# Resilient State Estimation for Control Systems Using Multiple Observers and Median Operation

Authors: Heegyun Jeon; Sungmin Aum; Hyungbo Shim; Yongsoon Eun
Journal: Mathematical Problems in Engineering
 (2016)

---

## Abstract

This paper addresses the problem of state estimation for linear dynamic systems that is resilient against malicious attacks on sensors. By “resiliency” we mean the capability of correctly estimating the state despite external attacks. We propose a state estimation with a bank of observers combined through median operations and show that the proposed method is resilient in the sense that estimated states asymptotically converge to the true state despite attacks on sensors. In addition, the effect of sensor noise and process disturbance is also considered. For bounded sensor noise and process disturbance, the proposed method eliminates the effect of attack and achieves state estimation error within a bound proportional to those of sensor noise and disturbance. While existing methods are computationally heavy because online solution of nonconvex optimization is needed, the proposed approach is computationally efficient by using median operation in the place of the optimization. It should be pointed out that the proposed method requires the system states being observable with every sensor, which is not a necessary condition for the existing methods. From resilient system design point of view, however, this fact may not be critical because sensors can be chosen for resiliency in the design stage. The gained computational efficiency helps real-time implementation in practice.


---

## Body

## 1. Introduction

Feedback control systems resilient against malicious attacks have received increasing attention in recent years [1–4]. This is because, combined with advances in computing and communications, feedback control systems now operate in a more connected manner with remotely located sensors, actuators, and other subsystems, which increase vulnerability of the systems compared to isolated ones in the past. The same trend is clearly seen in networked control systems [5, 6] and Cyber-Physical Systems [7, 8]. In particular, for applications to critical infrastructures of our society [9], such as power grid [10], public transportation, and nuclear facility, the consequence of malfunction due to attacks may be disastrous. Malicious attacks on control systems of trams, power grids, water distribution systems, and sewage plant have occurred in reality as reported in [11–13]. More potential attacks have been illustrated (see [1–4] and references therein for details).In this paper, we develop a state estimation method for feedback control systems that is resilient against malicious attacks on sensors. Resilient state estimation is a method that can correctly estimate the true state of the system despite attacks on sensors. Such a method is sometimes referred to as secure state estimation.The scenario considered here is the situation in which malicious attacks corrupt sensor outputs with the aim to degrade the control performance or fail the control systems. Such attacks, referred to as integrity attack [1], include the case where the sensors are physically destroyed and yielding false values or the case where the communication channels between sensors and controllers are compromised so that measurement values are intentionally altered. Altered sensor values can be arbitrary and no assumptions are made on their values or statistical properties.Feedback systems under consideration are those with multiple sensors. First we consider the case where multiple sensors measure the same physical quantity redundantly and then we consider the case of multiple sensors measuring different physical quantities. The rationale is that the systems with multiple sensors can retain its functionality with a properly designed state estimation mechanism, despite the fact that some sensors, not all, are compromised. We assume that compromising more sensors at once requires more effort and resource for the adversaries.Our approach is based on Luenberger state observers. Specifically, for redundant sensors that measure the same physical quantity, sensor outputs are combined through a median operation, which then feed to a state observer to estimate the state. For multiple sensors that measure different physical quantities, multiple observers are constructed first, and states estimates are combined through element-wise median operations. Analyses are provided for conditions under which resilient state estimation is guaranteed. Additionally, experimental results on a magnetic levitation system are also given to illustrate the efficacy of the proposed approach.State observers have been used previously to detect faults in the systems [14]. Most existing work designs an observer based scheme to generate residual signals that are used to detect faults. However, combining multiple state estimates using median operation in order to ensure resiliency has not been exploited to date.Median operation has been used previously to ensure system tolerance to faults. For example, [15] designs a Guidance Navigation and Control (GNC) system where outputs from encoders, decoders, and data process units are combined through median operation to detect faults in the Data Processing Unit (DPU). Tripple Modular Redundancy (TMR) used in airline industry [16] executes voting based on AND-OR operation at logic level, which could be interpreted at selecting the median of the values from three computing units. However, it has not been used in the context of resilient state estimation where integrity attacks on the sensors are of the main concerns.It should be acknowledged that seminal work of resilient state estimation is [17]. Formulated in discrete time linear systems setting, the method in [17] accumulates sensor outputs for multiple sampling periods, and process state estimation using techniques developed in compressed sensing literature [18, 19]. This work has been extended to systems with uncertainty, noise, and disturbance [20]. In [17], conditions for the correct estimation are given and an l
0 optimization problem is formulated. Since solving l
0 optimization online is computationally heavy (NP-hard), a relaxation condition on system parameters is given under which the solution of l
0 optimization is identical to a relaxed l
1 optimization. However, the relaxation condition narrows the class of the systems to which the method is applicable.In an attempt to reduce computational effort, [21] approaches the problem of resilient state estimation using multiple observers. Contrast to the setting of [17, 20], [21] formulates the problem in continuous time linear dynamic systems setting and combines the estimates from multiple observers using the technique from compressed sensing. This method reduces l
0 optimization search space to a finite set leading to substantial reduction of computational effort from NP-hard to polynomial time. In addition, it is applicable to a large class of systems, compared to l
1 optimization method in [17], whose states are observable from the sensors.Adaptive parameter estimation methods with various nonlinear elements [22, 23] may be used to solve resilient state estimation problem. When combining multiple observer outputs, especially, when each observes different number of states, adaptive fuzzy technique [24–29] can be utilized. These venues, however, have not yet been actively pursued.The approach of current paper follows the setting of [21] and achieves computational complexity in the order of O
(
n
p
) with n being the number of states and p being the number of sensors, under the assumption that the system states are observable from each sensor.It should be pointed out that the proposed method requires the system states being observable with every sensor, which is not a necessary condition for the existing methods. From resilient system design point of view, however, this fact may not be critical because sensors can be chosen for resiliency in the design stage. On the other hand, the gained computational efficiency helps real-time implementation in practice.The contributions of this paper are to propose multiple observers combined by median operation as a means to solve resilient state estimation problem and achive higher computational efficiency compared to existing methods for a class of systems.The outline of this paper is as follows. The problem formulation is given in Section2. Section 3 presents the main designs and analyses, and Section 4 provides experimental results. Comparison to existing methods is given in Section 4 as well in terms of applicability and computational effort. The conclusions are formulated in Section 5.


