Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Faculty of Mathematics, Natural Sciences and Computer Science Institute of Computer Science COMPUTER SCIENCE REPORTS Report 04/12 May 2012 A CYCLIC PROCESS MODEL FOR MONITORING MOBILE CYBER-PHYSICAL SYSTEMS TINO NOACK INGO SCHMITT Computer Science Reports Brandenburg University of Technology Cottbus ISSN: 1437-7969 Send requests to: BTU Cottbus Institut für Informatik Postfach 10 13 44 D-03013 Cottbus Tino Noack, Ingo Schmitt [email protected], [email protected], http://dbis.informatik.tu-cottbus.de A Cyclic Process Model for Monitoring Mobile Cyber-Physical Systems Computer Science Reports 04/12 May 2012 Brandenburg University of Technology Cottbus Faculty of Mathematics, Natural Sciences and Computer Science Institute of Computer Science Computer Science Reports Brandenburg University of Technology Cottbus Institute of Computer Science Head of Institute: Prof. Dr. Hartmut König BTU Cottbus Institut für Informatik Postfach 10 13 44 D-03013 Cottbus Research Groups: Computer Engineering Computer Network and Communication Systems Data Structures and Software Dependability Database and Information Systems Programming Languages and Compiler Construction Software and Systems Engineering Theoretical Computer Science Graphics Systems Systems Distributed Systems and Operating Systems Internet-Technology CR Subject Classification (1998): H.2.8, H.1 Printing and Binding: BTU Cottbus ISSN: 1437-7969 [email protected] Headed by: Prof. Dr. H. Th. Vierhaus Prof. Dr. H. König Prof. Dr. M. Heiner Prof. Dr. I. Schmitt Prof. Dr. P. Hofstedt Prof. Dr. C. Lewerentz Prof. Dr. K. Meer Prof. Dr. D. Cunningham Prof. Dr. R. Kraemer Prof. Dr. J. Nolte Prof. Dr. G. Wagner A Cyclic Process Model for Monitoring Mobile Cyber-Physical Systems Tino Noack Ingo Schmitt Institute of Computer Science TU Cottbus Institute of Computer Science TU Cottbus [email protected] [email protected] ABSTRACT behaviour continuously. The monitoring process requires knowledge about the CPS, the physical environment and the system behaviour. Such knowledge needs to be discovered continuously because of continuous changes like wear and tear. We distinguish between abrupt and long-term change in system behaviour. Abrupt change of system behaviour must be immediately followed by an appropriate action. For example, it is impossible to exclude abrupt changes such like crashes. Conditions of the physical environment can also induce long-term change and wearout effects. Longterm wearout effects can cause abrupt change in system behaviour. Monitoring long-term wear and tear is a prerequisite to forecast respectively to predict such abrupt change in system behaviour. Hence, monitoring mobile CPSs is essential and necessary to ensure reliability and to avoid damage. Basic approaches of mobile cyber-physical systems (CPS) such like cars, trains, aeroplanes or spaceships are parts of our daily life. Mobile CPSs are embedded into a physical environment which is usually harsh and uncertain. Monitoring mobile CPSs is essential to ensure reliability and to avoid damage. Monitoring mobile CPSs presupposes knowledge about the CPS, the physical environment and the system behaviour. Such knowledge needs to be discovered continuously because of continuous changes like wear and tear. Our contribution is the definition of an abstract process cycle for monitoring mobile CPSs. We call this abstract process cycle the Knowledge Discovery Cycle (KDC). Our KDC is based on common characteristics of mobile CPSs and key challenges for monitoring mobile CPSs. We particularly discuss common characteristics and key challenges by means of the German Inter City Express and the International Space Station. Based on this, we examine five overall considerations for monitoring mobile CPSs. Further on, we identify processing steps for our KDC and we associate existing concepts and technologies with the identified processing steps. This involves knowledge discovery in databases, knowledge discovery from data streams and complex event processing. Monitoring mobile CPSs is very challenging. Key challenges are (i.) data processing, (ii.) continuity and (iii.) autonomy. Data processing is a key challenge, because it is indispensable for monitoring mobile CPSs to process transient as well as persistent data. Continuity is a key challenge, because the monitoring process presupposes knowledge about the CPS, the physical environment and the system behaviour. Environmental conditions and the system behaviour are changing over time. Hence, it is necessary to gain knowledge continuously. Autonomy is a key challenge, because the monitoring solution must be able to act autonomously in case of the interruption of the external network connection. Categories and Subject Descriptors H.2.8 [DATABASE MANAGEMENT]: Database Applications—Data mining; H.1 [MODELS AND PRINCIPLES]: Miscellaneous 1. Our contribution is the motivation, introduction and definition of a Knowledge Discovery Cycle (KDC). Our KDC is an abstract process cycle for monitoring mobile CPSs. We motivate, introduce and define our KDC with special emphasis on the mentioned key challenges for monitoring mobile CPSs. (i.) The KDC reflects dynamic streams of data and events as well as static and historical data and events. (ii.) The KDC is an active, dynamic, cyclic and continuous process. For that reason, it is possible to gain knowledge about the CPS, the physical environment as well as the system behaviour over time. (iii.) We subdivide our KDC into two subcycles. This involves an online subcycle and an offline subcycle. The online subcycle is an automatic and autonomic process. The offline subcycle is a semiautomatic process which needs to be supported by human experts. INTRODUCTION Basic approaches of cyber-physical systems (CPS) [38, 39] are widely disseminated in application domains such like manufacturing, home entertainment, power grids, healthcare, transportation or aerospace. In this paper we focus on mobile CPSs. Examples are cars, trains such like the German Inter City Express (ICE), submarines, aeroplanes or spaceships such like the International Space Station (ISS). Mobile CPSs are embedded into a physical environment and they are location-independent. Mobile CPSs consist of embedded devices. A mobile CPS interacts with the physical environment by means of sensors and actuators. Furthermore, an external network connects the mobile CPS with external information systems. The changing system behaviour is one of the main facets for monitoring mobile CPSs. The physical environment is usually harsh and uncertain. Conditions of the physical environment such like heat or humidity influence the system The motivation, introduction and definition of our KDC also considers the characteristics of mobile CPSs. Monitoring mobile CPSs is very interdisciplinary because of complex 1 characteristics of today’s mobile CPSs. We identify processing steps for our KDC and we associate the identified processing steps with existing concepts and technologies. The usage of existing concepts and technologies can help to improve the adaptability and reusability of the monitoring process. Moreover, the usage of existing concepts and technologies can also help to decrease production and implementation costs for future monitoring applications. In particular, we use existing concepts and technologies from knowledge discovery in databases (KDD) [24, 21, 36, 43], knowledge discovery from data streams (KDDS) [29, 27] and complex event processing (CEP) [41, 20]. provide query languages such like the continuous query language (CQL) [3] or the stream query algebra (SQuAl) [1] for data stream processing. Data stream processing induced new storage strategies such like stream warehouses [30, 32]. Data stream mining [26, 61, 7] concepts are considered as well. Data stream mining is the application of data mining respectively machine learning algorithms directly onto data streams. Several data stream mining frameworks such like MOA [6], VEDAS [35] and SMM [59] were developed. All these concepts can be grouped together under the term knowledge discovery from data streams (KDDS) [29, 27]. In