# Takagi–Sugeno Fuzzy Control for a Nonlinear Networked System Exposed to a Replay Attack

Authors: Reda El Abbadi; Hicham Jamouli
Journal: Mathematical Problems in Engineering
 (2021)

---

## Abstract

This article investigates the stabilization problem of a nonlinear networked control system (NCS) exposed to a replay attack. A new mathematical model of the replay attack is proposed. The resulting closed-loop system is defined as a discrete-time Markovian jump linear system (MJLS). Employing the Lyapunov–Krasovskii functional, a sufficient condition for stochastic stability is given in the form of linear matrix inequalities (LMIs). The control law can be obtained by solving these LMIs. Finally, a simulation of an inverted pendulum (IP) with Matlab is developed to illustrate our controller’s efficiency.


---

## Body

## 1. Introduction

A networked control system (NCS) is a system in which all the data (control input, sensor readings, etc.) are transferred via a communication network. This novel kind of system differs significantly from the classical control systems, where the exchanges of the data pass via electrical wiring. The main advantages of the communication network are flexibility, high efficiency, and reasonable price. Nevertheless, a new issue arose with the use of this control implementation compared with the old wired control systems, such as the packet loss. This problem has been the subject of much systematic investigation, where Lu et al. [1] used the Bernoulli distribution to model the packet loss of the information transmitted through the network. Yu et al. [2] modelled the NCS with data packet dropout as a linear jump system. Chen et al. [3] studied the H∞ control of a nonlinear NCS with data packet dropout, where the data packet dropout was described as a homogeneous Bernoulli process and the global system was modelled as a Takagi–Sugeno (T-S) fuzzy system. Xiong and Lam [4] considered two categories of packet dropout; the first category was the random packet loss process, whereas the second was the Markovian packet loss process.Moreover, the control issue of an NCS with time delay and packet dropout was established in [5–8], where Qi et al. [5] studied the event-triggered H∞ control problem for networked switched systems with a mixed time and state-dependent switching law taking into consideration the effect of the network delay. Wang et al. [6] investigated the H∞ issue for NCS with packet dropout and varying time delays. Wang et al. [7] studied the robust H∞ fault detection dilemma for NCS with Markov time delay and packet loss in both communication channels. Qiu et al. [8] treated the stability problem for an NCS with random time delays and packet dropouts based on a unified Markov jump model. For more information on stochastic control using Markov chains, we refer the interested reader to [9].In addition to the network problems mentioned above. The cyberattacks pose a significant threat to the NCS, especially after a series of successful attacks. In the last ten years, the Stuxnet virus was considered the most dangerous cyberattack in history. This virus targeted Iranian nuclear facilities and caused enormous losses [10]. Stuxnet has the same characteristic as a replay attack [11, 12], it registers the measurements of the sensors; after that, it replaces the new sensor’s output with previous measurements that are already saved and stocked by the cybercriminal. This type of attack is commonly a principal source of instability.Due to the Stuxnet events, the control issues of a cyber system under a replay attack have attracted many researchers. The majority of these works have a common point. They had used a based-detector method to identify the replay attack by injecting a noisy signal as an authentication signal to the nominal control input. Then, they calculated the control law basing on the information offering by the detector. However, when the detection rate increases, the control efficacy deteriorates. A trade-off exists between the detection rate and the degradation of the control efficiency in terms of the variance of the authentication signal [13]. Moreover, the absenteeism of the attack when the adversary decides to stop the attack for a while produces a waste of control cost [11]. Consequently, new technical solutions are required to design the control law based upon the mathematical model of the replay attack. At our best knowledge, up to now, far too little attention has been paid to study this problem using the mathematical-based method, which motivates the study of this paper. The main objective of this article is to use an accurate mathematical model of the replay attack to calculate a robust feedback controller that guarantees the stability and conserves the control efficacy, with or without the existence of the replay attack.The main contribution of this article is to model the nonlinear NCS against a replay attacker as a discrete-time Markovian jump linear system (MJLS), where a two-state Markov chain is used to describe the attack apparition, and a finite-state Markov chain is utilized to model the replay delay value. Based on this mathematical model, we will develop a new LMI employing the Lyapunov–Krasovskii functional.Due to the various uses of the inverted pendulum (IP) in many fields, this system is considered one of the best applications of the NCS. Including its distinct physical characteristic (strong nonlinearity), these particularities encouraged us to choose it as an application system to test the robustness of our approach. Many methods are utilized to model the IP. For instance, Wang [14] modelled the IP based on the Euler–Lagrange equations. Furthermore, Çakan et al. [15] built for the IP a virtual prototype using MSC Adams software, this prototype was exporting to MATLAB, and the simulation was realized via MATLAB and MSC Adams software. In this study, we will use the Euler–Lagrange equations to give a mathematical model to the IP. Then, we will discretize the differential equations by using the discretization method of the first order (Euler). After that, we will linearise the discrete model creating the Takagi–Sugeno (T-S) fuzzy model of the IP, which means writing the nonlinear model in the form of many linear subsystems that are connected to membership function [16]. The overall number of subsystems depend on the number of nonlinearity exist in the system. For more information on the T-S fuzzy model and its applications, we refer the interested reader to [17–20].The article is organized as follows: first, we will represent our model of the replay attack, and we will describe the structure of the global system. Section3 develops the sufficient stability conditions of the overall system. After that, in Section 4, we will use the Euler–Lagrange equations to give a mathematical model to the IP. In Section 4.3, two simulations will be performed to investigate the effectiveness of the proposed approach. Finally, in Section 5, a brief conclusion is presented to sum up the approach.Notations. Let (Ω,ℱ,ℙ) be a complete probability space. X1>0 and X1<0 are utilized to denote a positive and negative definite matrices, respectively. Notation X1≥X2 (respectively, X1>X2) where X1 and X2 are real symmetric matrices, meaning that X1−X2 is positive semidefinite (respectively, positive definite). diag(X1,…,Xn) refers to an n×n diagonal matrix with Xi as its ith diagonal entry. 0n denotes the zero matrix, whereas In denotes the identity matrix with appropriate dimensions. The delimiter . refers to the Euclidean norm for vectors and induced 2-norm for matrices. The operator E. denotes the mathematical expectation. The superscript T denotes the transpose for vectors or matrices. The symbol ∗ stands for the symmetric terms of the corresponding off-diagonal term. The notation sym(X1) is employed to denote the expression X1+X1T.