## 2. Problem Formulation

Consider a linear time invariant system given by(1)
x
˙
t
=
A
x
t
+
B
u
t
+
d
t
,
y
t
=
C
x
t
,
w
t
=
y
t
+
a
t
+
ξ
t
,where x
∈
R
n is the plant state, u
∈
R
m is control, y
∈
R
p is the plant output, w
∈
R
p is the measurement for feedback control, d
∈
R
n is process disturbance, ξ
∈
R
p is sensor noise, and a
∈
R
p is a vector that represents the altered output value by external malicious attack. The matrices A, B, and C are in appropriate dimensions. Let the matrix C be written by(2)
C
=
C
1
C
2
⋮
C
p
,where each C
i for i
=
1,2
,
…
,
p is a row vector that corresponds to the i
th output y
i of the output vector y. The i
th sensor being under attack is described by i
th element of the vector a
t, denoted by a
i
t, being nonzero, and the value of a
i
t represents the amount of measurement altered by the external attack.In order to denote the set of sensors under attack, we introduce the following notation. The support of the vectora
t is defined as (3)
supp
⁡
a
t
=
i
∣
a
i
t
≠
0
,and the cardinality of the set supp
⁡
a
t is denoted by 
supp
⁡
a
t. The elements in the set supp
⁡
a
t are the indices of the attacked sensors.We now introduce assumptions for the system of (1).Assumption 1.
The setsupp
⁡
a
t satisfies 2

supp
⁡
a
t
<
p for all t.Assumption1 states that strictly less than half of all the sensors in the system may be under integrity attack. This is a standard assumption for resilient state estimation [17, 21] and in fact a necessary and sufficient condition for resilient state estimation problem to be solvable. The rationale is that the adversaries who attack the sensors have limited resource only enough to compromise a subset of the sensors.Assumption 2.
The pair(
C
i
,
A
) is observable for i
=
1,2
,
…
,
p.This assumption ensures that a bank ofp observers can be constructed. This assumption can be viewed as restrictive. However, from system design point of view, one can select sensors that satisfy Assumption 2.Assumption 3.
The vectorsd
t and ξ
t satisfy d
i
t
≤
d
max
⁡ for i
=
1,2
,
…
,
n and ξ
i
t
≤
ξ
max
⁡ for i
=
1,2
,
…
,
p.Assumption3 states that the process disturbance and measurement noise are bounded.We now formulate the following design problems.Problem 1.
Let Assumptions1 and 2 hold. Assume further that no process disturbance and measurement noise exist in the system; that is, d
t
=
0 and ξ
t
=
0. Furthermore, let C
i
=
C
0 for i
=
1,2
,
…
,
p. Construct a state estimator for the system of (1) such that the estimated state denoted by x
^
t asymptotically converges to x
t despite a
t
≠
0.Problem 2.
Let Assumptions1 and 2 hold. Assume further that d
(
t
)
=
0 and ξ
(
t
)
=
0. Construct a state estimator for the system of (1) such that the estimated state denoted by x
^
(
t
) asymptotically converges to x
(
t
) despite a
(
t
)
≠
0.It should be pointed out that unknown input observers (see, e.g., [30]), which address the problem of estimating states correctly despite unknown disturbances, may appear similar to Problems 1 and 2. However, the framework deals with unknown input entering the state dynamics instead of output equation, which differentiates Problems 1 and 2 from the problem of unknown input observers.Another aspect that differentiates Problems1 and 2 from existing work is that we seek a method of asymptotic estimation formulated in continuous dynamics, while [17, 20] seek instantaneous estimation formulated in discrete dynamics.The above formulated problems aim to achieve asymptotic state estimation and do not consider the effect of process disturbance and measurement noise. In practice, modeling errors, external process disturbance, and measurement noise exist. Hence, we formulate the following analysis problems.Problem 3.
Let Assumptions1, 2, and 3 hold. Analyze the effect of disturbance and measurement noise on the system of (1) and the state estimator of Problem 1.Problem 4.
Let Assumptions1, 2, and 3 hold. Analyze the effect of disturbance and measurement noise on the system of (1) and the state estimator of Problem 2.Solutions to Problems1–4 are given in Section 3.