recent times, data stream processing is reconsidered under a certain perspective. This certain perspective is intended by the extension of stream query languages by means of pattern definitions and action parts. This endeavour is already known from active data bases as the event condition action (ECA) paradigm [15, 50]. The combination of the ECA paradigm and data stream processing is called complex event processing (CEP) [41, 20, 18]. CEP is the deduction of complex events from fundamental or underlying events in a data stream context. Standards for CEP and reaction rules are discussed in [49]. A variety of academic and commercial CEP engines such like SASE [65], Cayuga [14] or Esper [19] were already developed. CEP induced new storage strategies such like event data warehouses [54]. The rest of the paper is organized into two main parts. The first main part addresses the motivation for monitoring mobile CPSs. In Section 2, we discuss related work. This discussion encompasses literature about CPSs, existing concepts, system monitoring and available applications. In Section 3, we introduce an abstract architecture of mobile CPSs. Additionally, we investigate common characteristics of mobile CPSs. In Section 4, we provide a discussion of characteristics of mobile CPSs by means of two real world scenarios. The first real world scenario is related to the German ICE. Whereas, the second real world scenario is related to the ISS Columbus module. A closer look on key challenges for monitoring mobile CPSs is provided in Section 5. In Section 6, we examine five overall considerations for monitoring mobile CPSs. The second main part addresses our KDC. In Section 7, we define the acronym KDC in detail. This detailed definition is based on the common characteristics of mobile CPSs, the overall considerations and the key challenges for monitoring mobile CPSs. Further on, we identify processing steps for our KDC in Section 8. In Section 9, we assign existing concepts and technologies to the identified processing steps. Finally, we conclude our work in Section 10. While concluding our work, we also consider challenges for future work. 2. Amongst others, the term embedded system is explained in [51, 44], real-time systems are described in [37] and more information about embedded software is located in [64]. A particular view on CPSs is given in [38, 39, 55, 52]. Real-time system monitoring is considered in [60] and an abstract viewpoint on real-time stream processing is given in [57]. Based on this abstract viewpoint, eight requirements for real-time stream processing are delineated. None of the listed references suggest the combination of data stream processing, KDD, KDDS and CEP for monitoring mobile CPSs in a cyclic manner as we purpose. RELATED WORK However, several approaches exist which refer specialized application domains. One of such approaches is Odysseus [9]. Odysseus is a data stream management framework. It is intended to combine and integrate different techniques for data stream processing and CEP. A second approach is VEDAS [35]. VEDAS is a mobile and distributed data stream mining system for real-time vehicle monitoring. A third approach is mentioned in [42]. This third approach describes an architecture for queries over streaming sensor data. A fourth approach is presented in [40], which reflects real-time storm detection and weather forecasting by means of data mining and event processing. A fifth approach is mentioned in [56]. This fifth approach is related to the application of CEP in real-time situations. A sixth approach is mentioned in [62], which is related to mining large distributed log data in near real-time. A seventh approach is called Mini-ME [11]. Mini-ME is a rule-based fault monitoring system for space craft monitoring. It also considers real-time fault diagnoses. Another approach is called Pharos [23]. Pharos is a testbed for validation and evaluation of mobile CPSs. However, the mentioned approaches consider complex characteristics of mobile CPSs and key challenges for monitoring mobile CPSs more or less insufficiently. The related work is structured as follows. We discuss basic approaches of KDD, KDDS and CEP first. Further on, we list literature which refers embedded systems, CPSs and real-time system monitoring respectively real-time stream processing. At least, we discuss related applications which refers directly to our KDC. As we assume, knowledge discovery in data bases (KDD) [24, 21, 36, 43] should be a basement for system monitoring. KDD is the process of identifying valid, novel and potentially useful patterns in data. KDD involves storage techniques such like data bases (DB) [12] and data warehouses (DWH) [34]. Data mining [16, 58, 8, 63] is the core of KDD. We assume that data stream processing should be a prerequisite to provide real-time monitoring. CPSs are equipped with a wide range of sensors. These sensors produce a variety of continuous sequences of data items. These continuous sequences can be construed as sensor data streams. Data streams are mostly produced in real-time and they are potentially infinitive [5, 4, 31, 2, 28, 32]. Based on the definition of data streams, a variety of academic data stream management systems (DSMS) such like STREAM [4] or Aurora [10] were developed. In most cases, DSMSs 2 3. MOBILE CYBER-PHYSICAL SYSTEMS puting resources. But external information systems are not always available. As stated in [39], the acronym CPS is motivated by the term cybernetics. The term cybernetics was coined over a half century ago and it describes the conjunction of physical processes, computation and communication. The acronym CPS is a redefinition of the term cybernetic system. It is inspired to bring the term cybernetic system into a context of today’s technologies. This includes digital computing, software intensive computation and massive use of networks. On that score, we define the acronym CPS as a cybernetic system for monitoring and controlling physical processes by means of digital computing, software intensive computation and massive use of networks. 3. Real-Time Constraints: Mobile CPSs are subject to real-time constraints. Stimuli respectively abrupt changes such like crashes can occur in real-time. Hence, the computation and the resulting actions must also be performed in real-time to ensure reliability and to avoid damage. 4. External Network: Due to the mobility of mobile CPSs, the external network connection is uncertain and subject to bandwidth limitations. Thus, the external network of mobile CPSs is a temporal connection and it is not always available. We distinguish between stationary CPSs and mobile CPSs. Stationary CPSs are strongly tied to a specific location. Examples are power grids, manufacturing plants or research facilities like the Large Hadron Collider. Mobile CPS are location-independent. Examples are cars, trains such like the German ICE, aeroplanes or spaceships such like the ISS. 4. The first real world scenario is related to the disastrous railway accident of ICE 884 in Eschede (Germany). The particular focus of the first real world scenario is on the physical environment, resulting wareout effects and the occurrence of abrupt change in system behaviour and real-time events. Figure 1 sketches an abstract architecture of a mobile CPS. A mobile CPS is embedded into a physical environment and it consists of embedded devices such like embedded systems (hardware). Embedded devices consist of electronic assemblies which are connected by an internal network. A mobile CPS interacts with the physical environment via sensors and actuators. The embedded devices and the internal network are usually used for monitoring and controlling of physical processes. Software is an integral and substantial part of a mobile CPS. An external network connects a mobile CPS with external information systems. External information systems are usually stationary parts of a mobile CPS. The second real world scenario is related to the ISS Columbus module. The particular focus of the second real world scenario is on the current implementation of the failure management of the ISS Columbus module. 