UNIVERSIDAD DE SEVILLA
Escuela Técnica Supe io de Ingenie ía
Dep. Ingenie ía de Sis emas y Au omá ica
Tesis Doc o al
Cybe secu i y in model-based con ol: esilien
design and so wa e eju ena ion me hods
Au o :
MªTe esa A aúz Pisón
Di ec o es:
José Ma ía Maes e To eblanca
Edua do Fe nández Camacho
Se illa, 2025
Tesis Doc o al:
Cybe secu i y in model-based con ol: esilien design and so wa e
eju ena ion me hods
Au o : MªTe esa A aúz Pisón
Di ec o es: José Ma ía Maes e To eblanca
Edua do Fe nández Camacho
El ibunal nomb ado pa a juzga la Tesis a iba indicada, compues o po los siguien es
doc o es:
P esiden e:
Vocales:
Sec e a io:
acue dan o o ga le la cali icación de:
El Sec e a io del T ibunal
Fecha:
Ag adecimien os
E
n p ime luga , quie o ag adece a mis di ec o es de esis, José MªMaes e y Edua do F.
Camacho, po su apoyo, o ien ación e implicación a lo la go de es os años. Sin duda,
pa a mí ha sido un au én ico p i ilegio y o gullo con a con es os g andes p o esionales con
an ecunda expe iencia y an al a calidad humana guiando mi o mación como ingenie a.
En especial, a Pepe, con quien he compa ido an os p oyec os desde aquella clase de
p ime o de In o má ica en 2012. Es oy p o undamen e ag adecida po la con ianza que
deposi ó en mí desde el p incipio, apos ando po mí incluso cuando yo misma no me sen ía
capaz, espe ando siemp e mis p opues as y necesidades, pe o animándome a da lo mejo
de mí.
También quie o ag adece a mis compañe os du an e es os años. En especial, a Paula,
po su apoyo, implicación y es ue zo en los a ículos que hemos desa ollado jun as. Y
a Ramón y José Ma ía, po su ayuda desin e esada, siemp e dispues os a echa me una
mano, no solo en lo p o esional, sino ambién en lo pe sonal. G acias, sob e odo, po
esos momen os compa idos de aleg ías, penas y isas, que sin duda han hecho es os años
mucho más lle ade os.
Ag adece ambién a mi amilia en el sen ido más amplio: mis pad es, mis he manas,
cuñados y sob inas. En especial a mi mad e, po es a siemp e a mi lado, po anima me a
segui adelan e a pesa de las di icul ades y po su disposición y ayuda incondicional en
odo momen o. Y a mis sueg os, Albe o y Elena, po su dedicación y po es a siemp e
dispues os a cuida de mis hijos, pe mi iéndome pe se e a en el es ue zo y saca adelan e
es a esis y lo que e dade amen e impo a.
Y, po supues o, quie o ag adece a mi pequeña amilia, que ha c ecido y se ha o mado
a lo la go de es os años. A Tillo, mi iel compañe o, po da me ue zas pa a segui siemp e
y es a a mi lado en cada paso de mi ida, en los buenos y en los malos momen os. Y a mis
hijos, Ignacio y Ja ie , mis pequeños explo ado es, po la ida y aleg ía que me egalan
cada día, haciendo que odo el es ue zo y las di icul ades i idas siemp e algan la pena.
Comencé la esis con el nacimien o de mi sob ina mayo , Te esa, y empecé a esc ibi la
con la llegada de mi úl ima sob ina, Angelines, nues o angeli o, la más especial de odos
los p imos. Po eso, es a esis no puede i dedicada a nadie más que a los niños de mi casa,
que han ido naciendo mien as odo es o se aguaba, llenando nues as idas de aleg ía y
poniéndolas pa as a iba.
A Te esa, Ana, Ignacio, Ja ie y Angelines, con odo mi ca iño.
Te esa A aúz Pisón
Se illa, 2025
I
Abs ac
T
he cu en in e connec ion o con ol a chi ec u es demands esilien con ol s a egies
capable o ensu ing s abili y and pe o mance unde ad e sa ial condi ions. This
doc o al hesis ocuses on he cybe secu i y o model-based con ol sys ems, pa icula ly
in ne wo ked en i onmen s, whe e cybe h ea s can signi ican ly comp omise sys em
pe o mance and sa e y. To his end, his hesis p esen s he undamen als o cybe secu i y
esilien design in model-based con ol sys ems and in oduces he concep o so wa e
eju ena ion in a p edic i e con ol se ing. In pa icula , he con ibu ions and esul s
ob ained in he published a icles co espond o ou key esea ch di ec ions: i) Cybe secu-
i y in model p edic i e con ol (MPC): A comp ehensi e su ey examines secu i y isks
in dis ibu ed MPC (DMPC) a chi ec u es, ca ego izing a ack models, and p oposing
mi iga ion s a egies o enhance hei esilience. ii) Resilien PI con olle design: A
model-based app oach using s a e-space echniques and LMIs is de eloped o enhance he
obus ness o PI con olle s. iii) S ochas ic MPC s a egies: A ee-based MPC amewo k
is in oduced o explici ly in eg a e packe losses and jamming a acks in o he con ol
op imiza ion p ocess, ensu ing obus sys em ope a ion unde ad e sa ial condi ions. i )
So wa e eju ena ion: This hesis ex ends he concep o so wa e eju ena ion o p e-
dic i e con ol, in oducing open- and closed-loop TBMPC s a egies. Addi ionally, his
hesis p esen s he manusc ip s o he published and accep ed a icles ha cons i u e he
ounda ion o his esea ch. Finally, he main indings and conclusions o his hesis a e
p o ided, along wi h possible u u e esea ch di ec ions.
III
Con en s
Abs ac III
Lis o Figu es VII
Glossa y IX
1 In oduc ion and objec i es 1
1.1 Cybe secu i y in model-based con ol sys ems 3
1.1.1 Vulne abili y sou ces 4
1.1.2 Types o cybe a acks 4
1.1.3 Cybe secu i y s a egies o model-based con olle s 5
1.1.4 Cybe secu i y and model-based con ol 6
1.2 P incipal concep s o so wa e eju ena ion 6
1.2.1 O igins and li e a u e e iew 7
1.2.2 Modes o ope a ion 8
1.2.3 Sa e se s o so wa e eju ena ion 8
1.3 Objec i es 10
1.4 Lis o publica ions 11
1.5 Ou line o he es o his hesis 12
2 Summa y o esul s and discussion 15
2.1 Cybe secu i y and MPC 16
2.2 Resilien model-based PI con olle design 19
2.2.1 Basic PI con olle s design using LMIs 19
2.2.2 Design o PI con olle s conside ing packe losses 24
2.3 S ochas ic MPC o un eliable ne wo ks 25
2.3.1 T ee-Based MPC o jamming a acks 25
2.3.2 Enhanced ee-based MPC o packe losses and dis u bances 28
2.4 So wa e eju ena ion s a egies 30
2.4.1
A linea p og amming app oach o compu ing sa e se s o so wa e
eju ena ion 30
2.4.2
Open and closed-loop p edic i e con ol s a egies o so wa e eju ena ion
33
3 Publica ions 39
V
2Chap e 1. In oduc ion and objec i es
play an impo an ole [4]. In pa icula , PI con olle s a e ulne able o cybe a acks in
which, o example, senso a e hijacked o communica ion links a e dis up ed, leading o
poo con ol pe o mance o sys em ins abili y [13,23]. To add ess hese ulne abili ies,
esea che s ha e explo ed a ious cybe - esilien PI con ol s a egies, such as secu e s a e
es ima ion echniques and adap i e con ol s a egies ha dynamically adjus gains in
esponse o de ec ed anomalies [19,24]. Addi ionally, he in eg a ion o PI con olle s
wi h secu i y mechanisms has demons a ed e ec i eness in imp o ing obus ness agains
cybe h ea s [21,22].
To add ess hese limi a ions, mode n con ol a chi ec u es, such as MPC, p o ide
ad anced capabili ies o op imiza ion bu also in oduce new secu i y challenges [14].
MPC is an op imiza ion-based con ol s a egy ha de e mines con ol inpu s by p edic ing
he sys em e olu ion o e a ini e ho izon. A each ime s ep, MPC sol es a cons ained
op imiza ion p oblem o minimize a p ede ined cos unc ion while ensu ing ha s a e and
inpu cons ain s a e sa is ied [25,26]. This p edic i e app oach allows he con olle o
an icipa e dis u bances and compensa e o sys em unce ain ies, making MPC widely used
in applica ions such as indus ial p ocesses, ene gy ne wo ks, and au onomous sys ems [27,
28]. Fu he mo e, i s lexibili y in handling mul i a iable sys ems and cons ain s has
es ablished MPC as a p e e ed choice o complex CPS applica ions [29,30]. Howe e ,
he eliance o MPC on eal- ime da a exchange and i e a i e op imiza ion inc eases i s
exposu e o cybe h ea s, highligh ing he need o secu e con ol echniques [31,32].
Since MPC con inuously upda es i s con ol ac ions based on s a e measu emen s, i
is pa icula ly ulne able o cybe a acks whe e in o ma ion is manipula ed o ne wo k
is dis up ed, comp omising he in eg i y and a ailabili y o con ol inpu s [23,24]. To
mi iga e hese isks, ecen esea ch has ocused on a ack- esilien MPC o mula ions
ha inco po a e anomaly de ec ion, obus op imiza ion, and enc yp ed communica ion
s a egies [33,34]. These enhancemen s aim o p ese e sys em s abili y and pe o mance
e en in ad e sa ial en i onmen s.
Besides hese s a egies o enhancing cybe secu i y in con ol sys ems, in his hesis we
also ocus on so wa e eju ena ion as a pa icula ly e ec i e app oach. Unlike adi ional
secu i y mechanisms ha ely on a ack iden i ica ion and classi ica ion, so wa e eju ena-
ion p oac i ely mi iga es he e ec s o cybe h ea s by pe iodically ese ing o es o ing
sys em componen s be o e aul s accumula e o an a ack ully comp omises he sys em.
O iginally in oduced in compu ing o coun e ac so wa e aging [35], his concep has
been ex ended o con ol sys ems o enhance esilience agains cybe a acks [36]. The
main idea is o pe iodically e esh he un ime con ol so wa e wi h a secu e copy o
p e en pe sis en a acks om al e ing online execu ion [36,37]. Di e en implemen a-
ions ha e been de eloped depending on he c i e ia used o de e mine he eju ena ion
equency: while some app oaches ely on p ede ined ime in e als based on sys em sa e y
cons ain s [38], o he s adap he e esh iming acco ding o he du a ion o an e ec i e
cybe a ack [39]. Mo e ad anced s a egies conside obus o mula ions o accoun o
unce ain ies, dis u bances, and senso noise [40], and also op imize he numbe o eboo s
by e alua ing po en ial a ack consequences in eal ime [37]. Gi en i s abili y o handle
a ious secu i y h ea s wi hou equi ing p e ious a ack de ec ion o iden i ica ion, so -
wa e eju ena ion becomes as a p omising solu ion o enhancing he secu i y o ne wo ked
con ol sys ems.
1.1 Cybe secu i y in model-based con ol sys ems 3
The e o e, his hesis add esses he g owing demand o imp o e he cybe secu i y o
mode n con ol sys ems, especially in ne wo ked en i onmen s, whe e he p esence o
communica ion links exposes he sys em o ex e nal a acks ha can signi ican ly deg ade
pe o mance and comp omise sys em sa e y. To p o ide he necessa y con ex , Sec ion 1.1
in oduces he main cybe secu i y aspec s ele an o model-based con ol sys ems. Sec ion
1.2 ocuses on so wa e eju ena ion, a key concep in his hesis. Sec ion 1.3 de ines he
objec i es o his hesis, p esen ing he speci ic goals ha guide he de elopmen o he
p oposed me hodologies. Sec ion 1.4 lis s he publica ions de i ed om his esea ch.
