1. Introduction
Cyber-physical systems (CPS) have been described as technical systems with the ability to process and act on acquired information (Reference McDermottMcDermott, 2019). Generally, CPS are mechatronic systems that network with the Internet of Things (VDI/VDE 2206), enabling interaction and communication with their environment and other CPS.
Within any CPS, internal changes of states, such as a repositioning of the CPS or a temperature change of a heating coil, are detected and transformed into some measure of information by sensors. This information is then processed by the decision characteristic handling the planning and the control (e.g., a certain algorithm running on a micro-control-unit). The output of the processing is then fed towards the actuators, which then themselves induce a change of state such as movement or heating. Outside of the CPS, its environment consists of other, usually technical systems, and humans (e.g., passengers in autonomous cars) with which the CPS interacts. A model of our understanding of autonomous CPS can be seen in Figure 1.
Model of an autonomous cyber-physical system (adapted from Reference McDermottMcDermott (2019))
Figure 1 Long description
A diagram of an autonomous cyber-physical system showing the interaction between the system and its environment. The system is divided into two main parts: Cyber and Physical. The process starts with Sensing, which collects information and sends it to the Cyber-Physical core. Within this core, decisions are made based on the collected information. The decisions lead to actions that result in a change of states. These changes are then translated into Actuation, which interacts with the environment. The environment includes humans and other systems. The diagram also highlights the role of Redundancy in the system, ensuring robustness and reliability. The flow of information and actions is depicted with arrows indicating the direction of processes and interactions.
CPS are classified as autonomous when the decision on the actuation based on the sensing is done by a computing system without human supervision. Examples of autonomous systems include self-driving cars, aerial and underwater drones, autonomous manufacturing systems and medical devices. (Reference Campean, Kabir, Dao, Zhang and EckertCampean et al., 2021)
As indicated in Figure 1, the sensing and the actuation can be implemented with redundancy. This enables the designer to improve the system’s fault tolerance, availability and potentially its resilience by replicating the functionality of the critical assets (Reference McDermottMcDermott, 2019).
Recent developments in the approach to resilience of autonomous CPS have manifested the need for efficient and reliable measurement procedures (Reference Asil and NasibovAsil & Nasibov, 2025). To achieve reliability in autonomous sensing, the state of research has provided approaches to resilience and redundancy in recent years. As can be seen in Figure 2, the number of publications in this domain has increased greatly since 2022. However, criteria for the understanding and classification of resilience are not consistent across the research and they not only diverge between researchers but also introduce questions regarding the distinction between resilience, robustness, safety and reliability.
Resilience itself is vaguely defined for different fields (Reference Bita, Hovemann and DumitrescuBita et al., 2025). For the engineering context, resilience has been approached as a precursor to safety. In that way a resilient system has been defined as one with the ability to “adjust its functioning prior to, during, or following changes and disturbances […]” enabling it to handle expected and unexpected situations without loss of the required functionality (Reference Pariès, Wreathall and HollnagelPariès et al., 2017). It has, however, been shown that prevailing definitions of resilience are not universally applicable nor stringently used by designers (Reference Kortenbusch and KirchnerKortenbusch & Kirchner, 2025). To discuss resilience in a meaningful way and as a precondition for its targeted implementation in autonomous CPS, it is therefore necessary to analyse how resilience can possibly be consistently defined. This paper analyses the state of research concerning autonomous CPS that are using redundancy among other measures to achieve resilience.
Frequency of research in autonomous systems with redundancy and resilience
Research gap
While reviews on resilience and resilience metrics exist in the literature (Reference Wied, Oehmen and WeloWied et al., 2020), and research has been conducted on sensor fusion (Reference Chen, Zhang, Kong, Zhang and DengChen et al., 2022) and redundancy (Reference McDermottMcDermott, 2019), research combining these domains systematically in an effort to achieve a targeted approach for the design of resilient technical systems is limited. This can be attributed in part to the difficulty surrounding the creation of a credible, distinct and effective definition of resilience.