4.1 Mobile Cyber-Physical System Embedded Device Electronic Assembly Electronic Assembly External Network Internal Network Electronic Assembly Sensors External Information Information Information Systems Systems Systems Electronic Assembly Sensors Railway Accident of ICE 884 in Eschede The root cause of the disastrous railway accident of ICE 884 in Eschede was the fracture of a rubber-sprung railway wheel tyre [53, 22]. The wheel tyre fracture arose because of long-term physical reactions (e.g. reduction of the wheel tyre thickness, deformations or corrosion). The particular analysis of the fracture plane pointed out that long-term wearout effects led to a crack in the wheel tyre. The fracture was the root cause for the derailment of the ICE. The described example outlines long-term wear and tear caused by the physical environment as well as the occurrence of abrupt changes and real-time events. In the following, we discuss the mentioned characteristics of mobile CPSs. Physical Environment Embedded Device REAL WORLD SCENARIOS In this section, we discuss the mentioned characteristics of mobile CPSs by means of two real world scenarios. 1. Physical Environment: The physical environment is usually harsh and uncertain. Weather conditions such like frost, heat or humidity can change within a short time. They also differ enormously within seasons and geographical locations. Fast train journeys, continual friction and corrosion induce long-term wear and tear of system components. The wheel tyre fracture is a real-time stimuli respectively a realtime event which arose because of long-term wear and tear. Actuators Actuators Figure 1: Mobile Cyber-Physical System Following, we identify four characteristics of a mobile CPS. 2. Restricted Computing Resources: The existing computing resources of ICEs are limited. For that reason, it is impossible to analyze complex interrelations of environmental and physical conditions, embedded devices and the system behaviour on the ICE directly. For that reason, continual maintenance is used to compensate resource restrictions. 1. Physical Environment: The physical environment is usually harsh and uncertain. Environmental conditions of mobile CPSs can change within seconds. Conditions of the physical environment can also induce long-term wearout. 2. Restricted Computing Resources: Mobile CPSs are subject to restricted computing resources such like processor speed or memory and power consumption. External information systems can be used to compensate restricted com- 3. Real-Time Constraints: The fracture of the wheel tyre and the derailment occurred in a very short time period. The fracture and the derailment must have triggered 3 a significant and measurable change of the normal driving performance. This significant change should be detected immediately. Furthermore, the detection should be suddenly followed by an appropriate action such like deceleration. 3. Engineering Support Centre: The engineering support centre is another ground instance. It is used for root cause analysis and to plan long-term corrective actions. It works semiautomatically as the ground control. Human experts work offline and they use data analysis tools. Furthermore, they use data and information which is available from persistent storage and the ground control. 4. External Network: Especially in rural areas, a permanent external network connection cannot be guaranteed. 4.2 4. Assembly, Integration and Test Facility: The assembly, integration and test facility is also a ground instance and it works semiautomatically. It is used for engineering tests, for troubleshooting and for validation tests. Troubleshooting of on-board issues and the validation of updated or new failure detection methods is very important. The assembly, integration and test facility uses data and information which is available from persistent storage and the ground control. ISS Columbus Failure Management In this section, we provide a closer look on the current implementation of the ISS Columbus failure management. The ISS Columbus failure management was previously described in [45, 46]. As depicted in Figure 2, it is distributed over different instances. Each instance is responsible for specific functions, capabilities and constraints. We distinguish between on-board instances and ground instances. The ISS Columbus module is a mobile CPS and it contains on-board instances. On-board instances are embedded devices and they are connected by an internal network. Onboard instances should work automatically and in real-time. But on-board instances suffer from resource restrictions. 5. Mission Archive: The mission archive is another ground instance. It is a persistent storage of all measurements and data which was transmitted from the ISS Columbus module to the ground control. Furthermore, it contains annotations and additional information. Ground instances are stationary parts of the mobile CPS and they are external information systems. Ground instances are applied semiautomatically and without real-time constraints. They can be used for long-term analysis. But ground instances suffer from bandwidth limitations and the availability of the wireless network. On-Board Instances 1. ISS Columbus Automatic Real-Time Ground Instances Wireless External Network Semiautomatic Long-Term 1. ISS Columbus: The ISS Columbus module is a mobile CPS which is embedded into the physical environment respectively the space. The ISS Columbus module comprises a set of on-board instances respectively embedded devices such like scientific laboratories or an air loop as life-support system. For example, the on-board failure management system is applied for monitoring the air loop. The on-board failure management system is responsible for crew health and it works automatically. Automatic detection of time critical failures is necessary. But existing on-board instances are subject to resource restrictions. The ISS Columbus module consists of a variety of sensors. The on-board failure management acquires approximately 3000 analogue and digital measurements per second. These measurements can be construed as data streams. But because of resource restrictions, only a small proportion (about 233) of these measurements can be adequately monitored on-board and in real-time. All measurements are sent to the ground control when the wireless network is available. But they cannot be sent directly in case of a loss of signal (LOS). Hence, they must be stored temporally on-board. 4. Assembly, Integration and Test Facility 2. Ground Control 5. Mission Archive 3. Engineering Support Centre Figure 2: ISS Columbus Failure Management Following, we discuss the characteristics of mobile CPSs. 1. Physical Environment: The physical environment respectively the space differs totally from terrestrial conditions. This includes zero gravity, atmospheric pressure and the existence of the earth’s magnetic field. The life support system of the ISS Columbus module is intended to be at service 24/7. Hence, wear and tear is an existing and overall problem. For example, the air loop is part of the life support system. The air loop consists of ventilation assemblies. As described in [45, 48], bearing wareout led to a functional loss of an existing ventilation assembly. 2. Ground Control: The ground control is one of the ground instances and it works semiautomatically. Hence, human experts are needed for manual failure detection and recovery. As the on-board failure management system, the ground control is responsible for crew health. Not all onboard measurements are available at the ground control because of the external network and its bandwidth limitations. Delays can occur from time to time due to LOS. On that score, on-board acquired measurements arrive at the ground control not in real-time. The ground control transmits the acquired data to other ground instances. 2. Restricted Computing Resources: The existing computing resources of the ISS Columbus module are limited. On that score, only a small proportion of approximately 233 from 3000 measurements can be adequately monitored onboard and in real-time. 4 Real-Time Long-Term Local Time Known Knowledge Unknown Global Locality Overall Considerations Sharpness Crisp Non-Crisp System Resources Restricted Unrestricted Figure 3: Overall Considerations [47] 6. 