The Separator, a Two-Phase Oil and Water Gravity CPS Separator Testbed
Michael Breza, Laksh Bhatia, Ivana Tomic, Anqi Fu, Waqas Ikram, Valentinos Kongezos, Julie A. McCann
TThe Separator, a Two-Phase Oil and Water GravityCPS Separator Testbed
Michael Breza ∗ , Laksh Bhatia ∗ , Ivana Tomi´c † , Anqi Fu ∗ , Waqas Ikram § , Valentinos Kongezos § ,Julie A. McCann ∗∗ Department of Computing, Imperial College London, UK † Department of Computing and Information Systems, University of Greenwich, London, UK § ABB, Oslo, NorwayEmail: [email protected], [email protected], [email protected],[email protected], [email protected], [email protected],[email protected]
Abstract —Industrial Control Systems (ICS) are evolving withadvances in new technology. The addition of wireless sensors andactuators and new control techniques means that engineeringpractices from communication systems are being integrated intothose used for control systems. The two are engineered invery different ways. Neither engineering approach is capableof accounting for the subtle interactions and interdependencethat occur when the two are combined. This paper describes ourfirst steps to bridge this gap, and push the boundaries of bothcomputer communication system and control system design. Wepresent The Separator testbed, a Cyber-Physical testbed enablingour search for a suitable way to engineer systems that combineboth computer networks and control systems.
Index Terms —Cyber-Physical Systems, Industrial Control Sys-tems, Wireless Communication Networks, Testbed
I. I
NTRODUCTION
Industrial Control Systems (ICS) are used in civil infras-tructure (water and gas distribution networks, power grids,transportation) and industrial applications (process plants,automotive industry). The automation of these systems isconstantly evolving with new technologies to increase theirefficiency, safety and reduce human management effort. Onearea currently changing ICS is the integration of wirelesscommunication systems. The inclusion of new technologiescreates new interactions between system components thatpreviously did not exist. This paper presents a new ICS testbedthat enables us to explore these new interactions.WirelessHART and ISA 100.11a [11] are wireless com-munication protocols used for ICS applications. They weredesigned for traditional sensing applications, standardised tobe used in industry and are used without any consideration forthe influences that the control application has on them, and theaffects that they have on the control application. For instance,if network interference slows down the data rate of the sensorsto the controller, the controller may not have the up-to-dateinformation that it needs to maintain system stability. On theother hand, if the controller is using a sampling scheme thatcan vary based on system state, then a disturbance to thesystem may cause the sensors to send data at a rate higherthan the network channel capacity. This notion of coupling between the control system, com-munication system and computation is the core idea of Cyber-Physical Systems (CPS). The aim of CPS is to developapproaches to engineer these coupled system components in away that ensures the entire system meets its design goals ofstability and safety.A common approach to study the interactions betweensystem components such as communication and control isthrough mathematical models and simulations. Control sys-tems are modelled analytically using differential equations,computer systems are modelled using simulations and dis-crete mathematical representations and these models do notcombine easily [5]. There exist simulation environments suchas Ptolemy II [12], but they use a high level of abstractionand need a special notion of time to integrate the continuousand discrete domains. The high level of abstraction obscuresrealistic effects like radio interference, temperature effects onthe physical phenomenon, etc. These effects are difficult tocategorise and hard to include in simulation, yet they mayhave a large impact when these systems are deployed in thewild.In this paper we present a CPS simulation testbed calledThe Separator. It overcomes the loss of accuracy due toabstraction associated with the use of simulations and models.The Separator allows us to reliably emulate the behaviour of areal system and accurately provide the physical characteristicsof sensors and actuators as well as the unpredictability ofwireless communication systems. It also gives us the abilityto perform repeatable experiments so that we can categoriseand understand the nature of CPS interactions present in thesystem.We collaborated with ABB to address the questions of thedesign, engineering and safety of a testbed suitable to explorethe CPS interactions in ICS. They are keenly aware of thechallenges, risks and issues associated with ICS engineering.Together, we developed the following testbed requirements.1) Have a real physical process that lends itself to controland has a well defined notion of stability and safety.2) Use industrial grade sensors and actuators for sensingand actuation of the physical process to approximate the a r X i v : . [ c s . OH ] F e b ehaviour on a real ICS. Domestic components can nothandle the demands of industrial applications, such aspressure for valves, current for wiring or to be operatedconstantly for long periods of time.3) Control the process with an industrial grade controllerthat has the same performance as one that would be usedon a production system.4) Use state-of-art wireless network connecting the sensorsto the controller to allow us to observe the performanceof the system with different radio environments.5) Build a system that can be used to address the issuesof communication and control co-design and capturethe subtle interactions between sensing, communication,control and computation.6) Design a safe system that can be used by students andresearchers in an academic environment.ABB addressed all of the diverse engineering challenges thatare associated with the development of a CPS testbed with areal physical process. Together we developed The Separator,a two phase, oil and water gravity separator with senorscommunicating using WirelessHART that uses industrial gradecomponents .In this paper we review previous approaches to the en-gineering of ICS systems, present the specifications of TheSeparator, show examples of the type of research that it iscapable of,briefly describe what we have learned so far fromits specification and building, and conclude with a descriptionof the research that we intend to pursue in the future.II. R
