**5.3 The state and disturbance observer for nonlinear systems using higherorder sliding mode differentiator**

Consider the locally stable system Eq. (11) where *y*<sup>1</sup> and *B*1ð Þ *x* are

*<sup>y</sup>*<sup>1</sup> <sup>¼</sup> *<sup>y</sup>*<sup>1</sup> *<sup>y</sup>*<sup>2</sup> *,*…*, yp*<sup>1</sup> h i*<sup>T</sup>* , *<sup>B</sup>* <sup>¼</sup> *<sup>b</sup>*1*; <sup>b</sup>*2*;* …*; bm*<sup>1</sup> ½ �<sup>∈</sup> <sup>R</sup>*n*�*m*<sup>1</sup> , *bi* <sup>∈</sup> <sup>R</sup>*n,* <sup>∀</sup>*<sup>i</sup>* <sup>¼</sup> <sup>1</sup>*,* …*, m*<sup>1</sup> are smooth vector fields defined on an open Ω ⊂ R*n*. According to (A5), we consider *p*<sup>1</sup> ¼ *m*<sup>1</sup> here. The following properties introduced by Isidori [36] are assumed for *x*∈ Ω.

**Assumption (A7):** The system in Eq. (11) is assumed to have vector relative degree *<sup>r</sup>* <sup>¼</sup> *<sup>r</sup>*1*;r*2*;* …*;rm*<sup>1</sup> f g and total relative degree *rt* <sup>¼</sup> <sup>P</sup>*m*<sup>1</sup> *i*¼1 *ri, rt* ≤ *n*, i.e.,

$$\begin{aligned} L\_{bj}L\_f^k \boldsymbol{\chi}\_i(\mathbf{x}) &= \mathbf{0} \quad \forall j = \mathbf{1}, \ldots, m\_1, \quad \forall k < r\_i - \mathbf{1}, \ \forall i = \mathbf{1}, \ldots, m\_1 \\ L\_{bj}L\_f^{r\_i - 1} \boldsymbol{\chi}\_i(\mathbf{x}) &\neq \mathbf{0} \quad \text{for at least one } \mathbf{1} \le j \le m\_1 \end{aligned} \tag{58}$$

**Assumption (A8):** The following Lie derivative matrix is of full rank.

$$L(\mathbf{x}) = \begin{bmatrix} L\_{b\_1} L\_f^{r\_1 - 1} \mathcal{Y}\_1 & L\_{b\_2} L\_f^{r\_1 - 1} \mathcal{Y}\_1 & \cdots & L\_{b\_{m\_1}} L\_f^{r\_1 - 1} \mathcal{Y}\_1 \\ L\_{b\_1} L\_f^{r\_2 - 1} \mathcal{Y}\_2 & L\_{b\_2} L\_f^{r\_2 - 1} \mathcal{Y}\_2 & \cdots & L\_{b\_{m\_1}} L\_f^{r\_2 - 1} \mathcal{Y}\_2 \\ \vdots & \vdots & \vdots & \vdots \\ L\_{b\_1} L\_f^{r\_{m\_1} - 1} \mathcal{Y}\_{m\_1} & L\_{b\_2} L\_f^{r\_{m\_1} - 1} \mathcal{Y}\_{m\_1} & \cdots & L\_{b\_{m\_1}} L\_f^{r\_{m\_1} - 1} \mathcal{Y}\_{m\_1} \end{bmatrix} \tag{59}$$

**Assumption (A9):** The distribution Γ ¼ *span b*f g <sup>1</sup>*; b*2*;* …*; bm*<sup>1</sup> is involutive [36]. The system given by Eq. (11) with the involutive distribution Γ and total relative

