A hierarchical trajectory model of cyber resilience in safety-critical cyber-physical systems

Abstract

Resilience in safety-critical cyber-physical systems is not a settled concept. It carries competing meanings inherited from four distinct intellectual traditions—materials science, ecology, safety engineering and cybersecurity—each with its own definition of what a successful outcome looks like. This tension is not merely academic. It produces operational frameworks in which robustness, adaptability, safety constraint and recovery are treated as equivalent attributes, their structural differences obscured. The result is guidance that can satisfy audit requirements while leaving complex systems vulnerable in ways that compliance-driven requirements cannot detect. This paper addresses that gap in three steps. First, it reconciles the engineering and ecological resilience traditions through the Cyber-Compatibilism principle. Second, it defines a hierarchical, CPS-specific structure of resilience domains spanning safety, engineering, organisational, governance and contextual attributes. Third, it develops a domain-attributed trajectory model that maps each domain to the phase of disturbance it dominantly shapes and to the corresponding NIST cyber resilience goal. No domain operates in isolation: each phase emerges from the combined action of attributes across all domains, with one typically dominant but nonsufficient alone. The model is informed by two industrial case studies and a physical safety-critical testbed representative of those systems; the empirical evidence base is reported in a companion paper.