ELATED W ORK
CPS interactions can be studied with two methods. One is touse models and simulation tools and second by using tesbteds.We first discuss some of the CPS simulators and then describesome CPS testbeds. For a more in-depth discussion please referto [14].There are model based approaches that use computer sys-tems to create models of CPSs. Systems such as Ptolemy II[12] or GISOO [2] combine discrete state-based models ofcomputer systems with continuous models of physical systemsand their controllers. Modelling platforms do not use inputdata from real sensors and actuators that contain noise fromthe physical sensing process and radio environment. This kindof noise is difficult to correctly categorise and include insimulation, yet can have a profound impact on the systemwhen it is deployed in the wild.There are a number of CPS testbeds simulating smart gridsand water distribution networks. The Secure Water Treatment(SWaT) testbed [8] was designed to assess the security vul-nerabilities of water treatment plants. The Water DistrubitionTesbted (WADI) [1] is used for detecting cyber-attacks andphysical attacks. The INVITED [13] testbed is designed totest the timing behaviours of CPSs. In [9], the authors havecreated a SCADA testbed with a focus on security research.This testbed uses industrial grade sensors and controller butdoes not use industrial wireless protocols. In [3], the authorsuse various aperiodic control schemes with 802.15.4 to control a double-tank system. The above testbeds have been designedfor security research or timing analysis but none of themwere designed to study CPS interactions nor do they usestate-of-the-art communication protocols designed for controllike WirelessHART. Other testbeds [6] focus on systems withpendulums as the physical process. Although Pendulums arean accepted benchmark for the control theory community[4], our industrial partners suggested two-phase oil and waterseparation as a physical process that is more representative inthe process industry.The CPS testbed that is closest to our requirements is theWaterBox [7]. It was designed with domestic components, acontrollable process and used 802.11 wireless communicationat the time of publication. The small-scale domestic control-lable valves on the WaterBox can only handle a small totalline pressure, and adjust themselves from open to close in second. We wanted industrial grade controllable valves andsensors. The one used in our testbed is designed for higherline pressures, but requires seconds to adjust themselvesfrom fully open to fully closed. These minor differences arevery important to the fidelity of our testbed.In the next section we describe the physical and digitalarchitecture of The Separator.III. T HE S EPARATOR A RCHITECTURE
The Separator testbed is the result of the design require-ments given in Section I. A summary of the Separator physicalprocess is given next, followed by a more in-depth descriptionof the Separator’s design overview and the components and theway that each of our requirements has been met. Finally, wepresent the safety features of The Separator.
A. The Separator Physical Process
Control of liquid levels in tanks and flows between tanks arebasic problems in process industry [10]. And so, the physicalprocess that we use is oil and water gravity separation. It isused in the petroleum industry. When the petroleum mixtureis extracted, the oil is mixed with water and other impurities.This mixture is put into a tank where the water settles to thebottom, and the oil floats on top at the rate of separation. Theplacement of a simple barrier in the middle of the tank allowsone part of the tank to have only water at the bottom, and theother to have only oil. The water and oil can then be separatedand drained into individual tanks by putting automatic valvesat the bottom of the tank. The level of oil and water in theseparation tank can be kept constant by controlling the degreeto which the valves are open.The oil separation process lends itself to a clear definitionof stability. The oil and the water levels, in their respectivesections of the separation tank, are set by an operator. Thecontroller maintains the oil and water levels by setting theopening degree of the valves. The degree over or under theset point of the liquid levels is referred to as the overshoot, orundershoot. We can use the maximum size of the overshootabove the set point as the measure of system stability.ig. 1: The Separator Design OverviewThe notion of safety is defined in terms of the stability. Ifthe total liquid level in the tank with its overshoot are belowa certain level, we can say that the system is operating safely.If the total liquid level with its overshoot exceeds 80% ofthe total capacity of the tank, or if the water level exceedsits section and enters the oil section, we say that the systemis operating in an unsafe way. This clean distinction betweensafe and unsafe states is common to all ICS applications, andgives us a clear set of parameters to use for analysis.These notions will be made clear in the next section whenwe present the actual architecture of The Separator.