3. Real-Time Constraints: Unforeseeable situations such like crashes or losses of on-board instances can occur at any time. Such situations should be immediately followed by an appropriate action to ensure reliability and to avoid damage. OVERALL CONSIDERATIONS According to the presented real world scenarios and the abstract architecture of mobile CPSs, we identify five overall considerations for monitoring mobile CPSs. This includes time, locality, knowledge, system resources and sharpness. We subdivide each consideration into two facts. Figure 3 summarizes the mentioned considerations and facts. 4. External Network: The downlink suffers from bandwidth limitations and it is continuously interrupted. In this section, we provide a closer look on the mentioned key challenges for monitoring mobile CPSs. Key challenges for monitoring mobile CPSs are data processing, continuity and autonomy. One of the main facets of monitoring mobile CPSs is the continuously changing system behaviour. Conditions of the physical environment influence the system behaviour continuously. Monitoring of the system behaviour presupposes knowledge about the CPS, its physical environment and the continuously changing system behaviour. Time: This consideration refers to the temporal changing of the target system behaviour. We distinguish between abrupt change and long-term change in system behaviour. Abrupt change is also called concept shift in the research area of change detection. Long-term change is also called concept drift [7]. Abrupt changes such like collision or crashes can occur unforeseeable and at any time. It is needed to detect such abrupt changes in real-time. In order to detect longterm influencing factors and changes such like wear and tear, long-term analysis is required. 1. Data Processing: Monitoring mobile CPSs requires processing of transient as well as persistent data. Sensors produce continuously transient data. These sensor data can be construed as data streams. It is necessary to process data streams automatically and in real-time. For long-term analysis, it is needed to store these transient data into persistent data repositories. Long-term analysis is important to discover complex interrelations of system components and for knowledge extraction. Long-term analysis is usually a semiautomatic process and it is needed to be supported and fostered by human experts. Locality: This consideration refers to interrelation effects of influencing factors and the spatial location of monitoring. We distinguish between local monitoring and global monitoring. Failures that relate on few system components should be detected by means of local monitoring and analysis. For example, local monitoring can be applied by means of intelligent sensors. Complex interrelations and influencing factors between the physical environment and the system components exists due to complex characteristics of mobile CPSs. Hence, it is needed to gather and to detect such complex interrelations by the use of global analysis. 2. Continuity: Monitoring mobile CPSs requires knowledge about the CPS, its physical environment and the system behaviour. Conditions of the physical environment as well as the system behaviour changes over time. For that reason, monitoring CPSs must be a continuous process. It is necessary to gain more and more knowledge over time. Such knowledge can be used for detection of long-term changes, for the detection of abrupt changes and for prediction. Knowledge: This consideration refers to the available information about the CPS, the physical environment and the system behaviour. We distinguish between known and unknown facts. Known facts refer to the existence of knowledge and information about the CPS, the physical environment and the system behaviour. It is necessary to employ available knowledge and information as comprehensively as possible. Because of unknown and unforeseeable conditions a dynamic, flexible and adaptable monitoring process is needed. This monitoring process should be able to gain continuously knowledge about the CPS, the physical environment and the system behaviour to decrease unawareness over time. 5. KEY CHALLENGES 3. Autonomy: The monitoring facility on the CPS must be able to act automatically and autonomously in case of a interruption of the external network. 5 System Resources: This consideration refers to all available resources for monitoring, data processing and analysis. We distinguish between unrestricted and restricted system resources. A CPS is subject to resource restrictions. External information systems can be used to compensate resource restrictions. Online monitoring refers to automatic real-time monitoring and should be applied on the CPS directly. Offline monitoring refers to semiautomatic long-term analysis and should be applied by means of external information systems. In particular long-term analysis requires extremely many system resources. For that reason, a combination of online and offline monitoring is needed to provide enough system resources for the intended monitoring approach. discovery. The offline subcycle is described by means of a separate and continuous cycle, because it is necessary to evaluate new derived knowledge by the use of preexisting knowledge and available persistent data. At certain times, a synchronization of both subcycles is necessary. For example, this synchronization can be used for data, knowledge and events transfer. For a complete round trip of the KDC, two synchronizations are needed. Real-Time Monitoring Online Sharpness: This consideration refers to the interpretation respectively the processing of conditions. We distinguish between crisp and non-crisp processing. System states must be detected exactly and reliably by the use of binary processing (Boolean logic). For example, if a threshold value is reached. Crisp processing is inadequate for particular problems. Hence, it is necessary to generalize binary processing by means of affiliation degrees between 0 and 1. The value 1 implies full affiliation and the value 0 implies the opposite. 7. Offline Long-Term Analysis KNOWLEDGE DISCOVERY CYCLE The KDD process is often described by means of a linear model. But because of the continuously changing conditions of the physical environment and the system behaviour, monitoring mobile CPSs is a continuous process. Knowledge about the CPS, the physical environment and the system behaviour must be discovered continuously over time. On that score, we extend the linear KDD process model by means of an abstract and cyclic process model. We call this cyclic process model a Knowledge Discovery Cycle (KDC). The definition of our KDC is based upon the presented real world scenarios, the mentioned key challenges and the explained overall considerations for monitoring mobile CPSs. The KDC is a cyclic, dynamic, abstract, data-, knowledgeand event-oriented arrangement of data processing and analysis concepts. This includes dynamic streams of data and events as well as static and historical data and events. The KDC is an abstract architectural model. As depicted in Figure 4, we distinguish between an online subcycle and an offline subcycle. Automatic real-time monitoring is applied on the online subcycle. Semiautomatic long-term analysis is applied on the offline subcycle. A complete cyclic pass through of the KDC is called a round trip hereinafter. Figure 4: The Knowledge Discovery Cycle Dynamic: Target system reconfigurations and unforeseeable changes of the system behaviour like crashes can occur at any time during runtime. On that score, our KDC is a dynamic and continuous process which reflects dynamic change in system behaviour as well as dynamic processing of data and event streams. Abstract: The KDC is an abstract model respectively an abstract infrastructure and we only use concepts for our KDC. On that score, the KDC is flexible, easily extensible and easily adaptable. Based upon this abstract model, the KDC can be used to associate existing concepts and techniques from