What is a Cyber-Physical System (CPS)?
A Cyber-Physical System (CPS) is a system in which computation, networking and physical processes are integrated so tightly that software perceives the physical world through sensors and acts on it directly through actuators, in a closed feedback loop. The physical state influences the computation, and the computation influences the physical state. A production line, a wind turbine, a self-driving car and a smart electricity grid are all examples. CPS is a key concept in Industry 4.0 and the IIoT, and it is in effect the technical form that OT convergence takes.
🧠 Where does the term Cyber-Physical System come from?
The term was introduced in 2006 by Helen Gill, a programme manager at the US National Science Foundation (NSF). From late 2006 US federal agencies organised workshops on the subject, and the NSF has since funded a dedicated CPS research programme. The prefix cyber refers to Norbert Wiener’s cybernetics of 1948, the science of control and feedback, not to the internet or cybercrime.
Two definitions are widely quoted:
- Edward Lee (UC Berkeley) - CPS are integrations of computation, networking and physical processes, in which embedded computers monitor and control physical processes through feedback loops where the physical process affects the computation and vice versa.
- NIST - in the Framework for Cyber-Physical Systems (NIST SP 1500-201, June 2017, drafted by the CPS Public Working Group), CPS are interacting digital, analogue, physical and human components engineered for function through integrated physics and logic.
In Germany the concept became the foundation of Industrie 4.0. The final report of the German Industrie 4.0 working group (acatech, April 2013) describes smart factories in which machines, storage systems and products communicate with each other as CPS. In that context people also speak of cyber-physical production systems (CPPS).
🔄 What is the difference between CPS, embedded systems and IoT?
The terms overlap heavily, but each puts the emphasis somewhere else.
| Term | Emphasis | Typical example |
|---|---|---|
| Embedded system | The computer inside a device whose main purpose is not computing | Control electronics in a washing machine or variable frequency drive |
| IoT / IIoT | Connecting devices and collecting data | Vibration sensor sending readings to the cloud over MQTT |
| Cyber-Physical System | Closed interaction between computation and the physical process, including timing and safety | Robot cell that corrects its own movements based on sensor input |
| Digital Twin | Virtual model synchronised with data from the physical system | Simulation model of a pumping station for predictive maintenance |
The key difference: IoT is mainly about connectivity and data, whereas a CPS also acts on the physical world. A digital twin is often part of a CPS: the cyber part that models the physical part.
🧱 Which layers make up a CPS?
A typical industrial Cyber-Physical System consists of:
- Physical components - machines, motors, valves, conveyors and the product itself
- Sensors - measure temperature, pressure, position, vibration or images and deliver real-time information on the physical state
- Actuators - perform physical actions, such as driving a motor or opening a valve
- Embedded control - local control and logic in a PLC, motion controller or embedded controller
- Network connectivity - fieldbuses and Industrial Ethernet such as ProfiNET and EtherCAT, supplemented by TSN for deterministic traffic
- Integration and data - OPC UA and MQTT to move data to higher layers, for example through a Unified Namespace or edge computing
- Decision-making - supervision and optimisation through SCADA, MES or AI algorithms, on site or in the Cloud
A widely used mental model is the 5C architecture by Jay Lee and colleagues (2015), which builds a manufacturing CPS in five levels: connection (attaching sensors and measuring reliably), conversion (turning data into information such as health indicators), cyber (pooling information from many machines centrally), cognition (insight and decision support) and configuration (feedback from the cyber world to the machine so that it adapts itself).
⏱️ Why is timing so important in a CPS?
In an ordinary IT system a late calculation is merely slow; in a CPS a late calculation can be wrong. A robot arm that receives its stop command too late still hits the obstacle. That is why a CPS requires deterministic behaviour: not just the right answer, but the right answer within a fixed time. The NIST framework therefore lists timing as one of the nine aspects against which a CPS should be assessed, alongside functionality, data, human factors, lifecycle and trustworthiness, among others.
Typical time scales in an industrial CPS:
| Layer | Task | Typical response time |
|---|---|---|
| Motion control | Synchronising servos and axes | 100 µs to 1 ms (e.g. EtherCAT) |
| Machine control | PLC cycle, interlocks | 1 to 20 ms |
| Process control | Closed control loops for pressure, flow, temperature | 100 ms to a few seconds |
| Supervision | SCADA polling, alarms | 1 to 10 seconds |
| Production management | MES orders, quality analysis | minutes to hours |
This leads to an important design rule: the faster the loop, the closer to the process the logic must sit. Cloud AI can optimise setpoints or predict maintenance, but it does not sit in the fast control loop. That division matches the levels of the Purdue Model.