Finally, Sec ion 1.5 ou lines he s uc u e o he emaining chap e s.
1.1 Cybe secu i y in model-based con ol sys ems
The inc easing in eg a ion o con ol sys ems wi h communica ion ne wo ks has signi i-
can ly enhanced hei e iciency, scalabili y, and adap abili y. Howe e , his in e connec ion
has also in oduced new cybe secu i y challenges ha can comp omise sys em pe o -
mance, s abili y, and sa e y. Ensu ing he secu i y o model-based con olle s, including
MPC and o he ad anced con ol s a egies, has become an essen ial esea ch opic due o
he g owing sophis ica ion and equency o cybe a acks.
Cybe h ea s in con ol sys ems can a ise om di e en sou ces, including malicious
ex e nal a acke s, comp omised ne wo k in as uc u e, o e en so wa e ulne abili ies
inhe en o he con ol algo i hms. These h ea s can ha e se e e consequences, a ying
om pe o mance deg ada ion o ca as ophic sys em ailu es in sa e y-c i ical applica ions.
Thus, a comp ehensi e unde s anding o cybe secu i y in con ol sys ems is necessa y o
de elop e ec i e de ense mechanisms ha ensu e eliable ope a ion e en unde ad e sa ial
condi ions.
In his con ex , he secu i y o con ol sys ems is o en de ined in e ms o [41]:
•
Con iden iali y: i ensu es ha sensi i e con ol da a, such as sys em s a es, con ol
commands, o ope a ional pa ame e s, emains p o ec ed om unau ho ized access.
This is pa icula ly ele an in ne wo ked con ol sys ems, whe e in o ma ion is
ansmi ed o e po en ially insecu e communica ion channels.
•
In eg i y: i gua an ees ha sys em da a, including senso measu emen s and con ol
ac ions, emains accu a e and unal e ed by malicious ad e sa ies. In eg i y is c i ical
in model-based con ol sys ems, whe e con ol decisions depend on he accu acy o
eal- ime da a.
•
A ailabili y: i ensu es ha con ol unc ionali ies emain accessible and ope a ional,
e en in he p esence o cybe a acks. Fo example, jamming a acks speci ically
a ge a ailabili y by dis up ing communica ions and p e en ing imely execu ion o
con ol ac ions.
Viola ion o any o hese aspec s can comp omise sys em sa e y and pe o mance.
Fo ins ance, an a acke who gains access o con ol commands (con iden iali y b each)
could manipula e ac ua o signals (in eg i y b each); a well-coo dina ed cybe a ack could
also p e en a sys em om execu ing i s asks (a ailabili y b each). The e o e, secu i y
4Chap e 1. In oduc ion and objec i es
s a egies mus add ess all h ee p inciples simul aneously o ensu e he obus ness o
con ol sys ems unde ad e sa ial condi ions.
1.1.1 Vulne abili y sou ces
Model-based con ol sys ems, pa icula ly hose ope a ing in ne wo ked en i onmen s,
a e inhe en ly ulne able o cybe h ea s due o hei eliance on eal- ime da a exchange,
communica ion in as uc u e, and compu a ional esou ces. These ulne abili ies can be
ca ego ized as ollows:
•Communica ion ne wo k ulne abili ies. Mode n con ol sys ems ely on wi ed
o wi eless communica ion ne wo ks o da a exchange be ween con olle s, senso s,
ac ua o s, and supe iso y sys ems. This in e connec i i y makes hem suscep i-
ble o cybe h ea s such as da a in e cep ion, manipula ion, and denial-o -se ice
a acks. In dis ibu ed con ol schemes, such as Dis ibu ed Model P edic i e Con-
ol (DMPC), whe e agen s exchange op imiza ion- ela ed da a o coo dina e hei
decisions, malicious in e e ence in communica ion can signi ican ly a ec o e all
sys em pe o mance [23].
•
Senso and ac ua o ampe ing. A acke s can comp omise senso s and ac ua o s
o injec alse measu emen s o al e con ol signals, leading o inco ec decisions by
he con olle . Fo example, in an MPC amewo k, an ad e sa y injec ing e oneous
senso eadings can mislead he op imiza ion p ocess, esul ing in unsa e con ol
ac ions [42].
•
So wa e exploi s and malwa e. So wa e-based ulne abili ies can be exploi ed
o in oduce malicious modi ica ions in con ol algo i hms, disable secu i y mech-
anisms, o cause unexpec ed ailu es. Malicious so wa e, such as ansomwa e,
can make con ol sys ems inope a i e by enc yp ing c i ical con igu a ion iles o
co up ing sys em dynamics [13].
•
Inside h ea s. A acke s wi h au ho ized access o he con ol sys em, such as
comp omised employees o ex e nal con ac o s, can manipula e ope a ional pa am-
e e s, disable secu i y ea u es, o ex ac con iden ial in o ma ion. In dis ibu ed
con ol a chi ec u es, inside h ea s can manipula e op imiza ion cons ain s o cos
unc ions o s ee he sys em owa ds unsa e o ine icien con igu a ions [43].
•
Resou ce cons ain s in embedded con olle s. Many indus ial con olle s ha e
limi ed compu a ional esou ces, which complica es he implemen a ion o ad anced
enc yp ion, in usion de ec ion, and eal- ime anomaly de ec ion wi hou impac ing
sys em pe o mance. This limi a ion also makes hem a ac i e a ge s o cybe
ad e sa ies [44].
These ulne abili ies demons a e ha ensu ing con ol sys ems secu i y equi es a
combina ion o p o ec i e s a egies ha add ess bo h physical and cybe -based h ea s.
1.1.2 Types o cybe a acks
Cybe a acks on con ol sys ems can be classi ied based on hei objec i es and impac on
sys em pe o mance. The mos common ca ego ies include:
1.1 Cybe secu i y in model-based con ol sys ems 5
•
Decep ion a acks: hey ocus on comp omising he in eg i y o da a exchanged
wi hin he con ol sys em. Thei goal is o comp omise he con olle by injec ing
manipula ed in o ma ion in o he sys em, leading o inco ec con ol decisions.
Examples include: i) False Da a Injec ion (FDI), whe e a acke s modi y senso
eadings o s a e es ima es o in oduce de ia ions in he con ol p ocess, e.g., o
deg ade con olle pe o mance o lead o unsa e ope a ions [19]; ii) eplay a acks,
whe e an ad e sa y eco ds alid senso da a and eplays i a a la e ime o decei e
he con olle in o belie ing ha he sys em is in a di e en s a e [42]; and iii) co e
a acks, which a e designed o emain unde ec ed by adi ional anomaly de ec ion
me hods, e.g., wi hou igge ing secu i y mechanisms [45].
•
Dis up ion a acks: hey ocus on educing sys em a ailabili y by in e e ing wi h
ne wo k communica ions o compu a ional esou ces. Some o he mos ele an
examples a e: i) Denial-o -Se ice (DoS), whe e an a acke loods he ne wo k wi h
excessi e a ic, making i di icul o con olle s o communica e wi h o he sys em
componen s [23]; ii) jamming a acks, whe e in e e ence signals a e gene a ed o
dis up no mal communica ion, p e en ing he ansmission o con ol inpu s o
senso measu emen s in wi eless con ol ne wo ks [5]; and iii) exploi ing packe
losses: which consis s o exploi ing he compensa ion mechanisms o handle packe
losses o sys ema ically deg ade con ol pe o mance [6]
•
Inside and so wa e-based a acks: unlike decep ion o dis up ion a acks, which
p ima ily a ge da a in eg i y and sys em a ailabili y, inside and so wa e-based
a acks exploi p i ileged access o so wa e ulne abili ies o comp omise con ol
sys ems. These a acks can be pa icula ly challenging o de ec and mi iga e, as
hey o en bypass adi ional secu i y mechanisms. Some imes, hey come om
indi iduals wi h legi ima e access o he con ol sys em, such as employees, con ac-
o s, o comp omised adminis a o s, and may in ol e malicious manipula ion o
con ol pa ame e s, op imiza ion cons ain s, and secu i y ea u es o induce unsa e
beha io . Howe e , no ice ha inside s may also c ea e secu i y isks acciden ally
by imp ope ly se ing access con ols o exposing sensi i e in o ma ion. O he imes,
hese a e so wa e-based a acks ha exploi ulne abili ies in con ol so wa e,
including i mwa e, middlewa e, and un ime en i onmen s, e.g., by i) malwa e
injec ion in o he con ol sys em, enabling pe sis en illici access, unau ho ized
command execu ion, o dis up ion o con ol loops [13]; ii) co up ion o he con ol
logic, al e ing se poin s, sa e y cons ain s, o compu a ional ou ines o induce
pe o mance deg ada ion o sys em ins abili y [44]; and iii) exploi ing so wa e
aging, memo y leaks o esou ce exhaus ion, leading o pe o mance deg ada ion
o e ime. Wi hou cybe -de ense s a egies like so wa e eju ena ion, hese issues
can emain unde ec ed un il hey cause sys em ailu es [35].
1.1.3 Cybe secu i y s a egies o model-based con olle s
To mi iga e cybe secu i y h ea s in model-based con ol sys ems, di e en de ense mech-
anisms ha e been p oposed in he li e a u e. These s a egies can be b oadly classi ied
in o:
6Chap e 1. In oduc ion and objec i es
•
P e en ion mechanisms. They p o ec he con ol sys em be o e an a ack occu s by
ein o cing communica ion p o ocols, es ic ing access o sys em componen s, and
designing obus con ol a chi ec u es. Key s a egies include: i) secu e communica-
ion p o ocols, such as end- o-end enc yp ion and au hen ica ion me hods (e.g., TLS
and IEC 62443) [46] and mus balance secu i y and compu a ional e iciency [13]; ii)
ze o- us and access con ol policies o es ic unau ho ized access [23] and block
unau ho ized a emp s in indus ial en i onmen s [19]; and iii) so wa e ha dening
o es ic pe missions, and s eng hen execu ion en i onmen s by making pe iodic
upda es, in eg i y e i ica ion, and c ea ing secu e execu ion en i onmen s [43].
•
De ec ion mechanisms. These me hods iden i y anomalies and cybe h ea s in
eal- ime by analyzing sys em beha io and ne wo k ac i i y, and include i) anomaly
de ec ion sys ems such as suppo ec o machines and ecu en neu al ne wo ks
o de ec de ia ions in ne wo k a ic and senso da a [47], possibly compa ing
p edic ed and obse ed s a es [6]; ii) s a e es ima ion-based secu i y, whe e obse e s
such as Kalman il e s and unknown inpu obse e s iden i y inconsis encies in
sys em s a es [19], possibly aided by c oss- e i ica ion o exchanged da a [5]; and iii)
in usion de ec ion sys ems, which analyze ne wo k a ic and can de ec anomalies
in con ol commands and p ocess a iables [44].
•
Mi iga ion mechanisms. These s a egies ensu e ha he sys em emains ope a-
ional a e an a ack. These can be ca ego ized in o i) passi e mi iga ion mechanisms
based on aul - ole an con ol, s ochas ic MPC [7], edundan con ol pa hs, g ace ul
deg ada ion echniques [47]; and ii) ac i e mi iga ion mechanisms o adap he con-
ol con igu a ion dynamically in esponse o de ec ed anomalies [44], and igge
a ack- esilien es ima ion echniques [5], o pe iodical ese s such as in so wa e
eju ena ion [7]. This is pa icula ly ele an in ne wo ked MPC a chi ec u es,
whe e unde ec ed malwa e can deg ade long- e m pe o mance.
By in eg a ing p e en ion,de ec ion, and mi iga ion s a egies, model-based con ol
sys ems can achie e cybe esilience ensu ing obus pe o mance e en unde ad e sa ial
condi ions.
