile with a large number of samples. Therefore, HRR profiles live in high-dimensional space. Most of classification techniques consist in comparing target signature under test with target signatures contained in a data set. In this case, classification problem is considered as a supervised classification problem [START_REF] Duda | Pattern Classification[END_REF]. Analysis of data set properties and visualization of classes repartition in this set can be interesting to estimate classification performance. To visualize high-dimensional data in a 2D or 3D space, a large number of dimensionality reduction techniques have been proposed for several years. Among these methods, t-Student Stochastic Neighbor Embedding [START_REF] Van Der Maaten | Visualizing Data using t-SNE[END_REF] method allows to reduce the tendency to crowd points together in the center of a map contrary to classical methods like Locally Linear Embedding [START_REF] Roweis | Nonlinear dimensionality reduction by Locally Linear Embedding[END_REF], Isomap [START_REF] Tenenbaum | A global geometric framework for non linear dimensionality reduction[END_REF] or Sammon mapping [START_REF] Sammon | A nonlinear mapping for data structure analysis[END_REF].

This paper is organized as follows. In section 2, the database used for our study is described. The section 3 is a reminder on the dimensionality reduction methods and more particularly on the t-Distributed Stochastic Neighbor Embedding technique. In the section 4, a GMM algorithm for NCTR application is proposed. The section 5 shows the kind of data visualization obtained with our method. Probability map and decision matrix in low-dimensional space are computed and compared with decision matrix obtained in high-dimensional space with GMM algorithm. Our conclusion and suggestions for future work are presented in section 6.

Database

The data used in this article are synthetic data. The data set contains N T range profiles in K = 3 different classes (N 1 T = N 2 T = N 3 T = 342). They were generated from target modeling (CAD) on which were applied techniques to calculate RCS. For each configuration (frequency, elevation angle, azimuth), the RCS complex value is calculated. The table 1 summarizes notation used for the data set.

the matrix of low-dimensional range profiles.

Table 1: Summary of notations used for the data set

Dimensionality reduction

A large number of nonlinear dimensionality reduction techniques that aims to preserve the local stucture of data have been proposed for many years and many of which are reviewed by Lee and Verleysen [START_REF] Lee | Nonlinear dimensionality reduction[END_REF]. Among these techniques, we can mention the most popular: Sammon Mapping [SA69], Stochastic Neighbor Embedding (SNE) [START_REF] Hinton | Stochastic Neighbor Embedding[END_REF], Isomap [START_REF] Tenenbaum | A global geometric framework for non linear dimensionality reduction[END_REF], Maximum Variance Unfolding (MVU) [START_REF] Weinberger | Learning a kernel matrix for non linear dimensionality reduction[END_REF], Locally Linear Embedding (LLE) [START_REF] Roweis | Nonlinear dimensionality reduction by Locally Linear Embedding[END_REF] and Laplacian Eigenmaps [START_REF] Belkin | Laplacian Eignemaps and spectral techniques for embedding and clustering[END_REF]. On artificial data, these techniques obtain very good performance but they are not often very successful at visualizing real high-dimensional data. Indeed, most of these techniques are not capable of retaining both local and the global structure of the data in a single map.

In 2009, van der Maaten and Hinton [START_REF] Van Der Maaten | Visualizing Data using t-SNE[END_REF] proposed a new method called "t-Distributed Stochastic Neighbor Embedding" or "t-SNE", which is capable of capturing very well much of the local structure of the high-dimensional data, while also revealing global structure such as the presence of clusters at several scales. t-SNE method is directly inspired from SNE method.

Stochastic Neighbor Embedding (SNE)

Principle of SNE method is to convert high-dimensional Euclidian distances between datapoints into conditional probabilities that represent similarities. The similarity of range profile x T,i to range profile x T,j is the conditionnal probability, p j|i , that x T,i would pick x T,j as its neighbor if neighbors were picked in proportion to their probability density under a Gaussian centered at x T,i . Mathematically, the conditional probability p j|i is defined by

p j|i = exp -||x T,i -x T,j || 2 /(2σ 2 i ) k =i exp (-||x T,i -x T,k || 2 /(2σ 2 i )) (1)
where σ i is the variance of the Gaussian that is centered on range profile x T,i .

For the low-dimensional range profiles y T,i and y T,j of the high-dimensional range profiles x T,i and x T,j , it is possible to compute a similar conditional probability, which is denote by

q j|i q j|i = exp -||y T,i -y T,j || 2 k =i exp -||y T,i -y T,k || 2 (2)
If the map points y T,i and y T,j correctly model the similarity between the high-dimensional range profiles x T,i and x T,j , the conditional probabilities p j|i and q j|i will be equal. Therefore, SNE aims to find a low-dimensional data representation that minimizes the mismatch between p j|i and q j|i . The Kullback-Leiber divergence is a natural measure of the faithfulness with which q j|i models p j|i . SNE minimizes the sums of Kullback-Leiber divergences over all datapoints using a gradient descent method. The cost function C is given by

C = i KL(P i ||Q i ) = i j p j|i log p j|i q j|i ( 3
)
where P i represents the conditional probability distribution over all other data points given datapoint x T,i and Q i represents the conditional probability distribution over all other map points given map point y T,i

t-Distributed Stochastic Neighbor Embedding (t-SNE)

t-SNE method provides two major innovations compared to classical SNE method. The cost function used by t-SNE differs from the one used by SNE in two ways. Firstly, it uses a symmetrized version of the SNE cost function with simpler gradients. Indeed, to minimizing the sum of the Kullback-Leiber divergences between the conditional probabilities p j|i and q j|i , it is also possible to minimize a single Kullback-Lieber divergence between a joint probability distribution, P , in the high-dimensional space and a joint probability distribution, Q, in the low-dimensional space:

C = KL(P ||Q) = i j p ij log p ij q ij with p ii = p jj = 0 (4)
In symmetric SNE, the pairwise similarities in the low-dimensional map q ij are given by

q ij = exp -||y T,i -y T,j || 2 k,l,k =l exp -||y T,k -y T,l || 2 (5)
and in the high-dimensionality space

p ij = p j|i + p i|j 2N T (6)
This ensures that j p ij > 1 2NT for all datapoints x T,i , as a result of which each datapoints x T,i makes a significant contribution to the cost function.

Secondly it uses the Student t-distribution rather than the Gaussian to compute the similarity between two points in the low-dimensional space. t-SNE employs a heavy-tailed distribution in the low-dimensional space to alleviate both the crowding problem and the optimization problems of SNE. Therefore, in t-SNE, q ij becomes

q ij = 1 + ||y T,i -y T,j || 2 -1 k,l,k =l 1 + ||y T,k -y T,l || 2 -1 (7)
4 Gaussian Mixture Models (GMM) for NCTR application

Let note by Z T the data set. Then for any of its element z T,i (in low-dimensional space z T,i = y T,i ∈ R 2 and in high-dimensional space z T,i = x T,i ∈ R M ), a mixture model can be defined as follows:

p(z T,i |Z T ) = K k=1 π k T p(z T,i |θ k T ) (8)
where θ k T is the set of parameters of distribution k and π k T is the prior probability of the class k.

Gaussian Mixture Models (GMM)

In the case of GMM,

θ k T = {m k T , C k T }
, where m k T (m k T ∈ R 2 in the lowdimensional space and m k T ∈ R M in the high-dimensional space) is the mean range profile of the class k:

m k T = 1 N k T N k T i=1 z k T,i (9)
and

C k T (C k T ∈ R 2×2
in the low-dimensional space and C k T ∈ R M×M in the high-dimensional space) is the covariance matrix of the class k. Elements of this matrix are defined by:

C k T (p, q) = 1 N k T -1 N k T i=1 (z k T,i (p) -m k T (p)) (z k T,i (q) -m k T (q)) (10)
Finally, the Bayes rule is used to computed posterior probability of each class k, with p(z

T,i |θ k T ) = N (z T,i |θ k T ). p(z T,i ∈ k|z T,i ) = π k T p(z T,i |θ k T ) K i π k T p(z T,i |θ k T ) (11)

Decision rule and error rate control

A major constraint in NCTR application is to control error rate to avoid fratricide shoots. In this context, the classical decision rule of maximum a posteriori (MAP) cannot be used. We defined a new decision rule adapted to NCTR context. Let p = [p 1 , . . . , p k ] be the vector of posterior probability computed for the K classes.

-if

p i ≥ T G, the class i is granted -if T D ≤ p i < T G, the class i is dubious -if p i < T D, le class i is denied
We construct three decision matrix: (i) a Granted matrix (Grm), (ii) a Dubious matrix (Dum) and (iii) a Denied matrix (Dem). Each of them is a K × K matrix. The decision thresholds T G and T D are ajusted empirically to maintain error rate 3 less than a fixed value (for example 5%).

(i) = Grm(i) × Q j =j (1 - Grm(j))). (iii)
We have a good identification when the class i is declared granted and the others classes denied for a range profile of the class i. Good identification rate (GIR) is deduced from Grm and Dem. (GIR(i) = Grm(i) × Q j =j Dem(j)).