## 3. Resilient State Estimation

### 3.1. Median Operation

First we define sample median operation. The sample median ofp many values w
1
,
w
2
,
…
,
w
p, denoted by med
⁡
(
w
1
,
…
,
w
p
), is defined by the p
+
1
/
2
th largest value of w
1
,
w
2
,
…
,
w
p if p is odd and defined by the average of the p
/
2
th and the p
/
2
+
1
th largest values of w
1
,
w
2
,
…
,
w
p if p is even.We now examine the property of median operation in the context of the system of (1). Suppose there are p measurements denoted by w
i with i
=
1,2
,
…
,
p, each measuring the same value denoted by y
0. Let w
i
=
y
0
+
a
i and a
i
≠
0 for i
∈
J. We denote the cardinality of J by q; that is, q
=
J. Then, it is straightforward to notice that, as long as the number of measurements p is greater than twice the number of elements in J, or equivalent to say 2
q
<
p, the median value is equal to y
0; that is,(4)
med
⁡
w
1
,
…
,
w
p
=
y
0
.Notice that the fact above holds regardless of the values ofa
i
(
t
) as long as 2
q
<
p at any given time. Note also that (4) holds even if the elements of J change in time. As an illustration, an example is given.Example 1.
Consider the case ofp
=
5. Assume that y
0
=
2, and J
=
1,3. Accordingly, let a
(
t
) be 3
0
5
0
0
T. Notice that q
=
2 in this case and 2
q
<
p is satisfied. Then, w
=
5
2
7
2
2
T and med(w
1
,
…
,
w
5) is given by 2, which is equal to y
0. If a
(
t
)
=
3
0
5
0
3
T, then, q
=
3, and 2
q
>
p. This yields w
=
5
2
7
2
5
T and med(w
1
,
…
,
w
5) is given by 5, which is not equal to y
0.For the case when measurement noise exists, we have the following property for the median. Letw, y, ξ, and a be p-dimensional vectors. The vector y is of the form y
=
y
0
1
1
⋯
1
T with y
0
∈
R, the vector ξ represents noise, and as in Assumption 3, each element of the vector ξ is bounded by a constant ξ
max
⁡; that is, |
ξ
i
|
≤
ξ
max
⁡, the vector a
(
t
) satisfies 
supp
⁡
a
t
=
q with 2
q
<
p, and let the vector w be given by w
=
y
+
ξ
+
a. Then, we have the following for the sample median operation:(5)
med
⁡
w
1
,
…
,
w
p
-
y
0
≤
ξ
max
⁡
.In words, this means when all the measurement is subject to bounded noise, sample median is also subject to noise, with the same bound as that for each element of the vector representing measurement noise. The derivation of (5) is in the appendix.