## 2. Replay Attack Model and Networked Controller

### 2.1. Replay Attack

A replay attack is a type of cyberattack in which a cybercriminal eavesdrops on a secure communication network, intercepts the data, and then maliciously delays or retransmits it to misdirect the system into doing what the adversary wants (Figure1). The thing that makes the replay attack one of the most perilous cyberattacks is that the adversary does not even need advanced skills to decrypt the data, he just needs to record the sensing data secretly and then resend it to the controller after modifying the sensors’ output fraudulently to push the controller to take wrong decisions which could destabilize the system in the feedback loop.Figure 1
Adversary attack.To explain how the replay attack behaves, an illustrative example will be utilized (Figure2), where the first line represents the transmitted sequence and the second line represents the received sequence under the replay attack. We suppose that the attacker records from 100 to 101, and then he replays it from 102 to 103. In other words, the adversary replaces the packets 102 and 103 by 100 and 101, respectively. The same procedure for the packet 200, but this time the replay delay equals 3Te; that means he saves the packets 197; 198; 199. Then, he replays it from 200 to 202.Figure 2
Replay attack.


### 2.2. Problem Formulation

This article deals with the control problem of a nonlinear NCS with a replay attack. As Figure3 shows, the transmission of the packets from the sensor to the controller passes via a communication network. We assume that an attacker has connected to the communication network of the system. To keep himself undercover and avoid being detected by the classical detectors, the attacker will not apply the attack all the time (steadily); he will appear at different times (randomly). This action will reflect negatively on the stability of the system.Figure 3
Structure of the physical process with a replay attack.The framework of nonlinear NCS exposed to a replay attack is depicted in Figure3. The T-S fuzzy model can be seen as represented by s plant rules. The ith plant rule is(1)Rulei:ifz1kisMi1and…and ifzrkisMir.Then,(2)xk+1=Aixk+Biuk,where xk∈ℝn denotes the system state and uk∈ℝm denotes the control input. Ai∈ℝn×n and Bi∈ℝn×m are the system matrices.Using a standard fuzzy inference, the final state of the fuzzy model is inferred as follows:(3)xk+1=∑i=1shixAixk+Biuk,where(4)hix=hizk=wizk∑l=1swlzk,wlzk=∏l=1jμi,lzlk,wizk is the attributed weight for each rule i, and μi,lzlk is the appurtenance degree of the membership function to the fuzzy set Mi,j.The functionshiz satisfies the convex sum property, i.e, ∑i=1shiz=1, and 0≤hiz≤1, with i = 1…s.The state feedback controller can be driven by the next rules:(5)Rulej:ifz1kisMj1and,…,and ifzrkisMjr.Then,(6)uk=∑j=1shjxKjx¯k,where Kj∈ℝm×n is the controller gain and x¯k is the controller input with(7)x¯k=1−δkxk+δkxk−τk.The variableδ is a two-state Markov model that represents the state of the switch S, Figure 4. If the communication link between the sensor and the controller was perfect, δ will be equal to 0. Otherwise, if there was a communication problem (communication delay and/or replay attack), δ will be equal to 1. τk represents the replay delay and/or the network delay; that means if there is an attack, the state x(k) will be changed by the previous state xk−τ1k. However, if there is a communication delay, the state x(k) will be equal to xk−τ2k. Finally, if there are a replay attack and a network delay simultaneously, the state x(k) will be equal to xk−τ1k−τ2k, and since the delays τ1k and τ2k are variables, we can unify the two variables in one variable τk, where τk is a random scalar which bounded between τmin and τmax, such as 0≤τmin≤τk≤τmax. Consequently, the controller (6) will be switching between several subsystems based on the value of δk and τk. The switching controller has been widely used for other similar systems (see [21, 22], and the references therein).Figure 4
Two-state Markov model.Replacing the equation (6) in (2), we obtain a discrete-time MJLS defined on a complete probability space (Ω,ℱ,ℙ):(8)xk+1=A¯CLδkxk+A¯dδkxk−τk,where A¯CLδk=A¯+1−δkB¯K¯ and A¯dδk=δkB¯K¯, A¯=∑i=1shixAi, B¯=∑i=1shixBi, K¯=∑j=1shjxKj, {δk,k∈ℤ} is a two-state Markov chain which takes value in the set S1≜0,1, and { τk,k∈ℤ } is a finite-state discrete-time homogeneous Markov chains which takes value in the finite set S2≜0,1,…,τmax. The transition probability matrices are(9)Probδk+1=β|δk=α=Παβ,Probτk+1=η|τk=ν=Θνη,where Παβ≥0 and Θνη≥0 for all α,β∈S1, ν,η∈S2, and(10)∑β=01Παβ=1,∑η=0τmaxΘνη=1.Definition 1.
(see [23]). The system (8) is stochastically stable if for any initial condition x0=x0 and initial modes δ0=δ0∈S1, τ0=τ0∈S2, there exists a finite Ξ>0 such that the following inequality holds:(11)E∑k=0∞xk2|x0,δ0,τ0<x0TΞx0.


## 2.1. Replay Attack

A replay attack is a type of cyberattack in which a cybercriminal eavesdrops on a secure communication network, intercepts the data, and then maliciously delays or retransmits it to misdirect the system into doing what the adversary wants (Figure1). The thing that makes the replay attack one of the most perilous cyberattacks is that the adversary does not even need advanced skills to decrypt the data, he just needs to record the sensing data secretly and then resend it to the controller after modifying the sensors’ output fraudulently to push the controller to take wrong decisions which could destabilize the system in the feedback loop.Figure 1
Adversary attack.To explain how the replay attack behaves, an illustrative example will be utilized (Figure2), where the first line represents the transmitted sequence and the second line represents the received sequence under the replay attack. We suppose that the attacker records from 100 to 101, and then he replays it from 102 to 103. In other words, the adversary replaces the packets 102 and 103 by 100 and 101, respectively. The same procedure for the packet 200, but this time the replay delay equals 3Te; that means he saves the packets 197; 198; 199. Then, he replays it from 200 to 202.Figure 2
Replay attack.


