What Is a Cyber-Physical System?
A cyber-physical system (CPS) is an integration of computation, networking, and physical processes. Embedded computers measure a physical process, decide what to do, and act on it, usually in a feedback loop where the physical process affects the computation and the computation affects the physical process.
A car's brake controller, an insulin pump, a power substation, and a robotic arm on an assembly line are all CPS. What they share is not a technology but a problem: the software is only correct if the physical outcome is correct, and the physical outcome depends on when the software acts, not just what it computes.
Origin of the term
The term was coined around 2006 by Helen Gill at the U.S. National Science Foundation. Its roots go back to Norbert Wiener's cybernetics, from the Greek word for helmsman: a system that steers itself using feedback.
Intersection, not union
CPS is not "computer science plus mechanical engineering." It studies what happens where their models meet: differential equations describe the plant, programs describe the controller, and neither model alone says anything about how they behave together.
Anatomy of a CPS
Almost every CPS can be decomposed into the same six building blocks. Learning to identify them is the first step in analyzing any system.
Physical plant
The part of the world being controlled: a vehicle, a chemical reactor, a grid segment, a patient. Its behavior evolves continuously in time and is usually modeled with differential equations.
Sensors
Convert physical quantities into numbers. They sample at discrete instants, quantize values, add noise, and introduce delay, so the computer never sees the plant exactly.
Computation platform
Microcontrollers, processors, FPGAs, or GPUs running control software, often on a real-time operating system. Execution time varies, and that variation matters.
Actuators
Convert numbers back into physical effects: motors, valves, relays, brakes. They saturate, have their own dynamics, and are where software mistakes become physical damage.
Network
Buses and networks (CAN, EtherCAT, TSN, wireless) connecting distributed components. They add latency, jitter, packet loss, and an attack surface.
Humans
Operators, drivers, clinicians, and bystanders who supervise, override, or are affected by the system. They are part of the loop whether the design admits it or not.
- Sense: a sensor samples the plant at time t.
- Communicate: the reading travels over a bus or network to a controller.
- Compute: software estimates state and chooses a control action.
- Actuate: the command reaches an actuator, which changes the plant.
- Evolve: the plant keeps moving the whole time; the next sample sees the result.
Every step takes time, and the plant does not wait. The interval between sensing and actuating, called the sensor-to-actuator latency, is a design parameter with direct physical consequences.
Key Concepts
These ideas recur throughout the rest of the series. Each one is a place where traditional computing assumptions break down.
Continuous and discrete dynamics
Physical processes change continuously (modeled with differential equations); software changes state in discrete jumps (modeled with state machines). A system mixing both is a hybrid system. Modeling them together is covered in System Design and Modeling.
Time is part of correctness
In ordinary software, a slower computer gives the same answer later. In a CPS, a late answer can be a wrong answer. Most programming languages have no way to express timing requirements, which pushes timing into the hardware and operating system. See Embedded Systems and Real-Time Operation.
Feedback and stability
Feedback lets a system correct for disturbances and model errors, but it can also make a system oscillate or diverge. Sampling and delay change stability, as the second example below shows. Control in industrial settings is covered in Control Systems and Industrial Applications.
Concurrency
The physical world is concurrent: every part of the plant evolves at once. Software must handle many sensors, tasks, and messages simultaneously. Threads and interrupts make behavior hard to predict; deterministic models of concurrency make it tractable.
Models are not the system
Claims like "the system is stable" or "the system is safe" are really claims about a model. They transfer to the real system only as far as the model is faithful. Much of CPS engineering is choosing models that are both analyzable and faithful enough. Proving properties of models is covered in Formal Methods for Verification and Validation.
Trustworthiness
NIST's CPS Framework groups safety, security, privacy, reliability, and resilience into one concern, because in a CPS they interact: a security breach can cause a safety failure, and a safety mechanism can be a denial-of-service vector. See Safety, Security, and Resilience.
Example: A Sampled Thermostat as a Hybrid System
A thermostat is the simplest complete CPS. The room temperature evolves continuously according to Newton's law of cooling. The controller is a two-state machine (heater on, heater off) with hysteresis: it switches on below the setpoint minus a band and off above the setpoint plus the band, which prevents rapid toggling.