KDD, KDDS and CEP. Data-oriented: A KDC requires different and adequate data storage strategies. On the one hand, it is required to process data streams which are transient respectively volatile data. On the other hand, this volatile data must be stored into non-volatile and persistent data repositories. Furthermore, adequate data access strategies are needed. In most cases, the online subcycle reflects streaming data and the offline subcycle reflects persistent data. At the first round trips of our KDC, only little persistent data exist. Over time, more and more persistent data are gathered. This continuously increasing amount of persistent data can be used for long-term analysis and for knowledge discovery. Cyclic: The KDC is a cyclic process which is intended to increase data as well as knowledge about the CPS, the physical environment and the system behaviour at each round trip. As depicted in Figure 4, we subdivide our KDC into two subcycles. Both subcycles are mostly decoupled, independent and asynchronous. This subdivision is based upon the assumption that the entire KDC is a semiautomatic process. The online subcycle reflects real-time monitoring, it is applied automatically and the support of human experts is not needed. The online subcycle is described by means of a separate and continuous cycle, because it is necessary to compare the current system behaviour with a small set of historical and previously identified system behaviour. The offline subcycle reflects long-term analysis, it is applied semiautomatically and human experts are needed to support knowledge Knowledge-oriented: One of the main intentions of the KDC is to discover, to harvest or to mine more and more knowledge about the CPS, its physical environment and the system behaviour during runtime. On that score, data repositories and data sources are used intensively. At the first round trips of our KDC, only little knowledge is avail6 able. Knowledge is mostly extracted and stored by the offline subcycle. It is intended to increase knowledge about the CPS, the physical environment and system behaviour over time. This implies round trips of the KDC and knowledge extraction during runtime. In most cases, the offline subcycle is used for knowledge discovery and knowledge mining. The online subcycle is mostly used to apply the previously discovered knowledge onto. For example, the application of knowledge onto the online subcycle can be implemented by means of rule sets. The applied knowledge is used for online and real-time monitoring. Whereas, only necessary knowledge is applied onto the online subcycle. Hence, the processing overhead for the existing system resources is minimized. However, the online subcycle can also be used for knowledge discovery. But the application of knowledge discovery directly onto the online subcycle increases the processing effort. On both subcycles, adequate knowledge repositories and knowledge storage strategies are needed. is related to automatic and online data processing. Hence, human experts are not needed. We can distinguish between three operational methods (i.) classification, (ii.) data stream mining and (iii.) hybrid online analysis. (i.) Classification refers to the application of previously extracted and available knowledge by means of, for example, rule sets. As depicted in Figure 5, this first operational method requires a repository for knowledge or rule sets. Furthermore, this operational method presupposes previous round trips of the offline subcycle respectively long-term analysis for knowledge extraction as well as rule sets generation and transfer to the online subcycle. (ii.) Data stream mining is the second operational method which reflects online knowledge extraction without any previously extracted knowledge and without any previous round trips of the offline subcycle respectively the long-term analysis. (iii.) Hybrid online analysis is the third operational method and it is a combination of classification and data stream mining. Event-oriented: Based upon the discovered knowledge, the KDC is intended to retract and detect events as well as complex events from data and event streams. On that score, adequate event storage techniques are necessary. Additionally, it could be useful to create event metrics. The main intention of the three mentioned operational methods is the description of the current system behaviour by means of fundamental events. This includes the identification of particular events and the generation of event streams. Based on these fundamental events, it is intended to deduce and to detect complex events (e.g. crashes). 8. PROCESSING STEPS 4. Actions: As depicted in Figure 5, the fourth processing step is directly related to the previous step and could be part of the online analysis. The deduction of fundamental and complex events necessitate the initiation of actions as known from the ECA paradigm. We distinguish between (i.) hardware actions and (ii.) software actions. (i.) Hardware actions effect hardware directly such like toggling of switches. (ii.) Software actions do not effect hardware. Amongst others, they can be used for messages sending, for alarm triggering or to provoke a storage strategy for data and events. Furthermore, software actions could also include the preparation of metrics and the initiation of data or event transfer from the online subcycle to the offline subcycle. We distinguish between four types of processing steps repository management, preprocessing, transfer and analysis as depicted in Figure 5. Repository management includes data streams and temporal as well as persistent storage techniques. Steps for repository management are depicted by means of cylinders. Preprocessing steps include data, knowledge or event preprocessing and they are depicted by means of hexagons. Transfer processing steps include the transfer of data, knowledge or events from one subcycle to another. Transfer processing steps are depicted by means of ellipses. Analysis includes stream analysis as well as analysis from persistent repositories. Analysis processing steps are depicted by means of squares. In the following, we identify twelve potential processing steps and we discuss each processing step in detail. 8.1 5. Temporal Storage: The fifth step includes the temporal storage on the online subcycle. This temporal storage is a window-based, preliminary and short-term storage. This includes storage of data items from data streams as well as the storage of events, complex events and metrics. We distinguish between two fundamental storage strategies (i.) complete storage and (ii.) incomplete storage. (i.) Complete storage assures that no data or events are getting lost and it refers to persistent respectively non-volatile data storage. Several application such like the ISS Columbus module presupposes complete storage. (ii.) Incomplete storage does not assure complete storage and it refers to transient respectively volatile data storage. On that score, data and event sketches respectively samples can be used. Furthermore, previously stored data can be overwritten or deleted if necessary. Because of restricted system resources, incomplete storage can be an adequate storage strategy. Online Processing Steps In this section, we discuss processing steps of the online subcycle respectively of the real-time monitoring process which are depicted in Figure 5. 1. Data and Event Streams: The first processing step is a repository. More precisely, this repository is a continuous data source. As depicted in Figure 5 data streams and event streams arrive continuously and asynchronously. 2. Preprocessing: This processing step includes the extraction of relevant data and event streams as well as the extraction of specific data items and events. Furthermore, this includes the transformation such like dimensionality reduction, noise reduction, scaling or time stamp standardization and correlation. This includes also the provision of the extracted and transformed data and events for the next processing step. The cyclic process model splits after the fifth processing step. This split points out that the online subcycle respectively the real-time monitoring process is asynchronous and decoupled from the offline subcycle respectively from longterm analysis. 