5 Data visualization and classification performance estimation

Probability map in low-dimensional space

After computing Y T from t-SNE algorithm and from X T , we want to visualize how data are placed over the decision rule. First from Y T , we estimate parameters θ k T of the K Gaussian distribution of GMM. Then, we can sample the 2D space and calculate for each sample of the grid the posterior probability for each Gaussian distribution of GMM. Finally, we can plot probability maps where granted, dubious and denied zones for each class are represented. The lowdimensional range profile can be superposed on this map and we can estimate graphically classification performance with our data. From figure 1a, 1d and 1g, we can see immediatly that error rate for class 2 and 3 will be equal to 0% and good identification rate equal to 100%, because each sample of class 2 and 3 is entirely in granted area. For the class 1, we can see that some samples are in class 1 denied area and in class 2 granted area. With SNR = 20dB (cf. figure 1b, 1e and1h), some samples of class 1 are yet placed in class 2 granted area and some samples of class 2 are in class 1 dubious area. Samples of class 3 remain in class 3 granted area. When SNR = 15dB (cf. figure 1c, 1f and 1i), increasingly samples of class 1 and 2 are placed in class 1 dubious area.

Finally, we can compute Grm, Dum and Dem matrix obtained applying GMM algorithm in the high-dimensional space (cf. Fig. 3). Overall, classification performances are better in high-dimensional space than in low-dimensional space. Even if rates are higher in high-dimensional space, we retrieve the same tendency than we can observe in low-dimensional space. Our method provide a good tool to estimate analytically and graphically classification performance we can get from a data set and its associated probability distribution model.

Conclusion and perspectives

In this paper, a new method of classification performance evaluation is proposed. This method mixes dimensionality reduction and classical Gaussian mixture modelization to propose a mathematical tool for classification performance evaluation. An additional work will be to generalize these methods for any kind of algorithm and to evaluate for each kind of algorithm the critical dimension from which the performances begin to degrade. This will allow to determine the best appropriate algorithm from data and to reduce the computational cost of this algorithm.

3

  (i) We have an error when the class i is declared denied for a range profile of the class i. Diagonal of Dem gives the error rate. (ii) We have a success when the class i is declared granted and the other classes dubious or denied for a range profile of the class i. Success rate (SR) is deduced from Grm. (SR

  Fig. 1: t-SNE 2D visualization of data for class 1, 2 and 3 (row) and for three SNR values (column).

Decision matrix in low-dimensional space

We can retrieve graphically observations by computing Grm, Dum and Dem matrix defined in section 4.2.

Grm

Dum Dem

P P P P

Test

Class 1 2 3 1 2 3 1 2 3

SNR=30dB

Class 1 99.1 0.9 0 0 0 0 0.9 99.1 100 Class 2 0 100 0 0 0 0 100 0 100 Class 3 0 0 100 0 0 0 100 100 0

SNR=20dB

Class 1 99.1 0.9 0 0 0 0 0.9 99.1 100 Class 2 0 98.5 0 0.9 1.5 0 98.5 0 100 Class 3 0 0 100 0 0 0 100 100 0

SNR=15dB

Class 1 95.6 0.9 0 3.5 1.1 0 0.9 98 100 Class 2 0.6 94.4 0 5 4.7 0 94.4 0.9 100 Class 3 0 0 100 0 0 0 100 100 0 Indeed, as seen on the probability maps, error rate and good identification rate (and success rate) are respectively equal to 0% and 100% for class 2 and 3 with an SNR = 30dB. With SNR = 30dB, SNR=20dB or SNR=15dB, we retrieve that some samples (0.9%) of class 1 are placed in class 2 granted area. When SNR = 15dB, some samples (3.5%) of class 1 are placed in class 1 dubious area and in class 2 dubious area (1.1%). Generally, this table allows us to get an analytical measurement of the observations made from probability maps.

Decision matrix in high-dimensional space


Jérôme Hugues

Jean-Marie Gauthier

Raphaël Faudou

Integrating AADL and FMI to Extend Virtual Integration Capability

Keywords: FMI, AADL, Cyber-Physical Systems, Co-Simulation, Virtual components

Virtual Integration Capability is paramount to perform early validation of Cyber Physical Systems. The objective is to guide the systems engineer so as to ensure that the system under design meets multiple criteria through high-fidelity simulation. In this paper, we present an integration scheme that leverages the FMI (Functional Mock-Up interface) standard and the AADL architecture description language. Their combination allows for validation of systems combining embedded platform captured by the AADL, and FMI components that represent physical elements, either mechanical parts, or the environment. We present one approach, and demonstrator case studies.

Introduction

Virtual integration capability `is paramount to perform early validation of Cyber Physical Systems. The objective is to guide the systems engineer so as to ensure that the system under design meets multiple criteria through high-fidelity simulation. The general approach is to leverage models as primary artefacts to capture all facets of a system, and tool supports to analyze and simulate the system.

Early study [START_REF] Feiler | System Architecture Virtual Integration: An Industrial Case Study[END_REF] demonstrated the importance of Architecture Description Language to capture many facets of a system, for the embedded perspective, supporting multiple kind of analysis such as timing performance, or safety analysis. Other standards like FMI [START_REF]MODELISAR Consortium and Modelica Association Project "FMI" -Functional Mock-up Interface for Model-Exchange and Co-Simulation[END_REF] did the same for the mechanical and control sphere, supporting co-simulation of high-level mechanical models (e.g. built on Modelica) or control command models built around Simulink or SCADE. FMI has been defined with primary objective to support system-level simulations, with a strong emphasis on early validation of systems made of separated models.

A remaining challenge is to combine both spheres. As a matter of fact, architecture description languages capture the organizational structure of the system to be designed, and the exchange of information, physics is abstracted through devices (sensors and captors) that interact with the environment and mechanical parts. These models capture their behavior as a set of model elements that ultimately lead to equations. FMI allows one to build reusable components from these models, but do not address the construction of simulation itself. This rupture in abstraction makes it difficult to build integrated simulation, and motivates our contribution.

Considering an architectural description model of an embedded system as a primary artifact, we want to streamline the construction of a virtual integration testbench that would integrate external models as environment stimulus, hence allowing through tests of the embedded (or cyber) part. Our contribution builds on the AADL architecture description language, and the FMI standard. Our main contribution in this paper concerns a model-based approach to integrate FMI blocks and AADL so as to leverage existing code generation strategy and build either model-in-the-loop or hardware-in-the-loop simulations.

The paper is organized as follows: in section 2, we review the main technological elements used: AADL and FMI. In section 3, we report on existing FMI-based integration workflows. In section 4 we propose an AADL-based workflow that leads to the generation of simulations. Section 5 is a case study that illustrates the approach. Section 6 proposes future work directions.

Standards in use a. AADL, Architecture Analysis and Design Language

The "Architecture Analysis and Design Language" (AADL) [START_REF] Feiler | Model-Based Engineering with AADL: An Introduction to the SAE Architecture Analysis & Design Language[END_REF]) is both a textual and graphical language for model-based engineering of embedded real-time systems. AADL is used to design and analyze software and hardware architectures of embedded real-time systems.

The AADL purpose is to model hardware components (memory, bus, processor, device, virtual processor, virtual bus) and their associated embedded software (data, thread, thread group, subprogram, process). It focuses on the definition of clear block interfaces, and separates the implementations from these interfaces.

From the separate description of these blocks, one can build an assembly of blocks that represent the full system. The AADL defines the notion of properties. They model non-functional properties that can be attached to model elements (components, connections, features, instances, etc.). Properties are typed attributes that specify constraints or characteristics that apply to the elements of the architecture such as clock frequency of a processor, execution time of a thread, bandwidth of a bus. As defined, AADL is an Architecture Description Language. Without loss of generality, similar notation such as EAST-ADL or UML/MARTE would provide the same power of expression.

AADL has a rich ecosystem to model, analyze and generate code from models, such as Ocarina [START_REF] Hugues | From the prototype to the final embedded system using the Ocarina AADL tool suite[END_REF]. The later aspect is interesting to ease the transition of AADL models' tasks, and communication semantics to an implementation on top of a regular Real-Time Operating Systems. We detail this part in the next section.