B. The Separator Design Overview
The design overview of The Separator is depicted in Fig-ure 1. The Separator consists of two individual layers:
Lower layer - A feed tank holding litres of ionised waterand liters of Exxsol D-60 oil. The tank has two feedvalves (V1 and V2), one for the water and one for the oil. Anelectrical impeller pump mixes and pumps the oil and waterto the upper layer.
Upper layer - A litre separation tank in which theseparation process occurs. The tank is fitted with wirelesssensors (P1, P2, P3 and T) and wired actuators (LV1 andLV2). The oil and water mixture is pumped into the separationtank by the pump mentioned above via inlet valve (V3). Theseparation tank is divided into two sections by a separationplate. The left section holds water and oil and is where gravityseparation occurs. The right section receives the overflow fromthe left section, and contains only oil. There are valves at thebottom of the separation tank, one in the left section whichonly drains water (LV1), and one in the right section for oil(LV2). The water and oil levels are regulated by the PIDcontroller which operates the valves. C. The Separator Components
The real Separator architecture is depicted in Figure 2. Indi-vidual components of the Separator testbed are: sensor nodes,actuator nodes, controller, wireless network and additionalsupporting components. These are described next.
Sensor Nodes - The Separator has four industrial grade Fig. 2: The Separator Testbed and its Components: a) Frontview, b) Operator Workplace, c) WirelessHART gateway, d)Sensor node, e) Electrical cupboard with controller, f) Actuatornodewireless sensors (depicted in Figure 2d) to measure the statesof physical process. These are: • Two ABB DP-Style 266DSH differential pressure sensors(P2 and P3 in Figure 1) that are used to measure oiland water levels. The sensor P2 measures the waterlevel in the left compartment of the tank based on thepressure difference between two liquids (oil and water)where water is at the bottom of the tank and oil on thetop. The sensor P3 measures the oil level in the rightcompartment of the tank based on the pressure differenceat the lowest (oil) and highest point (open-air) of the tank.The differential pressure values measured by P2 and P3are used as inputs for the PID controller. • An ABB 266HSH High overload Pressure sensor (P1 inFigure 1) that measures the absolute pressure in the feedline pipe. It is used as an input to the alarm system andthe controller stops the system if the pressure in the pipeexceeds a threshold. • An ABB TTF300-W WirelessHART Temperature sensor(T in Figure 1) that measures the temperature of the oilin the tank. It is used as an input for the alarm system.The system stops its operation when the temperature ofoil exceeds a threshold.The differential pressure sensors require calibration beforeach run and it remains stable once operation has begun.
Actuator Nodes - There are five Belimo NRQ24A-SR indus-trial grade valves in the system (depicted in Figure 2f). Thesevalves can go from fully open (100%) to fully closed (0%) in seconds. Two of these valves control the water and oil inputsto the system (V1 and V2 in Figure 1). The third valve controlsthe inlet level of the mixture into the tank (V3 in Figure 1).The other two valves are controlled by the PID controller toensure that the oil and water levels are at the set-points (LV1and LV2 in Figure 1). Industrial Grade Controller - The controller in Figure 2eis an ABB AC800M programmable automation with a CI867Modbus TCP interface card The CI867 enables a Modbus TCPconnection over Ethernet between the AC800M controller,the AWIN GW100 WirelessHART gateway and the ACS355motor drive. In the Separator we tune two basic PID controllersto control the water and oil levels in the left and rightcompartments. The system tunes the levels of the oil first andthen the levels of the water. The constant PID values are asfollows: for water P = 1 . , I = 80 and for oil P = 2 , I = 40 and D = 0 in both cases. Wireless Network - The wireless sensors communicateover WirelessHART protocol, an International ElectrotechnicalCommission (IEC) approved wireless communication protocolfor wireless sensor networks. It is based on the HighwayAddressable Remote Transducer (HART) protocol and uses802.15.4 in the 2.4GHz ISM band. It forms a resilient self-organising network. Sensors nodes can find neighbours, detectfailures, form communication routes and adjust these routesbased on sensor node failure. They form a mesh topologynetwork where each node can act as a router for its neigh-bours. Each node connects directly with a minimum of twoneighbours in order to provide this resiliency.WirelessHART organises the sensors so that they can trans-mit their readings to a central gateway, which forwards its dataover Ethernet to the controller. The WirelessHART gateway inthe Separator is the AWIN GW100 (depicted in Figure 2c).The gateway communicates using TCP via the CI867 ModbusTCP interface to the AC800M controller.