3. Online Analysis: The third processing step is the core of the online subcycle respectively the real-time process. It 7 3. Online Analysis Hardware/ Software Actions 4. Actions 2. Preprocessing Real-Time Monitoring Online 1. Data and Event Streams 5. Temporal Storage 6. Data and Event Transfer 12. Knowledge Transfer 11. Knowledge Storage Offline Long-Term Analysis 7. Persistent Storage 8. Preprocessing Annotations 10. Validation External Data 9. Offline Analysis Figure 5: KDC Processing Steps 6. Data and Events Transfer: The sixth step is the last step of the online subcycle. It is used for synchronization and to transmit temporally stored data, events and metrics from the online subcycle into a persistent memory on the offline subcycle. The data transmission is optional and not performed at each pass through. It can be performed from time to time when the external network is available. 8.2 offline analysis. This evaluation step can be used by human experts to interpret the discovered and derived knowledge and to evaluate analysis results. 11. Knowledge Storage: After the evaluation step, new derived knowledge must be stored, combined and integrated with already existing knowledge. Furthermore, the annotation of the derived knowledge by means of human experts with additional information can be useful. We distinguish between two operational methods (i.) evolutionary method and (ii.) re-launch method. (i.) The evolutionary method is the most common operational method and it is an evolutionary process. The evolutionary process is used to increases knowledge about the CPS, the physical environment and the system behaviour over time. It can be used to obtain an overview of existing knowledge and information. Furthermore, already existing knowledge can be used to evaluate new derived knowledge. (ii.) The re-launch method starts from the scratch without any knowledge. This operational method is useful at the very first round trip of the KDC. Furthermore, it can be useful if the system behaviour differs totally from preexisting knowledge. After the re-launch method it is possible to switch back to the evolutionary method to gather new knowledge over time again. Offline Processing Steps In this section, we discuss processing steps of the offline subcycle respectively of the long-term analysis as depicted in Figure 5. 7. Persistent Memory: As the real-time monitoring process, the long-term analysis starts with a data source. The persistent storage is the basis for the long-term analysis. It includes necessary, compacted and integrated data items, events and metrics. As depicted in Figure 5, it is also possible to import data or events from external data sources. 8. Preprocessing: This processing step reflects the selection and transformation of relevant data and events as known from the linear KDD process model. This preprocessing is necessary for the following offline analysis step. The cyclic process model splits after the eleventh processing step. This split points out that the offline subcycle is asynchronous and decoupled from the online subcycle. 9. Offline Analysis: Offline analysis is the core of the offline subcycle respectively the long-term analysis as known from the linear KDD process model. The analysis step is used to discover and to derive knowledge by means of preprocessed data. As already mentioned, the offline subcycle works semiautomatically. Hence, the offline analysis needs to be supported and fostered by human experts. 12. Knowledge Transfer: The twelfth processing step is the last step of the offline subcycle and the KDC. It is used for synchronization and to transmit knowledge from the offline subcycle to the online subcycle. This step is a kind of reconfiguration and refinement of the real-time monitoring process respectively the online subcycle. Knowledge transfer 10. Evaluation: The tenth processing step is directly related to the previous processing step and could be part of the 8 can affect the following processing steps from the online subcycle: preprocessing (2.), online analysis (3.), actions (4.), temporal storage (5.) or data and event transfer (6.). concepts refer to the online subcycle respectively to the realtime monitoring process. The concepts assignment is summarized in Figure 6. 9. 9.1 CONCEPTS ASSIGNMENT Concepts for the Online Subcycle In this ection, we discuss concepts for the online subcycle respectively for the real-time monitoring process. Limit monitoring or limit checking is a very easy monitoring approach which uses thresholds [25, 45]. Such thresholds are mostly defined by means of one-dimensional functions. A limit monitoring approach generates a message if an attribute value reaches the previously defined threshold. Intelligent sensors are an example for the implementation of limit monitoring. Limit monitoring is an appropriate monitoring approach that can be easily applied over a variety of application domains. But limit monitoring ignores complex interrelations between system components. Hence, this basic limit monitoring is not always the best approach. I. Data Stream Management: Starting with the online subcycle, we group the first and the second processing steps together. This group is a fundamental setup for data stream management. Hence, we associate this group with data steam management concepts. II. Data Stream Analysis and CEP: We associate the third processing step with data stream analysis and CEP. As already mentioned, we assume that data stream analysis is an automatic process. For data stream analysis, we apply the previously derived rules sets by means of a CEP engine and its query language. The CEP engine is intended to derive complex events. Based on these derived complex events it is intended to trigger actions. Further on, it is also possible to apply automatic data stream mining algorithms. Model-based monitoring is applied by building a static and preliminary model of the target system which is intended to be monitored. For example, a static and preliminary model could be build by means of a prototype [17, 13, 33]. Model-based monitoring is necessary to provide initial or basic reliability for the target system. But building such static and preliminary system models is highly expensive and very time consuming. Model-based monitoring approaches suffer from the limited knowledge about the CPS, the physical environment and the system behaviour during the design and test phases. Moreover, model-based monitoring approaches suffer from the inflexibility of the resulting static and preliminary model. This includes no dynamic, no revision and no adjustment of the static preliminary model during runtime. III. Data and Event Stream Warehousing: We associate the fifth processing step with data and event stream warehousing. Data stream warehouses faces the same challenges as standard DWHs. Additionally, it is required to consider continuously arriving data streams. Event stream processing is also necessary. The data and event stream warehouse approach is subject to the resource restrictions of mobile CPSs. Moreover, the data and event stream warehouse approach should be able to provide different storage strategies such like complete and incomplete storage. Our KDC is not intended to surrogate neither limit monitoring nor model-based monitoring. Both monitoring approaches have their justifications and are necessary to provide initial or basic reliability for a CPS. The KDC is intended to be an additional monitoring approach, which combines and improves both approaches for monitoring mobile CPSs. Therefore, we use KDD to build a static and preliminary model first. This reflects model-based monitoring. The resulting static and preliminary model defines limits. This could be done by means of a prototype during design and test phases. Further on, we suggest to translate the static and preliminary model into rule sets. These rule sets represent the preliminary knowledge about the CPS, its physical environment and the system behaviour. These rule sets are applied onto the CPS for real-time monitoring by means of KDDS and CEP concepts. This reflects one-dimensional and high-dimensional limit monitoring. During runtime, we suggest to collect more and more data. These collected data are transmitted to the offline subcycle afterwards. The offline subcycle is used for knowledge discovery. Such knowledge can be used for revision, adjustment and refinement of the existing model. The refined model can be translated into rule sets again. These new rule sets can be used for the refinement of already existing rule sets on the CPS. Hence, the KDC is a dynamic and continuous process which considers revision, adjustment and refinement during runtime. IV. ETL: The sixth processing step initializes the offline subcycle. At this point, both subcycles are synchronized and the cyclic KDD process starts. It is a kind of an ETL process as already known from data warehousing. First, relevant data and events are selected and extracted from the temporal storage respectively the data and event warehouse. Second, the extracted data and events are transmitted to the persistent storage on the offline subcycle. Finally, the transmitted data and events are loaded into the persistent storage respectively a data warehouse. 