Let us note that in such models, the time interval is given by the CPU clock rate (or simulated by a scheduler): AADL models are discrete by nature and fit in the cyber part of cyber-physical systems.

b. FMI, the Functional Mock-Up Interface

FMI [START_REF]MODELISAR Consortium and Modelica Association Project "FMI" -Functional Mock-up Interface for Model-Exchange and Co-Simulation[END_REF], the Functional Mock-Up Interface, is a standard for the simulation of systems, combining heterogeneous models. The initial revision of FMI mostly focused on models relevant for multi-physical aspects of automotive systems. Since then, it has been widely adopted in several settings, especially for the modelling and simulation of Cyber-Physical Systems, e.g. as part of the Ptolemy project at UC Berkeley [START_REF] Cremona | FIDE: An FMI Integrated Development Environment[END_REF]. FMI is already supported by an increasing number of tools used in several domains, e.g. Modelica1 tools, Simulink2 or SCADE Suite 3 . Through this standard, system designers may mix and co-simulate heterogeneous models built by experts to better understand how a system may be integrated. FMI, defines an interface to be implemented as a component called FMU (Functional Mock-up Unit). The FMI functions are used (called) by a simulation environment to create one or more instances of the FMU and to simulate them, typically together with other models. An FMU may either embeds its own solver (FMI for Co-Simulation) or requires the simulation environment to perform numerical integration (FMI for Model Exchange). For both approaches, each model is exported in a zip file, called FMU, which contains a binary file of the model and an XML file (named modeldescription.xml) which describes the model contents, properties, and interfaces (its associated model variables).

In this paper, we only focus on FMI 2.0 for Co-Simulation, as we are interested in combining self-contained simulable blocks and their integration in a system level simulation.

c. FMI for Co-Simulation

The FMI Standard for Co-simulation is intended to provide an interface standard for coupling two or more simulation tools in a co-simulation environment. Co-simulation is a technique used for the simulation of coupled models.

A coupled model, is a model that describes a system as a network of (logically or physically) coupled (or connected) components [START_REF] Zeigler | Theory of Modelling and Simulation[END_REF][START_REF] Vangheluwe | The discrete event system specification (DEVS) Formalism[END_REF]. In the coupled model formalism, the connections between subsystems are represented with connectors, or mathematical equalities. Formally, a coupled model may be represented as a graph structure. For non-causal and continuous models, the graph is undirected. For causal models, the graph is directed. A coupled model is valid if connected ports are compatible regarding their type and causalities [START_REF] Vangheluwe | An introduction to multi-paradigm modelling and simulation[END_REF]. The data exchange between subsystems is done at discrete communication points (called tci). In the interval between two communication points, the subsystems are solved independently by their respective solvers. Master algorithms control exchanges of data between the subsystems and the synchronization between slaves.

The Figure 1 depicts an FMU represented by a block, with internal state variables x(t), connected to other subsystems of the coupled problem by inputs u(t) and outputs y(t) [START_REF] Broman | Determinate Composition of FMUs for Co-simulation[END_REF].

Figure 1 : Data flow between the environment and an FMU for CS [1]

There are two possibilities for providing slave subsystems for co-simulation:

• subsystems with their specific solver, they can be simulated in stand-alone mode (see

• • • Figure 2),
• subsystems with the simulation tools in which they have been developed (see Figure 2).

Figure 2: FMU (CS) integration in stand-alone, and with tool coupling [1]

The FMI 2.0 specification defines the life cycle (different noticeable states) of an FMU as below. A master algorithm serves several purposes: to instantiate, to initialize, to execute and to synchronize FMUs [START_REF] Bastian | Master for Co-Simulation Using FMI[END_REF]. An instantiated FMUs is called a slave. Master algorithms synchronize FMUs by controlling the data that are exchanged between FMUs at specific synchronization points called communication steps. The communication step sizes are defined as hci = tci+1 -tci, where tci are communication points.

For co-simulation two basic groups of functions should be realized:

1. functions for the data exchange between subsystems, 2. functions for algorithmic issues to synchronize the simulation of all subsystems and to proceed in communication steps tci → tci+1 from initial time tc0 = tstart to end time tcN = tstop.

d. Combining ADL and FMI -benefits and challenges

An ADL model captures the organizational structure of the system, along with executable blocks that represents its inner structure. Its is fully configured so as to faithfully represent its behavior in terms of timing and communication. Several studies explored the capability to perform model checking or analysis of such model. Yet, a usual limit is the difficulty to capture a model of the environment that would act as a stimulus for the verification part.

FMI has been design to support system simulation. We claim it can also be used also for verification of real-time embedded systems, by combining a mock of the environment as a FMU and the system under test. In this paper, we illustrate our approach to address this part using AADL.

Combining AADL and FMI would equip system architects with a tool to prepare in advance integration phases through a virtual test bench. Indeed, this would make easier the early validation of AADL models: the stimulus provided by FMUs (that represent the physical environment) could be considered as test cases for AADL models.

Using FMU would also give access to models with high-level of fidelity, with connections to other engineering models beyond a naïve model of a plant.

However, this combination of discrete-time execution semantics for the cyber part (AADL) with systems dynamics (FMI, multi-physics simulation) is not an easy task. Such hybrid models raise issues regarding time management in co-simulation, typical issues concern the time step used to synchronize elements, or intermediate extrapolations performed by each model when no inputs are exchanged. [START_REF] Hoepfer | Towards a comprehensive framework for co-simulation of dynamic models with an emphasis on time stepping[END_REF] provides a through review of these topics in the general case.

In the following, we review existing work prior to propose an integrated workflow in section 4.

Related Work

FMI was first designed to co-simulate physical and hybrid systems (continuous and discrete) specified using DAEs (Differential and Algebraic Equations) and discrete events. In this paper, we focus on the use of FMI in the context of critical embedded software design with AADL. We plan also on leveraging existing code generation from AADL that targets Real-Time Operating Systems (RTOS).

In the following, we present related work that a) integrate FMI with modelling language, b) that combine FMI with RTOS code, and c) that use FMI for hybrid systems co-simulation.

a. Integrating FMI with high-level modelling language

The integration of FMI with modelling language such as UML or SysML is an addressed challenge. In [START_REF] Guermazi | Integration of UML Models in FMIbased Co-simulation[END_REF], the authors proposed a co-simulation environment that combines the execution of UML models (with fUML 4 ) and FMI within the Moka Papyrus plugin. This work the co-simulation of hybrid systems, e.g. a controller modelled as an activity diagram (discrete), and its environment as physical and continuous FMUs. Feldman et al. [START_REF] Feldman | Simulating Rhapsody SysML Blocks in Hybrid Models with FMI[END_REF] proposed to export Rhapsody SysML blocks into FMUs, with a limitation on flow ports and attributes (the behavior of SysML block, e.g. state-machines or activities, is not supported for now).

Combining EAST-ADL and FMI has also been investigated during the MAENAD project [START_REF] Cavdar | Supporting Embedded Systems Development -Tool Support for EAST-ADL import of Modelica FMU[END_REF]. The work resulted in FMI 1.0 import capability within EAST-ADL model using model transformation technology. However, this work focused on the semantic mapping between EAST-ADL and FMI, than on co-simulation issues and execution. Let us note current FMI technology lacks means to build simulation assemblies. The standard System Structure and Parameterization (SSP) [START_REF] Köhler | Modelica-Association-Project "System Structure and Parameterization"--Early Insights[END_REF] will complement FMI on this particular topic.

As our work concentrates at a lower level of CPS design, i.e. embedded software modelling and simulation using AADL, we propose to complete these related works at the lower left-side of the V-cycle with RTOS validation capabilities using FMI.

b. Combining FMI with RTOS code

In [START_REF] Nicolai | FMI for Co-Simulation of Embedded Control Software[END_REF], the authors propose to adapt embedded software to comply with FMI for co-simulation. More precisely, the authors propose to advance the clock of the RTOS, by overwriting the idle thread and waiting for a signal to start execution. Pohlmann et al. [START_REF] Pohlmann | Generating Functional Mockup Units from Software Specifications[END_REF], proposed to generate FMUs from UML software specification, where the clock is specified in a DSL named MechatronicUML. This clock is used to measure execution time and to specify Real-Time properties within timed state-machines.

On the contrary, we aim at validating a system from its ADL model. Hence, we propose to simulate the behavior of the embedded processor, which executes the target code. Hence, one can perform co-simulation of CPS, closest to the actual implementation without the need of specific hardware (between Software-In the Loop and Hardware in the Loop), or on the final target. This is left as a late-binding descision.

c. FMI for hybrid co-simulation

Co-simulating discrete (software) and continuous models (physical), raises several issues that we encountered during our study and experiments. Indeed, mixing continuous and discrete behavior in a cosimulation framework is not well handled by FMI. The representation of time and its management are the key issues of FMI based co-simulation approaches. In Cremona et al. [START_REF] Cremona | Hybrid Co-Simulation: It's About Time[END_REF], the authors identified extensions to FMI for supporting hybrid co-simulation: use integer time instead of floating point time representation, automatic choice of time resolution, use of "super-dense" time, and the use of absent signal. The proposed solution of [START_REF] Cremona | Hybrid Co-Simulation: It's About Time[END_REF] satisfies all the requirements for hybrid co-simulation stated in [START_REF] Broman | Requirements for Hybrid Cosimulation Standards[END_REF]. Unfortunately, it imposes strong constraints on the usability: these extensions are not backward-compatible with existing FMI 2.0 FMUs.. Finally, using the dependency graph as an asset to get more precise hybrid co-simulation results is an issue investigated in several works, especially in [START_REF] Van Acker | Generation of an Optimised Master Algorithm for FMI Co-simulation[END_REF], whose authors propose to generate master algorithm based on the dependency graph (with and without loop) and on the step-size of each FMU (multi-clock management). We are also interested in the recent results of DACCOSIM [START_REF] Galtier | Experimenting with Matryoshka Co-Simulation: Building Parallel and Hierarchical FMUs[END_REF], which propose to generate master algorithms for parallel and distributed co-simulation using hierarchical FMUs.