### 3.2.  Design of Resilient State Observer

Now we propose a solution to Problem1. Since all p sensors are measuring the same physical quantity, that is, C
i
=
C
0, for 1
≤
i
≤
p, we construct a Luenberger state observer in the following manner:(6)
x
^
˙
=
A
x
^
+
B
u
+
L
med
⁡
w
1
,
w
2
,
…
,
w
p
-
C
0
x
^
,where the gain matrix L is chosen such that A
-
L
C
0 is Hurwitz. Then it can be shown that, for the system of (1) with d
(
t
)
=
0 and ξ
(
t
)
=
0, the state observer (6) satisfies x
^
(
t
)
→
x
(
t
) as t
→
∞. In words, asymptotic state estimation is obtained by using (6). Specifically, since all the sensors measure the same output, we can denote this output by y
0 where y
0
=
C
0
x. As explained earlier, under Assumption 1, med
⁡
w
1
,
…
,
w
p
=
y
0 is obtained. Also, due to Assumption 2, the matrix L can always be chosen to render A
-
L
C
0 Hurwitz. This ensures the state estimate x
^ asymptotically converges to x.Therefore, the state observer of (6) is a solution to Problem 1. It ensures asymptotic state estimation despite external attack a
(
t
) as long as the number of attacked sensors is less than half of all the sensors (Assumption 1). We emphasize that this solution is computationally very efficient as the computational complexity of median operation of p variables is given by O
(
p
).Next we consider the case where not allp sensors measure the same physical quantities. As given in Assumption 2, the system states are observable from each sensor. For each sensor output y
i, one can design a Luenberger type observer that estimates the state x asymptotically. The state estimate from i
th sensor is denoted by z
i
∈
R
n with a superscript i. Then, Assumption 2 allows design of the observer,(7)
z
˙
i
=
A
z
i
+
B
u
+
L
i
w
i
-
C
i
z
i
,
i
=
1,2
,
…
,
p
,where L
i can be selected such that (
A
-
L
i
C
i
) is Hurwitz. By combining p state estimates z
1
,
z
2
,
…
,
z
p through median operation, we can obtain a state estimate(8)
x
^
=
x
^
1
,
…
,
x
^
n
T
,where (9)
x
^
j
=
med
⁡
z
j
1
,
z
j
2
,
…
,
z
j
p
,
j
=
1,2
,
…
,
n
.For the method in (7)–(9) to work, an additional assumption is needed.Assumption 4.
The setsupp
⁡
a
t does not change over time.The additional assumption is needed to avoid the case that attacks excite the transients response of each observer in (7) in a manner that prevents x
^
(
t
) from converging to x
(
t
). With Assumption 4, it can be shown that, for the system of (1) with d
(
t
)
=
0 and ξ
(
t
)
=
0, the state estimation method given by (7)–(9) achieves x
^
(
t
)
→
x
(
t
) as t
→
∞. This is possible because, under Assumption 1, more than half of p observers yield correct state estimates. Combining them through median would remove the effect of nonzero attack vector a
(
t
) and ensure asymptotic state estimate. Detailed derivation is given in the appendix. Therefore, the state estimation method of (7)–(9) for the system (1) provides a solution to Problem 2. Note that the additional computational effort for resiliency in this case is O
(
n
p
), which is more scalable than NP-hard [17, 20], or polynomial time of [21].


### 3.3.  Effect of Measurement Noise and Process Disturbance

Now we analyse the proposed state estimation method when measurement noise and process disturbances exist. In the presence of measurement noise and disturbance, asymptotic state estimation is generally not possible even without external attack. Hence, we focus on finding a bound on the estimation error. From a practical point of view, we deal with measurement noise and process disturbance that are bounded. Hence, Assumption3 applies throughout this subsection.First we consider the system of (1) with multiple sensors that measure the same physical quantity; that is, C
i
=
C
0 for i
=
1,2
,
…
,
p. Then, it can be shown that there exist some positive constants μ and λ such that the state estimation given by (6) yields(10)
x
^
t
-
x
t
2
≤
μ
x
^
0
-
x
0
2
e
-
λ
t
+
μ
L
2
ξ
max
⁡
+
d
max
⁡
λ
.Note that inequality (10) implies that the estimation error is bounded when bounded noise as well as process disturbance is present. Note moreover that the first term in (10) diminishes as time goes and the bound on the remaining term in the error is proportional to the bounds of the measurement noise ξ
max
⁡ and d
max
⁡. This solves Problem 3 given in Section 2. The derivation of (10) is given in the appendix.For the case with the sensors measuring different physical quantities, resilient state estimation is achieved by the method given in (7)–(9). When measurement noise and process disturbance exist, the method of (7)–(9) does not achieve asymptotic estimation. It turns out, however, that (10) holds for this case as well although the derivation now is more involved using p observers and element-wise median operation. Hence (10) solves Problem 4. The detailed derivation for this case is given in the appendix.We would like to emphasize that the bound on estimation error does not depend on attack vectora
(
t
). Attack can be arbitrarily large, but the effect is eliminated by resilient state estimator construction, and the bound on error only depends on the initial error, the bound d
max
⁡ of process disturbance, and the bound ξ
max
⁡ for the measurement noise.