1.1.4 Cybe secu i y and model-based con ol
Du ing his hesis, a su ey on cybe secu i y in DMPC has been published, p o iding an in-
dep h analysis o he secu i y challenges, a ack models, and de ense mechanisms speci ic
o his amewo k [48]. This wo k appea s in Chap e 3 and complemen s he discussion
p esen ed in his sec ion. Also, a summa y o he main indings and con ibu ions o he
su ey is p esen ed in Sec ion 2.1.
1.2 P incipal concep s o so wa e eju ena ion
This sec ion p o ides an o e iew o so wa e eju ena ion, one o he main s a egies
analyzed in his hesis and he ounda ion o i s mos signi ican con ibu ions [1,7,49].
As he p ima y cybe secu i y app oach explo ed in his wo k, so wa e eju ena ion plays
1.2 P incipal concep s o so wa e eju ena ion 7
a c ucial ole in he p oposed me hodologies and key esul s, pa icula ly in i s in eg a ion
wi h model-based con ol s a egies.
Gi en i s ele ance o he p oposed me hodologies, he ollowing subsec ions p esen
he key concep s unde lying his echnique. Speci ically, his sec ion co e s i s o igins and
ele an li e a u e, he modes o ope a ion ha de ine i s unc ioning, and he sa e se s used
o ensu e sys em s abili y. Addi ionally, an illus a i e example demons a es i s p ac ical
applica ion, ollowed by a discussion on he ypes o cybe a acks i mi iga es. While
his sec ion in oduces he undamen al aspec s o so wa e eju ena ion, he de ailed
implemen a ion and con ibu ions o his hesis a e p esen ed in Sec ion 2.4.
1.2.1 O igins and li e a u e e iew
So wa e eju ena ion is a p oac i e aul - ole ance echnique o iginally in oduced o
mi iga e so wa e aging, which e e s o he g adual deg ada ion o so wa e pe o mance
due o memo y leaks, da a co up ion, and he accumula ion o execu ion e o s [35].
Ini ially de eloped o pe iodically es o e he un ime code and da a, so wa e eju ena ion
was designed o p e en ailu es caused by non-an icipa ed so wa e s a es [35]. O e ime,
i s ole has expanded beyond eliabili y conce ns, becoming a cybe secu i y mechanism o
p o ec ing CPSs agains s eal hy and pe sis en cybe a acks ha can comp omise sys em
in eg i y [37,39].
The undamen al p inciple o so wa e eju ena ion is o pe iodically e esh he un ime
con ol so wa e wi h a us ed, secu e copy, ensu ing ha malicious modi ica ions a e
emo ed be o e hey can cause las ing damage [50]. Since i s beginnings, he concep has
e ol ed signi ican ly, wi h mode n esea ch ocusing on op imizing he e esh iming o
minimize sys em dis up ion while maximizing secu i y. Recen ad ances de ine e esh
equencies based on he ime ha a sys em can emain sa e du ing a cybe a ack [38] o he
du a ion be o e an a ack becomes e ec i e enough o comp omise sys em s abili y [39].
Despi e i s ad an ages, equen eboo s can deg ade con ol pe o mance, equi ing
adap i e s a egies o dynamically compu e op imal eju ena ion in e als [37]. To imp o e
secu i y, [37] inco po a es he ha dwa e oo s o us , which a e onboa d secu i y modules
esponsible o managing he secu e execu ion in e al. This in e al is a pe iod du ing
which ex e nal communica ions a e disabled o p e en po en ial cybe in e e ence while
he sys em eloads i s secu e so wa e e sion. Addi ionally, a sa e y con olle is ac i a ed
a e he so wa e e esh o ensu e ha he sys em e u ns o a s able ope a ional s a e
be o e esuming no mal con ol asks.
Ano he c ucial aspec in his con ex is he compu a ion o sa e se s, which p o ide
o mal gua an ees ha he sys em emains wi hin a de ined ope a ional bounda y a e
a so wa e e esh. Common app oaches include de ining obus in a ian e minal se s
and maximum sa e ini ial se s [51]. Howe e , compu ing hese se s can be demanding,
especially when using poly ope-based o mula ions [52,53]. To add ess his, esea che s
ha e p oposed simpli ied ep esen a ions such as zono opes [51] and ellipsoids [50].
No ably, hese challenges align wi h ad ances in lea ning-based con ol, whe e e icien
compu a ion and obus ness a e key conce ns [54,55].
In he li e a u e, so wa e eju ena ion has been explo ed as a cybe secu i y s a egy
o enhance sys em esilience by in eg a ing pe iodic so wa e e esh mechanisms in o
8Chap e 1. In oduc ion and objec i es
con ol a chi ec u es, ensu ing p o ec ion agains bo h known and s eal hy cybe h ea s.
Fo ins ance, Romagnoli e al. p oposed a amewo k ha p o ec s cybe -physical sys ems
agains un ime code ampe ing by pe iodically upda ing he so wa e wi h a clean, uncom-
p omised e sion, ensu ing secu i y by disabling all ex e nal communica ions du ing he
e esh p ocess [56]. Fu he mo e, in [57], he same au ho s de eloped an in a ian -se -
based app oach o de e mine he op imal eju ena ion in e als, ensu ing ha he sys em
emains in a sa e s a e e en unde unde ec able a acks. These wo ks demons a e he
po en ial o so wa e eju ena ion as an e ec i e de ense mechanism agains pe sis en
cybe h ea s in con ol a chi ec u es.
One o he con ibu ions o his hesis lies in p oposing he applica ion o so wa e eju-
ena ion in combina ion wi h MPC o he i s ime, in eg a ing his cybe secu i y s a egy
in o ad anced con ol amewo ks o enhance sys em esilience agains cybe a acks. The
speci ic con ibu ions in his di ec ion a e de ailed in Sec ion 2.4.
1.2.2 Modes o ope a ion
So wa e eju ena ion ope a es h ough speci ic ope a ional modes ha pe iodically ese
sys em componen s o mi iga e aul s and pe o mance deg ada ion [50]. In his amewo k,
he ope a ion ime is di ided in o h ee dis inc modes: Mission Con ol (MC),So wa e
Re esh (SR), and Sa e y Con ol (SC), which a e ac i e du ing
TMC
,
TSR
, and
TSC
ime s eps,
espec i ely. Addi ionally, he unce ain con ol pe iod (UC), deno ed as
TUC
, includes
bo h he so wa e e esh and mission con ol modes.
•
Mission Con ol Mode: The sys em exchanges in o ma ion h ough he ne wo k
du ing he MC mode, p esen ing ulne abili ies ha a acke s could exploi o hijack
he con ol signal, s ee ing he sys em away om i s goal.
•
So wa e Re esh Mode: SR akes place when he ope a ing so wa e is es o ed,
elimina ing possible modi ica ions om cybe -a acks so ha he sys em eco e s i s
ini ial sa e con igu a ion. Du ing his ime, ex e nal communica ions a e swi ched
o and he ac ua o s main ain he las con ol inpu p o ided du ing MC, which may
be co up ed in case o a ack. The e o e, i mus be ca e ully designed o ensu e
sys em sa e y.
•
Sa e y Con ol Mode: This mode is ac i a ed be o e ans e ing con ol back o
he mission con olle in case he s a e is ou side he sa e se a e he so wa e
e esh. The sa e y con olle s ee s he s a e o he sys em back o he sa e se while
communica ions a e s ill u ned o .
1.2.3 Sa e se s o so wa e eju ena ion
Sa e y condi ions a e de ined by speci ying wo se s co esponding o di e en con olle s,
ensu ing ha he cons ain se s wi hin he sys em s a e space emain sa is ied unde all
ci cums ances [50], such as i is illus a ed in Figu e 1.1:
•
Sa e Se (
SS
): This se is he maximum se con aining all admissible sys em s a es
ha comply wi h s a e and inpu cons ain s du ing he SC mode.
1.2 P incipal concep s o so wa e eju ena ion 9
Figu e 1.1
Illus a ion o he so wa e eju ena ion s a egy in a ne wo ked con ol sys em
unde cybe a ack, ex ac ed om [1]. The igu e depic s he sys em ansi ion
h ough di e en ope a ional modes: he MC (blue solid line) execu es no mal
con ol asks while an ad e sa y a emp s o manipula e sys em beha io ( ed
dashed line). A a scheduled SR e en (g ay dashed line), he sys em eloads
a secu e so wa e e sion, elimina ing malicious code, bu he sys em is s ill
d i en by he a acke . Due o he sys em s a e is ou side he Inne Sa e Se
(yellow egion), he SC (g een do ed line) d i es he sys em back in o ha se
be o e esuming no mal ope a ion. Once he sys em eaches he Inne Sa e Se ,
i ansi ions back o MC, and he cycle epea s.
•
Inne Sa e Se (
ISS
): This se is he subse o he Sa e se ha con ains all admissible
s a es du ing he MC mode. The
ISS
mus sa is y he ollowing sa e y condi ions:
1.
Con ainmen : The sys em mus emain wi hin
ISS
du ing no mal ope a ion
(MC mode).
2.
Reco e y Gua an ee: he sa e y con olle mus be able o e u n he sys em
om he Sa e Se o his se in a bounded ime.
3.
A ack Resilience: The a acke should no be able o d i e he sys em ou o
SS du ing he pe iod o unce ain con ol.
4.
Admissibili y:
ISS
mus be a subse o he se o admissible s a es o he
MC mode (which is composed o all s a es ha comply wi h bo h s a e and
inpu cons ain s).
These sa e se s es ablish o mal gua an ees ha he sys em emains wi hin con olled
limi s e en in he p esence o ad e sa ial pe u ba ions.
10 Chap e 1. In oduc ion and objec i es
1.3 Objec i es
The p ima y objec i e o his hesis is o de elop model-based con ol s a egies ha
imp o e he esilience o con ol sys ems agains cybe h ea s and ad e sa ial a acks. To
his end, he esea ch is s uc u ed a ound ou key objec i es:
•
Objec i e 1: Re iew o he s a e-o - he-a in cybe secu i y o ne wo ked
and dis ibu ed MPC. Cybe secu i y has become a c i ical aspec o mode n
con ol applica ions, especially in ne wo ked and dis ibu ed MPC a chi ec u es. To
gua an ee he secu i y o hese con olle s, a deep p io knowledge o bo h po en ial
h ea s and possible esilien con ol s a egies capable o mi iga ing hei impac is
necessa y. The e o e, a de ailed e iew o he s a e-o - he-a on cybe secu i y o
ne wo ked and dis ibu ed MPC has been ca ied ou . This e iew examines key
a ack ec o s, exis ing de ensi e app oaches, and eme ging s a egies o enhance
sys em secu i y. The main indings o his analysis a e p esen ed in he su ey [48],
which p o ides a s uc u ed o e iew o he in e sec ion be ween cybe secu i y and
ad anced con ol echniques.
•
Objec i e 2: Design o esilien PI con olle s agains cybe h ea s. PI con-
olle s a e widely used in indus ial applica ions due o hei simplici y and e ec-
i eness. They we e de eloped in a ime when cybe secu i y conce ns we e no a
p ima y conside a ion, and as a esul , hei classical uning me hods, such as he
Ziegle -Nichols ules, do no explici ly inco po a e esilience agains cybe a acks.
Gi en he inc easing complexi y o indus ial con ol sys ems and hei exposu e o
cybe h ea s, i is necessa y o upda e hei design o bene i om mode n con ol
me hodologies. This hesis aims o enhance he PI con olle design by employing
s a e-space echniques ha in eg a e obus ness p ope ies in o he PI o mula ion.
By inco po a ing hese me hods, he p oposed app oach imp o es he con olle ’s
abili y o wi hs and cybe -induced pe u ba ions while main aining s abili y and
pe o mance. The esul s o his objec i e a e demons a ed in [2,4].