## 2.2. Problem Formulation

This article deals with the control problem of a nonlinear NCS with a replay attack. As Figure3 shows, the transmission of the packets from the sensor to the controller passes via a communication network. We assume that an attacker has connected to the communication network of the system. To keep himself undercover and avoid being detected by the classical detectors, the attacker will not apply the attack all the time (steadily); he will appear at different times (randomly). This action will reflect negatively on the stability of the system.Figure 3
Structure of the physical process with a replay attack.The framework of nonlinear NCS exposed to a replay attack is depicted in Figure3. The T-S fuzzy model can be seen as represented by s plant rules. The ith plant rule is(1)Rulei:ifz1kisMi1and…and ifzrkisMir.Then,(2)xk+1=Aixk+Biuk,where xk∈ℝn denotes the system state and uk∈ℝm denotes the control input. Ai∈ℝn×n and Bi∈ℝn×m are the system matrices.Using a standard fuzzy inference, the final state of the fuzzy model is inferred as follows:(3)xk+1=∑i=1shixAixk+Biuk,where(4)hix=hizk=wizk∑l=1swlzk,wlzk=∏l=1jμi,lzlk,wizk is the attributed weight for each rule i, and μi,lzlk is the appurtenance degree of the membership function to the fuzzy set Mi,j.The functionshiz satisfies the convex sum property, i.e, ∑i=1shiz=1, and 0≤hiz≤1, with i = 1…s.The state feedback controller can be driven by the next rules:(5)Rulej:ifz1kisMj1and,…,and ifzrkisMjr.Then,(6)uk=∑j=1shjxKjx¯k,where Kj∈ℝm×n is the controller gain and x¯k is the controller input with(7)x¯k=1−δkxk+δkxk−τk.The variableδ is a two-state Markov model that represents the state of the switch S, Figure 4. If the communication link between the sensor and the controller was perfect, δ will be equal to 0. Otherwise, if there was a communication problem (communication delay and/or replay attack), δ will be equal to 1. τk represents the replay delay and/or the network delay; that means if there is an attack, the state x(k) will be changed by the previous state xk−τ1k. However, if there is a communication delay, the state x(k) will be equal to xk−τ2k. Finally, if there are a replay attack and a network delay simultaneously, the state x(k) will be equal to xk−τ1k−τ2k, and since the delays τ1k and τ2k are variables, we can unify the two variables in one variable τk, where τk is a random scalar which bounded between τmin and τmax, such as 0≤τmin≤τk≤τmax. Consequently, the controller (6) will be switching between several subsystems based on the value of δk and τk. The switching controller has been widely used for other similar systems (see [21, 22], and the references therein).Figure 4
Two-state Markov model.Replacing the equation (6) in (2), we obtain a discrete-time MJLS defined on a complete probability space (Ω,ℱ,ℙ):(8)xk+1=A¯CLδkxk+A¯dδkxk−τk,where A¯CLδk=A¯+1−δkB¯K¯ and A¯dδk=δkB¯K¯, A¯=∑i=1shixAi, B¯=∑i=1shixBi, K¯=∑j=1shjxKj, {δk,k∈ℤ} is a two-state Markov chain which takes value in the set S1≜0,1, and { τk,k∈ℤ } is a finite-state discrete-time homogeneous Markov chains which takes value in the finite set S2≜0,1,…,τmax. The transition probability matrices are(9)Probδk+1=β|δk=α=Παβ,Probτk+1=η|τk=ν=Θνη,where Παβ≥0 and Θνη≥0 for all α,β∈S1, ν,η∈S2, and(10)∑β=01Παβ=1,∑η=0τmaxΘνη=1.Definition 1.
(see [23]). The system (8) is stochastically stable if for any initial condition x0=x0 and initial modes δ0=δ0∈S1, τ0=τ0∈S2, there exists a finite Ξ>0 such that the following inequality holds:(11)E∑k=0∞xk2|x0,δ0,τ0<x0TΞx0.


