Mathematical Problems in Engineering

Volume 2016, Article ID 3750264, 9 pages

http://dx.doi.org/10.1155/2016/3750264

## Resilient State Estimation for Control Systems Using Multiple Observers and Median Operation

^{1}Department of Information and Communication Engineering, DGIST, Daegu 42988, Republic of Korea^{2}Department of Electrical and Computer Engineering, Seoul National University, Seoul 08826, Republic of Korea

Received 23 November 2015; Revised 22 January 2016; Accepted 27 January 2016

Academic Editor: Yan-Jun Liu

Copyright © 2016 Heegyun Jeon et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

This paper addresses the problem of state estimation for linear dynamic systems that is resilient against malicious attacks on sensors. By “resiliency” we mean the capability of correctly estimating the state despite external attacks. We propose a state estimation with a bank of observers combined through median operations and show that the proposed method is resilient in the sense that estimated states asymptotically converge to the true state despite attacks on sensors. In addition, the effect of sensor noise and process disturbance is also considered. For bounded sensor noise and process disturbance, the proposed method eliminates the effect of attack and achieves state estimation error within a bound proportional to those of sensor noise and disturbance. While existing methods are computationally heavy because online solution of nonconvex optimization is needed, the proposed approach is computationally efficient by using median operation in the place of the optimization. It should be pointed out that the proposed method requires the system states being observable with every sensor, which is not a necessary condition for the existing methods. From resilient system design point of view, however, this fact may not be critical because sensors can be chosen for resiliency in the design stage. The gained computational efficiency helps real-time implementation in practice.

#### 1. Introduction

Feedback control systems resilient against malicious attacks have received increasing attention in recent years [1–4]. This is because, combined with advances in computing and communications, feedback control systems now operate in a more connected manner with remotely located sensors, actuators, and other subsystems, which increase vulnerability of the systems compared to isolated ones in the past. The same trend is clearly seen in networked control systems [5, 6] and Cyber-Physical Systems [7, 8]. In particular, for applications to critical infrastructures of our society [9], such as power grid [10], public transportation, and nuclear facility, the consequence of malfunction due to attacks may be disastrous. Malicious attacks on control systems of trams, power grids, water distribution systems, and sewage plant have occurred in reality as reported in [11–13]. More potential attacks have been illustrated (see [1–4] and references therein for details).

In this paper, we develop a state estimation method for feedback control systems that is resilient against malicious attacks on sensors. Resilient state estimation is a method that can correctly estimate the true state of the system despite attacks on sensors. Such a method is sometimes referred to as secure state estimation.

The scenario considered here is the situation in which malicious attacks corrupt sensor outputs with the aim to degrade the control performance or fail the control systems. Such attacks, referred to as integrity attack [1], include the case where the sensors are physically destroyed and yielding false values or the case where the communication channels between sensors and controllers are compromised so that measurement values are intentionally altered. Altered sensor values can be arbitrary and no assumptions are made on their values or statistical properties.

Feedback systems under consideration are those with multiple sensors. First we consider the case where multiple sensors measure the same physical quantity redundantly and then we consider the case of multiple sensors measuring different physical quantities. The rationale is that the systems with multiple sensors can retain its functionality with a properly designed state estimation mechanism, despite the fact that some sensors, not all, are compromised. We assume that compromising more sensors at once requires more effort and resource for the adversaries.

Our approach is based on Luenberger state observers. Specifically, for redundant sensors that measure the same physical quantity, sensor outputs are combined through a median operation, which then feed to a state observer to estimate the state. For multiple sensors that measure different physical quantities, multiple observers are constructed first, and states estimates are combined through element-wise median operations. Analyses are provided for conditions under which resilient state estimation is guaranteed. Additionally, experimental results on a magnetic levitation system are also given to illustrate the efficacy of the proposed approach.

State observers have been used previously to detect faults in the systems [14]. Most existing work designs an observer based scheme to generate residual signals that are used to detect faults. However, combining multiple state estimates using median operation in order to ensure resiliency has not been exploited to date.

Median operation has been used previously to ensure system tolerance to faults. For example, [15] designs a Guidance Navigation and Control (GNC) system where outputs from encoders, decoders, and data process units are combined through median operation to detect faults in the Data Processing Unit (DPU). Tripple Modular Redundancy (TMR) used in airline industry [16] executes voting based on AND-OR operation at logic level, which could be interpreted at selecting the median of the values from three computing units. However, it has not been used in the context of resilient state estimation where integrity attacks on the sensors are of the main concerns.

It should be acknowledged that seminal work of resilient state estimation is [17]. Formulated in discrete time linear systems setting, the method in [17] accumulates sensor outputs for multiple sampling periods, and process state estimation using techniques developed in compressed sensing literature [18, 19]. This work has been extended to systems with uncertainty, noise, and disturbance [20]. In [17], conditions for the correct estimation are given and an optimization problem is formulated. Since solving optimization online is computationally heavy (NP-hard), a relaxation condition on system parameters is given under which the solution of optimization is identical to a relaxed optimization. However, the relaxation condition narrows the class of the systems to which the method is applicable.