Integrating FMUs as AADL blocks

In this Section, we present the integration workflow of FMU components within AADL models.

We view the integration of FMU as an integration process. Starting from an AADL model, one aims at integrating FMU as an executable block, similar to the inclusion of other functional models in AADL, such as C, Ada, Scade, Simulink that are already supported by our AADL toolchain Ocarina. Each block is actually integrated as a subprogram block, that is triggered by its enclosing component such as a thread or a device.

a. Integration of FMU in AADL workflow

First, let us say that one receives an FMU that models and simulates the mechanical part (physical) of a larger system. This FMU should be integrated with a controller (cyber part), designed with AADL. The goal is to verify that the controller behaves as expected. The integration workflow is presented Figure 45. The first step consists in an automated translation of the FMU as AADL model using an algorithm, which 1) unzips the FMU file, 2) parses the modeldescription.xml file to create AADL elements respecting the mapping of Table 1, and 3) creates the FMI wrapper as set of AADL constructs :subprogram that capture the execution entrypoint of the simulator) and and corresponding C implementation, thread and device abstractions. Then, one could connect the FMU with the larger AADL model to build a coupled model. FMU-based simulations rely on the concept of a Master Algorithm that orchestrates the overall simulation at each time step. Then, the FMUs perform a calculation step, and the resulting values are propagated to the scheduler, which launches tasks depending on the overall simulation time. The Master Algorithm can be built based on the dependency graph of the coupled model. However, in the case of algebraic loop detection, the calculation of the dependency graph is aborted and a generic Master Algorithm is provided. In parallel, the target RTOS code is generated from the AADL model, using Ocarina. Finally, the whole code is compiled and linked to be executed. 1, FMU blocks are mapped to AADL device, that is an abstraction of a device interacting with the physical world captured by the FMU model. Hence, FMU interactions are explicitly discretized by the activation of the device by other part of the model, e.g. reading from a sensor will trigger the corresponding FMU at the corresponding sampling time. Hence, one can integrate either continuous time or discrete time in the simulation.

In our approach, FMUs are embedded inside an AADL model that already have an execution semantics, and a scheduler. As a result, the Master Algorithm is implicitly defined by the combination of the scheduling parameters of all blocks: signals are captured in AADL event port communications; data propagation asAADL data port communications; scheduling is controlled by the scheduler of the system, e.g. prioritydriven scheduler. Thus, the cyber part of the system interacts with the environment through polling (periodic read), interrupts (reception of events from the environment) or actuation. These are captured by corresponding port directions in the AADL model.

As a consequence, the co-simulation time is linked to scheduler time.. We used signals to start the scheduler until the communication time step is reached. The implementation of the master algorithm is automatically generated using the Ocarina AADL code generator by translating AADL tasks and communication ports to the corresponding C artefacts. Thanks to the versatility of the code generation process, we can either really on true (wall clock) time, or simulated time using a simulator of a RTOS. Hence, this approach allows seamless integration of FMU as functional models.

Case Study and Experiment Results

In this section, we list two case studies built on the previous integration workflow 6 .

a. Moonlander

A Moon Lander model [START_REF] Fritzson | Introduction to modeling and simulation of technical and physical systems with Modelica[END_REF] was used to investigate co-simulation's time and scheduler's time issues. We built a Modelica model of the physical model and exported it into an FMU 2.0 for Co-Simulation. The controller implements a basic strategy to control the descent of the vehicle, and triggers the thrusters. A first version has been implemented in Modelica to check the correctness of the controller., and simulated in the OpenModelica framework.

Then, the FMU of the physical model was imported as an AADL component following the semantics mapping of the Table 1, and connected to a reimplementation of the controller in C. This controller and the plant, as seen as an AADL device that samples the environment, have been connected in an AADL model (see Figure 6). This model indicates the data types exchanges and the scheduling parameters of the controller. From the system designer perspective, the AADL model captures the configuration of the controller, and a device that interacts with the environment as a regular device driver. Here, FMI plays its role of "mock-up", instead of connecting this model to the implementation of a driver, we connect it to the model that simulated the environment it interacts with.

To simulate the overall system, we generated the C code of the AADL controller with Ocarina, along with code archetype for the various tasks and communication channels. We linked it to the FMU as an external library. We rely on the FMUSDK2 from Modelon (adapted by University of California -Berkeley7 ) to build a generic entry point to load FMUs and to compute simulation steps triggered by the host process. For this experiment, we relied on the GNU/Linux OS, combined with RT-POSIX API call to implement a realtime behavior for the controller.

Through analysis of the execution logs, we could assess the simulation has the same behavior for both the FMI-coupled model and the Modelica model. The environment of the controller is composed of three FMUs: an engine, an elevator, and the aircraft dynamics. These FMUs are connected to exchange physical quantities, and to the controller that is modeled in AADL. This controller is made of 11 periodic tasks interconnected. This model has a higher level of complexity compared to the MoonLander case study, with more FMUs and tasks.

To build these FMUs, we modelled the environment using the Modelica language and we generated the FMUs with JModelica. The controller has been implemented in Simulink, and later translated in C. Erreur ! Nous n'avons pas trouvé la source du renvoi. [START_REF] Vangheluwe | An introduction to multi-paradigm modelling and simulation[END_REF] shows the resulting AADL model that integrates the FMUs with the AADL controller. Then, based on (Van Acker, Denil, Vangheluwe, & De Meulenaere, 2015; [START_REF] Galtier | Experimenting with Matryoshka Co-Simulation: Building Parallel and Hierarchical FMUs[END_REF] we have investigated the construction of the overall dependency graph to generate automatically the Master Algorithm. This algorithm has been translated as a set of AADL scheduling configuration parameters. The models are simple enough to be full discretized, thus a causal graph can be deduced to capture the whole simulation behavior.

We could leverage the ROSACE validation script to ensure that our simulation was also consistent with other simulations done either in Simulink, Ptolemy/HLA or Giotto.

c. Lessons learnt

Through these two case studies, we could generate virtual integration testbench for cyber physical systems. We demonstrated the capability to connect architectural description to model simulating the environment using the FMI framework. This is a first step towards full generation of simulation environment. The architectural description of the system has been demonstrated to be enough to interact with the FMU-based environment blocks. This is a consequence of using causal systems: one case simulate the environment up to the instant required by the cyber part.

Conclusion and Further Work

In this paper, we addressed the early validation of embedded systems. We proposed a general approach to bind architectural description, amenable to code generation, to FMU blocks. This enables the construction of virtual integration test bench. First, we presented the various elements of contexts and related work. Then, we illustrated how FMI blocks can bebound to AADL modesl so to serve as a mock of the environment as seen through a device. Hence, one can test an AADL model considering a representative model of the environment, leading. Leveraging high-fidelity model turned into FMU, one can test more precise interaction scenario. Future work activities will increase the number of case studies, to stress timeliness issues, e.g. multi-clock scenarios. Another aspect will consider integrating multiple simulators like Instruction Set Simulators for precise simulation of hardware blocks, and interoperability with domainspecific simulators to simulate the occurrence of faults and defects.

Figure 3 :

 3 Figure 3: State-machine of FMI Co-Simulation[START_REF]MODELISAR Consortium and Modelica Association Project "FMI" -Functional Mock-up Interface for Model-Exchange and Co-Simulation[END_REF]

Ocarina 5 [

 5 [START_REF] Hugues | From the prototype to the final embedded system using the Ocarina AADL tool suite[END_REF]] is a model processor for the AADL. It supports code generation targeting a wide variety of RTOS (RTEMS, RT-POSIX, FreeRTOS, ARINC653). It maps AADL constructs onto the PolyORB-HI runtime that abstract RTOS constructs. It preserves the initial semantics of the AADL model.

Figure 4 :

 4 Figure 4: Integrating an FMU as an AADL component -Workflow b. Integration of FMU execution semantics

Figure 5

 5 Figure 5 AADL model of the lunar lander b. ROSACE case study The ROSACE case study (Pagetti, Saussié, Gratia, Noulard, & Siron, 2014) was used to investigate cosimulation graph issues, but also scalability. ROSACE has multiple implementations in C/POSIX, C/ARINC653, Simulink Giotto or Ptolemy. It is a reference benchmark for CPS simulation.