•
Objec i e 3: De elopmen o TBMPC o cybe -secu e con ol. While PI con-
olle s p o ide a basic le el o esilience, mo e ad anced con ol s a egies, such
as MPC, o e g ea e lexibili y in handling unce ain ies. Howe e , con en ional
MPC app oaches o en ely on inpu bu e s o manage communica ion delays o
packe losses, a echnique ha has been ex ensi ely explo ed in he li e a u e [25,26].
This hesis ex ends MPC-based secu i y s a egies by inco po a ing a ee-based
p edic i e s uc u e ha accoun s o mul iple po en ial cybe a acks, including
jamming a acks. In his way, ins ead o s o ing a single inpu sequence in he bu e ,
he p oposed TBMPC amewo k gene a es and s o es mul iple possible con ol
sequences in a ee s uc u e. This allows he con olle o dynamically adap o ne -
wo k dis up ions, inc easing esilience agains ad e sa ial h ea s. The e ec i eness
o his app oach has been alida ed in [5,6].
•
Objec i e 4: In eg a ion o so wa e eju ena ion in o TBMPC. Ano he key
objec i e o his hesis is o adap cybe secu i y s a egies om o he domains o
he ield o con ol enginee ing, speci ically, he so wa e eju ena ion s a egy in o
1.4 Lis o publica ions 11
MPC con olle s. O iginally, so wa e eju ena ion was de eloped in he 1990s o
handle he so wa e aging p oblem [35], and since hen, i has been explo ed in
a ious ields [36,58]. In pa icula , his hesis ex ends i s applica ion by in eg a ing
so wa e eju ena ion wi hin p edic i e con ol amewo ks, ep esen ing he i s
a emp o combine bo h me hodologies sys ema ically. The p oposed app oach is
de ailed in [1,7,49].
•
Objec i e 5: Valida ion and e alua ion in ealis ic scena ios h ough simu-
la ions. The inal objec i e o his hesis is o alida e he p oposed me hods in
ealis ic con ol scena ios, ensu ing hei applicabili y o p ac ical CPS. This is
achie ed h ough simula ions in wo di e en en i onmen s:
–The HyLab labo a o y-scale mic og id, which is a domes ic hyd ogen-based
enewable mic og id in oduced in [59]. This es bed was o iginally designed
o implemen and analyze di e en ope a ional modes and con ol s a egies
aimed a op imizing hyd ogen-based sma g id pe o mance. In ou case,
i p o ides a con olled en i onmen o assessing cybe -a ack esilience
s a egies in ne wo ked con ol sys ems. I ep esen s he case s udy used
in [1,7,49].
–
I iga ion canal ne wo ks, which a e la ge-scale hyd aulic sys ems designed o
dis ibu e wa e e icien ly o ag icul u al use. Gi en hei in e connec ed na-
u e and eliance on emo e con ol, hese sys ems a e inc easingly ulne able
o cybe h ea s ha can dis up wa e deli e y and comp omise in as uc u e
eliabili y. In pa icula , he ASCE Tes Canal 1 in oduced in [60,61] ep e-
sen s he case s udy in [2,4]. This es canal p o ides a s anda dized pla o m
o e alua ing con ol s a egies unde ealis ic condi ions. In ou simula ions,
we u ilize he linea canal model p oposed by [62].
The combina ion o hese es scena ios ensu es ha he p oposed secu i y mecha-
nisms a e no only heo e ically sound bu also e ec i e in eal-wo ld applica ions.
1.4 Lis o publica ions
The wo ks ca ied ou o his hesis ha e o igina ed he ollowing publica ions.
•Jou nal a icles:
1.
T. A auz, J.M. Maes e, X. Tian, G. Guan, "Design o PI Con olle s o
I iga ion Canals Based on Linea Ma ix Inequali ies," Wa e , ol. 12, no. 3,
pp. 855, 2020. [2]
2.
T. A auz, J.M Maes e, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linea
P og amming App oach o Compu ing Sa e Se s o So wa e Reju ena ion,"
IEEE Con ol Sys ems Le e s, ol. 6, pp. 1214–1219, 2021. [1]
3.
T. A auz, P. Chan eu , J.M. Maes e, "Cybe -secu i y in ne wo ked and dis-
ibu ed model p edic i e con ol," Annual Re iews in Con ol, ol. 53, pp.
338–355, 2022. [48]
18 Chap e 2. Summa y o esul s and discussion
sys em objec i es. So wa e-based a acks can in oduce pe sis en h ea s ha a e
di icul o de ec and mi iga e.
To illus a e hese a acks, he su ey p esen s simula ion esul s ha demons a e how
di e en DMPC amewo ks beha e unde ad e sa ial condi ions. Speci ically, i e alua es
he esilience o a dual-decomposi ion DMPC scheme unde jamming a acks (Example 1),
as well as he impac o alse e e ence injec ions on coope a ion-based DMPC (Example
2), ollowing models om [65,66].
To mi iga e cybe secu i y isks in DMPC, a ious de ense s a egies ha e been p oposed.
The su ey ca ego izes hese in o p e en ion, de ec ion, and mi iga ion echniques:
•
P e en ion mechanisms. These s a egies aim o s eng hen secu i y be o e an a ack
occu s. Common echniques include enc yp ed communica ion p o ocols, secu e
consensus algo i hms, and obus op imiza ion echniques ha imp o e esilience o
ad e sa ial dis up ions.
•
De ec ion mechanisms. These ocus on iden i ying cybe a acks in eal ime. Ad-
anced anomaly de ec ion sys ems use s a is ical models, machine lea ning, o s a e
es ima ion echniques o iden i y de ia ions om no mal sys em beha io . In pa ic-
ula , he su ey discusses in Example 3 he lea ning-based de ec ion mechanism
in oduced in [67], which employs his o ical da a o de ec ne wo k anomalies.
•
Mi iga ion mechanisms. When an a ack is de ec ed, mi iga ion s a egies ensu e
sys em s abili y by adap ing con ol ac ions. These s a egies can be classi ied as
passi e o ac i e.
–
Passi e mi iga ion echniques ocus on designing inhe en ly obus con olle s
capable o main aining s abili y despi e a acks, wi hou equi ing eal- ime
de ec ion. Examples include aul - ole an DMPC a chi ec u es and secu e
s a e es ima ion me hods, which enhance esilience by ensu ing ha con ol
ac ions emain s able unde ad e sa ial condi ions.
–
Ac i e mi iga ion s a egies, on he o he hand, dynamically adjus con ol
ac ions in esponse o de ec ed anomalies. These include neu al ne wo k-based
coun e measu es, such as hose p oposed in [68], which use p edic i e models
o compensa e o comp omised da a. In pa icula , Example 4 in [48] illus-
a es he applica ion o a neu al ne wo k-based de ec ion and compensa ion
mechanism wi hin a coope a i e-based DMPC amewo k, highligh ing i s
abili y o mi iga e he impac o cybe a acks on dis ibu ed con olle s.
Despi e signi ican ad ancemen s in cybe -de ense mechanisms o DMPC sys ems,
se e al open challenges emain. One o he mos p essing issues is he need o eal- ime
de ec ion and adap i e esponse s a egies, as many exis ing me hods ely on o line analysis
and p ede ined a ack models. Fu u e e o s should ocus on de eloping adap i e secu i y
amewo ks capable o dynamically esponding o eme ging h ea s wi hou comp omis-
ing sys em pe o mance. Addi ionally, in eg a ing cybe - esilien con ol mechanisms
di ec ly in o DMPC o mula ions is a c ucial esea ch di ec ion. Ensu ing ha con olle s
emain obus agains ad e sa ial condi ions while main aining op imal decision-making
2.2 Resilien model-based PI con olle design 19
unde unce ain y would enhance he esilience o dis ibu ed con ol a chi ec u es. An-
o he key challenge is scalabili y and compu a ional e iciency. As DMPC is commonly
applied o la ge-scale ne wo ked sys ems, cybe - esilien implemen a ions mus emain
compu a ionally easible o be p ac ical in eal-wo ld applica ions.
The su ey p esen ed in [48] p o ides a s uc u ed analysis o hese challenges, o e ing
a comp ehensi e o e iew o ulne abili ies, a ack s a egies, and de ense mechanisms in
dis ibu ed p edic i e con ol. This wo k se es as a e e ence o esea che s and p ac i-
ione s wo king owa ds he de elopmen o mo e secu e and esilien DMPC amewo ks.
2.2 Resilien model-based PI con olle design
This sec ion summa izes he wo ks o [2,4] ha p opose wo dis inc algo i hms based on
LMIs. Bo h designs aim o make canal i iga ion managemen mo e e icien and p ac ical.
In pa icula , he i s a icle [2] sol es an LMI-based op imal con ol p oblem o ob ain a
spa se eedback ha p o ides he PI uning. Mo eo e , he second algo i hm, p esen ed
in [4], enhances he wo k in [2] by inco po a ing s abili y gua an ees o sys ems wi h up
o a speci ied maximum p obabili y o packe losses. The nex subsec ions summa ize he
main ea u es o bo h LMI-based algo i hms.
2.2.1 Basic PI con olle s design using LMIs
The a icle [2] p esen s a no el LMI-based me hodology o uning PI con olle s wi h an
applica ion o i iga ion canals. In pa icula , he wo k ocuses on challenges in designing
PI con olle s o dis ibu ed sys ems and p oposes an LMI-based app oach ha ensu es
op imal con ol pe o mance by add essing hese challenges.
I iga ion canals a e essen ial o e icien ly dis ibu e wa e as hey ep esen app ox-
ima ely 85% o global wa e usage. Managing wa e le els and low a es ac oss in e -
connec ed canal pools equi es e ec i e con ol mechanisms. He e, PI con olle s a e
b oadly employed o hei simplici y and adap abili y. Howe e , hei uning p esen s
a signi ican challenge, o en equi ing a balance be ween pe o mance, obus ness, and
p ac ical implemen a ion.
The e o e, [2] p oposes an e icien LMI-based me hod o une PI con olle s o
i iga ion canal sys ems. The p oposed me hod inco po a es: i) A spa se eedback design
o minimize unwan ed in e ac ions be ween canal pools; ii) a cen alized con ol s a egy
le e aging subsys em syne gies; and iii) he abili y o in eg a e cons ain s and handle
unce ain ies, imp o ing obus ness and eliabili y.
This wo k also models he i iga ion canal sys em as a se ies o in e connec ed sub-
sys ems, each ep esen ing a canal pool. The dynamics o each subsys em a e desc ibed
using a linea ized model. The o e all goal is o minimize a cos unc ion ha penalizes
de ia ions in wa e le els and excessi e ga e mo emen s. The LMI app oach o mula es
he con olle design as a con ex op imiza ion p oblem. Key s eps include:
•
S a e and inpu mapping: A eedback ma ix is designed o map sys em s a es
o con ol ac ions unde spa si y cons ain s, ensu ing ha no all s a e a iables
in luence e e y con ol ac ion.
20 Chap e 2. Summa y o esul s and discussion
•
S abili y and pe o mance: Sys em s abili y is ensu ed h ough he use o a Lyapuno
unc ion. The ma ix inequali ies de i ed ensu e ha he con olle minimizes cos
while main aining s abili y.
•
Tuning lexibili y: By adjus ing he weigh ing ma ices o he cos unc ion, he
con olle allows ade-o s be ween wa e le el s abili y and con ol e o .
The p oposed me hod is es ed on he ASCE Tes Canal 1, a s anda dized model e-
quen ly used o e alua e i iga ion con ol algo i hms. The model includes eigh in e -
connec ed canal pools wi h ga ed con ols. A simpli ied linea model o he canal ( he
In eg a o -Delay model) is used o con olle design, and simula ions a e conduc ed using
Sobek so wa e, which sol es he ull Sain -Venan equa ions o uns eady low.