## 3. Main Results

This section will be devoted to the stabilization theorem for the closed-loop system (8).Theorem 1.
The overall closed-loop system (8) will be stochastically stable if there exist matrices Pαν>0, α∈S1, ν∈S2, Q^>0, R^>0 , Q^<R^, Yj with appropriate dimensions, and a symmetric matrix W, such that the following LMIs hold:(12)ϕ^11ϕ^12ϕ^13∗ϕ^22ϕ^23∗∗ϕ^33<0,where,(13)X^=W−1,Yj=KjX^,Q^=X^QX^,R^=X^RX^,P^αν=X^PανX^,P¯^αν=X^P¯ανX^,ϕ^11=Q^+τmax−τminR^+P¯^αν−P^αν−symX^+symAiX^+1−δkBiYj,ϕ^12=AiX^+1−δkBiYjT+δkBiYj−X^T,ϕ^13=P¯^αν+AiX^+1−δkBiYjT−symX^,ϕ^22=−Q^+symδkBiYj,ϕ^23=δkBiYjT−X^,ϕ^33=P¯^αν−symX^.Proof.
The stochastic Lyapunov functional candidate for the system (8) is(14)Vxk,δk,τk=∑ρ=13Vρxk,δk,τk=∑ρ=13Vρ,where(15)V1=xTkPδk,τkxk,V2=∑l=k−τkk−1xlTkQxlk,V3=∑l=−τmax+2−τmin+1∑m=k+l−1k−1xmTkRxmk.
The difference of the functionV is given by(16)ΔVxk,δk,τk=∑ρ=13ΔVρxk,δk,τk=∑ρ=13ΔVρ=∑ρ=13Vρxk+1,δk+1,τk+1|xk,δk,τk−Vρxk,δk,τk.
If we putδk=α, and τk=ν, we will denote Pδk,τk as Pαν, A¯CLδk as A¯αij, and A¯dδk as A¯dαij.
The mathematical expectation ofΔVρ is given by(17)∗EΔV1=ExTk+1Pδk+1,τk+1xk+1−xTkPδk,τkxk,=Exk+ykTPδk+1,τk+1xk+yk−xTkPδk,τkxk,=ζTk¯Pαν−Pαν0P¯αν∗00∗∗P¯ανζk,where(18)ζk=xTkxτTkyTkT,P¯αν=∑β=01∑η=0τmaxΠαβΘνηPβη.
We defineyk=xk+1−xk. Then,(19)xk+1−xk−yk=0,2ζTkWxk+1−xk−yk=0,2∑i=1s∑j=1shihjζTkWA¯αij−Inxk+A¯dαijxτk−yk=0.
Therefore,(20)EΔV1=ϕ11ϕ12ϕ13∗ϕ22ϕ23∗∗ϕ33,where(21)ϕ11=P¯αν−Pαν+symWA¯αij−symW,ϕ12=WA¯αijT+WA¯dαij−WT,ϕ13=P¯αν+WA¯αijT−symW,ϕ22=symWA¯dαij,ϕ23=WA¯dαijT−W,ϕ33=P¯αν−symW.∗EΔV2=∑l=k+1−τk+1kxlTQxl−∑l=k−τkk−1xlTQxl.
Notice that(22)∑l=k+1−τk+1kxlTQxl=∑l=k+1−τk+1k−τminxlTQxl+∑l=k+1−τmink−1xlTQxl+xkTQxk,∑l=k−τkk−1xlTQxl=∑l=k+1−τkk−1xlTQxl+xk−τkTQxk−τk.
Hence,(23)EΔV2=xkTQxk−xk−τkTQxk−τk+∑l=k+1−τk+1k−τminxlTQxl+∑l=k+1−τmink−1xlTQxl−∑l=k+1−τkk−1xlTQxl,(24)∗EΔV3=∑l=−τmax+2−τmin+1∑m=k+lkxmTRxm−∑l=−τmax+2−τmin+1∑m=k+l−1k−1xmTRxm=∑l=−τmax+2−τmin+1∑m=k+lk−1xmTRxm+xkTRxk−∑m=k+lk−1xmTRxm−xk+l−1TRxk+l−1=∑l=−τmax+2−τmin+1xkTRxk−xk+l−1TRxk+l−1,=τmax−τminxkTRxk−∑l=−τmax+2−τmin+1xk+l−1TRxk+l−1=τmax−τminxkTRxk−∑l=k+1−τmaxk−τminxlTRxl.
Notice that0≤τmin≤τk≤τmax for all k, we get(25)∑l=k+1−τmink−1xlTQxl≤∑l=k+1−τkk−1xlTQxl.∑l=k+1−τk+1k−τminxlTQxl≤∑l=k+1−τmaxk−τminxlTQxl.
Employing the simplification in ([24], p.5), we have(26)∑l=k+1−τmaxk−τminxlTQxl<∑l=k+1−τmaxk−τminxlTRxl.
Then,Q<R.
Finally, combining (20), (23), and (24) together with Theorem 1, we obtain(27)EΔV≤ζkTΨανijζk<0,where Ψανij=ϕ¯11ϕ12ϕ13∗ϕ¯22ϕ23∗∗ϕ33<0,(28)ϕ¯11=Q+τmax−τminR+ϕ11,ϕ¯22=−Q+ϕ22.Remark 1.
The inequality (27) cannot be regarded as an LMI because of the existence of nonlinear terms. So, we cannot solve it using Yalmip toolbox in Matlab. Nevertheless, if we multiply the matrix Ψανij in (27) by the matrix diag3×3W−1 in left and right sides. The problem will be solved, and we get (12).Remark 2.
In practice, it is important to know the maximum network delay and the maximum replay delay such that the NCS can remain stable. To determine these maximum time delays, we should solve the following nonlinear optimization problem:(29)maxτmaxs.t.12


## 4. Application to an Inverted Pendulum

### 4.1. Mathematical Model of the Inverted Pendulum

The inverted pendulum depends on three parameters Figure5. The position of the cart noted as X, the angle θ which makes the pendulum rod with the vertical position, and the force exerted to the cart to put the pendulum rod in the stable position. These parameters of the system are included in Table 1.Figure 5
Inverted pendulum.Table 1
Inverted pendulum parameters.
SymbolDescriptionUnitXCart positionMeterθPendulum angle with verticalRadiumFApplied force to the cartNewtonm’Mass of the pendulum rodKilogramMMass of the cartKilogramLHalf of pendulum rod lengthMeterIn reason to give the mathematical model of the system, we will use the Lagrangian equation. This equation is based on the principle of conservation of mechanical energy. In our case, the system has two degrees of freedom which can be represented by(i)
X for the horizontal movement of the cart.(ii)
θ for the angular position of the pendulum.The Lagrangian equation is generally defined by the difference between the kinetic energy (Ec) and the potential energy (Ep) of the system:(30)LE=Ec−Ep.The form of the Lagrange equation is(31)ddt∂LE∂E.j−∂LE∂Ej=Gj.WithEj and Gj are, respectively, the degree of freedom and the generalized force in the sense of the degree of freedom Ej.The kinetic energy of the system is given by(32)Ec=12MX˙2+12m′X˙2−2LX˙θ.cosθ+L2θ.2+12Jθ.2,whereJ = m′L2/3.The potential energy of the system is given by(33)Ep=m′gLcosθ.Replacing equation (32) and (33) in (30), we obtain(34)LE=12MX˙2+12m′X˙2−2LX˙θ.cosθ+L2θ.2+12Jθ.2−m′gLcosθ.(iii)
IfEjt=Xt, then, equation (31) becomes(35)M+m′X¨−m′Lθ..cosθ+m′Lθ.2sinθ=F,X¨=FM¯−m′Lθ.2sinθM¯+m′LM¯θ..cosθ.WithM¯ = m’ + M.(iv)
IfEjt=θt, then equation (31) becomes(36)m′L2+Jθ..+m′LX¨cosθ−m′gLsinaθ=0,(37)θ..=3g4Lsinθ+34LX¨cosθ.We define(38)x˙1t=x2t=θ..Hence,(39)x˙2t=θ...Replacing the value ofX¨ in (37), we obtain(40)x˙2t=3g4Lsinx1t+34Lcosx1taut−m′Lax22tsinx1t+m′aLx˙2tcosx1t,=gsinx1t−am′L/2.x22tsin2x1t4L/3−am′Lcos2x1t+acosx1tut4L/3−am′Lcos2x1t,wherea=1/M¯.The mathematical model of the IP system can be written as follows:(41)x˙1t=x2t,x˙2t=gsinx1t−am′L/2x22tsin2x1t+acosx1tut4L/3−am′Lcos2x1t.