Table 1 :

 1 Mapping Between FMI and AADL

	Concepts	FMI	AADL
	Component	FMU	Subprogram/Device
	Input/Output port	Causality In/Out	In port / Out port
	Discrete port / Continuous port	Variability Discrete/Continuous Event port / Data port
	Types	Real, Integer, Boolean	Base_Types::Float,
			Base_Types::Integer,
			Base_Types::Boolean
	As stated by Table

https://www.modelica.org/ [last visited 30/05/2017]

https://fr.mathworks.com/products/simulink.html [last visited

31/05/2017] 3 http://www.esterel-technologies.com/products/scade-suite/ [last visited 31/05/2017]

http://www.omg.org/spec/FUML/1.2.1/ [last visited 02/06/2017]

Other case studies are available through http://www.openaadl.org

https://github.com/cxbrooks/fmusdk2 [last visited 03/06/2017]


Long Chen

Nicolas Gac

Thomas Rodet

Colombe Maury

Parallelization on a 8-GPU server of iterative 3D reconstruction algorithm for dental X-ray tomography

come   L'archive ouverte pluridisciplinaire

Parallelization on a 8-GPU server of iterative 3D reconstruction algorithm for dental X-ray tomography Long Chen 1,2 , Nicolas Gac 1 , Thomas Rodet 1 , Colombe Maury 2 1,Groupe Probl èmes Inverses, Laboratoire des Signaux et Syst èmes ( L2S, UMR 8506 CNRS -SUPELEC -Univ Paris Sud 11) Sup élec, Plateau de Moulon, 91192 Gif-sur-Yvette, FRANCE 2, Trophy, Carestream Dental,4 rue F. Pelloutier -Croissy-Beaubourg 77534, France. E-mails: lchen@lss.supelec.fr, nicolas.gac@lss.supelec.fr, thomas.rodet@lss.supelec.fr, colombe.maury@carestream.com PUMPS summer school, july, 2-6, 2012, Barcelona, Spain ' & $ % Abstract: In dental numeric 3D imaging, classic filtered backprojection (FBP) methods, for exemple, Feldkamp (FDK), is too sensible to the number of projections and noise, also limited in metal artifacts and beam-hardening reduction, so we use a 3D iterative least squares algorithm. Because of the huge size of 3D volumes (512 3 to 1024 3 voxels) and sinograms (512*512*360), it was too long to be applied in clinical medical imaging. However, thanks to the high performance of computing acceleration by GPU, its appearance in clinic is possible. In our iterative algorithm,we have two principal operations, projection and backprojection. According to our first resultats, the computation time of these operations on GPU is less in two orders (/100) than that on CPU, in particular for backprojection. With Multi-GPU (8 GPUs, Tesla C1060) in a Carri system's server, it decreases by a significant factor compared to single GPU . My Ph.D job consists of developping an iterative reconstruction method to reduce or remove the artifacts above, and obtain a segmentation of reconstructed volume as well.

Cone beam X-ray tomography

Description: X-ray tomography consists of reconstruction of the unknown object from the detector data. We take it as an inverse problem. Mathematical modelling: Let f be an unknown object vector, g observation vector, H system matrix and noise vector.

(1)

Method: an iterative least squares algorithm.

Iterative least squares(LS) algorithm

To estimate the unknown object f , we minimize the square errors as below.

(2)

the n + 1 th estimation update f (n+1) :

where

Simpified Least squares algorithm steps, let g* be original data;


Nicolas Gac
email: nicolas.gac@lss.supelec.fr

Asier Rabanal

Alexandre Vabre
email: alexandre.vabre@cea.fr

Ali [ Mohammad-Djafari

Omte

Bayesian CT algorithm : reconstruction of a real foam

1 Few projections challenge Challenge: 3D CT cone beam reconstructions from limited number of projections (like in dose reduction context) require alternative methods to standard analytical filtered backproprojection method. Proposed method: A Bayesian iterative algorithm based on a Gauss-Markov-Potts prior model. Beyond limitations: Parallelization on a 8 GPUs server has allowed us to go beyond the computing time limitations.

A Bayesian approach

Inverse problem: Getting the object f from the projections data g collected from a cone beam 3D CT:

g = Hf +
(1) Prior model: Object f(r) is composed of K regions R k corresponding to K materials labeled by a hidden variable z(r)=k. A Markov/Potts model corresponding to the compactness of materials is used for z. It's A Gaussian model corresponding to the homogeneity of materials is used for each region R k .

p(f (r)/z(r)) = k) = N (m k , n k ) (2)
Steps of the Iterative method: 1) Reconstruction step: Updating f by computing f (i+1) = arg max f {p(f|z, θ, g)}. This is done by using a gradient type optimization algorithm:

f (i+1) = f (i) + α H t (g -Hf (i) ) + λD t Df (i) (3)
2) Segmentation step: Updating z by generating a sample from p(z|f, θ, g) with a sampling algorithm from a Potts-Markov model.

3) Characterization step: Updating the hyperparameters using p(θ|f, z, g).

Backprojection

z (i,m) f (i) δf (n) M C δf (n) reg f (i,n+1) f (i+1) ẑ(i) θ(i) ẑ(i+1) θ(i) θ(i+1) ĝ(n) δg (n) f (i,n) ẑ(i) θ(i)

  3 GPU implementation of the H and H t operatorsGoal: Acceleration of the projection step (Hf) and backprojection step (H t δg) wich are the most time consuming operators. GPU acceleration: On GPU, we reach a two orders of magnitude acceleration.Projector 755 ms (128 ms for CPU/GPU memory transfer) Backprojector234 ms (133 ms for CPU/GPU memory transfer)Reconstruction time on a GTX 295 (96 * 256 2 data) 8 GPUs server: Thanks to the use of a multi GPU server, an acceleration factor linearly propotional to the number of GPU used) has been reached on 1024 3 volume reconstruction.4 Foam reconstructed (CEA-LIST real data set) Semi automatic setting ot the regularization parameters Technologic transfer with an industrial partner Nicolas Gac 1 , Asier Rabanal 1 , Alexandre Vabre 2 and Ali Mohammad-Djafari 1

	Reconstruction with a FDK method	Reconstruction with a non bayesian method
	Recontruction with our method	Segmentation obtained
	5 Future works
	Optimization of our Gauss/Markov/Potts method
	Optimization of the CPU/GPU memory transfer
	Parallelization on the 8 GPU server of other operators (3D convolution, Potts sam-
	pling...)

L2S (UMR 8506 CNRS -SUPELEC -Univ Paris Sud 11), F-91192 Gif-sur-Yvette.

CEA-LIST, F-91191 Gif sur Yvette.


Christophe Lounis
email: christophe.lounis@isae-supaero.fr

Vsevolod Peysakhovich
email: vsevolod.peysakhovich@isae-supaero.fr

Mickaël Causse
email: mickael.causse@isae-supaero.fr

Intelligent cockpit: eye tracking integration to enhance the pilot-aircraft interaction

Keywords: Human-centered computing → HCI design and evaluation methods, Human computer interaction (HCI), Eye-tracking, Eye movements, Human factors, Human computer interaction, Neuroergonomics, Cockpit monitoring, Flying assistance technology

In this research, we use eye tracking to monitor the attentional behavior of pilots in the cockpit. We built a cockpit monitoring database that serves as a reference for real-time assessment of the pilot's monitoring strategies, based on numerous flight simulator sessions with eye-tracking recordings. Eye tracking may also be employed as a passive input for assistive system, future studies will also explore the possibility to adapt the notifications' modality using gaze.

RESEARCH OBJECTIVES

Nowadays, aviation is the safest mode of transportation with less than one accident per million flights [Airplane 2016]. Despite this low rate, accidents still occur; and human error is its major causal factor [START_REF] Shappell | Human error and commercial aviation accidents: an analysis using the human factors analysis and classification system[END_REF]]. Even if humans are able to cope with complex and degraded situations, the limitations of the human attentional capabilities are unavoidable and need to be taken into account. The National Transportation Safety Board (NTSB) found monitoring and cross-checking errors being involved in the majority of the accidents [Board 1994]. As such, the Federation Aviation Administration (FAA) issued a directive that includes new requirements for improving flight crew monitoring skills during the initial training [(FAA) 2013]. Moreover, the Bureau Enquetes-Accidents (BEA), the French accidents investigation agency, recommended studying pilot monitoring with eye-tracking to improve flight safety [(BEA) 2013].

HYPOTHESIS AND PROBLEM STATEMENT

Neuroergonomics approach proposes to use neuroscience tools to monitor the operator in order to assess its cognitive state when facing complex activities [START_REF] Parasuraman | Neuroergonomics: The brain at work[END_REF]. Far from replacing the human by machines, its goals are to enhance and optimize the human-system cooperation. A promising way to do so, the core of the current thesis project, is to integrate eye tracker on board in order to monitor pilots eye movements [START_REF] Peysakhovich | Des apports de l'oculométrie dans la sécurité aérienne[END_REF]. These data can be further used to deduce the crew attentional state, the breakdown of which can be detected early and prevented [START_REF] Dehais | Pilot Flying and Pilot Monitoring's Aircraft State Awareness During Go-Around Execution in Aviation: A Behavioral and Eye Tracking Study[END_REF][START_REF] Dehais | Automation surprise in aviation: Real-time solutions[END_REF][START_REF] Lefrancois | The role of Pilots' monitoring strategies in flight performance[END_REF][START_REF] Liu | Cognitive pilot-aircraft interface for single-pilot operations[END_REF][START_REF] Peysakhovich | The Neuroergonomics of Aircraft Cockpits: The Four Stages of Eye-Tracking Integration to Enhance Flight Safety[END_REF]].