## 3.1. Median Operation

First we define sample median operation. The sample median ofp many values w
1
,
w
2
,
…
,
w
p, denoted by med
⁡
(
w
1
,
…
,
w
p
), is defined by the p
+
1
/
2
th largest value of w
1
,
w
2
,
…
,
w
p if p is odd and defined by the average of the p
/
2
th and the p
/
2
+
1
th largest values of w
1
,
w
2
,
…
,
w
p if p is even.We now examine the property of median operation in the context of the system of (1). Suppose there are p measurements denoted by w
i with i
=
1,2
,
…
,
p, each measuring the same value denoted by y
0. Let w
i
=
y
0
+
a
i and a
i
≠
0 for i
∈
J. We denote the cardinality of J by q; that is, q
=
J. Then, it is straightforward to notice that, as long as the number of measurements p is greater than twice the number of elements in J, or equivalent to say 2
q
<
p, the median value is equal to y
0; that is,(4)
med
⁡
w
1
,
…
,
w
p
=
y
0
.Notice that the fact above holds regardless of the values ofa
i
(
t
) as long as 2
q
<
p at any given time. Note also that (4) holds even if the elements of J change in time. As an illustration, an example is given.Example 1.
Consider the case ofp
=
5. Assume that y
0
=
2, and J
=
1,3. Accordingly, let a
(
t
) be 3
0
5
0
0
T. Notice that q
=
2 in this case and 2
q
<
p is satisfied. Then, w
=
5
2
7
2
2
T and med(w
1
,
…
,
w
5) is given by 2, which is equal to y
0. If a
(
t
)
=
3
0
5
0
3
T, then, q
=
3, and 2
q
>
p. This yields w
=
5
2
7
2
5
T and med(w
1
,
…
,
w
5) is given by 5, which is not equal to y
0.For the case when measurement noise exists, we have the following property for the median. Letw, y, ξ, and a be p-dimensional vectors. The vector y is of the form y
=
y
0
1
1
⋯
1
T with y
0
∈
R, the vector ξ represents noise, and as in Assumption 3, each element of the vector ξ is bounded by a constant ξ
max
⁡; that is, |
ξ
i
|
≤
ξ
max
⁡, the vector a
(
t
) satisfies 
supp
⁡
a
t
=
q with 2
q
<
p, and let the vector w be given by w
=
y
+
ξ
+
a. Then, we have the following for the sample median operation:(5)
med
⁡
w
1
,
…
,
w
p
-
y
0
≤
ξ
max
⁡
.In words, this means when all the measurement is subject to bounded noise, sample median is also subject to noise, with the same bound as that for each element of the vector representing measurement noise. The derivation of (5) is in the appendix.


## 3.2.  Design of Resilient State Observer

Now we propose a solution to Problem1. Since all p sensors are measuring the same physical quantity, that is, C
i
=
C
0, for 1
≤
i
≤
p, we construct a Luenberger state observer in the following manner:(6)
x
^
˙
=
A
x
^
+
B
u
+
L
med
⁡
w
1
,
w
2
,
…
,
w
p
-
C
0
x
^
,where the gain matrix L is chosen such that A
-
L
C
0 is Hurwitz. Then it can be shown that, for the system of (1) with d
(
t
)
=
0 and ξ
(
t
)
=
0, the state observer (6) satisfies x
^
(
t
)
→
x
(
t
) as t
→
∞. In words, asymptotic state estimation is obtained by using (6). Specifically, since all the sensors measure the same output, we can denote this output by y
0 where y
0
=
C
0
x. As explained earlier, under Assumption 1, med
⁡
w
1
,
…
,
w
p
=
y
0 is obtained. Also, due to Assumption 2, the matrix L can always be chosen to render A
-
L
C
0 Hurwitz. This ensures the state estimate x
^ asymptotically converges to x.Therefore, the state observer of (6) is a solution to Problem 1. It ensures asymptotic state estimation despite external attack a
(
t
) as long as the number of attacked sensors is less than half of all the sensors (Assumption 1). We emphasize that this solution is computationally very efficient as the computational complexity of median operation of p variables is given by O
(
p
).Next we consider the case where not allp sensors measure the same physical quantities. As given in Assumption 2, the system states are observable from each sensor. For each sensor output y
i, one can design a Luenberger type observer that estimates the state x asymptotically. The state estimate from i
th sensor is denoted by z
i
∈
R
n with a superscript i. Then, Assumption 2 allows design of the observer,(7)
z
˙
i
=
A
z
i
+
B
u
+
L
i
w
i
-
C
i
z
i
,
i
=
1,2
,
…
,
p
,where L
i can be selected such that (
A
-
L
i
C
i
) is Hurwitz. By combining p state estimates z
1
,
z
2
,
…
,
z
p through median operation, we can obtain a state estimate(8)
x
^
=
x
^
1
,
…
,
x
^
n
T
,where (9)
x
^
j
=
med
⁡
z
j
1
,
z
j
2
,
…
,
z
j
p
,
j
=
1,2
,
…
,
n
.For the method in (7)–(9) to work, an additional assumption is needed.Assumption 4.
The setsupp
⁡
a
t does not change over time.The additional assumption is needed to avoid the case that attacks excite the transients response of each observer in (7) in a manner that prevents x
^
(
t
) from converging to x
(
t
). With Assumption 4, it can be shown that, for the system of (1) with d
(
t
)
=
0 and ξ
(
t
)
=
0, the state estimation method given by (7)–(9) achieves x
^
(
t
)
→
x
(
t
) as t
→
∞. This is possible because, under Assumption 1, more than half of p observers yield correct state estimates. Combining them through median would remove the effect of nonzero attack vector a
(
t
) and ensure asymptotic state estimate. Detailed derivation is given in the appendix. Therefore, the state estimation method of (7)–(9) for the system (1) provides a solution to Problem 2. Note that the additional computational effort for resiliency in this case is O
(
n
p
), which is more scalable than NP-hard [17, 20], or polynomial time of [21].


