Source-linked AI summary
Towards Illusions Awareness in Cyber-Physical System's Design
Anna Di Placido, Nicolas Ferry, Julien Deantoni
TL;DR
CPS design models depend on assumptions that may fail in open runtime contexts, leaving no unified methodology to exploit such invalidations as design knowledge. The paper conceptualizes these cases as design illusions and proposes a pipeline to identify, classify, characterize, and leverage them. Its Crazyflie example shows how localization error can undermine a modeled safety distance and how execution evidence can inform model revision.
Problem
Open runtime conditions can invalidate design assumptions and create discrepancies between expected and observed behaviour, while no unified methodology exploits these invalidations as design knowledge.
Source: §1 · p. 1Method
Results
In the Crazyflie example, A2 was violated: localization reported 210 mm from the wall when the actual distance was 190 mm against a 200 mm safety target.
Source: §2 · p. 2Takeaways & Limitations
Execution evidence can be used to refine assumptions and models, including by representing localization uncertainty and adjusting the safety margin.
Source: §2 · p. 2, §3.2.4 · p. 4Formalizing design illusions and integrating them into engineering processes remain future work.
Source: §5 · p. 5
Abstract
from arXiv · showhide
Cyber-Physical Systems (CPS) operate through a continuous sense-compute-act loop within an open context environment, making it impossible to anticipate all the situations the system will face. To cope with this openness, stakeholders rely on assumptions, formalized into design models. However, these assumptions may no longer hold once the system is confronted with runtime reality, resulting in a discrepancy between expected and observed behaviour known in literature as the reality gap. Existing approaches mainly focus on reducing or overcoming it by making simulations more faithful to reality, with no unified methodology to structure and exploit invalidated assumptions that give rise to this gap as reusable design knowledge. We refer to the persistent reliance on invalidated assumptions -and the resulting false confidence in the design model's operational validity -as design illusions, and argue that they need to be made explicit, structured, and exploited as knowledge to support better design decisions. We propose a conceptual pipeline for illusions-awareness that identifies, classifies, characterizes, and leverages illusions to transform them into actionable design knowledge.
1 Introduction
CPS design relies on assumptions and models to reason about an open, evolving context that cannot be fully anticipated. When runtime conditions invalidate those assumptions, the reality gap emerges; the paper frames this reliance as design illusions and proposes a pipeline for turning them into design knowledge.
1 Introduction
- CPS stakeholders use abstractions, approximations, and design assumptions to model expected system behaviour, although open contexts prevent anticipating every condition and interaction.Simulation and digital-twin approaches assess behaviour under controlled, reproducible conditions.Source: §1 · p. 1
- Runtime data may invalidate assumptions validated in simulation, creating discrepancies between expected and observed behaviour known as the reality gap.The gap can arise from heterogeneous sources, including hardware limits, environmental unpredictability, temporal delays, and modelling approximations.Source: §1 · p. 1
- The paper calls persistent reliance on invalidated assumptions, with resulting false confidence in model validity, design illusions; no unified methodology exploits them as design knowledge.Existing approaches mainly seek to reduce discrepancies by making simulations more faithful to reality.Source: §1 · p. 1
- The paper proposes an illusions-awareness pipeline to identify, classify, characterize, and leverage illusions, making them actionable for explaining discrepancies and informing design models.Its stated goal is to derive knowledge from illusion analysis that can be incorporated into design models.Source: §1 · p. 1
2 Motivation example
The Crazyflie wall-following example shows how operational conditions can undermine assumptions embedded in software and simulation models. Execution evidence identifies inaccurate localization as the observed cause of a safety-distance violation and illustrates how traces can inform model revisions.