In o de o analyze i s pe o mance, h ee LMI-based PI uning s a egies a e e alua ed,
each a ying he weigh ing ma ix o wa e le el s abili y: LMI Me hod 1, whe e penal ies
a e manually adjus ed h ough ial and e o ; LMI Me hod 2, wi h penal ies p opo ional
o he leng h o each canal sec ion; and LMI Me hod 3, wi h penal ies p opo ional o
he backwa e su ace a ea o each canal sec ion. Fu he mo e, his wo k compa es hese
con olle s wi h he ou PIF con olle s p esen ed by [3].
Figu es 2.1 and 2.2 illus a e he esul s o he LMI and PIF con olle s, espec i ely.
As can be shown in all Figu es and Tables o [2], he LMI-based con olle s consis en ly
ou pe o m PIF con olle s:
•
LMI me hods achie e lowe maximum e o alues, demons a ing imp o ed accu-
acy in main aining desi ed wa e le els.
•
LMI con olle s eco e as e om dis u bances, highligh ing hei obus ness unde
a iable condi ions.
•
LMI me hods educe he magni ude o de ia ions du ing ailu es, imp o ing o e all
eliabili y in ailu e scena ios.
Among he h ee LMI-based PI uning s a egies conside ed, he hi d s a egy achie es
he bes o e all pe o mance, balancing e o educ ion and eco e y speed. In con as ,
he i s con olle p o ides he as es dis u bance eco e y, al hough i leads o sligh ly
highe e o s. The second me hod o e s in e media e pe o mance, making i sui able o
gene al applica ions.
To sum up, he key ad an ages o he LMI app oach p esen ed in [2] a e:
•
Cen alized design: by conside ing he en i e canal sys em, he me hod a oids local
op ima and exploi s in e -pool syne gies.
•
Spa si y cons ain s: he eedback ma ix ensu es ha each con olle ocuses on
ele an s a es, minimizing complexi y and mi iga ing con lic s be ween con olle s.
•
Robus ness: he amewo k na u ally handles unce ain ies and dis u bances, en-
hancing adap abili y o p ac ical ope a ional scena ios.
2.2 Resilien model-based PI con olle design 21
(a) LMI Me hod 1.
(b) LMI Me hod 2.
(c) LMI Me hod 3.
Figu e 2.1
Simula ion esul s o he es in he non-linea canal model p esen ed in [2] o
he h ee LMI-based PI uning s a egies.
22 Chap e 2. Summa y o esul s and discussion
(a) PIF Me hod 1.
(b) PIF Me hod 2.
Figu e 2.2
Simula ion esul s o he es in he non-linea canal model p esen ed in [2] o
he PIF me hods [3].
2.2 Resilien model-based PI con olle design 23
(Figu e 2.2 con inued)
(c) PIF Me hod 3.
(d) PIF Me hod 4.
Figu e 2.2 (c) and (d).
24 Chap e 2. Summa y o esul s and discussion
2.2.2 Design o PI con olle s conside ing packe losses
The a icle [4] o e s an imp o ed app oach o i iga ion canal con ol in un eliable
communica ion ne wo ks. The ea lie a icle [2] p esen ed an PI con olle design using
LMIs, bu wi hou conside ing ne wo k impe ec ions like packe losses. Thus, his new
con ibu ion enhances he model by adding esilience o packe losses, imp o ing bo h
eliabili y and sys em s abili y.
I iga ion sys ems a e essen ial o global ag icul u e, bu hei e iciency is o en chal-
lenged by in as uc u al and communica ion laws, pa icula ly in CPSs. These sys ems
in eg a e compu ing esou ces wi h physical p ocesses, making hem ulne able o ne wo k
dis up ions. The p e ious wo k [2] highligh ed he e ec i eness o PI con olle s designed
using LMIs o s able canal managemen , al hough i assumed ideal communica ion condi-
ions.
Gi en he inc easing h ea o cybe secu i y inciden s and na u al packe losses due o
un eliable ansmissions, he de elopmen o obus con olle s has become inc easingly
impo an . This wo k [4] add esses hese challenges by p oposing a model capable o
main aining sys em s abili y e en unde signi ican packe loss, he eby enhancing he
p ac ical applicabili y o he PI con ol me hodology. This imp o emen is achie ed by
ex ending he LMI cons ain s om [2] wi h addi ional condi ions om [64] o accoun
o packe losses.
In pa icula , he main inno a ions o [4] o e he p e ious algo i hm o [2] a e:
•
Packe loss conside a ion: While he me hod o [2] op imizes con olle s wi hou
accoun ing o ne wo k eliabili y, he new design o [4] in oduces a p obabilis ic
Be noulli model o ep esen packe loss scena ios. This p obabilis ic app oach
ensu es ha he con olle main ains pe o mance up o a speci ied maximum packe
loss p obabili y.
•
S abili y gua an ees wi h LMIs: The enhanced design in eg a es addi ional LMI
cons ain s o ensu e s abili y despi e un eliable communica ion. The me hod calcu-
la es easible solu ions i e a i ely, adjus ing some pa icula pa ame e s o main ain
pe o mance despi e high packe loss p obabili ies (up o 60%).
•
Cen alized s. decen alized design: Unlike ea lie wo k o [2], ha ocuses on
cen alized con ol assump ions, he cu en model o [4] adap s o local a ia ions
while p ese ing cen alized coo dina ion. This allows o independen handling o
packe losses by each canal sec ion, he eby educing in e dependency isks.
In [4], h ee di e en con olle s a e compa ed unde a ious condi ions: i) he p oposed
packe loss ole an PI con olle , designed wi h obus ness agains up o 60% packe loss;
ii) he s anda d PI con olle o p e ious wo k [2]; and iii) he PIF con olle o [3] ha
p esen s he bes pe o mance o all me hods p esen ed in ha a icle.
The compa ison be ween he h ee con olle s is accomplished in [4] by simula ing h ee
di e en scena ios: wi h no packe losses, wi h
30%
p obabili y o packe losses and wi h
60%
p obabili y. The es simula ed in [4] is he same as in [2]. He e, only he esul s o
he simula ions wi h a
60%
packe loss p obabili y a e shown in Figu e 2.3. Howe e , he
comple e se o esul s is illus a ed in he igu es and ables in [4]. Nex , a summa y o
hei discussion is p o ided:
2.3 S ochas ic MPC o un eliable ne wo ks 25
•
No packe loss: In ideal condi ions, whe e he e a e no losses, he p e ious PI
con olle o [2] p esen s he bes pe o mance, ou pe o ming he new design o [4].
The la e p esen s he so es esponse due o i has been designed conside ing
packe losses.
•30%
Packe loss: The s anda d PI con olle o [2] exhibi s signi ican deg ada ion,
wi h inc eased e o s and ins abili y. Howe e , he p oposed design o [4] main ains
consis en pe o mance, demons a ing supe io esilience. The PIF con olle
handles mode a e packe loss bu exhibi s educed s abili y compa ed o he p oposed
me hod.
•60%
Packe loss: Unde se e e condi ions, he PI con olle o [2] ails, wi h e o s
inc easing signi ican ly. Al hough he PIF con olle pe o ms be e , i s ill expe-
iences conside able de ia ions. In con as , he p oposed design o [4] main ains
sys em in eg i y, e ec i ely con olling wa e le els wi h minimal inc ease in e o s.
The e o e, his wo k [4] ep esen s a signi ican imp o emen o e he p e ious PI
design o [2] by add essing he c i ical challenge o ne wo k eliabili y. By inco po a ing
packe loss esilience h ough ad anced LMI cons ain s, he new me hod ensu es obus
pe o mance and s abili y, e en unde se e e communica ion aul s. This ad ancemen
makes i a use ul ool o mode n i iga ion canal managemen , enhancing bo h e iciency
and sus ainabili y in wa e esou ce u iliza ion.
2.3 S ochas ic MPC o un eliable ne wo ks
In his sec ion, pape s [5] and [6] a e p esen ed. The i s pape [5] in oduces a no el
TBMPC app oach o add ess cybe secu i y h ea s, speci ically ocusing on jamming
a acks in ne wo ked con ol sys ems. The second a icle, [6], p esen s an enhanced
e sion o he p e ious TBMPC app oach [5] by inco po a ing obus ness agains bo h
packe losses and ex e nal dis u bances simul aneously, using a mul i-scena io s ochas ic
amewo k.
2.3.1 T ee-Based MPC o jamming a acks
The pape [5] p esen s a TBMPC s a egy o ace packe losses due o jamming a acks.
Unlike adi ional MPC me hods, his new amewo k enhances sys em obus ness by
an icipa ing po en ial packe losses and p e-compu ing con ol sequences o a ious loss
scena ios. By o ganizing hese sequences in o a ee s uc u e, he con olle dynamically
adap s o eal- ime condi ions, ensu ing s abili y and pe o mance e en unde signi ican
communica ion dis up ions.
Ne wo ked con ol sys ems depend on s able communica ion be ween componen s;
howe e , wi eless ne wo ks ace ulne abili ies such as in e e ence and jamming a acks,
which isk pe o mance and s abili y. Al hough p e ious esea ch has ocused on designing
obus con olle s o add ess hese challenges, adi ional MPC s a egies o en assume
ideal communica ion condi ions, educing hei p ac icali y in eal-wo ld applica ions.
MPC is a widely used con ol s a egy ha op imizes u u e con ol ac ions based on
sys em models and cons ain s. I compu es a sequence o inpu s o minimize a cos unc ion
26 Chap e 2. Summa y o esul s and discussion
(a) PI con olle o [4].
(b) PI con olle o [2].
(c) PIF con olle o [3].
Figu e 2.3
Simula ion esul s o he es in he non-linea canal model wi h
60%
o packe
loss p esen ed in [4] o he designed PI con olle o [4], he PI con olle o [2]
and he PIF con olle o [3].
2.3 S ochas ic MPC o un eliable ne wo ks 27
o e a p edic ion ho izon. Howe e , s anda d MPC implemen a ions s uggle wi h packe
losses because hey ely on con inuous eedback. When da a packe s a e los , he sys em
migh ecei e delayed o pa ial in o ma ion, esul ing in educed pe o mance o po en ial
ins abili y. P e ious e o s o add ess his issue include de e minis ic con olle s wi h
inpu bu e s and s ochas ic MPC o mula ions ha inco po a e packe loss p obabili ies
in o he cos unc ion. Al hough hese app oaches imp o e esilience, hey o en ail o
pe o m e ec i ely in highly unce ain scena ios, such as coo dina ed jamming a acks.
The p oposed TBMPC me hod o e comes hese limi a ions by conside ing all possible
packe loss scena ios wi hin he p edic ion ho izon, allowing he con olle o success ully
adap o dis up ions.
The main inno a ion o TBMPC lies in i s ee s uc u e, which maps all possible
communica ion scena ios. Each b anch o he ee co esponds o a di e en packe loss
pa e n, and each node ep esen s a con ol ac ion. By e alua ing he sys em’s e olu ion
unde each scena io, he con olle selec s he op imal sequence o ac ions based on a
weigh ed cos unc ion.
The key ea u es o he TBMPC amewo k p esen ed in [5] a e:
•The sys em is modeled using a disc e e- ime s a e-space ep esen a ion.
•
Packe losses a e modeled using a Be noulli p ocess, wi h each packe ha ing a
p obabili y o being los . This p obabilis ic amewo k allows he con olle o
an icipa e dis up ions and adjus i s s a egy acco dingly.
•
The p edic ion ho izon is di ided in o ime s eps, and each s ep is b anched in o wo
possible ou comes: success ul ansmission o packe loss. This b anching esul s
in a bina y ee wi h 2N−1possible scena ios o a p edic ion ho izon o leng h N.
•
To ensu e he con olle does no an icipa e u u e packe losses, non-an icipa i i y
cons ain s a e imposed, equi ing con ol ac ions a each node o be consis en wi h
he in o ma ion a ailable a ha ime.