### 4.2. T-S Fuzzy Modelling of the Inverted Pendulum

To pass from continuous time to discrete time, the differential equations (41) can be discretised by using the discretization technique of the first-order Euler in which we will replace x˙it by xik+1−xik/Te, where Te is the sampling time. The differential equation (41) becomes(42)x1k+1=x1k+Tex2k,x2k+1=x2k+Tegsinx1k−am′L/2x22ksin2x1k+acosx1kuk4L/3−am′Lcos2x1k.As we can notice from (42), the state-space representation contains four nonlinearities, which can be presented as follows:(43)z1k=14L/3−am′Lcos2x1k,z2k=sinx1k,z3k=x2ksin2x1k,z4k=cosx1k,where x1k∈−π/2,π/2. For x1k=±π/2, the system is not controllable. So let us suppose that x1k is bounded between two angles −θlimit,θlimit with θlimit is less than 90 degree Figure 6.Figure 6
Stabilization zone [25].The equation (42) becomes(44)x1k+1=x1k+Tex2k,x2k+1=x2k+Tez1kgz2k−am′L/2z3k+az4kuk,where(45)z1k=14L/3−am′Lcos2x1k=∑i=12Miz1kqi,with q1=maxz1k, q2=minz1k, M1z1k=z1k−q2/q1−q2, and M2z1k=q1−z1k/q1−q2.(46)z2k=sinx1k=∑i=12Niz2kbi,with b1=maxz2k, b2=minz2k, N1z2k=z2k−b2/b1−b2, and N2z2k=b1−z2k/b1−b2.(47)z3k=x2k.sin2.x1k=∑i=12Riz3kci,with c1=maxz3k, c2=minz3k, R1z3k=z3k−c2/c1−c2, and R2z3k=c1−z3k/c1−c2.(48)z4k=cosx1k=∑i=12Siz4kdi,with d1=maxz4k, d2=minz4k, S1z4k=z4k−d2/d1−d2, and S2z4k=d1−z4k/d1−d2.After using this linearisation technique, the IP system can be written as a sixteen linear subsystems, with the matricesAi and Bi of these subsystems given in Appendix.


### 4.3. Simulation

#### 4.3.1. System Stabilization

To illustrate the effectiveness of the developed controllers in Theorem1, a simulation of an IP controlled through a communication network is performed using the parameters in Table 2.Table 2
Inverted pendulum parameters.
SymbolDescriptionValuegGravitational acceleration9.81 Newton/kilogramm’Mass of pendulum rod0.25 kilogramMMass of cart1 kilogramLHalf of pendulum rod length0.15 meterTeSampling time0.01 secondThe convex sum propriety of the activation functionshiz is well respected. From Figure 7, we can see that 0≤hiz≤1. And from Figure 8, we have ∑i=1shiz=1, with i = 1…16.Figure 7
Activation functionshiz of the IP.Figure 8
Summation ofhiz from i = 1 to 16.Figure9 represents the switch values of δk. To be close to the reality, we chose that the commutation of the switch S is random. The command “dmtc” in Econometrics Matlab toolbox is used to create the switching law of δk. The matrix of the transition probability is(49)Π=0.50.50.50.5.Figure 9
Switch values ofδk.In this example, we will take the case whenτk is bounded between 0.5s and 1s, which means it will take the following values (0.5–0.6–0.7–0.8–0.9–1). Figure 10 shows the switch of τk between these values. The transition probability matrix is as follows:(50)Θ=00.250.20.2500.30.1000.40.10.40.350.1500.10.20.20.4500.150.100.30.30.200.200.30.150.20.150.30.10.1.Figure 10
Switch values ofτk.As is custom, the IP system has an inherent instability, Figures11 and 12 show the state trajectory of the open-loop system. The states of the system (x1 which denotes the angular θ, and x2 which denotes the angular velocity θ.) diverge from zero. According to Theorem 1 and exploiting Matlab, the LMIs (12) have a feasible solution, with the value of the gain vector Kj of the controller(51)K1=−5.2918−6.7255,K2=−5.2975−6.7248,Kj=K2,for allj=3,…,16.Figure 11
State trajectoryx1 of the open-loop system.Figure 12
State trajectoryx2 of the open-loop system.The state trajectories are shown in Figures13 and 14, where the two curves represent the trajectory of the states x1 and x2 under the controller gain Kj. The initial condition is x0=π/40T. As we can notice from the figures, the two curves converge to zero. Accordingly, the closed-loop system is stable.Figure 13
State trajectory ofx1 of the closed-loop system.Figure 14
State trajectory ofx2 of the closed-loop system.