2 Motivation example
- A Crazyflie nano drone is intended to follow apartment walls and avoid obstacles, with development assumptions covering sensing, localization accuracy, and obstacle-triggered avoidance.The three assumptions require early wall detection, sufficiently accurate wall-relative position estimates, and an avoidance maneuver for every detected obstacle.Source: §2 · p. 2
- The drone repeatedly collided with the wall despite no observed implementation faults, contrary to the expected mission behaviour encoded in its assumptions.Potential explanations include late wall detection, localization error, or obstacle detection failing to trigger avoidance.Source: §2 · p. 2
- With a 200 mm safety-distance target, localization reported 210 mm while the actual distance was 190 mm, so the controller continued toward the wall.The observed violation was A2: the controller used estimated rather than actual distance.Source: §2 · p. 2
- Execution traces show collisions when estimated and actual distances diverge significantly, supporting revision of A2 to model localization uncertainty and adjust the safety margin.One suggested update is to use an uncertainty interval and maintain a larger estimated distance as localization error increases.Source: §2 · p. 2
- Longer missions may reveal higher-than-anticipated battery consumption from avoidance maneuvers, requiring revision of the original energy model.The examples illustrate how execution information can help developers update models and assumptions.Source: §2 · p. 2
3 Managing design illusions
The section defines design illusions within a sequence of behaviour representations and discrepancies from planning through runtime. It proposes a pipeline that identifies, classifies, characterizes, and leverages illusions as reusable design knowledge.
3.1 Problem definition
- The model distinguishes stakeholders’ assumed behaviour, formal Expected Behaviour, Expected Behaviour under illusions, and observed behaviour across planning, design, and runtime.Observed Behaviour provides the ground truth against which expected behaviour is compared.Source: §3.1 · pp. 2–3
- Formalization can diverge from assumed behaviour, invalid assumptions create design illusions, and comparing executed behaviour with expectations yields a potentially accumulating Reality Gap.The Reality Gap can have neutral, positive, or negative effects and may grow as illusions accumulate or new ones emerge.Source: §3.1 · pp. 2–3
3.2 Toward an illusions-awareness pipeline
- Because design illusions cannot be entirely avoided, the proposed pipeline aims to identify and understand them, then exploit their knowledge to refine models and inform design decisions.It is presented as a conceptual pipeline for turning illusions into reusable, informative knowledge.Source: §3.2 · p. 3
3.2.1 Identify.
- Design monitoring extracts explicit and implicit assumptions from models, code, and parameters, while runtime monitoring examines execution data for deviations from expected behaviour.Runtime observations depend on the probes deployed; testing and experimentation are needed to establish assumption validity and identify illusions.Source: §3.2.1 · pp. 3–4
3.2.2 Classify.
- Illusions can be classified by whether assumptions are explicit or implicit and by the system architecture component they concern, such as perception, computation, or actuation.Source: §3.2.2 · p. 4
3.2.3 Characterize.
- Characterization records an assumption’s origin, validity conditions, confidence, and impact, including possible corrective responses when it proves false.Validity can depend on operational context, while confidence reflects the reasoning and evidence behind an assumption as well as sensor and historical-data quality.Source: §3.2.3 · p. 4
3.2.4 Leverage.
- Illusion knowledge can inform autonomous model updates or designer feedback to revise assumptions, models, and specifications, and may accumulate into a knowledge base of illusion patterns.Source: §3.2.4 · pp. 4–5
4 Related work
Related work addresses assumption validation, discrepancies between requirements and implementation, sim-to-real transfer, and digital-twin context mismatch. The section distinguishes this paper’s focus on reusing invalidated assumptions as design knowledge from approaches centered on validation, discrepancy reduction, or recalibration.
5 Conclusion
The conclusion presents design illusions as invalid assumptions that expose limitations in designers’ representations of reality, rather than implementation errors. It proposes a pipeline for turning them into reusable knowledge, while leaving formalization and engineering-process integration to future work.
- Design illusions describe cases where a system behaves according to its design despite underlying assumptions failing in the encountered context, revealing limits in the designer’s representation of reality.Source: §5 · p. 5
- The proposed pipeline identifies, classifies, characterizes, and leverages illusions as reusable knowledge that combines runtime and design monitoring with assumption characterization and feedback.The intended use is to turn unexpected behaviours into insights for future design decisions.Source: §5 · p. 5
- Formalization and integration into engineering processes remain future work, including automated assumption extraction and monitoring, validity metrics, and ways to leverage knowledge autonomously or through designers.Source: §5 · p. 5