Supporting Components - There is an electrical cabinet onthe rear of the Separator that houses the ACS355 Drive, the24V DC power supply, the network switch and the Intel NUCPC (depicted in Figure 2e). It includes the distribution of the220V AC and 24V DC to the above equipment through fourcircuit breakers and a marshalling terminal for the IO signals.The Separator has a Human Machine Interface (HMI) asa part of the Operator Workplace (depicted in Figure 2b).It allows the user to see information regarding the physicalprocess, shows the state of the actuators and the measuredvalues from the sensors. The user can intervene to stop thepump if deemed necessary, or to open/close a valve and evenset the set-points at runtime.
D. Safe Operation for Users of the System
The last of our design requirements was that our CPStestbed be safe to use for research by students and researchers.To address this, The Separator was designed in compliancewith ABB’s process safety expertise. The Separator controllershuts down the system in the event that the water or oillevel reach 80%, to prevent an unsafe state. There is also anemergency switch under the separator tank which shuts thepump down when it is pressed.IV. E
XPERIMENTAL U SE C ASES OF T HE S EPARATOR
In this section we present potential experimental use casesof The Separator. These include both the aspects of processcontrol and system communication. We first present resultsshowing the stability of the control process under stableoperation. We then show how The Separator can adjust itselfand maintain system stability when the oil level set pointchanges. Finally, we show the robustness of the networkand the controller to local radio interference which causesslower communication. We evaluate CPS performance withfour metrics that are defined as follows: • Latency (in ms) - The average time required for adata packet to travel from the originating sensor to thecontroller. • Path stability (in %) - The ratio of acknowledged packetsto sent packets between two sensors or between a sensorand the gateway. • Overshoots (OvSh in %) - The percentage of the liquid(water or oil) above the set-point. This metric is importantfor ensuring safe behaviour of the system. • Undershoots (UnSh in %) - The percentage of the liquidbelow the set-point after the first overshoot. This metricindicates the minimum level of liquid in the tank oncethe set-point has been reached.The first two metrics describe the performance of the com-munication network, while the last two metrics describe theperformance of the control system.
A. Use Case 1: Stable Process Operation
We first evaluate the stable operation of the testbed. We tunethe PID controller and the inlet valves to create a baselineexperiment (as defined in Section ?? ). In this experiment,the goal of the system is to maintain the levels of oil andwater at the desired set-points of 60% and 40%, respectively.We run the experiment five times. The results for overshootsand undershoots in the left compartment (i.e. the water level)over four waves are shown in Table I. The results for latencyand path stability are shown in Table II. We also presentthe measured oil and water levels and actuator levels forthe left and right compartments in Figure 3. The resultsin Table I show that the water level overshoots are almostindistinguishable for the second, third and four peaks. Thesepeaks occur during stable operation. The first wave occursas the system is stabilising, and so has larger overshoots,but has small standard deviation between experiments. Theseexperiments show that The Separator can be used to performig. 3: Stable process operation: a) Oil and water levels, b)Actuators open levelsTABLE I: Stable process operation: Overshoots and Under-shoots for water levels over 5 runs Wave 1 Wave 2 Wave 3 Wave 4OvSh (%)
OvSh Std Dev(%)
UnSh (%)
UnSh Std Dev(%)
TABLE II: Stable process operation: Latency and Path stabilityover 5 runs
Run 1 Run 2 Run 3 Run 4 Run 5Latency (ms)
Path Stability (%) reproducible experiments, with a very small standard deviationbetween the mean values during system stability.