In an attempt to reduce computational effort, [21] approaches the problem of resilient state estimation using multiple observers. Contrast to the setting of [17, 20], [21] formulates the problem in continuous time linear dynamic systems setting and combines the estimates from multiple observers using the technique from compressed sensing. This method reduces optimization search space to a finite set leading to substantial reduction of computational effort from NP-hard to polynomial time. In addition, it is applicable to a large class of systems, compared to optimization method in [17], whose states are observable from the sensors.

Adaptive parameter estimation methods with various nonlinear elements [22, 23] may be used to solve resilient state estimation problem. When combining multiple observer outputs, especially, when each observes different number of states, adaptive fuzzy technique [24–29] can be utilized. These venues, however, have not yet been actively pursued.

The approach of current paper follows the setting of [21] and achieves computational complexity in the order of with being the number of states and being the number of sensors, under the assumption that the system states are observable from each sensor.

It should be pointed out that the proposed method requires the system states being observable with every sensor, which is not a necessary condition for the existing methods. From resilient system design point of view, however, this fact may not be critical because sensors can be chosen for resiliency in the design stage. On the other hand, the gained computational efficiency helps real-time implementation in practice.

The contributions of this paper are to propose multiple observers combined by median operation as a means to solve resilient state estimation problem and achive higher computational efficiency compared to existing methods for a class of systems.

The outline of this paper is as follows. The problem formulation is given in Section 2. Section 3 presents the main designs and analyses, and Section 4 provides experimental results. Comparison to existing methods is given in Section 4 as well in terms of applicability and computational effort. The conclusions are formulated in Section 5.

#### 2. Problem Formulation

Consider a linear time invariant system given bywhere is the plant state, is control, is the plant output, is the measurement for feedback control, is process disturbance, is sensor noise, and is a vector that represents the altered output value by external malicious attack. The matrices , , and are in appropriate dimensions. Let the matrix be written bywhere each for is a row vector that corresponds to the output of the output vector . The sensor being under attack is described by element of the vector , denoted by , being nonzero, and the value of represents the amount of measurement altered by the external attack.

In order to denote the set of sensors under attack, we introduce the following notation. The support of the vector is defined as and the cardinality of the set is denoted by . The elements in the set are the indices of the attacked sensors.

We now introduce assumptions for the system of (1).

*Assumption 1. *The set satisfies for all .

Assumption 1 states that strictly less than half of all the sensors in the system may be under integrity attack. This is a standard assumption for resilient state estimation [17, 21] and in fact a necessary and sufficient condition for resilient state estimation problem to be solvable. The rationale is that the adversaries who attack the sensors have limited resource only enough to compromise a subset of the sensors.

*Assumption 2. *The pair is observable for .

This assumption ensures that a bank of observers can be constructed. This assumption can be viewed as restrictive. However, from system design point of view, one can select sensors that satisfy Assumption 2.

*Assumption 3. *The vectors and satisfy for and for .

Assumption 3 states that the process disturbance and measurement noise are bounded.

We now formulate the following design problems.

*Problem 1. *Let Assumptions 1 and 2 hold. Assume further that no process disturbance and measurement noise exist in the system; that is, and . Furthermore, let for . Construct a state estimator for the system of (1) such that the estimated state denoted by asymptotically converges to despite .

*Problem 2. *Let Assumptions 1 and 2 hold. Assume further that and . Construct a state estimator for the system of (1) such that the estimated state denoted by asymptotically converges to despite .

It should be pointed out that unknown input observers (see, e.g., [30]), which address the problem of estimating states correctly despite unknown disturbances, may appear similar to Problems 1 and 2. However, the framework deals with unknown input entering the state dynamics instead of output equation, which differentiates Problems 1 and 2 from the problem of unknown input observers.

Another aspect that differentiates Problems 1 and 2 from existing work is that we seek a method of asymptotic estimation formulated in continuous dynamics, while [17, 20] seek instantaneous estimation formulated in discrete dynamics.

The above formulated problems aim to achieve asymptotic state estimation and do not consider the effect of process disturbance and measurement noise. In practice, modeling errors, external process disturbance, and measurement noise exist. Hence, we formulate the following analysis problems.

*Problem 3. *Let Assumptions 1, 2, and 3 hold. Analyze the effect of disturbance and measurement noise on the system of (1) and the state estimator of Problem 1.

*Problem 4. *Let Assumptions 1, 2, and 3 hold. Analyze the effect of disturbance and measurement noise on the system of (1) and the state estimator of Problem 2.

Solutions to Problems 1–4 are given in Section 3.

#### 3. Resilient State Estimation

##### 3.1. Median Operation

First we define sample median operation. The sample median of many values , denoted by , is defined by the largest value of if is odd and defined by the average of the and the largest values of if is even.

