Cyber-Physical Systems of Systems

• Cyber-physical Systems of Systems (CPSoS) are integrated networks of independent CPSs that interact physically and computationally to achieve emergent functionality.
• CPSoS leverage multi-layer architectural models and distributed control methods, including MPC and ADMM, to optimize performance across diverse, large-scale infrastructures.
• Robust security frameworks, adaptive resilience strategies, and modular certification processes ensure reliable and safe operation in applications like automotive, energy grids, and industrial automation.

A Cyber-Physical System of Systems (CPSoS) is a composition of independently operated cyber-physical systems (CPSs) that interact through tightly coupled physical processes, computation, and communication to deliver emergent functionality unobtainable by any single constituent system. CPSoS exhibit heterogeneity, distributed control, scalable architecture, and complex interdependencies, and form the backbone of next-generation infrastructure, mobility, industrial, and energy platforms. Convergence of IT and OT, large-scale virtualization, AI-enhanced autonomy, and increased cyber-physical coupling drive both capability and risk, necessitating advanced engineering, control, and verification methods.

1. Structural and Architectural Models of CPSoS

Formally, a CPSoS is modeled as a graph $G = (V, E)$, where $V$ is the set of CPS components (sensors, controllers, actuators, servers, etc.), and $E \subseteq V \times V$ denotes the communication or functional-dependency links. Each component $v \in V$ participates in a subset of functions $F = \{f_1, ..., f_m\}$, captured by a mapping $\sigma: V \to 2^F$. Constituent systems are each composed of physical, IT (control, computation), and CT (communication) layers, joined by interfaces that enable robust, flexible integration (Vogel et al., 18 Nov 2025).

CPSoS architectures frequently adopt dual-layer or multi-layer abstractions. One approach introduces a Perception Layer for environment modeling (object detection, SLAM, localization, mapping) and a Behavioral Layer for distributed decision-making and human-in-the-loop control (Nousias et al., 2021). Adaptive resilience architectures embed an Adaptive Coordination Layer (ACL) for real-time risk detection and response, with an Adaptation & Learning Layer (AL) for strategic, data-driven policy evolution (Vogel et al., 21 Nov 2025).

Key distinguishing attributes:

• Scale: Dozens to thousands of subsystems potentially spanning large geographic extents (Vasan et al., 2022).
• Operational and Managerial Independence: Constituent CPSs retain autonomy, control, and life-cycles but contribute to higher-level objectives.
• Heterogeneity: Disparate physical processes, time scales, interface standards, and safety/criticality levels (indexed by performance capability $c_i$, criticality level $\kappa_i$, and goal vector $g_i$ per agent $i$) (Nousias et al., 2021).
• Emergent Functionality: Unpredicted system-level behaviors driven by local interactions and global coordination.

2. Control, Decision-Making, and Optimization in CPSoS

Decision-making in CPSoS is fundamentally distributed. The system-level objective function $F_{\text{system}}(x_1, ..., x_N)$ is optimized subject to constraints $x_i \in X_i(c_i, \kappa_i)$, where each local space encodes agent-specific state, operational bounds, and embedded control policies (Nousias et al., 2021).

For infrastructure CPSoS, the distributed optimal control problem is posed as: $$\min_{\{u_i(t)\}} J(x(0), u(\cdot)) = \sum_{t=0}^{T-1} \sum_{i=1}^N \ell_i (x_i(t), u_i(t)) + h(x(T))$$ subject to discrete-time subsystem dynamics: $$x_i(t+1) = f_i(x_i(t), u_i(t), w_i(t)),\quad g(x(t), u(t)) \leq 0$$ and local constraints $x_i(t) \in \mathcal{X}_i, u_i(t) \in \mathcal{U}_i$ (Vasan et al., 2022).

Distributed decomposition predominates. Dual decomposition introduces Lagrange multipliers for coupling constraints, with each agent minimizing local cost plus a global consensus penalty. ADMM is exploited when global constraints are affine, and consensus-based gradient or actor-critic methods leverage local information sharing across the SoS graph (Vasan et al., 2022). These enable plug-and-play composition, modular control law updates, and resilience to node failures.

In automotive and mobility CPSoS, Model Predictive Control (MPC) and Kalman Filter-based state estimation underpin cooperative adaptive cruise and platooning with sub-100 ms latency and lane-level accuracy (Bemani et al., 2020, Nousias et al., 2021). Large-scale energy and manufacturing CPSoS aggregate reinforcement learning and federated learning with traditional optimization to adapt to environment and demand fluctuations (Vogel et al., 21 Nov 2025).

3. Cyber-Resilience, Security, and Adaptive Recovery

Emergent interdependencies greatly extend the attack surface of CPSoS (Javed et al., 2019). The resilience model is cyclic, comprising:

• Anticipation: Forecasting disturbances via real-time monitoring.
• Error Analysis: Anomaly detection and root cause isolation.
• Adaptation: Integrating updated countermeasures prior to recovery to avoid recurrence.
• Recovery: Restoration to pre-disturbance operational state.
• Resistance: Maintenance and extension of the countermeasure pool (Vogel et al., 18 Nov 2025).

A partitioned security architecture can be constructed by dividing components into Intrusion Boundaries (IBs), each supporting a specific function. IBs are further subdivided into protection-zones by minimizing edge cuts and bounding cross-zone connectivity—thus constraining intra-CPSoS attack propagation. When a compromise is detected, automated response isolates an affected zone and traces dependencies, allowing fine-grained, function-level recovery (Javed et al., 2019).

