## 4 Two Countermeasures against Zero-Dynamics Attack
### Generalized-Hold-Based Strategy  
GH has been introduced in [20] and involves a function \(h_{g}(t)\), the so-called hold function that is defined as a piecewise continuous function \(h_{g}\) so that the actual input applied to the system is given by  
\[\hat{u}(t)=\sum_{k=-\infty}^{\infty}h_{g}(t-kT_{s})\hat{u}_{k}.\]  
If a GH having a hold function \(h_{g}(t)\) is used instead of ZOH, the sampled-data model of wind turbine system (6) under constant wind speed \(\bar{V}\) (so that \(\bar{V}=0\)) and ZDA becomes  
\[\hat{x}_{k+1} =\hat{A}_{\mathrm{d}}\hat{x}_{k}+\hat{B}_{g}(\hat{u}_{k}+a_{k}) \tag{14}\] \[\hat{g}_{k} =C_{\mathrm{d}}\hat{x}_{k},\]  
where \(\hat{A}_{\mathrm{d}}=e^{\hat{A}_{\mathrm{d}}T_{s}}\), \(\hat{B}_{g}=\int_{0}^{T_{s}}e^{\hat{A}_{\mathrm{d}}(T_{s}-\tau)}\hat{B}_{s}h_ {g}(\tau)d\tau\), and \(C_{\mathrm{d}}=C_{s}\). The discrete-time transfer function from the generator torque \(\hat{u}_{k}(=\hat{T}_{g})\) (equivalently from the attack \(a_{k}\)) to generator angular velocity \(\hat{y}_{k}(=\hat{\omega}_{g})\), denoted by \(G_{\mathrm{d}}(z)\), is then given by  
\[G_{\mathrm{d}}(z)=C_{\mathrm{d}}(zI-\hat{A}_{\mathrm{d}})^{-1}\hat{B}_{g}. \tag{15}\]  
Figure 7: Responses of the wind turbine under ZDA: with ZOH and SS.  
It is emphasized that since \((\hat{A}_{s},\hat{B}_{s})\) is controllable, one can always find a hold function \(h_{g}\) so that the zeros of \(G_{\rm d}(z)\) can be placed anywhere in the complex plane [20; 23].  
Let \(z_{d,1}\) and \(z_{d,2}\) be the desired zeros located inside the unit circle and \(k_{d}\) be a gain. The problem is to find \(\hat{B}_{g}\) such that the transfer function \(G_{\rm d}(z)\) has desired zeros and gain, i.e., the following identity holds  
\[G_{\rm d}(z)=C_{\rm d}(zI-\hat{A}_{\rm d})^{-1}\hat{B}_{g}=k_{d} \frac{(z-z_{d,1})(z-z_{d,2})}{\det(zI-\hat{A}_{\rm d})}=:G_{\rm d}^{*}(z).\]  
Let \(\det(zI-\hat{A}_{\rm d})=z^{3}+d_{2}z^{2}+d_{1}z+d_{0}\). Then, \(G_{\rm d}^{*}(z)\) can be realized in the control canonical form [54] given by  
\[\begin{split}\hat{x}_{k+1}&=A_{\rm con}\hat{x}_{k} +B_{\rm con}\hat{u}_{k}\\ \hat{y}_{k}&=C_{\rm con}\hat{x}_{k},\end{split} \tag{16}\]  
where  
\[A_{\rm con}=\begin{bmatrix}0&1&0\\ 0&0&1\\ -d_{0}&-d_{1}&-d_{2}\end{bmatrix},\ B_{\rm con}=\begin{bmatrix}0\\ 0\\ 1\end{bmatrix},\ C_{\rm con}=\begin{bmatrix}k_{d}z_{d,1}z_{d,2}&-k_{d}(z_{d,1}+z_{ d,2})&k_{d}\end{bmatrix}.\]  
Equating the Markov parameters of the two transfer functions, one has  
\[C_{\rm d}\hat{A}_{\rm d}^{k}B_{g}=C_{\rm con}A_{\rm con}^{k}B_{ \rm con},\ k=0,1,\ldots,\]  
from which \(\hat{B}_{g}\) is determined by  
\[\hat{B}_{g}=\begin{bmatrix}C_{\rm d}\\ C_{\rm d}\hat{A}_{\rm d}\\ C_{\rm d}\hat{A}_{\rm d}^{2}\end{bmatrix}^{-1}\begin{bmatrix}C_{\rm con}\\ C_{\rm con}A_{\rm con}^{2}\end{bmatrix}B_{\rm con}, \tag{17}\]  
where the invertibility is assured by the observability of \((\hat{A}_{\rm d},C_{\rm d})\).  
As discussed in [20; 23], one candidate of GH is to use a piecewise constant function given by  
\[h_{g}(t)=h_{i},\frac{(i-1)T_{s}}{N}\leq t<\frac{iT_{s}}{N},i=1, \ldots,N,\]  
where \(h_{i}\) are constant gains and \(N\) is the number of subintervals. It can be shown that the gains \(h_{i}\) and the vector \(\hat{B}_{g}\) are related as  
\[\hat{B}_{g}=\sum_{l=1}^{N}h_{l}\int_{\frac{(l-1)T_{s}}{N}}^{\frac {T_{s}}{N}}e^{A_{s}(T_{s}-\tau)}\hat{B}_{s}d\tau \tag{18}\]  
and this can be rewritten as  
\[\hat{B}_{g}=\begin{bmatrix}A_{\rm d,N}^{N-1}B_{\rm d,N}&\cdots&A _{\rm d,N}B_{\rm d,N}&B_{\rm d,N}\end{bmatrix}h=:\mathcal{C}_{\rm d,N}h,\]  
where \(h=[h_{1},\ldots,h_{N}]^{\top}\) and  
\[A_{\rm d,N}=e^{\hat{A}_{s}\frac{T_{s}}{N}},\ B_{\rm d,N}=\int_{0 }^{\frac{T_{s}}{N}}e^{\hat{A}_{s}(\frac{T_{s}}{N}-\tau)}\hat{B}_{s}d\tau.\]  
The hold gains are then computed as  
\[h=C_{d,N}^{\dagger}\hat{B}_{g}. \tag{19}\]For more details on the derivation, see [23].