A recent review by Reference Merveille, Jia, Xu and FredMerveille et al. (2024) has approached a similar problem for resilience but explicitly focused on the localisation and mapping of underwater environments. However, early investigations revealed that to target resilience in product design the developer must look beyond solitary resilience properties such as those investigated by Reference Merveille, Jia, Xu and FredMerveille et al. (2024), in favour of a more holistic view.
Research objectives and research questions
This work pursues two research objectives in order to address the research gap. The first objective is to understand the concept of resilience systematically in accordance with industry standards. This conceptual foundation is required to address the second objective which is answering the following research questions on the basis of that acquired understanding: (1) In which domains and operating environments are resilient, autonomous CPS deployed, and which types of disruptions do they encounter? (2) How is redundant sensing realised in autonomous CPS? (3) Which resilience properties are reported in the literature, and how prevalent are they across the systems?
The first research question guides the investigation of the domains and environments in which autonomous CPS operate, as well as the disruptions these systems must be resilient against. The second research question initiates a discussion about the realisation of redundancy in autonomous CPS. Finally, the third research question guides the investigation of the resilience properties that are present in the systems discussed in the literature.
2. Methodology
In this section, the methodology applied to achieve the research objectives will be presented. At first, the analysis of resilience definitions from relevant ISO standards is explained. Following that, the methods for data collection, information extraction and analysis of the relevant literature are outlined.
2.1. Analysis of resilience definitions from ISO standards
A shared understanding of resilience is required to be in accordance with established industry standards in order to be suitable as a guide for product designers. A holistic understanding of resilience for autonomous CPS must cover the diverse technical domains in which these systems operate. The derivation of such an emerging understanding must be transparent and reproducible. One possible approach according to these requirements encompasses the extraction of information from ISO standards. Accordingly, all grouped ISO standards defining resilience without additional qualifiers (e.g., organisational resilience) were collected from the ISO online browsing platform.
A comparable approach was taken by Reference Bita, Hovemann and DumitrescuBita et al. (2025) for the development of a resilience definition for the automotive context. Their research, however, analysed only nine ISO definitions. In contrast, aiming for a holistic result that is not confined to the automotive context, this work expands the analysis to include 30 definitions.
To synthesise an understanding of resilience, a thematic analysis of standard-based definitions of resilience was conducted in this work. To that end, each definition’s subject or entity for which resilience is defined, its property consisting of a noun and a verb, and any condition mentioned in the definition under which the system should fulfil the resilience properties was extracted and coded. The entity may, for example, be an engineering system or an organisation or a service for which resilience is being defined. The resilience property is the property that the entity must exhibit in order to be considered resilient. To illustrate with an example, the definition of ISO/IEC 22989:2022 is presented in Table 1 and its components are coded as described above.
Decomposition of the resilience definition in ISO/IEC 22989:2022
2.2. Data collection and information extraction
Addressing the second research objective, the collection of data for the literature study encompassed the retrieval of records from the Scopus database. For this purpose, a search query was derived from the described scope, aiming to include autonomous CPS from all relevant domains. Following screening based on inclusion and exclusion criteria aligned with the scope of this work, 34 reports were included in the study out of 96 identified records. A flow chart of the screening process showing the different steps according to the PRISMA statement (Reference PagePage et al., 2021) is presented in Figure 3.
Flow chart visualising the screening process based on (Reference PagePage et al., 2021)
The extraction of information from the retrieved reports was approached with a novel systematic method. Addressing the challenge of aligning the analysis results among the researchers involved, a data extraction framework was created. This also helps to standardise the process and to minimise the impact of the individual researcher’s bias on the results.
At first, information of interest had to be defined. For that, concepts for the identification and classification of factors were taken from the Characteristics-Properties-Modelling (CPM) framework (Reference Weber and KrauseWeber, 2007). In CPM, the characteristics describe the structure (or shape, material, etc.) of the system. These can be directly specified by the designer. Whereas properties describe the system’s behaviour. These cannot be directly determined by the designer, only influenced indirectly by modifying the characteristics. Additionally, external conditions capture the context in which the system properties are valid. Based on this understanding, three sections of information are defined, which form the structure of the data extraction framework.