B. Use Case 2: Stable Operation with changing Oil Set-Pointat Run-Time
Use case 2 evaluates the capability of The Separator tomaintain a stable system when the set-point changes. Thisallows us to evaluate the performance of the network and thecontroller for an application with requirements that change atrun-time. We change the set-point for oil level from 60% to40% after three overshoot peaks. We run the experiment fivetimes and present the average overshoots, undershoots andthe standard deviation after the set-point has been changed.The results are presented in Table III. We also present theoil level and open-level of the actuators in Figure 4. The firstundershoot occurs as the system is stabilising itself, but itis still small, and the average of the results has a standarddeviation which is less than . %. The system stabilises afterthe change very quickly, and by the subsequent overshootsare very small, and self-similar between runs with a standarddeviation of less than %. These results show that TheSeparator can perform reproducible experiments with run-timeconfiguration changes. Fig. 4: Oil levels and Actuator open levels for the set-pointchangeTABLE III: Oil Errors, first one is undershoot other twoovershoots for the set-point change from 60% to 40% UnSh 1 OvSh 1 OvSh 2Error (%)
Error Std Dev(%)
TABLE IV: Disruption of WirelessHART protocol
Reliability (%) Stability (%) Latency (ms)t = 0 min
100 99.38 0.296 t = 7 min
100 88.26 0.452 t = 20 min
100 71.9 0.402
C. Use Case 3: Stable Operation in the Presence of RadioInterference
The Separator contains sensors that communicate to agateway via WirelessHART. This allows us to evaluate therobustness of the network and controller to adverse wirelesscommunication conditions cause by interference (potentiallyan attacker). To realise this, we used two USRP B210 softwaredefined radios to create white noise interference in the rangeof 802.15.4 channels 14, 15, 16, 23, 24, and 25. The affectsare shown in Table IV. We can see that the reliability, orpercentage of messages received, was 100% for the entiretrial. The link stability, or the number acknowledgements overthe number of messages, dropped due to the interference,and the packet delivery latency increased. The reliability ofWirelessHART is unsurprising, it is a robust, multi-channelprotocol that blacklists unreliable channels. Despite the robust-ness of WirelessHART, we can see that the link stability andnetwork performance were still affected by the interference.These results show that The Separator can also be usedto evaluate system robustness in the presence of adversecommunication conditions.V. L
IMITATIONS AND F UTURE R ESEARCH D IRECTIONS
Part of the research output of The Separator was theinvestigating what is needed for the research, design, andengineering of reliable, safe CPSs. We tread the line betweenfidelity, with the use of industrial grade sensors, flexibility,with less robust research equipment. Things that we wouldconsider differently would be:) Industrial grade wireless transceivers can not run differ-ent communication protocols or add more sensors. Forfuture iterations we would search for a flexible industriallevel sensor platform.2) The current differential pressure sensors require calibra-tion after every run/every time the tank is drained. In anindustrial setting, this calibration is not time-consuming.The processes run for a long time. In research, multipleexperiments are run. Sensors that need calibration everyrun add an overhead, and make it difficult to obtainrepeatable results. We would search for industrial gradesensors less reliant on initial calibration.Finally, if we had unlimited funds we would choose to builda larger-scale distributed system as many industrial systemsare distributed over a number of processes and over largedistances. This would also allow for the deployment andevaluation of long-range communication protocols like LoRa.A list of the future research opportunities with the currentgeneration of The Separator, along with other associateddirections, is presented below:
Co-design of Communication and Control Techniques -Explore different techniques to co-design systems that inte-grate communication and control. Examine the use of formaltechniques to model the protocol behaviour with the controllerto both ensure that the communication protocol maintainsthe properties required by the controller, and use run-timeverification to check these properties during system operation.
Alternative Controller Schemes - Compare of various mod-ern control schemes, such as event-triggered or self-triggered ,with currently used control schemes, such as time triggeredcontrol. Experiment with other, non-conventional control ap-proaches, such as the use of machine learning to learn ’blackbox controllers’.
Alternative Communication Schemes - Use wired commu-nication protocols like HART, Profibus, Fieldbus to commu-nicate with the sensors. Integrate different communicationtechnologies like WiFi, 802.15.4e and bluetooth low energyinto The Separator.