The twist is that the controller only samples the temperature every ts seconds. Between samples the plant keeps evolving. The simulation below integrates the continuous dynamics with a small step dt and runs the discrete controller at the slower sampling period.
def simulate(t_end=3600.0, dt=0.1, ts=10.0, setpoint=21.0, band=0.5):
ambient, k, heat = 10.0, 0.0012, 0.03
temp, heater, t, next_sample = 15.0, False, 0.0, 0.0
log, switches = [], 0
while t < t_end:
if t >= next_sample:
reading = temp
if heater and reading >= setpoint + band:
heater, switches = False, switches + 1
elif not heater and reading <= setpoint - band:
heater, switches = True, switches + 1
next_sample += ts
dtemp = -k * (temp - ambient) + (heat if heater else 0.0)
temp += dtemp * dt
t += dt
log.append(temp)
settled = log[len(log) // 2:]
return switches, min(settled), max(settled)
for ts in (1.0, 10.0, 60.0):
n, lo, hi = simulate(ts=ts)
print(f'sample period {ts:5.1f} s switches {n:3d} range {lo:5.2f} to {hi:5.2f} C')
Output:
sample period 1.0 s switches 49 range 20.49 to 21.51 C
sample period 10.0 s switches 43 range 20.38 to 21.62 C
sample period 60.0 s switches 25 range 19.91 to 22.31 C
What to notice
- The designed band is 20.5 to 21.5 C. With fast sampling the system stays inside it; with 60 s sampling it overshoots on both sides, because the plant keeps moving between samples.
- The controller logic is identical in all three runs. Only the timing changed, and timing alone changed the physical outcome.
- Slower sampling means fewer switches (less actuator wear, less computation) but worse regulation. This is a typical CPS trade-off between computing resources and physical performance.
- The simulation itself is a model: forward Euler integration with step
dt. Its fidelity to a real room is an assumption, not a fact.
Example: When Delay Destabilizes Control
Consider an unstable plant dx/dt = a·x + b·u with a = 1, like an inverted pendulum near upright. A proportional controller u = -K·x with K = 2 stabilizes it in continuous time. On a computer, the controller samples every h seconds and holds its output constant between samples (zero-order hold), which turns the plant into a discrete-time system x[k+1] = a_d·x[k] + b_d·u[k].
If computation and communication take one full sample period, the control applied at step k was computed from x[k-1]. The code below compares the closed loop with and without that one-sample delay. The system is stable when the largest eigenvalue magnitude (spectral radius) is below 1.
import numpy as np
a, b, gain = 1.0, 1.0, 2.0
def closed_loop(h, delayed):
ad = np.exp(a * h)
bd = (ad - 1.0) / a * b
if delayed:
m = np.array([[ad, -bd * gain], [1.0, 0.0]])
else:
m = np.array([[ad - bd * gain]])
return max(abs(np.linalg.eigvals(m)))
for h in (0.05, 0.2, 0.5, 0.8, 1.0):
r0 = closed_loop(h, False)
r1 = closed_loop(h, True)
s0 = 'stable' if r0 < 1 else 'unstable'
s1 = 'stable' if r1 < 1 else 'unstable'
print(f'h={h:4.2f} no delay: {r0:5.3f} {s0:8s} one-sample delay: {r1:5.3f} {s1}')
Output:
h=0.05 no delay: 0.949 stable one-sample delay: 0.942 stable
h=0.20 no delay: 0.779 stable one-sample delay: 0.665 stable
h=0.50 no delay: 0.351 stable one-sample delay: 1.139 unstable
h=0.80 no delay: 0.226 stable one-sample delay: 1.566 unstable
h=1.00 no delay: 0.718 stable one-sample delay: 1.854 unstable
What to notice
- The same gain, the same plant, and the same control law are stable or unstable depending only on the sampling period and whether the result arrives one period late.
- A control engineer who assumes zero latency and a software engineer who assumes timing does not affect correctness can each be right about their own model and still ship an unstable system.
- This is why scheduling, worst-case execution time, and network latency are control-theoretic quantities in a CPS, not just performance metrics.
Application Domains
CPS appear wherever computers act on the physical world. A few domains dominate research and practice, and each has its own constraints.
