Neutralizing zero dynamics attack on sampled-data systems via generalized holds

This paper focuses on cyber-security issues of networked control systems in closed-loop forms from the perspective of quantized sampled-data systems. Quantization of control inputs adds quantization error to the plant input, resulting in certain variation in the plant output. On the other hand, sampling can introduce non-minimum phase zeros in discretized systems. We consider zero-dynamics attacks, which is a class of false data injection attacks utilizing such unstable zeros. Although non-quantized zero-dynamics attacks are undetectable from the plant output side, quantized attacks may be revealed by larger output variation. Our setting is that the attack signal is applied with the same uniform quantizer used for the control input. We evaluate the attack stealthiness in the closed-loop system setting by quantifying the output variation. Specifically, we characterize the cases for static and dynamic quantization in the attack signal, while keeping the control input statically quantized. Then we demonstrate that the attacker can reduce such output variation with a modified approach, by compensating the quantization error of the attack signal inside the attack dynamics. We provide numerical examples to illustrate the effectiveness of the proposed approaches. We show that observing the quantized control input value by a mirroring model can reveal the zero-dynamics attacks.

If one considers a sampled-data system derived from a continuous-time system with a relative degree of one or two on a finite-time interval, it is not simple to predict the behavior of the output of the inverse of the sampled-data system as the sampling period goes to zero. This is because the number of sample points increases while the zeros of the pulse-transfer function tend to the boundary between the stable and unstable areas. The paper shows that the output of the sampled-data inverse systems converges to the output of the continuous-time inverse systems independently of the stability of zeros.

The zeros of sampled-data systems resulting from continuous-time systems preceded by a hold and followed by a sampler are discussed. The holds considered are a zero-order hold and a first-order hold. For a sufficiently small or large sampling period, such zeros are called limiting zeros. For a sufficiently small sampling period, they are known to consist of two different types of zeros: the zeros of the first type correspond to the zeros of the original continuous-time system, while those of the second type have no continuous-time counterparts. Basic properties of the zeros of sampled-data systems are shown for a sufficiently small sampling period. The correspondence between the former type of zeros of the sampled-data systems and the zeros of the original continuous-time system are clarified in more detail, including the stability property of these zeros. Stability properties of the latter type of zeros are also studied. In addition, limiting zeros are studied for a sufficiently large sampling period from the viewpoint of the stability of the zeros. The results are combined to derive the conditions which assure the stability of all limiting zeros. The conditions lead to the consequence that first-order hold provides no advantage over zero-order hold as far as the stability of the zeros of the resulting sampled-data systems is concerned. >

Zero dynamics attacks are known to be lethal in the sense that they are stealthy in principle and are not detected from output measurements. Therefore, instead of detecting the zero dynamics attacks, an idea to mitigate the effect of the zero dynamics attack has been proposed recently, which is to enforce the zeros to become stable by changing the zero-order hold to a generalized hold in the sampled data framework. Once all the zeros become stable, then even if the zero dynamics attack is engaged, its effect on the plant is negligible. However, it was observed that the amplitude of the generalized hold becomes unrealistically large in some cases, which leads to a large input to the physical plant. This paper studies this phenomenon at a deeper level and figures out that changing the intrinsic zeros requires an excessively large amplitude of the generalized hold while changing the sampling zeros can be done with a reasonable amplitude.

Recently, the Plant Input Mapping (PIM) method was proposed as a digital-redesign (or an emulation) approach in digital control system design. This method guarantees stability of a redesigned digital control system for a wide range of sampling periods. In this paper the PIM method is applied to the design of a digital model-matching flight control system. In the model-matching control system design a plant must have no unstable zeros. However, unstable zeros appear for small sampling periods in a step invariance model of a continuous-time (CT) plant with the relative degree greater than two, even if the CT plant has no unstable zeros. Hence, in such a case, the direct-digital approach cannot be applied to the design of a digital model-matching control system. By contrast, the digital-redesign approach such as the Tustin's method or the PIM method is free from the problem. Simulation results for an unstable VTOL aircraft show that the proposed method gives better performance than the conventional design methods.

Tuning of controllers and generalized hold functions in sampled-data systems using iterative feedback tuning

A new digital redesign method is proposed for feedback control systems, by which the states in the continuous-time system are completely reserved in the redesigned sampled-data system. The features of the proposed method are: 1) the N-delay control is employed, and the lth plant input is changed N/sub l/ times during one sampling period; 2) the states of the redesigned sampled-data system completely match those of the original continuous-time closed-loop system at every sampling period; and 3) the proposed redesign method can be applicable for a static state-feedback and/or a dynamic controller. An illustrative example of position control using a DC servo motor is presented. The advantages of the proposed redesign approach are demonstrated both in the time and frequency domains.

The contributions of this paper are threefold. We first explore the differences in uncertainty representations and control designs between continuous time systems and discrete time systems, particularly the high frequency interpretation does not work for discrete time systems. It is shown that uncertainties appeared in sampled data systems may be highly structured, however they do not fall into any category which is currently available in the literature. Secondly, we define a measure on these uncertainties which confines a neighborhood to the nominal model in terms of frequency content, and then we propose a control design method which guarantees the stability of the closed loop system in the face of uncertainties. Last, we consider a generalization of a classical continuous time approach in representing the multiplicative uncertainty to sampled data systems by using a slightly modified sampler and present a method to calculate a frequency bound on the uncertainty in sampled data systems.