CPS Security Research - Assess potential vulnerabilities thatthe sensors and the communication may have to physicallayer attacks that aim to disrupt the sensor readings or thecommunication to the controller.
Teaching and Collaborations - Use The Separator for teach-ing. It is the perfect testbed illustrate several of the principlesof CPSs, gives students hands-on experience with a realcontrol system. The Separator will be available for collab-orative projects that allow the broader ICS community (bothacademia and industry) to contribute to our long-term goal oftransforming the ICS design process.VI. C
ONCLUSION
In this paper we presented The Separator, a CPS testbedwhose inception and creation are part of the search for ap-proaches and techniques for the engineering of safe and stableCPS systems. The Separator is a result of the need to better understand the confluence of computer software and hardwaresystems, wireless communication and physical control pro-cesses. Preliminary experimental results demonstrate its highreliability, its use in performing reproducible experiments, andits ability to aid our understanding of how unreliable wirelesscommunication and physical controllers can affect one another,and how to engineer this relationship to create stable and safeCPS. R
EFERENCES[1] C. M. Ahmed, V. R. Palleti, and A. P. Mathur. WADI: A WaterDistribution Testbed for Research in the Design of Secure CyberPhysical Systems. In
Proc. of the 3rd Int. Workshop on Cyber-PhysicalSys. for Smart Water Netw. , CySWATER ’17, pages 25–28. ACM, 2017.[2] B. Aminian, J. Ara´ujo, M. Johansson, and K. H. Johansson. GISOO:A virtual testbed for wireless cyber-physical systems. In
IECON 2013- 39th Annual Conference of the IEEE Industrial Electronics Society ,pages 5588–5593, 2013.[3] J. Ara`ujo, M. Mazo, A. Anta, P. Tabuada, and K. H. Johansson. Systemarchitectures, protocols and algorithms for aperiodic wireless controlsystems.
IEEE Trans. on Industrial Informatics , 10(1):175–184, 2014.[4] O. Boubaker. The inverted pendulum: A fundamental benchmark incontrol theory and robotics. In
International conference on educationand e-learning innovations , pages 1–6. IEEE, 2012.[5] P. Derler, E. A. Lee, and A. Sangiovanni Vincentelli. Modelingcyberphysical systems.
Proc. of the IEEE , 100(1):13–28, Jan 2012.[6] A. Hernandez, J. Faria, J. Araujo, P. Park, H. Sandberg, and K. H.Johansson. Inverted pendulum control over an ieee 802.15.4 wirelesssensor and actuator network. In
European Conf. on Wireless SensorNetw. (EWSN) , 2011.[7] S. Kartakis, E. Abraham, and J. A. McCann. Waterbox: A testbedfor monitoring and controlling smart water networks. In
Proc. of the1st ACM Int. Workshop on Cyber-Physical Sys. for Smart Water Netw. ,CySWater’15, pages 8:1–8:6. ACM, 2015.[8] A. P. Mathur and N. O. Tippenhauer. Swat: a water treatment testbed forresearch and training on ics security. In , pages 31–36.IEEE, 2016.[9] T. Morris, A. Srivastava, B. Reaves, W. Gao, K. Pavurapu, and R. Reddi.A control system testbed to validate critical infrastructure protectionconcepts.
Int. J. of Critical Infrastructure Protection , 4(2):88–103, 2011.[10] A. L. S. Nair, S. A. J. Mary, and J. A. Linsely. Modeling and controlof level control process a comparative study. In , pages 1–4, 2017.[11] S. Petersen and S. Carlsen. Wirelesshart versus isa100.11a: The formatwar hits the factory floor.
IEEE Industrial Electronics Magazine ,5(4):23–34, Dec 2011.[12] C. Ptolemaeus.
System design, modeling, and simulation: using PtolemyII , volume 1. Ptolemy. org Berkeley, 2014.[13] A. Shrivastava, M. Mehrabian, M. Khayatian, P. Derler, H. Andrade,K. Stanton, Y. S. Li-Baboud, E. Griffor, M. Weiss, and J. Eidson. Invited:A testbed to verify the timing behavior of cyber-physical systems. In , pages 1–6, 2017.[14] X. Zhou, X. Gou, T. Huang, and S. Yang. Review on testing of cyberphysical systems: Methods and testbeds.