•
The objec i e o TBMPC is o minimize he expec ed alue o a cos unc ion ha
includes s a e de ia ions and con ol e o s.
•
The op imiza ion p oblem ensu es ha con ol inpu s espec sys em cons ain s
while minimizing he expec ed cos .
To demons a e he e ec i eness o TBMPC in [5], he me hod was applied o a ca -
pendulum sys em, a common benchma k in con ol heo y. In addi ion, wo di e en
s a egies a e es ed o he inpu signal in case o packe loss: a ze o inpu is applied o
he sys em, o he co esponding elemen o he las inpu sequence success ully ecei ed
is applied ins ead. The simula ion compa es TBMPC wi h s anda d MPC unde di e en
packe loss scena ios:
•Resul s wi hou packe loss: In he absence o packe losses, he TBMPC and s an-
da d MPC pe o m iden ically, bo h achie ing quick s abiliza ion o he pendulum.
This esul con i ms ha TBMPC does no in oduce unnecessa y complexi y o
pe o mance deg ada ion when communica ion is eliable.
34 Chap e 2. Summa y o esul s and discussion
and SR pe iods. This ensu es ha con ol ac ions a e op imized o bo h immedia e
and long- e m objec i es. The p edic ion ho izon inco po a es he p obabili y o
cybe a acks du ing MC and in eg a es he ixed du a ion o SR ac ions o ensu e
con inui y and sys em s abili y.
•
T ee-based s uc u e: A key ea u e o he amewo k is i s ee-based s uc u e,
which models all possible a ack scena ios o e he p edic ion ho izon. Each scena io
is associa ed wi h a p obabili y, which is used o calcula e he expec ed cos and
guide op imal decision-making. Each b anch co esponds o a dis inc sequence
o a ack and eco e y e en s, enabling he con olle o e alua e a ious pa hways
simul aneously. This s uc u e allows he sys em o an icipa e dis up ions and adjus
con ol ac ions acco dingly, enhancing i s esilience o cybe a acks.
•
Non-an icipa o y cons ain s: To main ain causali y, he con ol ac ions ac oss di e -
en scena ios mus align un il he co esponding di e gence poin o he ee. These
cons ain s educe he numbe o decision a iables, simpli ying he op imiza ion
p oblem while main aining p ecision.
•
Cos unc ion: The cos unc ion balances mul iple objec i es, including minimizing
s a e de ia ions, con ol e o , and eco e y ime. By assigning weigh s o hese
objec i es, he con olle can p io i ize he goals based on ope a ional needs. In
addi ion, he p obabilis ic na u e o a acks is in oduced in o he cos unc ion,
ensu ing ha he op imiza ion p ocess accoun s o he likelihood and impac o
each scena io.
•Open-loop p edic i e con ol s a egy: This app oach builds on he indings o ou
p e ious a icles [5,6,49], and compu es con ol ac ions o e a ixed p edic ion
ho izon, conside ing p ede ined p obabili ies o po en ial cybe a acks. Based on
how unce ain a iables a e managed, h ee di e en con igu a ions a e es ablished:
–
Open-Loop Wo s -Case Min-Max TBMPC (OL-WmmTBMPC): Focused on
obus ness, his con igu a ion compu es con ol ac ions unde he assump ion o
he wo s -case a ack scena io, i.e., bo h a acks and dis u bances a e conside ed
as unce ain. The e o e, his is he mos conse a i e app oach.
–
Open-Loop Min-Max TBMPC (OL-mmTBMPC): This con igu a ion consid-
e s a acks as an unce ain a iable and o ecas o dis u bances (ex e nal
dis u bances se as hei mean obse ed alues).
–
Open-Loop TBMPC (OL-TBMPC): A baseline con igu a ion ha p ecompu es
con ol ac ions based on nominal condi ions, wi hou explici ly accoun ing o
wo s -case scena ios, i.e., conside ing dis u bance and a ack o ecas (ex e nal
dis u bances se as hei mean obse ed alues and no a acks).
•
Closed-loop p edic i e con ol s a egy: The Closed-Loop TBMPC (CL-TBMPC)
is based on he me hodology p esen ed in [71]. This app oach employs dis u bance
eedback pa ame e iza ion, which means ha he con ol policy is de ined as an
a ine unc ion o he sequence o pas dis u bances wi hin he p edic ion ho izon.
Howe e , his s a egy is adap ed in [7] o he ee-based amewo k ha includes
2.4 So wa e eju ena ion s a egies 35
bo h sou ces o unce ain y: ex e nal dis u bances and a acks. Fu he de ails a e
p o ided in Sec ion III-B and he Appendix o [7].
The a icle [7] e alua es hese s a egies h ough simula ions conduc ed on he lab-
scale HyLab mic og id [70], which was p e iously used in o he so wa e eju ena ion
wo ks [1,49]. The con igu a ion o he so wa e eju ena ion se -up is compu ed using
he basic algo i hm ou lined in [1], and he co esponding LQR con olle o MC is also
included o compa a i e analysis. Fou scena ios a e analyzed based on he p obabili y o
a ack:
0%
,
25%
,
50%
, and
75%
. And h ee dis inc ypes o a ack a e de ined ega ding
he a acke ’s pe o mance:
•A ack Case 1: The a acke se s he inpu signals o hei maximum alues.
•
A ack Case 2: The a acke disables he ac ua o s by se ing he inpu signals o
ze o.
•
A ack Case 3: The a acke eplays he las inpu signal applied by he MC con olle .
To e alua e he pe o mance o he di e en mission con olle s, some pe o mance indica-
o s a e calcula ed: he accumula ed cos , he numbe o ins an s whe e he SC is ac i a ed,
and he o al numbe o a acks expe ienced. Fo he h ee scena ios ha in ol e a acks,
he esul s a e p esen ed as he mean alue wi h he s anda d de ia ion shown in b acke s.
Each case is based on a se o 1,000 simula ions. The comple e esul s a e summa ized in
Table 2.1.
Finally, Figu e 2.7 shows an in e al o
30
ime ins an s (
15
min) o he simula ions
pe o med wi h
25%
o p obabili y o a acks and a ack case 1 (
uA
=umax
) using he
LQR, he OL-mmTBMPC, and he CL-TBMPC as mission con olle s. The simula ion
esul s highligh he s eng hs and weaknesses o each s a egy:
•
The CL-TBMPC consis en ly ou pe o ms all open-loop con igu a ions and he
LQR-based con olle in e ms o eco e y ime and cos e iciency, especially unde
high-in ensi y a acks (A ack Case 3).
•
Among he open-loop con igu a ions, OL-mmTBMPC achie es he bes balance
be ween pe o mance and ope a ional cos , whe eas OL-WmmTBMPC p io i izes
obus ness, esul ing in inc eased cos s.
•
The LQR con olle pe o ms e ec i ely in low-in ensi y a ack scena ios. Howe e ,
i s uggles o main ain s abili y and incu s highe ope a ional cos s unde mo e
se e e condi ions.
In conclusion, his a icle [7] highligh s he bene i s o closed-loop TBMPC in add ess-
ing he challenges o cybe a acks in so wa e eju ena ion s a egies. The h ee open-loop
con igu a ions o e al e na i e app oaches, wi h OL-mmTBMPC being pa icula ly e ec-
i e o applica ions ha p io i ize educed compu a ional complexi y. As demons a ed,
CL-TBMPC achie es mode a e imp o emen s compa ed o he baseline LQR mission
con olle , p o iding a simple se up o so wa e eju ena ion pa ame e s bu equi ing
mo e in ensi e online compu a ions. In addi ion, ecu si e easibili y is eadily ensu ed
wi hin his amewo k, as s a e cons ain s a e managed by he sa e y con olle and he
pe iodic so wa e e esh mechanism.
36 Chap e 2. Summa y o esul s and discussion
(a) LQR mission con olle .
(b) OL-mmTBMPC mission con olle .
Figu e 2.7
Simula ion esul s o he es in he lab-scale mic og id HyLab sys em p esen ed
in [7], wi h a p obabili y o a acks o
25%
du ing
15
minu es, using ou
di e en mission con olle s.
2.4 So wa e eju ena ion s a egies 37
(Figu e 2.7 con inued)
(c) CL-TBMPC mission con olle .
Figu e 2.7 (c).
38 Chap e 2. Summa y o esul s and discussion
Table 2.1
Values o
1000
simula ions wi h a ying a ack p obabili ies p esen ing he mean alues and, in b acke s, he co esponding
s anda d de ia ion.
MC Con olle Cos (104) Ins an s o SC # A acks Cos (104) Ins an s o SC # A acks Cos (104) Ins an s o SC # A acks
A ack P obabili y 0%
LQR 0.26 0.00 0 – – – – – –
OL-TBMPC 0.26 0.00 0 – – – – – –
OL-mmTBMPC 0.26 0.00 0 – – – – – –
OL-WmmTBMPC 0.71 0.00 0 – – – – – –
CL-TBMPC 0.25 0.00 0 – – – – – –
A ack Case 1 A ack Case 2 A ack Case 3
A ack P obabili y 25%
LQR 5.84 (1.43) 38.42 (12.67) 21.45 (3.62) 0.37 (0.04) 0.00 (0.00) 23.93 (4.37) 0.26 (0.00) 0.00 (0.00) 23.93 (4.37)
OL-TBMPC 5.84 (1.45) 40.92 (12.67) 21.28 (3.56) 0.36 (0.04) 0.01 (0.13) 23.93 (4.37) 0.26 (0.01) 0.00 (0.09) 23.93 (4.37)
OL-mmTBMPC 6.12 (1.49) 41.88 (12.80) 21.23 (3.55) 0.42 (0.05) 0.01 (0.13) 23.93 (4.37) 0.32 (0.02) 0.01 (0.13) 23.93 (4.37)
OL-WmmTBMPC 7.25 (1.53) 55.50 (11.58) 20.30 (3.47) 0.93 (0.09) 3.53 (2.64) 23.83 (4.32) 0.81 (0.07) 3.12 (2.75) 23.83 (4.35)
CL-TBMPC 5.70 (1.39) 40.57 (12.46) 21.32 (3.58) 0.35 (0.04) 0.00 (0.00) 23.93 (4.37) 0.25 (0.00) 0.00 (0.00) 23.93 (4.37)
A ack P obabili y 50%
LQR 13.65 (2.26) 79.15 (12.70) 37.52 (3.63) 0.58 (0.10) 0.13 (0.66) 48.03 (5.19) 0.26 (0.00) 0.00 (0.00) 48.03 (5.19)
OL-TBMPC 13.26 (2.22) 83.24 (11.93) 37.00 (3.50) 0.54 (0.10) 0.11 (0.59) 48.03 (5.19) 0.25 (0.02) 0.10 (0.78) 48.02 (5.18)
OL-mmTBMPC 13.85 (2.18) 85.92 (11.94) 36.66 (3.48) 0.72 (0.12) 0.56 (1.29) 48.02 (5.18) 0.40 (0.04) 0.10 (0.72) 48.02 (5.19)
OL-WmmTBMPC 14.80 (2.20) 93.41 (9.89) 35.67 (3.60) 1.20 (0.12) 7.17 (2.80) 47.32 (5.01) 0.92 (0.12) 2.93 (2.88) 47.85 (5.16)
CL-TBMPC 13.10 (2.20) 83.12 (11.84) 37.03 (3.50) 0.56 (0.10) 0.11 (0.61) 48.03 (5.19) 0.25 (0.00) 0.00 (0.00) 48.03 (5.19)
A ack P obabili y 75%
LQR 23.05 (2.43) 111.19 (8.41) 50.00 (2.79) 1.05 (0.19) 3.35 (2.83) 71.76 (3.98) 0.28 (0.03) 0.38 (2.03) 72.01 (4.12)
OL-TBMPC 22.22 (2.50) 114.62 (7.16) 49.32 (2.67) 0.96 (0.19) 2.37 (2.50) 71.90 (4.05) 0.32 (0.10) 5.25 (7.08) 71.24 (3.73)
OL-mmTBMPC 22.81 (2.41) 116.33 (6.83) 48.97 (2.75) 1.22 (0.18) 5.38 (3.19) 71.36 (3.88) 0.52 (0.10) 0.49 (1.78) 72.02 (4.17)
OL-WmmTBMPC 23.54 (2.32) 118.24 (5.90) 48.58 (2.88) 1.50 (0.14) 11.77 (2.41) 69.85 (3.92) 1.01 (0.21) 2.46 (4.16) 71.76 (4.10)
CL-TBMPC 22.15 (2.49) 114.81 (7.03) 49.28 (2.68) 1.03 (0.19) 2.87 (2.66) 71.83 (4.01) 0.29 (0.06) 1.34 (3.75) 71.88 (4.00)
3 Publica ions
The con en o his chap e has been omi ed o copy igh easons. Ins ead, we
p o ide a lis o he publica ions included in his hesis, along wi h hei DOI and a
summa y o hei con en , which is p esen ed in he di e en sec ions o Chap e 2.