## 3.3.  Effect of Measurement Noise and Process Disturbance

Now we analyse the proposed state estimation method when measurement noise and process disturbances exist. In the presence of measurement noise and disturbance, asymptotic state estimation is generally not possible even without external attack. Hence, we focus on finding a bound on the estimation error. From a practical point of view, we deal with measurement noise and process disturbance that are bounded. Hence, Assumption3 applies throughout this subsection.First we consider the system of (1) with multiple sensors that measure the same physical quantity; that is, C
i
=
C
0 for i
=
1,2
,
…
,
p. Then, it can be shown that there exist some positive constants μ and λ such that the state estimation given by (6) yields(10)
x
^
t
-
x
t
2
≤
μ
x
^
0
-
x
0
2
e
-
λ
t
+
μ
L
2
ξ
max
⁡
+
d
max
⁡
λ
.Note that inequality (10) implies that the estimation error is bounded when bounded noise as well as process disturbance is present. Note moreover that the first term in (10) diminishes as time goes and the bound on the remaining term in the error is proportional to the bounds of the measurement noise ξ
max
⁡ and d
max
⁡. This solves Problem 3 given in Section 2. The derivation of (10) is given in the appendix.For the case with the sensors measuring different physical quantities, resilient state estimation is achieved by the method given in (7)–(9). When measurement noise and process disturbance exist, the method of (7)–(9) does not achieve asymptotic estimation. It turns out, however, that (10) holds for this case as well although the derivation now is more involved using p observers and element-wise median operation. Hence (10) solves Problem 4. The detailed derivation for this case is given in the appendix.We would like to emphasize that the bound on estimation error does not depend on attack vectora
(
t
). Attack can be arbitrarily large, but the effect is eliminated by resilient state estimator construction, and the bound on error only depends on the initial error, the bound d
max
⁡ of process disturbance, and the bound ξ
max
⁡ for the measurement noise.


## 4. Experiment

### 4.1. Modeling

The proposed methods of resilient state estimation are experimentally validated using a magnetic leviation control system. Figure1 shows the magnetic levitation system developed by Quanser for control education purpose. It consists of electromagnet, infrared ray position sensor, a steel ball, voltage amplifier, ADC converter, and data acquisition system connected to a PC using USB cable. A control algorithm is implemented using real-time workshop in Matlab/Simulink.Figure 1
Magnetic levitation system.The system model is given by [31](11)
x
˙
1
=
x
2
,
x
˙
2
=
g
-
K
m
I
2
M
b
x
1
2
,
y
=
x
1
,where x
1 is the position of the ball, x
2 is the velocity of the ball, g is the gravitational constant, I is the current applied to the electromagnet, K
m is the electromagnet force constant, and M
b is the metal ball mass. Values for parameters K
m and M
b are specified in [31]. By linearizing the dynamics of (11) at the equilibrium point of x
eq
=
0.006
0
T and I
eq
=
1, the following linear model is obtained:(12)
Δ
x
˙
=
A
Δ
x
+
B
Δ
I
=
0
1
3270
0
Δ
x
1
Δ
x
2
+
0
-
26.67
Δ
I
,where Δ is used to indicate deviations from the equilibrium state x
eq and input I
eq.Quanser magnetic levitation system has only one sensor that measures the position of the steel ball. In order to apply the proposed state estimation method, we virtually create in Matlab an additional position sensor and a velocity sensor. Then, the system output equation including attack can be written as(13)
w
1
w
2
w
3
=
C
1
C
2
C
3
Δ
x
1
Δ
x
2
+
a
1
a
2
a
3
,where C
1
=
[
1
0
], C
2
=
[
1
0
], and C
3
=
[
0
1
]. It can be easily verified that the system of (12) and (13) satisfies Assumption 2.