APPROACH AND METHOD

In the first part, the project aims to build a database of visual circuits. This database will serve as an optimal cockpit monitoring reference. This database will integrate different eye movement characteristics (dwell times, time without fixation, blinks, etc.) according to the different flight phases or aircraft configurations. In the second part, we will study different alerting modalities (haptic, sound, visual) that could be employed according to the pilot' attentional state. For example, literature showed that if the pilot is too much focused on visual information, auditory information can be unnoticed [START_REF] Dehais | Failure to detect critical auditory alerts in the cockpit: evidence for inattentional deafness[END_REF]. A haptic alarm might be employed in such context.

PRELIMINARY RESULTS

A first experiment, involving 12 airlines pilots was conducted in the ISAE-SUPAERO PEGASE flight simulator. Pilots were between 23 and 52 years old (mean = 39, SD = 17.32). They had a minimum of 5800 hours of flight with airline aircraft (mean=2163, SD=1636.15). Pilots performed twice three different manual landings. Scenario 1 corresponded to a nominal manual landing. In the two others landings scenarios, pilots were asked to perform a supplementary monitoring task (double-task). The monitoring task consisted in calling out the distance in nautical miles (Nm) between the aircraft and a designed radio beacon. The pilots were asked to call out the distance either every 0.5 Nm (scenario 2) or every 0.2 Nm (scenario 3). A Smart Eye system recorded eye movements of the pilots. The cockpit has been divided into several Areas Of Interest (AOIs, Figure 1) corresponding to the flight instruments. The Figure 2 presents the result of this experiment with the non-monitored AOIs, the time during which the AOIs were not fixed.

PLANS FOR FUTURE WORK

Both types of eye movements characteristics (i.e. non-monitored and fixations frequency) will allow adding in the cockpit an adaptive system with some rules about pilot's eye movements. The time threshold that defined tolerance for non-monitored AOIs will be included in a Flight Eye-Tracking Assistant (FETA). The priority of the alarms will be defined by the fixations frequency in order to manage potential conflicts between concurrent alerts. Next experiment will try to compare pilot' performance during landing task with and without FETA system in order to validate the system efficiency in baseline case.

Figure 1 :

 1 Figure 1: Cockpit Display with Areas Of Interest and Sub-AOIS: (1) Primary Flight Display (PFD), (2) Navigation Display (ND),(3) Electronic Centralized Aircraft Monitoring (ECAM), (4) Out of Window (OTW),(5) Flight Control Unit (FCU), (6) Flight Mode Annunciator (PFD.FMA) , (7) Speed Tape (PFD.SPD), (8) Attitude indicator (PFD.ATT), (9) Vertical Speed Tape (PFD.VS), (10) Heading Tape (PFD.HDG), (11) Message Zone (PFD.MSG), (12) Navigation display indicator of the PFD.

Figure 2 :

 2 Figure 2: From the top to bottom, box plots of nonmonitored AOIs for each scenario 1, 2, 3.


Mouna Rekik
email: mouna.rekik@ifsttar.fr

Christophe Gransart
email: christophe.gransart@ifsttar.fr

Marion Berbineau
email: marion.berbineau@ifsttar.fr

Cyber-physical Threats and Vulnerabilities Analysis for Train Control and Monitoring Systems

Keywords: Railway System, TCMS, Cyberphysical security, Threat, Vulnerability, Risk

Cyber-physical security is a major concern for the new generation of trains. In fact, trains are increasingly relying on automation, control and communication technologies in order to improve the efficiency and safety of their services as well as the comfort of passengers. This dependency introduces certainly new vulnerabilities and entry points to the system which exposes the system to new threat scenarios. This paper deals with cyber-physical security aspects of Train Control and Monitoring Systems (TCMSs). We analyse vulnerabilities and characteristics of railway threat landscape including potential threats, threats agents and motivations. We discuss, also, direct impacts and cascading consequences on the whole system as well as the risk generated.

I. Introduction

Technological advances and ongoing digitalization are continuously improving safety and efficiency of railways systems. New generation of trains will use real-time rail information and on-line environmental data in combination with on-board references to achieve optimal control of the train traction and braking while keeping with travel schedule and reducing energy consumption. Train passengers travelling experience will be improved as well through services such as connected infotainment, realtime information, etc. These innovations are accomplished using networked devices along with advanced remote access and control capabilities. Introducing such features for safety critical systems like railway systems brings not only improvements but also new challenges concerning cyber-physical security.

Cyber-attacks are becoming increasingly automated and sophisticated. Their impact on critical infrastructures, in particular railway systems, can lead to catastrophic consequences, no matter whether they are the intended target or not. Attacks on operational systems could lead to the disruption or the unavailability of the rail transport itself. When informational systems are attacked it can lead to the unavailability of services for the passenger, like being unable to buy a ticket or digitally check a ticket into the system. Consequently, cyber-attacks on the transportation sector create a large impact on society and people's daily life varying from direct effects like delays, accidents, injuries or even deaths, to indirect effects, like socio-economic effects. The work presented in this paper is conducted within the European project Roll Rail under the task "security for TCMS"that aims to identify convenient security countermeasures and to define required protection levels for each TCMS asset. Yet, such outcomes can be accomplished using a coherent and strategic approach that encompasses all cyber-physical security aspects. The starting point of the selected approach is studying the system vulnerabilities and threat landscape. As such, in this paper, we present security threats and vulnerabilities assessments of TCMS with the aim of identifying threats, quantifying impacts and expected losses, and analyzing criticality of the system assets. The remainder of this paper is structured as follows. Section II shortly introduces the System under Consideration (SuC). We analyze the system vulnerabilities in section III. Then, we discuss railway threat landscape through a threat model, actors and motivation analysis in section IV, and present potential impacts and risks on railway systems in section V. A detailed threat analysis of some assets of the SuC is presented in section VI. Finally, the paper is concluded, in section VII.

II. System Identification

The starting point of a cyber-physical security analysis is performing a clear identification of the SuC. This step consists in illustrating the SuC assets and Industrial Automation Control System (IACS) included in the system, identifying the access points to the system and defining the security perimeter. Thus, in this section, we detail the proposed architecture of the SuC which is the TCMS, as well as its different functionalities. This step helps to identify the sensitive assets of the SuC. The TCMS is mainly responsible for providing basic train control functions: -inaugurate the train network, -determine train topology and configuration, -provide orientation information for coupled elements, -manage leading vehicle information, -distribute train topology and configuration, -confirm train configuration, -manage train network operation, -manage train network access and -transmit data. Nevertheless, with the recent advances of Information and Communication Technology (ICT) integrated in the railway industry, a TCMS is expected to manage a set of sophisticated applications not only for a more reliable train control, but also for operator oriented services and customer comfort purposes. As such, in order to separate the control system ICT from To accomplish all functionalities mentioned above, system actors and devices need to exchange data and commands using communication networks in different communication schemes such as intra-train, train-to-train and trainto-ground communications. Communication networks for future railway systems are expected to be heterogeneous composed of a mixture of several networks and radio access technologies that can be simultaneously accessed by different system actors and devices in order to improve the capacity of communications. For instance, New Dependable Rolling Stock for a more Sustainable, Intelligent and Comfortable Rail Transport in Europe (Roll Rail) proposes the use of an heterogeneous network architecture combining wireless technologies, such cellular network like LTE, IEEE . , RFID and wired networks where the advantages and specificities of each access network can be taken into consideration [ ]. For safety and security purposes, access between different domains will be limited. Indeed, as shown in Figure , the proposed architecture includes also network protection devices between different functional domains since their security and safety requirements differ.

III. Vulnerability Assessment

The integration of cyber-physical systems into critical infrastructures brings not only benefits but also a new set of vulnerabilities for the whole system. The exploitation of such cyber-vulnerabilities can lead to physical consequences. The vulnerabilities of railway systems can be divided in two categories [ ]: general cyber-vulnerabilities, and vulnerabilities coming from the specificity of railway systems. 1-General vulnerabilities for IACS • Wireless and cellular communications. Although such communication technologies bring several advantages to the system, they introduce typical vulnerabilities because communications take place 'through the air' using radio frequencies and thus it is difficult to prevent physical access to them, especially in open and accessible areas like public railway infrastructure. The risk of attack such as interception and intrusion is greater than with wired networks.

• Increasing system automation. Although automation control improves safety and global system operations by removing the possibility of human error, it introduces new vulnerabilities since the surface of attack increases and therefore the risk of attack is higher. 2-Specific vulnerabilities for railway use case • Scale and complexity of railway systems. Railway infrastructure is a large-scale international infrastructure. Applying networked technologies across large railway systems increases number of access points to the system, and thus increases the difficulty and cost. Thereby, securing communications and connectivity between mobile devices on a large area is a complicated task.