#### 4.3.2. Trajectory Tracking

Let us consider the above system with the same parameter’s value given in Table2. The subject of this paragraph is that the angle θk of the IP’s rod tracks the desired trajectory Yr (the reference).The control law will be written as follows:(52)uk=K¯x¯k+L¯Yrk,(53)xk+1=A¯+1−δB¯K¯xk+δB¯K¯xk−τk+B¯L¯Yrk.To find the value ofLj, we will apply the Z-transform proprieties on the equation (53):(54)zXz−zx0=A¯+1−δB¯K¯Xz+δB¯K¯z−τXz+B¯L¯Yrz,Xz=z−A¯+1−δB¯K¯+δB¯K¯z−τ−1×zx0+B¯L¯Yrz.The outputy(k) of the system can be rewritten as follows:(55)yk=Cxk,where C = [1 0].The gainsLj will be calculated in such a way that y∞=Yr, with(56)y∞=limz⟶11−z−1CXz.Hence,(57)L¯−1=CI−A¯+B¯K¯−1B¯,Lj−1=CI−A¯+B¯Kj−1B¯.L¯=∑j=116hjzkLj.To see the robustness of the proposed theorem, three different situations will be studied. In the first situation, the event rate of the switch S is 0.1 (the percentage to have a replay attack during 100 s is 10%). In the second situation, the event rate equals 0.3. Finally, in the third situation, the event rate is 0.5.Figures15–17 represent the different events rates of the switch S. 0.1, 0.3, and 0.5, respectively.Figure 15
Event rate ofS is 0.1.Figure 16
Event rate ofS is 0.3.Figure 17
Event rate ofS is 0.5.As we have said previously, the instants, whenδk takes value 1, represent the times of the replay attacks. To simulate perfectly the attacks, these instance are chosen arbitrary. The values of τk stayed the same (Figure 10).The value of the controller gainKj and the trajectory controller gain Lj are given in Tables 3 and 4.Table 3
Controller gain values.
Value ofKjj10%30%50%1[−1.0577, −7.8518][−1.3758, −6.6825][−5.2918, −6.7255]j ≥ 2[−1.0835, −7.8515][−1.3931, −6.6876][−5.2975, −6.7248]Table 4
Trajectory tracking gain values.
Value ofLjj10%30%50%112.750513.068616.9846j ≥ 212.776313.085916.9903From Figure18, we can notice that if the event rate of the switch S equals 0.1, the output can track perfectly the reference; the same thing happens if the chance to have an attack rises to 30% or 50%. But, the response time at start up increases in these two cases. However, the results stay acceptable, which reflects the potency of our theorem.Figure 18
Trajectory tracking.


## 4.1. Mathematical Model of the Inverted Pendulum

The inverted pendulum depends on three parameters Figure5. The position of the cart noted as X, the angle θ which makes the pendulum rod with the vertical position, and the force exerted to the cart to put the pendulum rod in the stable position. These parameters of the system are included in Table 1.Figure 5
Inverted pendulum.Table 1
Inverted pendulum parameters.
SymbolDescriptionUnitXCart positionMeterθPendulum angle with verticalRadiumFApplied force to the cartNewtonm’Mass of the pendulum rodKilogramMMass of the cartKilogramLHalf of pendulum rod lengthMeterIn reason to give the mathematical model of the system, we will use the Lagrangian equation. This equation is based on the principle of conservation of mechanical energy. In our case, the system has two degrees of freedom which can be represented by(i)
X for the horizontal movement of the cart.(ii)
θ for the angular position of the pendulum.The Lagrangian equation is generally defined by the difference between the kinetic energy (Ec) and the potential energy (Ep) of the system:(30)LE=Ec−Ep.The form of the Lagrange equation is(31)ddt∂LE∂E.j−∂LE∂Ej=Gj.WithEj and Gj are, respectively, the degree of freedom and the generalized force in the sense of the degree of freedom Ej.The kinetic energy of the system is given by(32)Ec=12MX˙2+12m′X˙2−2LX˙θ.cosθ+L2θ.2+12Jθ.2,whereJ = m′L2/3.The potential energy of the system is given by(33)Ep=m′gLcosθ.Replacing equation (32) and (33) in (30), we obtain(34)LE=12MX˙2+12m′X˙2−2LX˙θ.cosθ+L2θ.2+12Jθ.2−m′gLcosθ.(iii)
IfEjt=Xt, then, equation (31) becomes(35)M+m′X¨−m′Lθ..cosθ+m′Lθ.2sinθ=F,X¨=FM¯−m′Lθ.2sinθM¯+m′LM¯θ..cosθ.WithM¯ = m’ + M.(iv)
IfEjt=θt, then equation (31) becomes(36)m′L2+Jθ..+m′LX¨cosθ−m′gLsinaθ=0,(37)θ..=3g4Lsinθ+34LX¨cosθ.We define(38)x˙1t=x2t=θ..Hence,(39)x˙2t=θ...Replacing the value ofX¨ in (37), we obtain(40)x˙2t=3g4Lsinx1t+34Lcosx1taut−m′Lax22tsinx1t+m′aLx˙2tcosx1t,=gsinx1t−am′L/2.x22tsin2x1t4L/3−am′Lcos2x1t+acosx1tut4L/3−am′Lcos2x1t,wherea=1/M¯.The mathematical model of the IP system can be written as follows:(41)x˙1t=x2t,x˙2t=gsinx1t−am′L/2x22tsin2x1t+acosx1tut4L/3−am′Lcos2x1t.