9.2 Concepts for the Offline Subcycle In this section, we discuss concepts for the offline subcycle respectively of the long-term process. V. Data Warehousing: The data warehousing process starts with the already mentioned ETL process. The DWH contains integrated data, events and metrics. VI. Data Mining and Machine Learning: Data mining and machine learning is used to discover knowledge from data, events and metrics which are provided by the DWH. This concept assignment refers to preprocessing, offline analysis and evaluation. Data mining and machine learning as well as evaluation are supported by human experts. Based on KDD, KDDS and CEP concepts it is potentially possible to build a flexible, adaptable, dynamic and continuous monitoring process. KDD concepts refer to the offline subcycle respectively to long-term analysis. KDDS and CEP VII. Knowledge Repository: This concept assignment refers to knowledge storage. This includes the integration 9 II. Data Stream Analysis and CEP at a I. D m ea Str M en em ag n a t Ev en 3. Online Analysis 4. Actions KD DS 2. Preprocessing Real-Time Monitoring Online in g 5. Temporal Storage L IV. ET 6. Data and Events Transfer KDD 1. Data and Event Streams t S III. t re D a m ata W a nd ar eh ou s II. K no wl e 8. Preprocessing dg eR 10. Validation ep os it ng usi 7. Persistent Storage ata Wa reh o t emen Refin V 11. Knowledge Storage Offline Long-Term Analysis V. D VIII. 12. Knowledge Transfer 9. Offline Analysis or y VI. Data Mining and Machine Learning Figure 6: KDC with Associated Concepts of evaluated knowledge into a persistent repository. For example, the storage of the integrated knowledge can be done by the already existing DWH. Additionally, this concept assignment also includes the representation of knowledge by means of standard CEP vocabularies and semantic ontologies [49]. Moreover, this concept assign also refers to the annotation of the discovered knowledge by human experts. mentioned real world scenarios, our KDC can potentially help to predict similar crashes such like the disastrous railway accident of ICE 884 in Eschede. Moreover, it is potentially possible to strengthen the existing failure management of the ISS Columbus module. A first future challenge refers to CEP for monitoring mobile CPSs. A lightweight CEP engine is needed which reflects restricted system resources and real-time constraints. Moreover, such a CEP engine should provide data stream mining algorithms as well as crisp and non-crisp processing of conditions. A second future challenge is related to the temporal storage. A combined data and event stream warehouse is required which also considers the restricted system resources. A third future challenge refers to data and event transfer. An adequate ETL process is needed to synchronize the online subcycle with the offline subcycle. A fourth future challenge is related to knowledge storage. Adequate techniques are required for knowledge representation and annotations of human experts. Finally, another future challenge is related to knowledge transfer. Relevant knowledge must be translated into a specific query language. Moreover, the resulting queries must be transferred to the online subcycle in a proper way. This also includes the synchronization of the offline subcycle with the online subcycle. VIII. Refinement: The refinement refers to the translation of the derived knowledge into a specific query language. Furthermore, it reflects the transmission of the resulting queries to the online subcycle. 10. CONCLUSION Our contribution is the motivation, introduction and definition of a Knowledge Discovery Cycle (KDC). The KDC is an architectural model and an abstract process cycle for monitoring mobile CPSs. We subdivide the KDC into an online subcycle and an offline subcycle. Our KDC is a cyclic, dynamic, abstract, data-, knowledge- and event-oriented arrangement of data processing and analysis concepts. This includes dynamic streams of data and events as well as static and historical data and events. In particular, we associate our KDC with well known concepts from KDD, KDDS and CEP. Based on the usage of these well known existing concepts, it is potentially possible to provide a flexible, adaptable and continuous monitoring process. Our KDC is a monitoring approach which combines and improves limit monitoring and model-based monitoring. With respect to the 11. ACKNOWLEDGMENTS We wish to thank and acknowledge DLR, ESA and ASTRIUM Space Transportation for their insights and support, 10 with special thanks to Enrico Noack. We would also like to thank Adrian Giurca for preliminary reading. This work was supported by the Brandenburg Ministry of Science, Research and Culture as part of the International Graduate School at Brandenburg University of Technology. 12. [16] [17] REFERENCES [1] D. J. Abadi, D. Carney, U. Çetintemel, M. Cherniack, C. Convey, S. Lee, M. Stonebraker, N. Tatbul, and S. Zdonik. Aurora: A New Model and Architecture for Data Stream Management. The VLDB Journal, 12:120–139, 2003. [2] C. C. Aggarwal, editor. Data Streams: Models and Algorithms. Springer, 2007. [3] A. Arasu, S. Babu, and J. Widom. The CQL Continuous Query Language: Semantic Foundations and Query Execution. The VLDB Journal, 15:121–142, 2006. [4] B. Babcock, S. Babu, M. Datar, R. Motwani, and J. Widom. Models and Issues in Data Stream Systems. In PODS ’02: Proceedings of the twenty-first ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pages 1–16. ACM, 2002. [5] S. Babu and J. Widom. Continuous Queries over Data Streams. SIGMOD Record, 30(3):109–120, September 2001. [6] A. Bifet, G. Holmes, R. Kirkby, and B. Pfahringer. MOA: Massive Online Analysis. Journal of Machine Learning Research (JMLR), 11:1601–1604, 2010. [7] A. Bifet, G. Holmes, R. Kirkby, and B. Pfahringer. Data Stream Mining - A Practical Approach. Technical report, Centre for Open Software Innovation (COSI) - Waikato University, 2011. [8] C. M. Bishop. Pattern Recognition and Machine Learning. Springer, 2006. [9] A. Bolles. A flexible Framework for Multisensor Data Fusion using Data Stream Management Technologies. In Proceedings of the 2009 EDBT/ICDT Workshops, EDBT/ICDT ’09, pages 193–200. ACM, 2009. [10] D. Carney, U. Çetintemel, M. Cherniack, C. Convey, S. Lee, G. Seidman, M. Stonebraker, N. Tatbul, and S. Zdonik. Monitoring Streams: A New Class of Data Management Applications. In VLDB ’02: Proceedings of the 28th International Conference on Very Large Data Bases, pages 215–226. VLDB Endowment, 2002. [11] S. H. Chung, J. M. V. Eepoel, and B. C. Williams. Improving Model-based Mode Estimation through Offline Compilation. In In Proceedings of the 6th International Symposium on Artificial Intelligence and Robotics and Automation in Space, 2001. [12] E. F. Codd. Relational Database: A Practical Foundation for Productivity. Commun. ACM, 25(2):109–117, 1982. [13] J. de Kleer and B. C. Williams. Diagnosing with Behavioral Modes. In Proceedings of