• Cohabitation between legacy and new systems. Since railway infrastructure is a shared common infrastructure used by different railway companies, the use of legacy equipment and infrastructures introduces new vulnerabilities.

• Multiple independent systems. In addition to legacy problems, railway systems are composed of diverse systems such as sensors, computers, payment systems, emergency systems,etc. It is crucial, but also difficult, to ensure smooth interfacing, communication and securing between such independent and heterogeneous systems. This increases system vulnerabilities.

• Access to real-time data. Reliable operation of the system requires a non-stop real-time data exchange which may result in costly maintenance and periods of service downtime.

• Online passenger services such as timetabling, passenger information, ticket booking, are also susceptible to cyber attacks.

IV. Railway Threat Landscape

A threat landscape provides an overview of potential threats against the SuC and their characteristics. To this end, in this section, we are identifying the set of threats against a railway system, threat actors and their motivation to attack.

A. Potential threats against TCMS

Railway system is exposed to many types of attacks of different nature. In this section, we present a threat taxonomy that covers mainly cyber-security threats; which are threats directly applied to ICT assets and thus affecting SuC operations. We also present non-IT threats to cover threats to SuC physical assets that are necessary for the system operation. Based on recent studies published by European Union Agency for Network and Information Security (ENISA) [ ] [ ] [ ], threats can be classified into physical threats, accidental threats, disasters and outages, failure and malfunctions (system failure) and malicious actions.

• Physical attacks. This type of threats is caused by intentional offensive actions aiming to achieve maximum distraction, disruption, destruction, exposure, alteration, theft or unauthorized accessing of assets such as infrastructure, hardware or ICT connections.

• Accidental damages. These are caused by unintentional insider actions [ ] including human errors [ ]. Unintentional mistakes can be made by authorized employees, users, developers, and testers during data entry, operations, or system or application development. Such errors can affect system integrity and stability.

• Malicious activities. This type of threats contains cyber-attacks and intentional nefarious activities or abuse targeting railway system assets through digital assets.

B. Threat actors and motivations

Railway systems can be threaten by several types of actors with different motivations. In the following, we present an taxonomy of threat actors against railway systems in order of importance:

• Nation states is an emerging, yet critical, class of threat actor against critical infrastructures in general, including railway systems. In fact, these systems provide the essential services for the nation's society and serve as the backbone of its economy, security, and health. As such, they become a significant targets in modern cyber-warfare. Attacks performed by such actors can be politically or economically motivated.

• Non-state organized threat groups. This category includes mainly cyber-terrorists but also cyber-fighters and cyber-criminals . Common to all these threat actors is that they can be organized on local, national or international level. However, their motivations and skill level vary. Cyber-terrorists have political or religious motivations and their capability varies from low to high. Whereas, cyber-fighters are patriotic motivated groups of citizens with strong feelings when their political, national or religious values seem to be threatened by another group and are capable of launching cyber-attack to protest and . Cyber-criminals are organized groups with quite high skill level that attack systems for financial gain.

• Insider threat agents including employees (staff, contractors, operational staff) and third party (vendors, system integrators, and other third party service and product providers) are considered as dangerous threat actors since they have insider access to private facilities and resources and a significant amount of knowledge that allows them to place effective attacks against sensitive parts of the system.

• Hacktivists are attackers, in many cases with limited technical skills, but rely on ready-to-use attack kits and services, or even third-party botnets, to cause damage to a system e.g., denial of service, defacement as a means of protest. Their protests are often politically motivated.

• Business-oriented attackers is a traditional category of attackers that are interested in performing abusive activities against competitor-controlled cyber-physical systems in order to cause concrete damage and gain business advantages.

• Casual cyber-attackers that usually have little or no technical skills, launching attacks against connected control systems can cause serious damage, much higher than in the case of simple IT system. It is important to note that individual non state attackers (such as hacktivists, business-oriented attackers and casual attackers) could also be considered by nation states as allies in a low intensity warfare against an opponent nation.

The aforementioned actors are driven by several categories of motivations. We identify two main motivations:

• Political purposes. Since railway systems are part of a nation critical infrastructure, attacking them is considered as a strategical warfare weapon that may cause severe consequences varying from endangering people lives to financial loss and economical impacts. As these systems become increasingly reliant on ICT, they merge as a important target for political motivated cyber attacks. These warefare strategies are already used and they have been multiplied in the few past years. They can be used to cause physical damage or exfiltrating intelligence or secret information. Some well-publicized example is the attack conducted on Iranian Nuclear Facilities by using the worm Stuxnet [ ]. According to [ ], Stuxnet was launched by the US and Israel several years ago, in an attempt to sabotage IranâĂŹs nuclear program. Actors such as nation states and hacktivists fall in this category.

• Financial purposes. Transportation systems, including railway systems, are the backbone of national economies, providing connections for people and goods, access to jobs and services, and enabling trade and economic growth. Attacking such systems results in financial loss to the service providers, but also other cascading consequences on other domains. At railway operator level, attacks can be financially motivated in order to cause business disruption and sales loss. This can cause significant long-term economic impact when reputation of the operators and trust of customers are impacted [ ]. Financial motivated attacks are usually performed by business-oriented actors, but also by nation states actors driven by economic reasons. This category of motivation also existed before critical infrastructures became an appealing and sensitive target.

V. Risk on railway systems

A risk is defined as the potential that a given threat will successfully exploit vulnerabilities and thereby produce a negative impact on the system. From operator perspective, the most important aspect is the train movement, for that, security concern is first integrity, then availability and finally confidentiality. In fact, loss of integrity could lead to accidents or collisions, whereas loss of availability would bring the railway system to a halt. Loss of confidentiality is less of an immediate threat, but might result in the leak of sensitive operational information. From passenger perspective, negative impacts can be confidentiality and privacy problems (since the system uses sensing, tracking, real-time behaviour evaluation and automated decisions), interruption and disturbance of transport services resulting in disruption of their daily lives, etc. However, the most critical impact is when passengers health and safety are affected. Indeed, passengers safety is the priority to all railway systems actors, nonetheless, some incidents may endanger health and safety, not to mention threats coming from terrorism that need to be accounted for when protecting railway systems and infrastructure. The aforementioned impacts can affect one or many areas. We distinguish categories of risk based on the impacted area [ ]. For each area, we define levels of severity.

• Safety : Risks impacting safety differ in terms of severity. In fact, a risk can result in (level ) light and moderate injuries and/or minor damage to the environment, (level ) severe injuries and/or large damage to the environment and even (level ) life-threatening and fatal injuries and/or extreme damage to the environment.

• Financial : Financial impacts vary from undesirable financial damage and impact on the public image of the company(level ), to substantial financial damage and a serious impact on the public image of the company(level ), and even existence-threatening financial damage and severe impact to the public image of the company such as the incident may incur people suing the company(level ).

• Operational : Impacts on operational aspects may affect comfort functionalities, however the vehicle can be used but with some restrictions(level ). It can also lead to affect an important functionality but the train still can be used, only with massive restrictions(level ). In the worst cases, one or more fundamental functions may be affected such as the train become unusable(level ).

VI. Threat analysis

In this section, we present a detailed threat analysis for TCMS. We describe potential threats, the direct impacts on the attacked asset, the cascading consequences on the whole system, the impacted area (marked I.A)(S, F or O for safety, financial, operational respectively) and the risk level ( , or as defined in paragraph V).In our original work, we performed the analysis for all system assets. In this paper, due to space limitation, we selected two assets of a railway system with different functionalities and levels of criticality: propulsion system from TCMS domain and CCTV surveillance system from OOS domain. Table I presents a threat analysis of the propulsion system responsible for the movement of a train. The analysis shows that threats on propulsion system (and this is also true for all TCMS domain functions) target mainly the availability (blocking , disconnection, destruction, etc) and integrity (changing configuration, erroneous administration, etc) of the system. Such actions may result in catastrophic consequences on train operation (maximum security level for operational aspects) and thus on passengers safety (maximum security level for safety). This also lead to severe financial impacts for the train operator, but railway sector in general.

OOS domain CCTV surveillance system is responsible for managing surveillance sources, collecting surveillance information, analyzing surveillance functions, displaying surveillance information (selected, or triggered by alarm source) and recording surveillance information. CCTV asset at OOS domain does not cover CCTV for rear view. A threat analysis of CCTV surveillance system is presented in Table II. As shown in this analysis, threats on OOS CCTV affect the system integrity and availability but also customers confidentiality since sensitive data about particular passengers or particular shipped goods and their location in the train may be shared with unauthorized entities. Attacking CCTV system my be a step behind bigger attack on the train (such as criminal or terrorist attacks). For that, attacking the CCTV system may severely affect safety of the passengers and vehicle although it does not directly affect train operations.