We now examine the property of median operation in the context of the system of (1). Suppose there are measurements denoted by with , each measuring the same value denoted by . Let and for . We denote the cardinality of by ; that is, . Then, it is straightforward to notice that, as long as the number of measurements is greater than twice the number of elements in , or equivalent to say , the median value is equal to ; that is,

Notice that the fact above holds regardless of the values of as long as at any given time. Note also that (4) holds even if the elements of change in time. As an illustration, an example is given.

*Example 1. *Consider the case of . Assume that , and . Accordingly, let be . Notice that in this case and is satisfied. Then, and med() is given by 2, which is equal to . If , then, , and . This yields and med() is given by 5, which is not equal to .

For the case when measurement noise exists, we have the following property for the median. Let , , , and be -dimensional vectors. The vector is of the form with , the vector represents noise, and as in Assumption 3, each element of the vector is bounded by a constant ; that is, , the vector satisfies with , and let the vector be given by . Then, we have the following for the sample median operation:In words, this means when all the measurement is subject to bounded noise, sample median is also subject to noise, with the same bound as that for each element of the vector representing measurement noise. The derivation of (5) is in the appendix.

##### 3.2. Design of Resilient State Observer

Now we propose a solution to Problem 1. Since all sensors are measuring the same physical quantity, that is, , for , we construct a Luenberger state observer in the following manner:where the gain matrix is chosen such that is Hurwitz. Then it can be shown that, for the system of (1) with and , the state observer (6) satisfies as . In words, asymptotic state estimation is obtained by using (6). Specifically, since all the sensors measure the same output, we can denote this output by where . As explained earlier, under Assumption 1, is obtained. Also, due to Assumption 2, the matrix can always be chosen to render Hurwitz. This ensures the state estimate asymptotically converges to .

Therefore, the state observer of (6) is a solution to Problem 1. It ensures asymptotic state estimation despite external attack as long as the number of attacked sensors is less than half of all the sensors (Assumption 1). We emphasize that this solution is computationally very efficient as the computational complexity of median operation of variables is given by .

Next we consider the case where not all sensors measure the same physical quantities. As given in Assumption 2, the system states are observable from each sensor. For each sensor output , one can design a Luenberger type observer that estimates the state asymptotically. The state estimate from sensor is denoted by with a superscript . Then, Assumption 2 allows design of the observer,where can be selected such that is Hurwitz. By combining state estimates through median operation, we can obtain a state estimatewhere For the method in (7)–(9) to work, an additional assumption is needed.

*Assumption 4. *The set does not change over time.

The additional assumption is needed to avoid the case that attacks excite the transients response of each observer in (7) in a manner that prevents from converging to . With Assumption 4, it can be shown that, for the system of (1) with and , the state estimation method given by (7)–(9) achieves as . This is possible because, under Assumption 1, more than half of observers yield correct state estimates. Combining them through median would remove the effect of nonzero attack vector and ensure asymptotic state estimate. Detailed derivation is given in the appendix. Therefore, the state estimation method of (7)–(9) for the system (1) provides a solution to Problem 2. Note that the additional computational effort for resiliency in this case is , which is more scalable than NP-hard [17, 20], or polynomial time of [21].

##### 3.3. Effect of Measurement Noise and Process Disturbance

Now we analyse the proposed state estimation method when measurement noise and process disturbances exist. In the presence of measurement noise and disturbance, asymptotic state estimation is generally not possible even without external attack. Hence, we focus on finding a bound on the estimation error. From a practical point of view, we deal with measurement noise and process disturbance that are bounded. Hence, Assumption 3 applies throughout this subsection.

First we consider the system of (1) with multiple sensors that measure the same physical quantity; that is, for . Then, it can be shown that there exist some positive constants and such that the state estimation given by (6) yieldsNote that inequality (10) implies that the estimation error is bounded when bounded noise as well as process disturbance is present. Note moreover that the first term in (10) diminishes as time goes and the bound on the remaining term in the error is proportional to the bounds of the measurement noise and . This solves Problem 3 given in Section 2. The derivation of (10) is given in the appendix.

For the case with the sensors measuring different physical quantities, resilient state estimation is achieved by the method given in (7)–(9). When measurement noise and process disturbance exist, the method of (7)–(9) does not achieve asymptotic estimation. It turns out, however, that (10) holds for this case as well although the derivation now is more involved using observers and element-wise median operation. Hence (10) solves Problem 4. The detailed derivation for this case is given in the appendix.

We would like to emphasize that the bound on estimation error does not depend on attack vector . Attack can be arbitrarily large, but the effect is eliminated by resilient state estimator construction, and the bound on error only depends on the initial error, the bound of process disturbance, and the bound for the measurement noise.

#### 4. Experiment

##### 4.1. Modeling

The proposed methods of resilient state estimation are experimentally validated using a magnetic leviation control system. Figure 1 shows the magnetic levitation system developed by Quanser for control education purpose. It consists of electromagnet, infrared ray position sensor, a steel ball, voltage amplifier, ADC converter, and data acquisition system connected to a PC using USB cable. A control algorithm is implemented using real-time workshop in Matlab/Simulink.