### 4.2.  Attack Scenario and State Estimation Results

We construct resilient state estimator given in (7)–(9). In the case of the magnetic levitation plant, the method yields three Luenberger observers as we have three sensors. Each observer dynamics is given by(14)
z
˙
i
=
A
z
i
+
B
Δ
I
+
L
i
w
i
-
C
i
z
i
,where i
=
1,2
,
3 is the index for the i
th sensor, z
i is the i
th observer state, and w
i is the output of the i
th sensor. The observer gain matrix L
i is selected such that A
-
L
i
C
i is Hurwitz for all i
=
1,2
,
3. Specifically, the gains are L
1
=
200
13271
T, L
2
=
210
14299
T, and L
3
=
4.0584
200
T, respectively. Then, Δ
x
^ is computed by (15)
Δ
x
^
1
=
med
⁡
z
1
1
,
z
1
2
,
z
1
3
,
Δ
x
^
2
=
med
⁡
z
2
1
,
z
2
2
,
z
2
3
.Finally, the state estimate around the equilibrium is obtained by x
^
=
Δ
x
^
+
x
eq.We consider the scenario where the velocity sensor, which provides the third measurement, is compromised by adversaries. The attack on the sensor,a
3
(
t
), consists of constant, ramp, sinusoid, and square waves as shown in Figure 2.Figure 2
Attack signal on the third sensor.The estimated statex
^ and true state x are shown in Figure 3. As expected, x
^ is practically identical with x despite the attack on the velocity sensor. Slight mismatches between the two are due to modeling uncertainty which act as if they were disturbance.Figure 3
The estimated state and the true state.For further investigation, Figure4 shows state estimates z
1
,
z
2, and z
3 from the three observers. The effect of attack is clearly present in z
3. As shown by the analysis in Section 3, the element-wise median operation removes the effect of z
3 on x
^.Figure 4
The states estimates from each Luenberger observer.As illustrated by the above experiments, the proposed state estimation method is resilient against external attacks on the measurement.


### 4.3.  Comparison with Existing Methods

Here we consider the method of [17] with the magnetic levitation system. It is difficult to apply the method of [17] on the magnetic levitation system for two reasons. First, the exact optimization using l
0 norm is computationally expensive (NP-hard) and no efficient method is known for l
0 optimization. Second, the relaxation condition in [17] for enabling l
1 convex optimization isnot satisfied for the magnetic levitation system. Hence we do not implement and compare the method of [17] in the context of experiment with magnetic levitation.The proposed method and that of [21] are compared in the following manner. From the above experiment, data from the sensors are stored. Then, two state estimation algorithms coded in Matlab m-file are executed on the stored sensor data, respectively. In this way, the execution times for the two algorithms alone (separated from the computation needed for control and communications) can be measured and compared.We compared the two for the cases of 3, 5, 7, and 9 sensors. The cases of 5, 7, and 9 sensors use duplicated data from the first sensor for the sake of simplicity. The sensor data is collected over 58001 samples, and the time for 58001 executions of each algorithm is measured to obtain average value. Each Matlab code is executed on a computer with Intel i7-4790 CPU, 3.60 GHz clock speed, 32 GB RAM, and 64-bit Windows operating system. Both algorithms correctly estimate the true states despite attacks, although no plots are shown as our main interest here is the computational efficiency. Average execution time for the two algorithms is listed in Table1.Table 1
Computation time comparison between the proposed method and the method in [21].
Number of sensors
Proposed method
Method in [21]
3
0.06259 (msec)
0.1547 (msec)
5
0.08098 (msec)
0.5258 (msec)
7
0.01017 (msec)
2.115 (msec)
9
0.1196 (msec)
9.293 (msec)Clearly, the proposed method is superior to the method in [21] in terms of computational effort, showing smaller computation time by orders of magnitude. We point out that method of [21] is superior to the proposed method in terms of applicability: the condition of systems states being observable from every sensor is not necessary for [21].


## 4.1. Modeling

The proposed methods of resilient state estimation are experimentally validated using a magnetic leviation control system. Figure1 shows the magnetic levitation system developed by Quanser for control education purpose. It consists of electromagnet, infrared ray position sensor, a steel ball, voltage amplifier, ADC converter, and data acquisition system connected to a PC using USB cable. A control algorithm is implemented using real-time workshop in Matlab/Simulink.Figure 1
Magnetic levitation system.The system model is given by [31](11)
x
˙
1
=
x
2
,
x
˙
2
=
g
-
K
m
I
2
M
b
x
1
2
,
y
=
x
1
,where x
1 is the position of the ball, x
2 is the velocity of the ball, g is the gravitational constant, I is the current applied to the electromagnet, K
m is the electromagnet force constant, and M
b is the metal ball mass. Values for parameters K
m and M
b are specified in [31]. By linearizing the dynamics of (11) at the equilibrium point of x
eq
=
0.006
0
T and I
eq
=
1, the following linear model is obtained:(12)
Δ
x
˙
=
A
Δ
x
+
B
Δ
I
=
0
1
3270
0
Δ
x
1
Δ
x
2
+
0
-
26.67
Δ
I
,where Δ is used to indicate deviations from the equilibrium state x
eq and input I
eq.Quanser magnetic levitation system has only one sensor that measures the position of the steel ball. In order to apply the proposed state estimation method, we virtually create in Matlab an additional position sensor and a velocity sensor. Then, the system output equation including attack can be written as(13)
w
1
w
2
w
3
=
C
1
C
2
C
3
Δ
x
1
Δ
x
2
+
a
1
a
2
a
3
,where C
1
=
[
1
0
], C
2
=
[
1
0
], and C
3
=
[
0
1
]. It can be easily verified that the system of (12) and (13) satisfies Assumption 2.