•Block 1: Cybe secu i y and MPC (Sec ion 2.1).
1.
T. A auz, P. Chan eu , J.M. Maes e, "Cybe -secu i y in ne wo ked and dis-
ibu ed model p edic i e con ol," Annual Re iews in Con ol, ol. 53, pp.
338–355, 2022. [48]
DOI: 10.1016/j.a con ol.2021.10.005
Summa y: Sec ion 2.1
•Block 2: Resilien model-based PI con olle design (Sec ion 2.2).
2.
T. A auz, J.M. Maes e, X. Tian, G. Guan, "Design o PI Con olle s o
I iga ion Canals Based on Linea Ma ix Inequali ies," Wa e , ol. 12, no. 3,
pp. 855, 2020. [2]
DOI: 10.3390/w12030855
Summa y: Sec ion 2.2.1
3.
T. A auz, J.M. Maes e, A. Ce inkaya, E.F. Camacho, "Model-based PI design
o i iga ion canals wi h aul y communica ion ne wo ks," 2021 Eu opean
Con ol Con e ence (ECC), pp. 1236–1242, 2021. [4]
DOI: 10.23919/ECC54610.2021.9655060
Summa y: Sec ion 2.2.2
•Block 3: S ochas ic MPC o un eliable ne wo ks (Sec ion 2.3).
4.
T. Pie on, T. A auz, J.M. Maes e, A. Ce inkaya, C. S oica Maniu, "T ee-
Based Model P edic i e Con ol o Jamming A acks," 2020 Eu opean Con ol
Con e ence (ECC), pp. 948–953, 2020. [5]
DOI: 10.23919/ECC51009.2020.9143814
Summa y: Sec ion 2.3.1
39
40 Chap e 3. Publica ions
5.
T. A auz, J.M. Maes e, A. Ce inkaya, C. S oica Maniu, "A T ee-Based
Mul i-Scena io App oach o Ne wo ked MPC unde Packe Losses and Dis u -
bances," IFAC-Pape sOnLine, ol. 55, no. 16, pp. 296–301, 2022. [6]
DOI: 10.1016/j.i acol.2022.09.040
Summa y: Sec ion 2.3.2
•Block 4: So wa e eju ena ion s a egies (Sec ion 2.4).
6.
T. A auz, J.M Maes e, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linea
P og amming App oach o Compu ing Sa e Se s o So wa e Reju ena ion,"
IEEE Con ol Sys ems Le e s, ol. 6, pp. 1214–1219, 2021. [1]
DOI: 10.1109/LCSYS.2021.3090448
Summa y: Sec ion 2.4.1
7.
T. A auz, J.M. Maes e, D. Que edo, E.F. Camacho, "T ee-based Model P edic-
i e Con ol S a egy o So wa e Reju ena ion," 2022 IEEE 61s Con e ence
on Decision and Con ol (CDC), pp. 1124–1129, 2022. [49]
DOI: 10.1109/CDC51059.2022.9993366
Summa y: Sec ion 2.4.2
8.
T. A auz, J.M. Maes e, P. Chan eu , D.E. Que edo, E.F. Camacho, "Open
and closed-loop p edic i e con ol s a egies o so wa e eju ena ion," IEEE
T ansac ions on Eme ging Topics in Compu ing, 2024. [7]
DOI: 10.1109/TETC.2024.3481997
Summa y: Sec ion 2.4.2
4 Conclusions and u u e esea ch
di ec ions
H
is o ically, mos indus ial con ol sys ems we e designed as isola ed, independen
uni s ope a ing in physically secu e en i onmen s wi h limi ed ex e nal in e ac ion.
Howe e , he ex ended adop ion o ne wo ked con ol a chi ec u es, oge he wi h he
p og essi e in eg a ion o ad anced compu ing and communica ion echnologies, has
d ama ically inc eased he po en ial a ack su ace o hese sys ems. Mode n CPS ely
on eal- ime da a exchange be ween dis ibu ed componen s, emo e access capabili ies
o moni o ing and main enance, and cloud-based in as uc u es o da a s o age and
p ocessing. While hese ea u es o e undeniable bene i s in e ms o ope a ional e iciency
and lexibili y, hey also in oduce nume ous possibili ies o malicious ac o s.
The g owing numbe o documen ed cybe a acks a ge ing c i ical in as uc u es in
sec o s such as ene gy, wa e managemen , anspo a ion, and manu ac u ing highligh s
he eal and immedia e h ea posed by hese ulne abili ies. A acks on con ol sys ems
ha e become eal dange s wi h documen ed impac s on he economy, he en i onmen , and
ope a ional sa e y. Mo eo e , he e olu ion o a ack s a egies, including he use o s eal hy,
pe sis en echniques speci ically designed o bypass adi ional de ec ion mechanisms,
u he complica es he ask o secu ing hese sys ems. This si ua ion is agg a a ed by he
ac ha many o he con ol a chi ec u es cu en ly in ope a ion we e de eloped decades
ago, be o e cybe secu i y was conside ed a design equi emen . As a esul , much o he
indus ial con ol in as uc u e in ope a ion oday lacks basic secu i y measu es, lea ing
i highly exposed o cybe a acks.
The challenges posed by his con ex a e u he ampli ied when conside ing he high
speci ici y o cybe a acks a ge ing con ol sys ems. Unlike con en ional a acks on
in o ma ion sys ems, which ypically ocus on dis up ing se ices o s ealing da a, a acks
on con ol sys ems aim o manipula e he physical p ocess, g adually al e ing i s beha io
o deg ade pe o mance, c ea e unsa e condi ions, o e en cause comple e ailu es. This
dual na u e, which combines cybe manipula ion wi h physical consequences, makes he
de elopmen o uni e sal de ense mechanisms ex emely di icul . E ec i e cybe secu i y
o con ol sys ems he e o e equi es a mul idisciplina y app oach, capable o add essing
bo h he inhe en ulne abili ies o con ol algo i hms and he communica ion and so wa e
in as uc u es on which hey ely.
This hesis add esses p ecisely his need, ocusing on imp o ing he esilience o model-
based con ol sys ems agains cybe h ea s h ough he in eg a ion o secu i y-awa e
41
42 Chap e 4. Conclusions and u u e esea ch di ec ions
design me hodologies. The wo k has ackled his challenge om a b oad pe spec i e,
co e ing bo h con en ional con ol s a egies, such as PI con olle s widely used in indus y,
and mo e ad anced app oaches like p edic i e con ol, pa icula ly in ne wo ked and
dis ibu ed se ings. In bo h cases, he p oposed me hodologies aim o explici ly accoun
o he p esence o cybe h ea s, ensu ing ha he designed con olle s no only mee
pe o mance equi emen s unde nominal condi ions, bu also main ain hei abili y o
ope a e sa ely and eliably in ad e sa ial en i onmen s.
In he case o PI con olle s, which emain he mos common con ol solu ion in indus ial
applica ions, his hesis has demons a ed how a model-based design app oach using
s a e-space echniques and LMIs can be applied o enhance hei obus ness agains cybe -
induced dis u bances. Despi e hei ex ensi e use in indus ial p ocesses, PI con olle s a e
s ill p edominan ly designed using classical uning me hods, such as he Ziegle -Nichols
ules, which do no explici ly accoun o cybe h ea s. This hesis add esses his limi a ion
by inco po a ing obus ness p ope ies di ec ly in o he con olle design, ensu ing ha he
esul ing PI con olle s a e no only capable o main aining pe o mance unde nominal
condi ions, bu also wi hs and communica ion aul s, packe losses, and cybe -induced
pe u ba ions ha ypically a ise in ne wo ked en i onmen s. These con ibu ions combine
he simplici y and amilia i y o PI con olle s wi h he obus ness bene i s de i ed om
mode n con ol design echniques. The e o e, hey p o ide a p ac ical and e ec i e
way o upg ade exis ing indus ial con ol sys ems o add ess he cybe secu i y challenges
associa ed wi h in e connec ed in as uc u es. Fu he mo e, his esul highligh s ha e en
well-es ablished con ol echniques, de eloped decades ago, can be adap ed and enhanced
o inco po a e esilience p ope ies, demons a ing ha adi ional con ol solu ions can
e ol e o mee mode n secu i y equi emen s, as shown in [2,4].
Fo mo e ad anced con ol a chi ec u es, his hesis has ocused on MPC, a s a egy
ha inhe en ly o e s conside able lexibili y o handle unce ain ies and ope a ional con-
s ain s, bu also in oduces speci ic ulne abili ies due o i s eliance on eal- ime da a
exchange and i e a i e op imiza ion p ocesses. While PI con olle s p o ide a basic le el
o esilience, MPC con olle s enable a mo e explici conside a ion o ad e sa ial sce-
na ios by embedding po en ial dis u bances and ne wo k-induced issues di ec ly in o he
op imiza ion o mula ion. To enhance he obus ness o p edic i e con ol in ne wo ked
en i onmen s, his hesis p oposes a new class o cybe - esilien p edic i e con olle s,
buil on ee-based MPC o mula ions. They explici ly accoun o po en ial ne wo k
dis up ions, including packe losses and jamming a acks, by gene a ing a ee o possible
con ol sequences ha e lec s he ange o easible scena ios he sys em could deal wi h.
This enables he con olle o dynamically adap i s ac ions as he ac ual communica ion
condi ions un old. Unlike con en ional MPC s a egies, which p ima ily ely on inpu
bu e s o conse a i e cons ain s o mi iga e he impac o delays and packe losses, he
p oposed app oach o e s a mo e lexible and adap i e esponse, an icipa ing ad e sa ial
scena ios and embedding his awa eness di ec ly in o he op imiza ion p ocess. The esul s
p esen ed in [5,6] demons a e he e ec i eness o his s a egy, which builds upon and
ex ends p e ious app oaches ha ocused on compensa ing o communica ion delays, now
inco po a ing a b oade iew ha conside s bo h s ochas ic dis u bances and ad e sa ial
in e e ence.