## 4.2. T-S Fuzzy Modelling of the Inverted Pendulum

To pass from continuous time to discrete time, the differential equations (41) can be discretised by using the discretization technique of the first-order Euler in which we will replace x˙it by xik+1−xik/Te, where Te is the sampling time. The differential equation (41) becomes(42)x1k+1=x1k+Tex2k,x2k+1=x2k+Tegsinx1k−am′L/2x22ksin2x1k+acosx1kuk4L/3−am′Lcos2x1k.As we can notice from (42), the state-space representation contains four nonlinearities, which can be presented as follows:(43)z1k=14L/3−am′Lcos2x1k,z2k=sinx1k,z3k=x2ksin2x1k,z4k=cosx1k,where x1k∈−π/2,π/2. For x1k=±π/2, the system is not controllable. So let us suppose that x1k is bounded between two angles −θlimit,θlimit with θlimit is less than 90 degree Figure 6.Figure 6
Stabilization zone [25].The equation (42) becomes(44)x1k+1=x1k+Tex2k,x2k+1=x2k+Tez1kgz2k−am′L/2z3k+az4kuk,where(45)z1k=14L/3−am′Lcos2x1k=∑i=12Miz1kqi,with q1=maxz1k, q2=minz1k, M1z1k=z1k−q2/q1−q2, and M2z1k=q1−z1k/q1−q2.(46)z2k=sinx1k=∑i=12Niz2kbi,with b1=maxz2k, b2=minz2k, N1z2k=z2k−b2/b1−b2, and N2z2k=b1−z2k/b1−b2.(47)z3k=x2k.sin2.x1k=∑i=12Riz3kci,with c1=maxz3k, c2=minz3k, R1z3k=z3k−c2/c1−c2, and R2z3k=c1−z3k/c1−c2.(48)z4k=cosx1k=∑i=12Siz4kdi,with d1=maxz4k, d2=minz4k, S1z4k=z4k−d2/d1−d2, and S2z4k=d1−z4k/d1−d2.After using this linearisation technique, the IP system can be written as a sixteen linear subsystems, with the matricesAi and Bi of these subsystems given in Appendix.


## 4.3. Simulation

### 4.3.1. System Stabilization

To illustrate the effectiveness of the developed controllers in Theorem1, a simulation of an IP controlled through a communication network is performed using the parameters in Table 2.Table 2
Inverted pendulum parameters.
SymbolDescriptionValuegGravitational acceleration9.81 Newton/kilogramm’Mass of pendulum rod0.25 kilogramMMass of cart1 kilogramLHalf of pendulum rod length0.15 meterTeSampling time0.01 secondThe convex sum propriety of the activation functionshiz is well respected. From Figure 7, we can see that 0≤hiz≤1. And from Figure 8, we have ∑i=1shiz=1, with i = 1…16.Figure 7
Activation functionshiz of the IP.Figure 8
Summation ofhiz from i = 1 to 16.Figure9 represents the switch values of δk. To be close to the reality, we chose that the commutation of the switch S is random. The command “dmtc” in Econometrics Matlab toolbox is used to create the switching law of δk. The matrix of the transition probability is(49)Π=0.50.50.50.5.Figure 9
Switch values ofδk.In this example, we will take the case whenτk is bounded between 0.5s and 1s, which means it will take the following values (0.5–0.6–0.7–0.8–0.9–1). Figure 10 shows the switch of τk between these values. The transition probability matrix is as follows:(50)Θ=00.250.20.2500.30.1000.40.10.40.350.1500.10.20.20.4500.150.100.30.30.200.200.30.150.20.150.30.10.1.Figure 10
Switch values ofτk.As is custom, the IP system has an inherent instability, Figures11 and 12 show the state trajectory of the open-loop system. The states of the system (x1 which denotes the angular θ, and x2 which denotes the angular velocity θ.) diverge from zero. According to Theorem 1 and exploiting Matlab, the LMIs (12) have a feasible solution, with the value of the gain vector Kj of the controller(51)K1=−5.2918−6.7255,K2=−5.2975−6.7248,Kj=K2,for allj=3,…,16.Figure 11
State trajectoryx1 of the open-loop system.Figure 12
State trajectoryx2 of the open-loop system.The state trajectories are shown in Figures13 and 14, where the two curves represent the trajectory of the states x1 and x2 under the controller gain Kj. The initial condition is x0=π/40T. As we can notice from the figures, the two curves converge to zero. Accordingly, the closed-loop system is stable.Figure 13
State trajectory ofx1 of the closed-loop system.Figure 14
State trajectory ofx2 of the closed-loop system.


### 4.3.2. Trajectory Tracking

Let us consider the above system with the same parameter’s value given in Table2. The subject of this paragraph is that the angle θk of the IP’s rod tracks the desired trajectory Yr (the reference).The control law will be written as follows:(52)uk=K¯x¯k+L¯Yrk,(53)xk+1=A¯+1−δB¯K¯xk+δB¯K¯xk−τk+B¯L¯Yrk.To find the value ofLj, we will apply the Z-transform proprieties on the equation (53):(54)zXz−zx0=A¯+1−δB¯K¯Xz+δB¯K¯z−τXz+B¯L¯Yrz,Xz=z−A¯+1−δB¯K¯+δB¯K¯z−τ−1×zx0+B¯L¯Yrz.The outputy(k) of the system can be rewritten as follows:(55)yk=Cxk,where C = [1 0].The gainsLj will be calculated in such a way that y∞=Yr, with(56)y∞=limz⟶11−z−1CXz.Hence,(57)L¯−1=CI−A¯+B¯K¯−1B¯,Lj−1=CI−A¯+B¯Kj−1B¯.L¯=∑j=116hjzkLj.To see the robustness of the proposed theorem, three different situations will be studied. In the first situation, the event rate of the switch S is 0.1 (the percentage to have a replay attack during 100 s is 10%). In the second situation, the event rate equals 0.3. Finally, in the third situation, the event rate is 0.5.Figures15–17 represent the different events rates of the switch S. 0.1, 0.3, and 0.5, respectively.Figure 15
Event rate ofS is 0.1.Figure 16
Event rate ofS is 0.3.Figure 17
Event rate ofS is 0.5.As we have said previously, the instants, whenδk takes value 1, represent the times of the replay attacks. To simulate perfectly the attacks, these instance are chosen arbitrary. The values of τk stayed the same (Figure 10).The value of the controller gainKj and the trajectory controller gain Lj are given in Tables 3 and 4.Table 3
Controller gain values.
Value ofKjj10%30%50%1[−1.0577, −7.8518][−1.3758, −6.6825][−5.2918, −6.7255]j ≥ 2[−1.0835, −7.8515][−1.3931, −6.6876][−5.2975, −6.7248]Table 4
Trajectory tracking gain values.
Value ofLjj10%30%50%112.750513.068616.9846j ≥ 212.776313.085916.9903From Figure18, we can notice that if the event rate of the switch S equals 0.1, the output can track perfectly the reference; the same thing happens if the chance to have an attack rises to 30% or 50%. But, the response time at start up increases in these two cases. However, the results stay acceptable, which reflects the potency of our theorem.Figure 18
Trajectory tracking.