## 4.2.  Attack Scenario and State Estimation Results

We construct resilient state estimator given in (7)–(9). In the case of the magnetic levitation plant, the method yields three Luenberger observers as we have three sensors. Each observer dynamics is given by(14)
z
˙
i
=
A
z
i
+
B
Δ
I
+
L
i
w
i
-
C
i
z
i
,where i
=
1,2
,
3 is the index for the i
th sensor, z
i is the i
th observer state, and w
i is the output of the i
th sensor. The observer gain matrix L
i is selected such that A
-
L
i
C
i is Hurwitz for all i
=
1,2
,
3. Specifically, the gains are L
1
=
200
13271
T, L
2
=
210
14299
T, and L
3
=
4.0584
200
T, respectively. Then, Δ
x
^ is computed by (15)
Δ
x
^
1
=
med
⁡
z
1
1
,
z
1
2
,
z
1
3
,
Δ
x
^
2
=
med
⁡
z
2
1
,
z
2
2
,
z
2
3
.Finally, the state estimate around the equilibrium is obtained by x
^
=
Δ
x
^
+
x
eq.We consider the scenario where the velocity sensor, which provides the third measurement, is compromised by adversaries. The attack on the sensor,a
3
(
t
), consists of constant, ramp, sinusoid, and square waves as shown in Figure 2.Figure 2
Attack signal on the third sensor.The estimated statex
^ and true state x are shown in Figure 3. As expected, x
^ is practically identical with x despite the attack on the velocity sensor. Slight mismatches between the two are due to modeling uncertainty which act as if they were disturbance.Figure 3
The estimated state and the true state.For further investigation, Figure4 shows state estimates z
1
,
z
2, and z
3 from the three observers. The effect of attack is clearly present in z
3. As shown by the analysis in Section 3, the element-wise median operation removes the effect of z
3 on x
^.Figure 4
The states estimates from each Luenberger observer.As illustrated by the above experiments, the proposed state estimation method is resilient against external attacks on the measurement.


## 4.3.  Comparison with Existing Methods

Here we consider the method of [17] with the magnetic levitation system. It is difficult to apply the method of [17] on the magnetic levitation system for two reasons. First, the exact optimization using l
0 norm is computationally expensive (NP-hard) and no efficient method is known for l
0 optimization. Second, the relaxation condition in [17] for enabling l
1 convex optimization isnot satisfied for the magnetic levitation system. Hence we do not implement and compare the method of [17] in the context of experiment with magnetic levitation.The proposed method and that of [21] are compared in the following manner. From the above experiment, data from the sensors are stored. Then, two state estimation algorithms coded in Matlab m-file are executed on the stored sensor data, respectively. In this way, the execution times for the two algorithms alone (separated from the computation needed for control and communications) can be measured and compared.We compared the two for the cases of 3, 5, 7, and 9 sensors. The cases of 5, 7, and 9 sensors use duplicated data from the first sensor for the sake of simplicity. The sensor data is collected over 58001 samples, and the time for 58001 executions of each algorithm is measured to obtain average value. Each Matlab code is executed on a computer with Intel i7-4790 CPU, 3.60 GHz clock speed, 32 GB RAM, and 64-bit Windows operating system. Both algorithms correctly estimate the true states despite attacks, although no plots are shown as our main interest here is the computational efficiency. Average execution time for the two algorithms is listed in Table1.Table 1
Computation time comparison between the proposed method and the method in [21].
Number of sensors
Proposed method
Method in [21]
3
0.06259 (msec)
0.1547 (msec)
5
0.08098 (msec)
0.5258 (msec)
7
0.01017 (msec)
2.115 (msec)
9
0.1196 (msec)
9.293 (msec)Clearly, the proposed method is superior to the method in [21] in terms of computational effort, showing smaller computation time by orders of magnitude. We point out that method of [21] is superior to the proposed method in terms of applicability: the condition of systems states being observable from every sensor is not necessary for [21].


## 5. Conclusion

This paper addresses the problem of resilient state estimation against malicious attacks on the sensors. We propose a state estimation with a bank of observers combined through median operations. Then, we show that this method is resilient in the sense that state estimation converges to the true state despite existence of attacks on sensors. For practical considerations, the effect of sensor noise and process disturbance on the proposed state estimation is analyzed.We point out that the proposed method requires the system states being observable with every sensor, which is not required for the existing methods. This may not be a critical limitation because sensors can be chosen in the system design stage in applications where resiliency is of importance.We emphasize that the proposed method is computationally efficient compared to existing methods in the literature, yielding the complexity ofO
(
n
p
) with n being the number of system states and p being the number of sensors. The gained computational efficiency helps real-time implementation for feedback systems in practice. Due to the simplicity of the state estimator structure and computational advantage over the existing method, the proposed method will benefit the design of resilient control systems.Developing resilient state estimation methods using adaptive parameter estimation techniques is a future work.



---

*Source: 3750264-2016-03-07.xml*