the 11th IJCAI, 1989. [14] A. Demers, J. Gehrke, M. Hong, M. Riedewald, and W. White. Towards Expressive Publish/Subscribe Systems. In In Proceedings of the 10th International Conference on Extending Database Technology (EDBT 2006), 2006. [15] K. R. Dittrich, S. Gatziu, and A. Geppert. The Active [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] 11 Database Management System Manifesto: A Rulebase of ADBMS Features. SIGMOD Rec., 25(3):40–49, 1996. R. O. Duda, P. E. Hart, and D. G. Stork. Pattern Classification. Wiley, 2001. D. Dvorak and B. Kuipers. Model-based Monitoring of Dynamic Systems. In Proceedings of the 11th international joint conference on Artificial intelligence - Volume 2, pages 1238–1243. Morgan Kaufmann Publishers Inc., 1989. M. Eckert and F. Bry. Aktuelles Schlagwort: Complex Event Processing (CEP). Informatik-Spektrum, 32:163–167, 2009. EsperTech. Esper, 2011. O. Etzion and P. Niblett. Event Processing in Action. Manning Publications Co., 2010. U. M. Fayyad, G. Piatetsky-Shapiro, and P. Smyth. From Data Mining to Knowledge Discovery in Databases. AI Magazine, 17(3):37–54, 1996. G. Fischer and V. Grubisic. Praxisrelevante Bewertung des Radbruchs vom ICE 884 in Eschede. Materialwissenschaft und Werkstofftechnik, 38(10):789–801, 2007. C.-L. Fok, A. Petz, D. Stovall, N. Paine, C. Julien, and S. Vishwanath. Pharos: A Testbed for Mobile Cyber-Physical Systems. Technical report, University of Texas at Austin, 2011. W. J. Frawley, G. Piatetsky-Shapiro, and C. J. Matheus. Knowledge Discovery in Databases: An Overview. AI Magazine, 13:57–70, 1992. R. Fujimaki, T. Yairi, and K. Machida. An Approach to Spacecraft Anomaly Detection Problem Using Kernel Feature Space. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining, KDD ’05, pages 401–410. ACM, 2005. M. M. Gaber, A. Zaslavsky, and S. Krishnaswamy. Mining Data Streams: A Review. SIGMOD Rec., 34(2):18–26, 2005. J. Gama. Knowledge Discovery from Data Streams. Chapman & Hall, 2010. J. Gama and M. M. Gaber, editors. Learning from Data Streams. Springer, 2007. J. Gama, R. Klinkenberg, and J. Aguilar, editors. The Fourth International Workshop on Knowledge Discovery from Data Streams, 2006. L. Golab and T. Johnson. Consistency in a Stream Warehouse. In CIDR, pages 114–122, 2011. L. Golab and M. T. Özsu. Issues in Data Stream Management. SIGMOD Rec., 32(2):5–14, 2003. L. Golab and M. T. Özsu. Data Stream Management. Morgan & Claypool Publishers, 2010. E. Horvitz and M. Barry. Display of Information for Time-Critical Decision Making. In Proceedings of the Eleventh Conference on Uncertainty in Artificial Intelligence, pages 296–305. Morgan Kaufmann Publishers Inc., 1995. W. H. Inmon. Building the Data Warehouse. John Wiley & Sons, Inc., 2002. H. Kargupta, R. Bhargava, K. Liu, M. Powers, P. Blair, S. Bushra, J. Dull, K. Sarkar, M. Klein, [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48] [49] [50] M. Vasa, and D. Handy. VEDAS: A Mobile and Distributed Data Stream Mining System for Real-Time Vehicle Monitoring. In Proceedings of the Fourth SIAM International Conference on Data Mining, 2004. W. Klösgen and J. M. Zytkow, editors. Handbook of Data Mining and Knowledge Discovery. Oxford University Press, Inc., 2002. H. Kopetz. Real-Time Systems: Design Principles for Distributed Embedded Applications. Kluwer Academic Publishers, 1997. E. A. Lee. Cyber Physical Systems: Design Challenges. In Proceedings of the 2008 11th IEEE Symposium on Object Oriented Real-Time Distributed Computing, pages 363–369. IEEE Computer Society, 2008. E. A. Lee and S. A. Seshia. Introduction to Embedded Systems: A Cyber-Physical Systems Approach. Published by authors, 2011. X. Li, B. Plale, N. Vijayakumar, R. Ramachandran, S. Graves, and H. Conover. Real-time Storm Detection and Weather Forecast Activation Through Data Mining and Events Processing. Earth Science Informatics, 1:49–57, 2008. D. Luckham. The Power of Events. Addison-Wesley Longman, 2002. S. Madden and M. J. Franklin. Fjording the Stream: An Architecture for Queries Over Streaming Sensor Data. In Proceedings of the 18th International Conference on Data Engineering. IEEE Computer Society, 2002. O. Maimon and L. Rokach, editors. Data Mining and Knowledge Discovery Handbook. Springer, 2nd edition, 2005. P. Marvedel. Embedded System Design. Springer, 2011. E. Noack, W. Belau, R. Wohlgemuth, R. Müller, S. Palumberi, P. Parodi, and F. Burzagli. Efficiency of the Columbus Failure Management System. In AIAA 40th International Conference on Environmental Systems, 2010. E. Noack, T. Noack, V. Patel, I. Schmitt, M. Richters, J. Stamminger, and S. Sievi. Failure Management for Cost-Effective and Efficient Spacecraft Operation. In Proceedings of the 2011 NASA/ESA Conference on Adaptive Hardware and Systems, AHS ’11. IEEE Computer Society, 2011. T. Noack. Real-Time Monitoring and Long-Term Analysis by Means of Embedded Systems. In Proceedings of the CAiSE Doctoral Consortium, 2011. G. Parzianello, M. Schmid, E. Roberts, and O. Duforet. Investigation of an Anomalous Failure of Bearing on a Fan within the Columbus Module of the ISS. In 14th European Space Mechanisms and Tribology Symposium (ESMATS), 2011. A. Paschke, P. Vincent, and F. Springer. Standards for Complex Event Processing and Reaction Rules. In F. Olken, M. Palmirani, and D. Sottara, editors, Rule - Based Modeling and Computing on the Semantic Web, volume 7018 of Lecture Notes in Computer Science, pages 128–139. Springer, 2011. N. W. Paton and O. Dı́az. Active Database Systems. ACM Comput. Surv., 31(1):63–103, 1999. [51] J. K. Peckol. Embedded Systems: A Contemporary Design Tool. John Wiley & Sons, 2007. [52] R. Rajkumar, I. Lee, L. Sha, and J. Stankovic. Cyber-Physical Systems: The Next Computing Revolution. In Proceedings of the 47th Design Automation Conference, DAC ’10, pages 731–736. ACM, 2010. [53] H. A. Richard, M. Fulland, M. Sander, and G. Kullmer. Fracture in a Rubber-Sprung Railway Wheel. Engineering Failure Analysis, 12(6):986 – 999, 2005. [54] H. Roth, J. Schiefer, H. Obweger, and S. Rozsnyai. Event Data Warehousing for Complex Event Processing. In RCIS, pages 203–212, 2010. [55] L. Sha, S. Gopalakrishnan, X. Liu, and Q. Wang. Cyber-Physical Systems: A New Frontier. In IEEE International Conference on Sensor Networks, Ubiquitous, and Trustworthy Computing (SUTC), pages 1–9, 2008. [56] N. Stojanovic and A. Artikis. On Complex Event Processing for Real-Time Situational Awareness. In N. Bassiliades, G. Governatori, and A. Paschke, editors, Rule-Based Reasoning, Programming, and Applications, volume 6826 of Lecture Notes in Computer Science, pages 114–121. Springer, 2011. [57] M. Stonebraker, U. Çetintemel, and S. Zdonik. The 8 requirements of real-time stream processing. SIGMOD Rec., 34(4):42–47, 2005. [58] P.-N. Tan, M. Steinbach, and V. Kumar. Introduction to Data Mining. Addison-Wesley, 2005. [59] H. Thakkar, N. Laptev, H. Mousavi, B. Mozafari, V. Russo, and C. Zaniolo. SMM: a Data Stream Management System for Knowledge Discovery. In Proceedings of the 2011 IEEE 27th International Conference on Data Engineering, pages 757–768. IEEE Computer Society, 2011. [60] J. J. P. Tsai and S. J. H. Yang. Monitoring and Debugging of Distributed Real-Time Systems. IEEE Computer Society Press, 1995. [61] H. Wang, P. S. Yu, and J. Han. Mining data streams. In O. Maimon and L. Rokach, editors, Data Mining and Knowledge Discovery Handbook, pages 777–792. Springer, 2005. [62] S. Weigert, M. Hiltunen, and C. Fetzer. Mining Large Distributed Log-Data in Near Real-Time. In Managing Large-Scale Systems via the Analysis of System Logs and the Application of Machine Learning Techniques (SLAML/SOSP), SLAML ’11, pages 5:1–5:8. ACM, 2011. [63] I. H. Witten, E. Frank, and M. A. Hall. Data Mining: Practical Machine Learning Tools and Techniques. Elsevier, 2011. [64] F. Wolf. Behavioral Intervals in Embedded Software: Timing and Power Analysis of Embedded Real-Time Software Processes. Kluwer Academic Publishers, 2002. [65] E. Wu, Y. Diao, and S. Rizvi. High-Performance Complex Event Processing over Streams. In Proceedings of the 2006 ACM SIGMOD international conference on Management of data, SIGMOD ’06, pages 407–418. ACM, 2006. 12