4.1 Fu u e esea ch 43
The mos inno a i e con ibu ion o his hesis lies in he in eg a ion o so wa e eju-
ena ion echniques in o p edic i e con ol amewo ks, ep esen ing a no el app oach
o imp o ing he cybe secu i y o ne wo ked con ol sys ems. O iginally de eloped in
he compu ing ield o add ess so wa e aging, so wa e eju ena ion was designed o
pe iodically ese he un ime so wa e, elimina ing accumula ed e o s, esou ce leaks, o
unin ended modi ica ions. This hesis ex ends ha concep and adap s i o he speci ic
equi emen s o con ol sys ems ope a ing in ad e sa ial en i onmen s, using so wa e
eju ena ion as a p oac i e cybe secu i y mechanism. By pe iodically es o ing he con ol
so wa e o a secu e s a e, he sys em can e ec i ely emo e any s eal hy modi ica ions
in oduced by unde ec ed cybe a acks ha a ge he un ime code. A key con ibu ion o
his wo k is he di ec inco po a ion o scheduled so wa e e eshes in o he p edic i e
con ol o mula ion, ensu ing ha bo h he iming o hese e en s and hei po en ial impac
on he sys em dynamics a e explici ly conside ed du ing he op imiza ion p ocess. This
combina ion be ween so wa e eju ena ion and TBMPC allows he con olle o an icipa e
and plan a ound so wa e ese s, ensu ing smoo h ansi ions be ween ope a ional modes
and main aining sys em s abili y and pe o mance e en when ope a ing unde ad e sa ial
condi ions. The e ec i eness o his s a egy has been demons a ed in [1,7,49], whe e
i s abili y o mi iga e hijacking-based a acks and pe sis en s eal hy h ea s in ne wo ked
con ol sys ems has been alida ed.
Toge he , hese con ibu ions ep esen a comp ehensi e and cohe en se o me hodolo-
gies ha ad ance he s a e-o - he-a in cybe secu i y o model-based con ol sys ems.
By combining imp o ed design me hods o con en ional PI con olle s, cybe - esilien
p edic i e con ol s a egies, and he in eg a ion o so wa e eju ena ion in o p edic i e
con ol amewo ks, his hesis p o ides p ac ical ools and heo e ical ounda ions o en-
hance he cybe secu i y o mode n con ol sys ems. These esul s no only add ess cu en
challenges, bu also lay he g oundwo k o u u e esea ch e o s aimed a de eloping
inc easingly adap i e, in elligen , and esilien con ol a chi ec u es capable o ope a ing
sa ely in he ace o e ol ing cybe h ea s.
4.1 Fu u e esea ch
Al hough his hesis p o ides ad ances in he ield o cybe -secu e con ol, se e al open
esea ch ques ions emain. Fu u e wo k should aim o u he explo e and enhance he
me hodologies p oposed he e, add essing se e al key aspec s ha could expand bo h he
applicabili y and e ec i eness o he p oposed app oaches in he ollowing a eas:
•
In a ian se compu a ion o so wa e eju ena ion. One ele an esea ch di ec-
ion conce ns he compu a ion o in a ian se s o so wa e eju ena ion s a egies.
In Chap e 3 [1], a LP app oach was used o compu e he minimal in a ian se ,
ensu ing ha sys em cons ain s we e sa is ied a e each so wa e e esh. This se
plays a c ucial ole in gua an eeing ha he sys em always e u ns o a sa e s a e
ollowing a so wa e eju ena ion e en . Howe e , he compu a ion o he maximal
in a ian se , which would enla ge he se o s a es om which sa e eco e y is
gua an eed, emains an open challenge. This ex ension could exploi he pe iodic
na u e o so wa e eju ena ion o e o mula e he con ol p oblem as a pe iodic
50 Bibliog aphy
[38]
L. Aung, Y. Xin, D. Han, K. Vaidyana han, and K. S. T i edi, “So wa e eju ena ion:
Towa ds p oac i e aul managemen ,” Jou nal o Sys ems and So wa e, ol. 76,
no. 1, pp. 3–22, 2004.
[39]
P. A oyo, J. Cuella , and A. F. Ska me a, “Fi ed: A amewo k o a ack de ec ion
in indus ial con ol sys ems,” Compu e s & Secu i y, ol. 73, pp. 274–295, 2017.
[40]
R. Romagnoli, J. M. Maes e, and E. F. Camacho, “Robus con ol s a egies o
esilien cybe -physical sys ems unde cybe -a acks,” Con ol Enginee ing P ac ice,
ol. 102, p. 104556, 2020.
[41] N. Zeldo ich, Compu e Sys ems Secu i y. MIT OpenCou seWa e, 2014.
[42]
Y. Mo and B. Sinopoli, “Secu e con ol agains eplay a acks,” P oceedings o he
47 h Annual Alle on Con e ence on Communica ion, Con ol, and Compu ing, 2009.
[43]
A. Humayed, J. Lin, F. Li, and B. Luo, “Cybe -physical sys ems secu i y—a su ey,”
IEEE In e ne o Things Jou nal, ol. 4, no. 6, pp. 1802–1831, 2017.
[44]
R. F. Ali, A. Munee , P. D. Dominic, E. A. Ghaleb, and A. Al-Ashmo i, “Su ey on
cybe secu i y o indus ial con ol sys ems,” in 2021 In e na ional Con e ence on
Da a Analy ics o Business and Indus y (ICDABI). IEEE, 2021, pp. 630–634.
[45]
R. Smi h, “Decoupled ne wo ks: A co e channel a chi ec u e,” P oceedings o he
2011 ACM Wo kshop on P i acy in he Elec onic Socie y, 2011.
[46]
H. Sandbe g, A. Teixei a, and K. H. Johansson, “Cybe physical secu i y in con ol
sys ems,” IEEE Con ol Sys ems Magazine, 2015.
[47]
F. Boem, D. M. Raimondo, and T. Pa isini, “Secu e s a e es ima ion and con ol o
cybe -physical sys ems,” IEEE T ansac ions on Au oma ic Con ol, 2019.
[48]
T. A auz, P. Chan eu , and J. Maes e, “Cybe -secu i y in ne wo ked and dis ibu ed
model p edic i e con ol,” Annual Re iews in Con ol, ol. 53, pp. 338–355, 2022.
[49]
T. A auz, J. M. Maes e, D. Que edo, and E. F. Camacho, “T ee-based model p edic-
i e con ol s a egy o so wa e eju ena ion,” in 2022 IEEE 61s Con e ence on
Decision and Con ol (CDC). IEEE, 2022, pp. 1124–1129.
[50]
R. Romagnoli, B. H. K ogh, and B. Sinopoli, “Design o so wa e eju ena ion o
cps secu i y using in a ian se s,” in 2019 Ame ican Con ol Con e ence (ACC).
IEEE, 2019, pp. 3740–3745.
[51]
F. G ube and M. Al ho , “Compu ing sa e se s o linea sampled-da a sys ems,”
IEEE Con ol Sys ems Le e s, ol. 5, no. 2, pp. 385–390, 2020.
[52]
S. V. Rako ic, E. C. Ke igan, K. I. Kou amas, and D. Q. Mayne, “In a ian ap-
p oxima ions o he minimal obus posi i ely in a ian se ,” IEEE T ansac ions on
au oma ic con ol, ol. 50, no. 3, pp. 406–410, 2005.
Bibliog aphy 51
[53]
S. V. Rako ić, B. Kou a i akis, and M. Cannon, “Equi-no maliza ion and exac
scaling dynamics in homo he ic ube model p edic i e con ol,” Sys ems & Con ol
Le e s, ol. 62, no. 2, pp. 209–217, 2013.
[54]
I. M. Mi chell, J. Yeh, F. J. Laine, and C. J. Tomlin, “Ensu ing sa e y o sampled
da a sys ems: An e icien algo i hm o il e ing po en ially unsa e inpu signals,”
in 2016 IEEE 55 h Con e ence on Decision and Con ol (CDC). IEEE, 2016, pp.
7431–7438.
[55]
K. P. Wabe sich and M. N. Zeilinge , “Linea model p edic i e sa e y ce i ica ion o
lea ning-based con ol,” in 2018 IEEE Con e ence on Decision and Con ol (CDC).
IEEE, 2018, pp. 7130–7135.
[56]
R. Romagnoli, T. Alamo, B. Sinopoli, and E. F. Camacho, “Secu e con ol agains
s eal hy a acks ia so wa e eju ena ion,” a Xi p ep in a Xi :1810.10468, 2018.
[57]
——, “Op imal in a ian se compu a ion o so wa e eju ena ion s a egies in
cybe -physical sys ems,” IEEE T ansac ions on Au oma ic Con ol, 2019.
[58]
D. Co oneo and R. Na ella, “A su ey o so wa e aging and eju ena ion s udies,”
ACM Compu ing Su eys (CSUR), ol. 47, no. 2, pp. 1–36, 2014.
[59]
L. Val e de, F. Rosa, A. Del Real, A. A ce, and C. Bo dons, “Modeling, simula-
ion and expe imen al se -up o a enewable hyd ogen-based domes ic mic og id,”
In e na ional jou nal o hyd ogen ene gy, ol. 38, no. 27, pp. 11 672–11 684, 2013.
[60]
A. Clemmens, T. Kace ek, B. G awi z, and W. Schuu mans, “Tes cases o canal
con ol algo i hms,” Jou nal o i iga ion and d ainage enginee ing, ol. 124, no. 1,
pp. 23–30, 1998.
[61]
A. Clemmens, G. Sloan, and J. Schuu mans, “Canal-con ol needs: example,” Jou -
nal o i iga ion and d ainage enginee ing, ol. 120, no. 6, pp. 1067–1085, 1994.
[62]
J. Schuu mans, A. Ho , S. Dijks a, O. Bosg a, and R. B ouwe , “Simple wa e le el
con olle o i iga ion and d ainage canals,” Jou nal o i iga ion and d ainage
enginee ing, ol. 125, no. 4, pp. 189–195, 1999.
[63]
M. Si ianes, T. A auz, E. Ma ín, and J. M. Maes e, “Repu a ion-based consensus
on a secu e blockchain ne wo k,” in Blockchain o Cybe secu i y in Cybe -Physical
Sys ems. Sp inge , 2022, pp. 167–184.
[64]
A. Ce inkaya, H. Ishii, and T. Hayakawa, “Ne wo ked con ol unde andom and
malicious packe losses,” IEEE T ansac ions on Au oma ic Con ol, ol. 62, no. 5,
pp. 2434–2449, 2016.
[65]
P. Chan eu , J. M. Maes e, and H. Ishii, “Vulne abili ies in dis ibu ed model
p edic i e con ol based on jacobi-gauss decomposi ion,” in 2018 Eu opean Con ol
Con e ence (ECC). IEEE, 2018, pp. 2587–2592.
52 Bibliog aphy
[66]
P. Vela de, J. M. Maes e, H. Ishii, and R. R. Negenbo n, “Scena io-based de ense
mechanism o dis ibu ed model p edic i e con ol,” in 2017 IEEE 56 h Annual
Con e ence on Decision and Con ol (CDC). IEEE, 2017, pp. 6171–6176.
[67]
W. Anandu a, J. M. Maes e, C. Ocampo-Ma inez, and H. Ishii, “Resilien dis ibu ed
model p edic i e con ol o ene gy managemen o in e connec ed mic og ids,”
Op imal Con ol Applica ions and Me hods, ol. 41, no. 1, pp. 146–169, 2020.
[68]
P. Chan eu , A. Sánchez-Amo es, J. M. Maes e, and E. F. Camacho, “Dis ibu ed
model p edic i e con ol based on dual decomposi ion wi h neu al-ne wo k-based
wa m s a ,” in 2021 Eu opean Con ol Con e ence (ECC). IEEE, 2021, pp. 1969–
1974.
[69]
P. T odden, “A one-s ep app oach o compu ing a poly opic obus posi i ely in a ian
se ,” IEEE T ansac ions on Au oma ic Con ol, ol. 61, no. 12, pp. 4100–4105, 2016.
[70]
M. Pe ei a, D. Limon, D. M. de la Peña, L. Val e de, and T. Alamo, “Pe iodic
economic con ol o a nonisola ed mic og id,” IEEE T ansac ions on indus ial
elec onics, ol. 62, no. 8, pp. 5247–5255, 2015.
[71]
P. J. Goula , E. C. Ke igan, and J. M. Maciejowski, “Op imiza ion o e s a e
eedback policies o obus con ol wi h cons ain s,” Au oma ica, ol. 42, no. 4, pp.
523–533, 2006.