Quantitative evaluations show that, in power grid CPSoS, such architectures can maintain availability $w \approx 84.5\%$ under sustained attack, with ≤20% damage extents even at high attack propagation speeds ($\theta < 1$), while unpartitioned systems suffer over 90% compromise (Javed et al., 2019). These findings underscore the necessity of architectural partitioning, rapid IDS→response→recovery pipelines, and resilience-driven fault containment.

The continuous resilience framework adds two automated layers: an operational ACL that scores risks and dynamically allocates countermeasures via multi-objective resource optimization, and an AL that closes the feedback loop by evaluating metrics (MTTR, residual aggregate risk, cost-effectiveness) and updating operational policies through learning mechanisms (rule-based, KPI-driven, supervised, or reinforcement learning) (Vogel et al., 21 Nov 2025). This process transforms resilience from a static property to an adaptive, ongoing system process.

4. Verification, Validation, and Compositional Certification

The verification and certification of CPSoS face unique scalability and completeness challenges due to their hybrid, asynchronous, and deeply interconnected control structures (Ledinot, 2021). Three major open problems are identified:

• Compositional Verification: The state-space explosion from spatial and temporal cycles necessitates modular, set-based, invariant proofs and assume/guarantee contract frameworks.
• Behavioral-Coverage Metrics: Unlike digital software, no accepted notion of full behavioral coverage exists for continuous or hybrid physical systems.
• Safety Assessment on High-Fidelity Models: Bridging high-level symbolic/fault models with simulation-equivalent fidelity remains unresolved.

Set-based/invariant design lifts pointwise safety to setwise proofs: for a system $x'(t) = f(x(t), u(t))$, an invariant $I$ satisfies $x(0) \in I \implies x(t) \in I$ ∀ $t$. Contracts $C = (A, G)$ specify that if input traces satisfy assumptions $A$, outputs must guarantee $G$. These allow CPSoS to retain modular certification paths under interconnection (Ledinot, 2021).

Adversarial and probabilistic testing is used to estimate boundary-crossing risk under rare and compounded scenarios. Residual risks are quantified using importance sampling, with probability estimates bounding the residual after formal verification—thus satisfying both deterministic and statistical certification requirements.

5. Governance, Autonomy, and Conflict Avoidance

Uncoordinated autonomy in CPSoS can induce unsafe or inefficient behaviors. A governance-based model introduces explicit rules and authorities aligned to the autonomy and awareness levels of constituent CPSs (Gharib et al., 2020).

Each CPS $c$ and activity $a$ is assigned an autonomy level via: $$\begin{aligned} \text{Autonomy}(c,a) = \mathrm{Full} & \iff \mathrm{AwareBySelf}(c,a) \land \mathrm{Controllable}(c,a) \ \text{Autonomy}(c,a) = \mathrm{Partial} & \iff \mathrm{AwareByDependency}(c,a) \land \mathrm{Controllable}(c,a) \ \text{Autonomy}(c,a) = \mathrm{Limited} & \iff \neg\mathrm{Controllable}(c,a) \end{aligned}$$ Governance rules map these levels to authority assignments (Monitoring, Warning, Controlling), which are then enforced by overseer CPSs or orchestration engines. This yields predictable, minimally intrusive conflict management, enables tailored human-in-the-loop workflows, and provides a path for scalable, rule-driven evolution as new CPSs are added (Gharib et al., 2020).

6. Use Cases, Experimental Prototypes, and Practical Implementations

CPSoS frameworks are deployed across energy grids, water and HVAC infrastructure, automotive fleets, and industrial automation.

Automotive CPSoS exploit perception–behavior architectures for lane-level localization, cooperative platooning, and emergent traffic management (Nousias et al., 2021). Energy grid CPSoS use partition-driven recovery and adaptive learning for load balancing and attack containment (Javed et al., 2019, Vogel et al., 21 Nov 2025). In research testbeds, cooperative multi-vehicle platforms have experimentally validated hybrid distributed/centralized control, state-observer robustness via Kalman Filters, and model-predictive controllers buffered against wireless communication imperfections, achieving cm-level localization and ms-level response for platooned vehicles (Bemani et al., 2020).

Continuous resilience models are now implemented by embedding both rule-based and machine-learned policy layers, with simulation-backed digital twins providing validation prior to deployment (Vogel et al., 21 Nov 2025). Practical guidance emphasizes the progressive rollout of advanced resilience and learning mechanisms, the retention of auditability for regulatory compliance, and modular architectural adjustments as system complexity increases.

7. Research Challenges and Future Directions

CPSoS research converges on methods to reconcile adaptivity, resilience, safety, and verifiability at extreme scale and heterogeneity. Open questions include:

• Scalable, modular verification that spans both digital and physical domains, possibly via digital twins and set-based methods (Ledinot, 2021).
• Integration of learning-based adaptation (including reinforcement and meta-learning) with formally certified core control layers (Vogel et al., 21 Nov 2025).
• Privacy-preserving and robust consensus algorithms for distributed optimization under adversarial environments (Vasan et al., 2022).
• Automated governance-driven conflict resolution and dynamic policy management for large-scale SoS with mixed human–machine teams (Gharib et al., 2020).
• Unified toolchains supporting design, simulation, and run-time adaptation—bridging model-based engineering, co-simulation, and fielded code (Nousias et al., 2021).

The evolving methodological foundation now encompasses compositional contracts, integrated set-based safety envelopes, adversarial/statistical risk quantification, and adaptive governance scaffolds. This multi-disciplinary approach is required to realize the continuous, assurance-driven evolution of future CPSoS.