-
1. The characteristics of the examined system: What was developed?
This includes the system’s name, the system domain, which types of measurement procedures were used and the proposed decision characteristics.
-
2. External conditions: Which conditions is the system operating under?
This refers to the operating environment and the related disruption event.
-
3. The targeted properties of the examined system: Why was the system developed?
Here information about the achieved resilience properties that are valid for the external conditions is collect ed.
To streamline the information extraction process, a template was created from the framework. It offers an in-depth guide regarding the specifics of the information that is needed in each section. It includes specific questions and examples for each section aiming to make the resulting information independent of the researcher’s interpretation. To collaborate within the project, a virtual working environment was created in Obsidian and connected to Git for ease of collaboration and version control. In this environment the researchers linked the extracted information directly to the quote from the corresponding report to ensure transparency and traceability.
The system domain is a generic description of the field of engineering, e.g., unmanned aerial vehicles or autonomous vehicles (i.e., cars). The operating environment describes the working conditions under which the system is designed to operate. In contrast to that, the disruption event describes the irregular, sudden happenings within the operating environment that the system was made resilient against. To identify similarities between the systems and synthesise knowledge, the system domains, operating environments and disruption events from the reports underwent a thematic analysis.
During the thematic analysis, the extracted data (e.g., all mentioned operating environments) were compiled into a list. One researcher iteratively identified, merged and adapted codes to fit the data. After the iterations, a limited number of themes were identified from the codes. In the next round, a different researcher, who was given only the themes and the original list, was asked to map the given themes to the original list. If the mapping of both researchers aligned, the themes were verified and accepted. Using this inductive method, a list of operating environments and disruption events was compiled.
To analyse the redundant sensing, information on the types of measurement procedures used in the autonomous CPS was extracted. In this work, measurement procedures were understood as described by Reference KirchnerKirchner et al. (2024). The extracted information includes a differentiation between homogeneous and heterogeneous redundancy. Redundancy is considered homogeneous if the redundant components are identical while heterogeneous redundancy refers to the use of different components (Reference Tian, Cai, Si and SongTian et al., 2024), i.e., measuring procedures. For the cases of heterogeneous redundancy, the combinations of measurement procedures used were also extracted. If a report investigated multiple CPS or a single CPS with multiple separate combinations of measurement procedures, each case was treated separately.
In the third section of the data extraction framework existing resilience properties were extracted. These were recognised based on the insights gained from the completion of the first research objective and were then deductively coded according to the normalised list of resilience properties.
Note that the identified disruption events from the reports were not mapped to the conditions defined in the ISO standards. Even though there is a significant overlap in both content and function between the two, the ISO standard’s conditions (e.g., changing environment, disruptive event, see Figure 4) are too generic to be used for synthesis and do not refer to the context within which the system is used.
3. Results and discussion
In this section the results are presented. The research objectives are addressed, and the specific research questions are answered chronologically.
3.1. Understanding resilience in accordance with industry standards
By analysing the ISO standard definitions on resilience as described above, the resilience properties, the corresponding entities and conditions were identified. To illustrate how the definitions of resilience overlap, the acquired codes can be visualised in a Sankey diagram, as shown in Figure 4. Each path in the diagram corresponds to a unique definition. The width of each node visualises how frequently a given code is applicable to the definitions. From left to right, the diagram presents: the definition’s subject as the entity, its resilience property (noun phrase and verb) and the condition.
Visualisation of the ISO standard resilience definitions
Figure 4 Long description
A diagram visualizing the ISO standard resilience definitions. The diagram categorizes entities, resilience properties, and conditions. Entities include cloud service, unspecified, system, community, organization, and people. Resilience properties include absorb, adapt, resist, endure, restore, recover, anticipate, maintain, deliver, prepare for, respond, learn, reorganize, transform, and degrade gracefully. Conditions include changing environment, disruptive event, failure, fault, incident, security attack, change, shock, stress, adversity, hazardous event, and internal or external change. The diagram shows the relationships between these entities, properties, and conditions through connecting lines.