In this paper, we provide a novel defence strategy for a nonlinear sampled-data control system under zero-dynamics attacks. In a sampled data structure, sampling zeros induced by discretization make a system vulnerable to deception attacks. we analyze the dissipativity in the zero-dynamics part of the system equipped with a multi-rate setup and find conditions on sampling rates to neutralize the attacker's target plan. We show that, under some mild conditions, using multi-rate sampling in the nonlinear sampled-data system not only preserves the dissipativity property of the intrinsic zero-dynamics but also stabilizes the extrinsic zero-dynamics induced by the sample and hold process, and as a result attenuate the effects of attacks on the system stability. Finally, a numerical example is used to illustrate the effectiveness of the proposed approach.

This paper is concerned with the zeros of sampled-data systems resulting from continuous-time systems preceded by a hold and followed by a sampler. The holds we shall consider are a zero-order hold and a first-order hold. For sufficiently small or large sampling periods, such zeros are called limiting zeros. For sufficiently small sampling periods, they are known to consist of two different types of zeros: the zeros of the first type correspond to the zeros of the original continuous-time system, while those of the second type have no continuous-time counterparts. We first show basic properties of the zeros of sample-data systems for sufficiently small sampling periods. Next, we clarify, in more detail, the correspondence between the former-type zeros of the sampled-data systems and the zeros of the original continuous-time system, including the stability property of these zeros. We also study stability properties of the latter-type zeros. In addition, we study limiting zeros for sufficiently large sampling periods from the viewpoint of stability of the zeros. Finally, the above results are combined to derive the conditions which assure stability of all limiting zeros. The conditions lead to a consequence that a first-order hold provides no advantage over a zero-order hold as far as stability of the zeros of the resulting sampled-data systems is concerned.

Sampled-data control systems generally have fixed sampling frequencies which must be set high enough to give satisfactory performance for all anticipated conditions. A study is made here of an adaptive system which varies the sampling frequency by measuring a system parameter. It is shown that a sampler followed by a zero-order hold whose sampling period is controlled by the absolute value of the first derivative of the error signal will be a more "efficient" sampler than a fixed-frequency sampler. That is, over a given time interval, fewer samples are needed with the variable-frequency system than with a fixed-frequency system while maintaining essentially the same response characteristics. Analog computer studies of simple Type I and Type II sampled-data servo systems with error sampling and unity feedback verified the method. Standard analog computer components were used to set up a simulated servo system, a rate detector, absolute-value detector, a voltage-controlled oscillator, and a sampler and zero-order hold. The system described reduced the number of samples required for response to a step input to about three-quarters that required in a fixed-sampling-frequency system. Over a long period of time savings in the number of samples required can be expected to be between 25 and 50 per cent. In many applications the savings produced by reducing the over-all number of samples required may outweigh the added complexity of the adaptive-sampling-frequency system.

Cyber Physics Systems consists of physical systems and information systems. Modern power systems are increasingly dependent on information systems, experts and scholars are paying more and more attention to cyber attacks on CPS. This paper first introduces the existing research on cyber physical power system. Then this paper reviews the current status of existing cyber attacks. Finally, the modeling method for CPS is summarized such as correlation characteristic matrix, graph theory, complex network theory, finite state machine, mathematical programming and cellular automata method. These methods have vital theoretical and practical significance for the research of cyber physical power system.

In this work, we consider the problem of simultaneously estimating the system states and unknown inputs in a linear sampled-data system, whose dynamics is influenced by external disturbances and uncertainties. Hardware limitations prevent an estimation scheme for a sampled-data system from achieving finite-time convergence, which is a typical property of existing sliding mode observers for dynamical continuous-time systems, because the sampling period is finite. Due to the sampling process, an approximate implementation of such an observer, designed for a continuous-time system, may not retain the desired performance in the sampled-data context. In this paper, we present an observer which takes advantage of the quasi-sliding motion concept to simultaneously estimate the state variables and the unknown input signals in a sampled-data context. A theoretical study is conducted to formally justify the convergence properties of the observer whilst simulation results are provided to show the efficiency of the proposed scheme.

From the viewpoint of passivity, it is well known that wave variables are robust to transmission delay of a system. During wave transformation for the sampled-data system, a unit delay arises due to causality of the reflection wave. This delay makes the wave transformation in the sampled-data system different from the standard one in the continuous-time system. The unit delay on the reflection wave occasionally becomes a passive element. From the passivity condition of the sampled-data system, the wave impedance can be designed such that wave transformation using delayed reflection provides the effect of positive damping and thus a stable haptic interface is achieved in the sampled-data system. For a passive haptic device, although it is always considered stable because of its passive nature, the oscillatory motion appears during the wall-following task with force approximation. Various experiments for a two-linked passive haptic device show that a stable haptic interface can be accomplished for the wall-following task through wave transformation using delayed reflection.

The networking of Cyber-Physical Systems (CPS) is a worldwide trend. With the growing accessibility of data, vulnerability to cyber attacks increases. If the cyber attack remains undetected by the monitoring system, it is called stealthy. Stealthiness of the attack produces the risk that an adversary can take control over a CPS via a communication network and remain unnoticed. We aim to call attention to this problem by proposing a new attack scenario called local covert attack. Different from the previously known covert attack introduced in (Smith, 2011), the local covert attack proposed here needs less disruption resources and does not require the access to all control input signals and sensor output signals. We show that the local covert attack can be made completely stealthy by applying the decoupling technique or by combining the basic idea of covert attack and zero-dynamics attack. Simulation results are provided to demonstrate the stealthiness of the proposed local covert attacks.