Autonomous vehicles
Perception, planning, and control running on dozens of networked processors, with machine-learned components and human passengers.
Autonomous Vehicles and Smart TransportationIndustrial control
PLCs and SCADA systems running factories, pipelines, and water treatment, often for decades on legacy protocols never designed for hostile networks.
Control Systems and Industrial ApplicationsSmart grids
Generation, storage, and demand balanced in real time across a continent, with growing shares of variable renewables and distributed resources.
Smart Grids and Energy SystemsMedical devices
Pacemakers, infusion pumps, and closed-loop insulin delivery, where the plant is a human body and certification is strict.
Safety in Cyber-Physical SystemsAerospace
Fly-by-wire flight control and avionics, historically the most rigorous CPS discipline, with formal methods and redundancy built into certification.
Formal Methods for Verification and ValidationRobotics and manufacturing
Collaborative robots, cyber-physical production systems, and digital twins that mirror machines on the factory floor.
Human-Machine InteractionCross-Cutting Challenges
| Challenge | Why it is hard | Explored in |
|---|---|---|
| Timing predictability | Caches, pipelines, multicore interference, and networks make execution time vary; programming languages cannot express deadlines | Embedded and Real-Time |
| Heterogeneous modeling | Plant, software, and network models use incompatible mathematics and tools | Design and Modeling |
| Safety assurance | Failures have physical consequences; exhaustive testing is impossible for continuous state spaces | Safety, Formal Methods |
| Security | Attacks can manipulate sensors or actuators to cause physical harm; long-lived legacy devices cannot be patched easily | Security |
| Uncertainty and failure | Sensors fail, environments change, and components degrade over decades of service | Resilience and Robustness |
| Learning-enabled components | Neural networks in perception and control resist traditional verification | Future Trends |
| People and society | Automation shifts responsibility, creates new failure modes in human oversight, and raises questions of accountability | Human-Machine Interaction, Ethics and Society |
The Series
Primary Reference
Introduction to Embedded Systems: A Cyber-Physical Systems Approach
Edward A. Lee and Sanjit A. Seshia. Second Edition, MIT Press, 2017. ISBN 978-0-262-53381-2.
The standard text for CPS at the advanced undergraduate and graduate level, organized around modeling, design, and analysis. The authors make it freely available online.
Book website and free PDFChapters most relevant to each part of this series:
| Topic | Lee & Seshia chapters |
|---|---|
| Foundations (this page) | 1 Introduction; 2 Continuous Dynamics; 3 Discrete Dynamics; 4 Hybrid Systems |
| Embedded and real-time operation | 7 Sensors and Actuators; 8 Embedded Processors; 9 Memory Architectures; 10 Input and Output; 11 Multitasking; 12 Scheduling |
| Design and modeling | 5 Composition of State Machines; 6 Concurrent Models of Computation |
| Formal verification | 13 Invariants and Temporal Logic; 14 Equivalence and Refinement; 15 Reachability Analysis and Model Checking; 16 Quantitative Analysis |
| Security | 17 Security and Privacy |
Tutorials, Tools, and Interactive Learning
Python Control Systems Library
Open-source Python package for modeling, simulating, and analyzing feedback control systems: state space, transfer functions, stability, LQR, MPC, Kalman filters.
Documentation TutorialLingua Franca
A coordination language from UC Berkeley for deterministic, time-sensitive, concurrent programs, with reactor bodies written in Python, C, C++, TypeScript, or Rust. Includes a full embedded/CPS lab sequence paired with Lee & Seshia.
Home Handbook Embedded Systems LabsOpenModelica
Open-source environment for Modelica, an equation-based language for modeling multi-domain physical systems (mechanical, electrical, thermal, hydraulic). OMWebbook offers interactive, in-browser examples.
Home OMWebbook (interactive)CARLA Simulator
Open-source autonomous driving simulator with configurable sensor suites, traffic scenarios, a Python API, and ROS integration.
Home QuickstartGazebo
Robotics simulator for testing control strategies against physics models before deploying to hardware.
HomeNIST Framework for Cyber-Physical Systems
A domain-independent framework for analyzing CPS through facets (conceptualization, realization, assurance) and aspects (functional, timing, trustworthiness, data, and more).
SP 1500-201 NIST CPS program