While the disruption event and the resilience property noun given in the ISO definitions are quite generic, the resilience property verbs effectively show the variety in capability of resilient technical systems. In the following, the resilience property verbs will therefore be referred to as the resilience properties. To further classify them, they can be grouped based on the time when they are impacting the parent system relative to the disruption event, following Reference StankovićStanković et al. (2023). For that, the resilience properties are presented in Figure 5, together with a suitable definition for each property. Because of their similarity, the properties endure and absorb are combined into withstand. Deliver is included within maintain and respond within adapt. For completeness, detect is included from Reference Bita, Hovemann and DumitrescuBita et al. (2025). Learn and improve is taken from Reference StankovićStanković et al. (2023) replacing learn.
It is shown that resilience in a technical system can be achieved by implementing means for before, during and after the disruption event. Before the disruption event a resilient autonomous CPS can anticipate or prepare for the disruption. During the disruption event a resilient system might detect the disruption which could be useful in resisting it or adapting to it and thus withstanding the disruption. Additionally, maintaining refers to the system’s ability to continue delivering the desired level of performance. Should it not be able to maintain it at the desired levels, a graceful degradation as a response to the event can also be considered a form of resilience if the system retains a minimal acceptable level of performance.
After the disruption event has passed, the system’s resilience is reflected in its ability to recover from any degradation or its ability to learn and improve autonomously or transform to even leave the system in a more capable state than before the disruption.
This combined understanding of resilience was then used to identify and code resilience properties from the retrieved literature. It is however also apparent that the conditions or disruptions that are mentioned in the ISO standards are not precise enough for a disruption-based description and analysis of resilience. This needs to be addressed by analysing the disruption events which are described in the retrieved literature in contrast to the conditions from the ISO definitions.
Classification and definition of resilience properties based on their time of impact
3.2. Answering the research questions
RQ1 - In which domains and operating environments are resilient, autonomous CPS deployed, and which types of disruptions do they encounter?
After the information extraction from the retrieved reports and the inductive coding of the identified operating environments and disruption events, a Sankey diagram is created showing the frequency of each code in the data via the width of the respective node (Figure 6). Four different domains were identified: autonomous vehicles, autonomous robots, satellites and unmanned aerial vehicles (e.g., drones) with reports on autonomous sensing in ground and aerial vehicles making up 30 of the resulting 34 reports and only Reference Mukherjee, Banerjee, Satpute and NikolakopoulosMukherjee et al. (2023) publishing about autonomous satellite navigation. The inductive coding and thematic analysis of the operating environment resulted in 11 themes. Four of them are related to driving (urban, highway, rural and general driving). Indoor and outdoor environments are referred to with the latter being distinguished by structured and unstructured environments. Other systems are designed to operate underground or under constrained communication. Additionally, urban canyons and near-asteroid environments are explicitly mentioned in the reports as well.
The disruptions, which describe unintended and irregular events, are coded by a similar process resulting in 9 unique themes. Compared to the operating environments, the disruption events have a higher degree of individuality in their combinations. The Sensor Malfunction or Degradation code is used for a failure of the sensor itself such as no measurements being forwarded for an extended period of time (Reference Lee, Geneva, Chen and HuangLee et al., 2023). Corrupted Data refers to a case in which a local map is outdated or otherwise wrong (Reference Li, Queralta, Gia, Zou and WesterlundLi et al., 2020). The theme Weather-Related Adverse Conditions describes disrupting weather conditions like snow (Reference Vachmanus, Ravankar, Emaru and KobayashiVachmanus et al., 2021) or fog and rain (Reference Vinoth and SasikumarVinoth & Sasikumar, 2024). In cases in which the weather or other factors lead to a decreased visual perception, the theme Visual Perception Degradation is applied. This could be motion blur, sudden illumination changes, or insufficient visual texture (Reference Asil and NasibovAsil & Nasibov, 2025). Measurement Noise or Inaccuracies could, for example, be radar signal fluctuations (Reference Mukherjee, Banerjee, Koval and NikolakopoulosMukherjee et al., 2024) or multipath effects (Reference TaoTao et al., 2025) but also includes initial calibration errors. Environmental Complexity and Dynamics refers to, for example, obscurant-filled environments (Reference AlexisAlexis, 2019), structural self-similarity (Reference Khattak, Nguyen, Mascarich, Dang and AlexisKhattak et al., 2020), or repetitive patterns (Reference Choi, Lee, Lee and RyuChoi et al., 2025). The theme Cyber Attacks encompasses jamming attacks (Reference Zhou, Wang, Hong and ZhangZhou et al., 2024), false data injection (Reference MoradiMoradi et al., 2024), DDoS, spoofing, or similar malicious attacks (Reference QurashiQurashi et al., 2025). GNSS Failures or Degradation is a theme addressed by 7 of the retrieved reports targeting Global Navigation Satellite System (GNSS) signal outages (Reference CorraroCorraro et al., 2024) as the disruption event. Lastly, Communication Delays or Failures refers to, e.g., general data delays leading to outdated data (Reference Chen, Zhang, Kong, Zhang and DengChen et al., 2022), data dropouts, or broken communication links (Reference ShenShen et al., 2021).