## 4.3.1. System Stabilization

To illustrate the effectiveness of the developed controllers in Theorem1, a simulation of an IP controlled through a communication network is performed using the parameters in Table 2.Table 2
Inverted pendulum parameters.
SymbolDescriptionValuegGravitational acceleration9.81 Newton/kilogramm’Mass of pendulum rod0.25 kilogramMMass of cart1 kilogramLHalf of pendulum rod length0.15 meterTeSampling time0.01 secondThe convex sum propriety of the activation functionshiz is well respected. From Figure 7, we can see that 0≤hiz≤1. And from Figure 8, we have ∑i=1shiz=1, with i = 1…16.Figure 7
Activation functionshiz of the IP.Figure 8
Summation ofhiz from i = 1 to 16.Figure9 represents the switch values of δk. To be close to the reality, we chose that the commutation of the switch S is random. The command “dmtc” in Econometrics Matlab toolbox is used to create the switching law of δk. The matrix of the transition probability is(49)Π=0.50.50.50.5.Figure 9
Switch values ofδk.In this example, we will take the case whenτk is bounded between 0.5s and 1s, which means it will take the following values (0.5–0.6–0.7–0.8–0.9–1). Figure 10 shows the switch of τk between these values. The transition probability matrix is as follows:(50)Θ=00.250.20.2500.30.1000.40.10.40.350.1500.10.20.20.4500.150.100.30.30.200.200.30.150.20.150.30.10.1.Figure 10
Switch values ofτk.As is custom, the IP system has an inherent instability, Figures11 and 12 show the state trajectory of the open-loop system. The states of the system (x1 which denotes the angular θ, and x2 which denotes the angular velocity θ.) diverge from zero. According to Theorem 1 and exploiting Matlab, the LMIs (12) have a feasible solution, with the value of the gain vector Kj of the controller(51)K1=−5.2918−6.7255,K2=−5.2975−6.7248,Kj=K2,for allj=3,…,16.Figure 11
State trajectoryx1 of the open-loop system.Figure 12
State trajectoryx2 of the open-loop system.The state trajectories are shown in Figures13 and 14, where the two curves represent the trajectory of the states x1 and x2 under the controller gain Kj. The initial condition is x0=π/40T. As we can notice from the figures, the two curves converge to zero. Accordingly, the closed-loop system is stable.Figure 13
State trajectory ofx1 of the closed-loop system.Figure 14
State trajectory ofx2 of the closed-loop system.


## 4.3.2. Trajectory Tracking

Let us consider the above system with the same parameter’s value given in Table2. The subject of this paragraph is that the angle θk of the IP’s rod tracks the desired trajectory Yr (the reference).The control law will be written as follows:(52)uk=K¯x¯k+L¯Yrk,(53)xk+1=A¯+1−δB¯K¯xk+δB¯K¯xk−τk+B¯L¯Yrk.To find the value ofLj, we will apply the Z-transform proprieties on the equation (53):(54)zXz−zx0=A¯+1−δB¯K¯Xz+δB¯K¯z−τXz+B¯L¯Yrz,Xz=z−A¯+1−δB¯K¯+δB¯K¯z−τ−1×zx0+B¯L¯Yrz.The outputy(k) of the system can be rewritten as follows:(55)yk=Cxk,where C = [1 0].The gainsLj will be calculated in such a way that y∞=Yr, with(56)y∞=limz⟶11−z−1CXz.Hence,(57)L¯−1=CI−A¯+B¯K¯−1B¯,Lj−1=CI−A¯+B¯Kj−1B¯.L¯=∑j=116hjzkLj.To see the robustness of the proposed theorem, three different situations will be studied. In the first situation, the event rate of the switch S is 0.1 (the percentage to have a replay attack during 100 s is 10%). In the second situation, the event rate equals 0.3. Finally, in the third situation, the event rate is 0.5.Figures15–17 represent the different events rates of the switch S. 0.1, 0.3, and 0.5, respectively.Figure 15
Event rate ofS is 0.1.Figure 16
Event rate ofS is 0.3.Figure 17
Event rate ofS is 0.5.As we have said previously, the instants, whenδk takes value 1, represent the times of the replay attacks. To simulate perfectly the attacks, these instance are chosen arbitrary. The values of τk stayed the same (Figure 10).The value of the controller gainKj and the trajectory controller gain Lj are given in Tables 3 and 4.Table 3
Controller gain values.
Value ofKjj10%30%50%1[−1.0577, −7.8518][−1.3758, −6.6825][−5.2918, −6.7255]j ≥ 2[−1.0835, −7.8515][−1.3931, −6.6876][−5.2975, −6.7248]Table 4
Trajectory tracking gain values.
Value ofLjj10%30%50%112.750513.068616.9846j ≥ 212.776313.085916.9903From Figure18, we can notice that if the event rate of the switch S equals 0.1, the output can track perfectly the reference; the same thing happens if the chance to have an attack rises to 30% or 50%. But, the response time at start up increases in these two cases. However, the results stay acceptable, which reflects the potency of our theorem.Figure 18
Trajectory tracking.


## 5. Conclusion

This study dealt with the control problem of a nonlinear NCS exposed to a replay attack. A novel approach was used to calculate the control law based on an accurate mathematical description of the global system, taking into account the stochastic characteristics of the replay attack.Two simulations have been performed to investigate the effectiveness of the proposed approach. The obtained results show that the new approach conserves the performance of the system despite the existence of the replay attack. The main advantages of the presented control method compared with the other approach that based on the detectors are the stochastic robustness, the good response time, and the adaptability for a practical application.As a perspective of this study, our attention will be oriented towards studying the same problem with packet losses and an external disturbance.



---

*Source: 6618105-2021-01-25.xml*