🏭 Where are CPS used?
| Sector | Example |
|---|---|
| Manufacturing (smart factory) | Self-regulating production lines with real-time quality control and collaborative robots |
| Transport | Autonomous vehicles, train protection and traffic management systems |
| Energy | Smart grids that balance demand, supply and solar inverters |
| Water | Pumping stations and treatment plants that adjust automatically to rainfall and levels |
| Building management | Automated HVAC and lighting systems with energy optimisation |
| Healthcare | Smart prosthetics, insulin pumps and medical monitoring equipment |
🔐 What safety and security risks do CPS have?
Because they tightly integrate IT and OT, CPS have a particular risk profile: a digital fault or attack can cause physical damage, environmental harm or injury. Well-known examples:
- Aurora test (2007) - Idaho National Laboratory demonstrated that digital switching commands could physically destroy a diesel generator
- Stuxnet (discovered in 2010) - reprogrammed PLCs to sabotage uranium centrifuges at Natanz while operators saw normal values
- Industroyer (2016) - malware that in December 2016 operated the circuit breakers of a transmission substation near Kyiv directly through industrial protocols such as IEC 60870-5-104
- TRITON (2017) - targeted the Safety Instrumented System of a petrochemical plant in Saudi Arabia
That is why safety and security must be designed together in a CPS. Functional safety according to IEC 61508 protects against random and systematic failures; IEC 62443 protects against deliberate attacks. Cyber-Informed Engineering goes a step further by making design choices that limit physical consequences even when the digital defences fail, for example a mechanical pressure relief valve that needs no software.
Measures such as Defense in Depth, the zones and conduits model, network segmentation and detection on the OT network are therefore essential for CPS.
🛠️ How do you approach a CPS project securely?
A practical approach for a new or extended industrial CPS:
- Map the physical consequences - which process deviations could cause injury, environmental damage or major production loss? Start from the process, not from IT.
- Set timing requirements per loop - which functions must remain deterministic and local, and which may run through edge or cloud?
- Divide the system into zones - group components with the same security needs and define the connections between them according to IEC 62443-3-2.
- Keep safety independent - run safety functions on a separate safety PLC or SIS, not in the same software as the optimisation.
- Design for degradation - if the network or cloud fails, the process must keep running or stop in a safe, known state (fail-safe).
- Monitor and maintain - keep an asset register, patch according to a fixed process and follow the guidance of NIST SP 800-82 (revision 3, September 2023).
In the Netherlands and the EU this is increasingly a legal obligation. The Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026) imposes a duty of care and incident reporting on essential and important entities. The Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents from 11 September 2026 and to comply fully from 11 December 2027. The Machinery Regulation (EU) 2023/1230 makes protection against corruption of control software part of the CE marking of machinery from 20 January 2027.
❓ Frequently asked questions
Is a PLC a Cyber-Physical System?
A PLC on its own is an embedded controller, not a complete Cyber-Physical System. Only together with the sensors, actuators, network and the physical process it controls does the whole form a CPS. The PLC is the computational heart of that closed control loop.
What is the difference between a CPS and a digital twin?
A Cyber-Physical System is the real system in which software and the physical process work together. A digital twin is a virtual model of that system, synchronised with data from the CPS. A digital twin can therefore be part of a CPS, but a CPS does not always have a digital twin.
Why are Cyber-Physical Systems vulnerable to cyberattacks?
Cyber-Physical Systems connect controllers that were originally designed for closed networks to IT networks, edge and cloud. This lets an attacker cause physical damage through a digital route, as Stuxnet and TRITON showed. Many OT components also stay in service for twenty years or more and are hard to patch.
Which standards apply to the security of CPS?
For industrial CPS, IEC 62443 is the main security standard, with requirements for asset owners, integrators and suppliers. NIST SP 800-82 adds guidance on OT security, and IEC 61508 covers functional safety. The NIST Framework for Cyber-Physical Systems (SP 1500-201) offers a general framework for designing and assessing CPS.
What is the 5C architecture of a CPS?
The 5C architecture is a model for Cyber-Physical Systems in manufacturing with five levels: connection, conversion, cyber, cognition and configuration. It describes the path from raw sensor data through information and insight to automatic adjustment of the machine. The model is widely used for predictive maintenance.
Does AI belong in the control loop of a CPS?
In a Cyber-Physical System, AI is usually used for optimisation, quality control and predictive maintenance, not in the fast control loop itself. Fast and safety-critical loops remain deterministic in a PLC, motion controller or safety system. AI then supplies, for example, new setpoints that the local controller executes within safe limits.
📌 In summary
Cyber-Physical Systems are systems in which software, networks and physical processes influence each other in a closed feedback loop, so a digital fault can have direct physical consequences.
The term emerged at the NSF in 2006 and became the technical basis of Industry 4.0. A CPS combines sensors, actuators, embedded control and networks, with strict requirements for timing and determinism. Because attacks such as Stuxnet and TRITON can cause physical damage, you design safety and security together, keep fast loops local and follow standards such as IEC 62443 and IEC 61508.