An example of a retrieved report is the multi-sensor fusion method proposed by Reference Wright, Sun, Davies, Proudler and HopgoodWright et al. (2024), which is targeting resilience against measurement noise in the domain of unmanned aerial vehicles in an outdoor unstructured environment.
Sankey diagram showing the system domain, operating environment and disruption event of each autonomous CPS
Figure 6 Long description
A Sankey diagram showing the system domain, operating environment, and disruption event of each autonomous cyber-physical system. The diagram includes three main sections: System Domain, Operating Environment, and Disruption Event. The System Domain section lists various autonomous systems such as Autonomous Vehicle, Autonomous Robot, Autonomous Satellite Navigation, and Unmanned Aerial Vehicle. The Operating Environment section details specific environments like Urban Driving, Highway Driving, Rural Driving, Indoor Environment, General Driving Scenarios, Extraterrestrial Environment near Asteroid, Underground Environment, Constrained Communication, Outdoor Structured Environment, Outdoor Unstructured Environment, and Urban Canyons. The Disruption Event section identifies various disruption events including Corrupted Data, Sensor Malfunction or Degradation, Weather-Related Adverse Conditions, Measurement Noise or Inaccuracies, Environmental Complexity and Dynamics, Cyber Attacks, Visual Perception Degradation, GNSS Failures or Degradation, and Communication Delays or Failures. The width of each node in the diagram represents the frequency of each code in the data, with lines connecting the nodes to show the relationships and flow between different system domains, operating environments, and disruption events.
RQ2 - How is redundant sensing realised in autonomous CPS?
For the realisation of redundant sensing in autonomous CPS, various combinations of heterogeneous measurement procedures are researched and published in the literature. These combinations, their frequency mapped to the different system domains, and the frequency of the individual measurement procedures are presented in an UpSet plot, depicted in Figure 7.
Frequency of measurement procedures and their combinations
It can be seen that the most common measurement procedures involve inertial measurement units (IMU), various types of visual cameras, LiDAR, or GNSS. This can be attributed to (i) their cost-effectiveness with even solid-state LiDAR offering “reliable performance at a much lower cost compared to mechanical LiDAR” (Reference LuLu et al., 2023) and (ii) LiDAR’s ability to complement IMU measurements in situations where the latter fails (Reference WanWan et al., 2018). Only two instances were found where the systems use homogeneous redundancy comprised of different ranges of radars (Reference Enayati, Asef and WilsonEnayati et al., 2024) or GNSS (Reference Zhou, Wang, Hong and ZhangZhou et al., 2024) to improve the accuracy of their object detection and position estimation. Most systems use heterogeneous redundancy with up to 6 different measurement procedures to determine the desired quantities such as position estimates, orientation, mapping of their surroundings, velocity, etc.
RQ3 - Which resilience properties are reported in the literature, and how prevalent are they across the systems?