VII. Conclusions

In this paper, we performed security threats and vulnerabilities assessments for TCMS. We also presented some results from the detailed threat analysis. This work was conducted as a part of Roll Rail project. It presents the first step in a selected methodology to establish a cyber-physical secure TCMS. Throughout this analysis, we deduced that the absolute majority of threats targets mainly integrity and availability of TCMS services. The violation of these security properties by attacks against many train subsystems and especially against communication services can lead to the most severe consequences or even catastrophic. Regarding data confidentiality, it is to be considered only for COS and video surveillance from OOS. Further, we will continue the security risk assessment process. As such, a detailed risk assessment will be elaborated to evaluate the criticality of the identified threats on railway systems, and to help suggesting more efficient countermeasures for securing TCMS. Propulsion system is not able to exchange information about status of its components. The driver cannot receive information from propulsion system to ensure that the right functioning. The driver is not able to command the propulsion system, the commands are blocked. For safety reasons, the train performs a controlled emergency break.

Massive damage to safety and security related functions can be made. Danger for passengers and vehicle.

S-F-O-

Physical attacks

Unauthorized physical access/ Unauthorized entry to premises An unauthorized person controls propulsion system increase/decrease train speed in an inappropriate way, propulsion system stops working. For safety reasons, the train performs a controlled emergency break.

Massive damage to safety and security related functions can be made. Danger for passengers and vehicle.

S-F-O-

Erroneous use or administration of devices and systems

An employee may accidentally enter erroneous administration data of propulsion control system.

A bad or erroneous administration and configuration of the system may lead to erroneous actions. The propulsion could stop working and the train cannot move until the problem is fixed. The network is disconnected, no data exchange between propulsion system components. The propulsion system is not able to take the right decision. The driver can not control the propulsion system. For safety reasons, the train performs a controlled emergency break. Using the identity, the attacker has advanced privileges, and thus can manipulate the system. The attacker makes the train travel to an unauthorized speed, or stops the propulsion system from working. The attacker can manipulate propulsion system and create new entry point to conduct more attacks.

Massive damage to safety and security related functions can be made. Danger for passengers and vehicle.

S-F-O-

Sabotage vandalism

Theft An attacker can put an obstacle in front of CCTV camera or paint the facade of the camera.

An attacker can unplug the camera from the system. An attacker can break the CCTV camera.

An attacker can steal CCTV cameras. to loose (partially) visibility of the attacked part of the train.

At the worst case, some criminal actions can not be prevented, and once accomplished, they can not be identified, which can seriously risk the safety of the train and passengers

Possible damage to safety and security related functions. Railway operator's reputation can be affected, financial loss.

S-F-O-

Information leakage/ sharing Confidential information can be shared with unauthorized entities due to intentional human actions (mainly by employees that have access to restricted facilities) which lead to loss of information confidentiality The attacker could have access to sensitive data recorded by the cctv system, such as particular passengers or particular shipped goods and their location in the train. In the worst case, these information can be used for criminal purposes, which can risk the safety of passengers and the train Loss of visibility of parts or all the system. manipulation or loss of information, including sensitive and important data.

In the worst, some criminal or malicious actions performed in the train can not be detected and/or analyzed, thus their consequences cannot be prevented

Possible damage to safety and security related functions. Railway operator's reputation can be affected, financial loss.

S-F-O-

Denial of service

An Attacker can conduct Distributed Denial of network service (DDoS) attack on the network or application layers. Disturb or the communication between CCTV system components and thus limit the controlling capacities of the system. At the worst case, it may lead to disconnect the whole system, and thus loose visibility on the train.

Possible damage to safety and security related functions. Railway operator's reputation can be affected, financial loss.

S-F-O-

Eavesdropping/ Interception/ Hijacking An attacker can intercept communications to record data transmitted from video capture components to video display and video storage components. Threat of failure of IT hardware or transmission connection due to electromagnetic induction or electromagnetic radiation emitted from an another source.

An attacker can maliciously or fraudulently repeat or delay transmission of valid data. Network Reconnaissance, Network traffic manipulation and Information gathering. Man in the middle attack, to sniff the data and command traffic exchanged between the system components, and alter communications.

loss of visibility of parts or all the system. The CCTV can be stopped from working, or blocked. loss of confidential information Malicious re-transmission of valid data may perturb the system or transmission of erroneous or manipulated data and commands. In the worst case, false alarm and emergency situation may be triggered in inappropriate time. Criminal activities could also be covered using such attacks, which lead to inability of performing right reactions when needed to prevent or stop crimes

Possible damage to safety and security related functions. Railway operator's reputation can be affected, financial loss.

S-F-O-

Malicious actions

Identity theft

An attacker can steal authentication information for CCTV system users or administrators in order to have more Privileged capacities to control the system.

The attacker may take control of the system. Loss of visibility of parts or all the system. Manipulation recorded/ displayed data or even data analysis Criminal actions occurring in the train can not be detected and/or analyzed, thus their consequences cannot be prevented

Possible damage to safety and security related functions. Railway operator's reputation can be affected, financial loss.

S-F-O-

Table II: Detailed threat analysis for OOS CCTV

  Figure : SuC functional domains based model [ ] • TCMS domain includes both safety related and nonsafety related TCMS functions. The functions of this domain, which are mandatory to ensure safe train movement and carrying the payload, are : main control, train radio, air conditioning, propulsion, brakes, electricity, lavatories, lighting, supporting systems, passenger announcement system, external doors and internal doors, European Train Control System (ETCS), Automatic Train Protection (ATP), On-board Driving Data Recording System (ODDRS), passenger alarm system and Closed-circuit television (CCTV) for rear view purposes. • Operator Oriented Services (OOS) are auxiliary services for proper train operation. Funtions of OOS domain are: priority logic, CCTV for video surveillance purposes, infotainment in train embedded devices, mobile phone amplifiers, automatic passenger counting,vehicle positioning, fare management or ticketing, driver assistance system, Eschedule, diagnostics and Condition Based Maintenance (CBM) systems and Passenger Information System (PIS) (including automatic • Customer Oriented Services (COS) include the functions executed by passenger devices such as: access for the passenger's devices (e.g. Wi-Fi access points), Access to the public internet and passenger info-portal. This three-level modelling, presented in Figure , aims to increase flexibility, scalability, and adaptability of the system for future evolutions.To accomplish all functionalities mentioned above, system actors and devices need to exchange data and commands using communication networks in different communication schemes such as intra-train, train-to-train and trainto-ground communications. Communication networks for future railway systems are expected to be heterogeneous composed of a mixture of several networks and radio access technologies that can be simultaneously accessed by different system actors and devices in order to improve the capacity of communications. For instance, New Dependable Rolling Stock for a more Sustainable, Intelligent and Comfortable Rail Transport in Europe (Roll Rail) proposes the use of an heterogeneous network architecture combining wireless technologies, such cellular network like LTE, IEEE . , RFID and wired networks where the advantages and specificities of each access network can be taken into consideration [ ]. For safety and security purposes, access between different domains will

[

  ] R R-WP . . Specification of Wireless TCMS. Technical report, ROLL RAIL, . [ ] R R-WP . . WLAN in WTCN Discussion Paper. Technical report, ROLL RAIL, . [ ] R R-WP . . Architecture for the Train and Consist Wireless Networks. Technical report, ROLL RAIL, . [ ] R R-WP . . Infotainment and CCTV. Technical report, ROLL RAIL, . [ ] C. Lévy-Bencheton and E. Darra. Cyber security and resilience of intelligent public transport: Good practices and recommendations. Technical report, European Union Agency for Network and Information Security (ENISA), . [ ] ENISA threat taxonomy: A tool for structuring threat information. Technical report, ENISA, . [ ] Cyber security and resilience of smart cars : Good practices and recommendations. Technical report, ENISA, . [ ] CERT Insider Threat Team. Unintentional insider threats: A foundational study. Software Engineering Institute Technical Report, .

  erroneous use or administration of devices and systemsThe propulsion could stop working and the train cannot move until the problem is fixed.

Table I :

 I Detailed threat analysis for Propulsion control system

		I.A.
		System effect
	Closed-circuit television (CCTV): surveillance system	Direct effect
	Asset:
		Description
	[ ] M. Ahmed, L. Sharif, M. Kabir, and M. Al-Maimani.	.
		Human errors in information security. Int. Journal of	[ ] R R-WP . . Cyber Threat Scenarios for Rail Vehicle IT
		Advanced Trends in Computer Science and Engineering,	Systems. Technical report, ROLL RAIL,	.
		( ),	.
	[ ] J. P. Farwell and R. Rohozinski. Stuxnet and the future of cyber war. Survival, ( ): -, . [ ] G. McDonald, L. O Murchu, S. Doherty, and E. Chien. Stuxnet . : The missing link. Technical report, Syman-tec, . [ ] J. Vazquez M. Boer. Cyber security and financial stability: How cyber-attacks could materially impact the global Class Threat
		financial system. Technical report, Institute of int. finance,

Acknowledgment

This works was supported by the European H Roll Rail project. The authors gratefully acknowledge the support provided by this institution.