The resilience properties from Figure 5 were used to deductively code the retrieved literature. The results can be seen in Figure 8 as a bar chart showing the frequency of different resilience properties in the autonomous CPS. The mapping was based on the explicitly mentioned or shown results found in the reports. During the process only those mentions that aligned with the derived definitions for the resilience properties were considered. For example, the identification of a live disruption was coded as detect whereas an autonomous vehicle’s perception of a road was not classified as detect.
The graph shows that while resilience properties classified as during-event are frequent, pre-event and post-event are scarcely represented in the data.
An example of the resilience property recover is the correction of accumulated positioning errors in autonomous vehicles by recognising when the vehicle has completed a loop and returned to a previously visited location of which the position is known (Reference LuLu et al., 2023).
Frequency of resilience properties in autonomous CPS
The data shows that the most frequent resilience property is maintain. Maintain and degrade gracefully are the relevant resilience properties that refer directly to the performance of the system and can be used to describe its robustness. Most analysed resilient CPS either maintain their performance in case of disruption within the same bounds as prior to the disruption or achieve a graceful degradation of performance when a deterioration is inevitable. Some systems exhibit both, maintain and degrade gracefully, for example if different factors or disruption events are being addressed by the resilience property (e.g., performance being maintained under jamming attacks but degrading gracefully when experiencing Doppler frequency shifts (Reference Zhou, Wang, Hong and ZhangZhou et al., 2024)). The other resilience properties impacting the system during the disruption event are directly related to the disruption itself. They are detecting, withstanding, resisting, or adapting to the disruption to achieve the aforementioned performance objectives. We can therefore establish that there are two kinds of resilience properties: disruption response and resulting performance state. This explains the seemingly small difference between, e.g., withstand and maintain.
A similar distinction can be drawn for the resilience properties prepare, adapt, and learn & improve (see Figure 5). The event-wise classification was found helpful during the coding as a means of differentiating between these properties. However, in a system that is subjected to periodic disruptions, learn & improve (post-event) may manifest similar to prepare (pre-event).
Adapt and detect are also quite frequent in the existing literature. This is explained by the circumstance that adaptation can be realised most easily if the disruption is detected. It is, however, not an absolute necessity, which is reflected in there being more instances of adapt than of detect.
4. Conclusion and outlook
In this work an understanding of resilience based on ISO standards was derived systematically, resulting in 11 different properties that can be used to identify resilience in technical systems. For these resilience properties definitions were derived and the properties, were classified temporally relative to the disruption events. The understanding of resilience was then applied in order to analyse redundancy-based resilience in autonomous CPS. The analysis encompassed the domains and environments that CPS are operating in as well as the disruption events that the systems are resilient against. The redundancies present in these CPS were analysed based on their heterogeneity and frequency showing recent trends towards increased use of IMUs, cameras, and LiDARs. In addition, the resilience properties’ frequencies in the reported autonomous CPS were examined. The results indicated a prevalence of measures acting during the disruption events, while measures acting before and after disruptions are comparatively scarce. Overall, the study showed that current innovations within the chosen scope are predominantly on the algorithmic level and less in hardware technology.
Adding to the discussion above, it is important to state that while the proposed understanding was effective at systematically discussing resilience, it was not proven that this approach is the only viable one. Even the resilience property definitions could be derived based on other, non-ISO standards and can deliver different results. Additionally, when identifying relevant records on resilience, this work was limited by the chosen search query. Said search query was influenced by the researchers’ knowledge about the relevant terms and could benefit from an expansion in future works.
Future work will build on the proposed understanding of resilience and the extracted information to develop and evaluate a data-driven design support tool in the form of a database/knowledge graph. The tool will establish causal links between the characteristics (i.e., potential design solutions) and properties (i.e., design requirements related to resilience). A focus on the decision characteristics that ultimately influence and achieve the resilience properties will also be helpful in allowing designers to systematically achieve resilience in technical systems.
Acknowledgement
This work was funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – 550413623. We thank the “Future Talent Short-term Scholarship” program of TU Darmstadt to allow Dr. Anubhab Majumder to visit and contribute to this research work at TU Darmstadt.
Open access