degree *rt* can be rewritten as

$$\delta\_i = \begin{bmatrix} \mathbf{0} & \mathbf{1} & \mathbf{0} & \cdots & \mathbf{0} \\ \mathbf{0} & \mathbf{0} & \mathbf{1} & \cdots & \mathbf{0} \\ \vdots & \vdots & \vdots & \cdots & \vdots \\ \mathbf{0} & \mathbf{0} & \mathbf{0} & \mathbf{0} & \mathbf{0} \end{bmatrix}\_{\mathbf{r}\_i \times \mathbf{r}\_i} \delta\_i + \begin{bmatrix} \mathbf{0} \\ \mathbf{0} \\ \vdots \\ \mathbf{L}\_f^{r\_i} \mathbf{y}\_i(\mathbf{x}) \end{bmatrix} + \begin{bmatrix} \mathbf{0} \\ \mathbf{0} \\ \vdots \\ \sum\_{j=1}^{m\_1} L\_b L\_f^{r\_i - 1} \mathbf{y}\_i(\mathbf{x}) d(t) \end{bmatrix}, \forall i = 1, \ldots, m\_1 \tag{60}$$

where *<sup>δ</sup>* <sup>¼</sup> *<sup>δ</sup>*<sup>1</sup> *<sup>δ</sup>*<sup>2</sup> <sup>⋯</sup> *<sup>δ</sup><sup>m</sup>*<sup>1</sup> ½ �*<sup>T</sup>* and

$$\delta \mathbf{l} = \begin{bmatrix} \delta\_{l1} \\ \delta\_{l2} \\ \vdots \\ \delta\_{l\nu\_1} \end{bmatrix} = \begin{bmatrix} \eta\_{l1}(\mathbf{x}) \\ \eta\_{l2}(\mathbf{x}) \\ \vdots \\ \eta\_{l\nu\_1}(\mathbf{x}) \end{bmatrix} = \begin{bmatrix} \mathbf{y}\_{i}(\mathbf{x}) \\ L\_{f}\eta\_{i}(\mathbf{x}) \\ \vdots \\ L\_{f}^{r\_{l}-1}\eta\_{i}(\mathbf{x}) \end{bmatrix} \in \mathbb{R}^{\mathbb{R}} \\ \uplus \mathbf{\hat{i}} = \mathbf{1}, \ldots, m\_{1}, \quad \mathbf{y} = \begin{bmatrix} \boldsymbol{\eta}\_{1} \\ \boldsymbol{\eta}\_{2} \\ \vdots \\ \boldsymbol{\eta}\_{n-r}(\mathbf{x}) \end{bmatrix} = \begin{bmatrix} \boldsymbol{\eta}\_{r+1}(\mathbf{x}) \\ \boldsymbol{\eta}\_{r+2}(\mathbf{x}) \\ \vdots \\ \boldsymbol{\eta}\_{n}(\mathbf{x}) \end{bmatrix} \tag{61}$$

With an involutive distribution Γ as defined in (A9), it is always possible to identify the variables *η<sup>r</sup>*þ<sup>1</sup>ð Þ *x ,* …*, ηn*ð Þ *x* which satisfy

$$L\_{b\_{\uparrow}}\eta\_i(\mathbf{x}) = \mathbf{0} \quad \forall i = r+1, \dots, n, \ \forall j = 1, \dots, m\_1 \tag{62}$$

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode… DOI: http://dx.doi.org/10.5772/intechopen.88669*

**Assumption (A10):** The norm-bounded solution of the internal dynamics *γ*\_ ¼ *g*ð Þ *δ; γ* is assumed to be locally asymptotically stable [29].

If assumption (A9) is satisfied, then it is always possible to find *n* � *r* functions *ηr*þ1ð Þ *x ,* …*, ηn*ð Þ *x* such that

$$\Psi(\mathbf{x}) = \operatorname{col}\left\{\eta\_{11}(\mathbf{x}), \dots, \eta\_{1r\_1}(\mathbf{x}), \dots, \eta\_{m\_1 1}(\mathbf{x}), \dots, \eta\_{m\_1 r\_{m\_1}}(\mathbf{x}), \eta\_{r+1}(\mathbf{x}), \dots, \eta\_n(\mathbf{x})\right\} \in \mathbb{R}^n \tag{63}$$

is a local diffeomorphism in a neighborhood of any point *x*∈ Ω ⊂ Ω ⊂ R*n*, i.e.,

$$\mathfrak{x} = \Psi^{-1}(\delta, \mathfrak{y}) \tag{64}$$

In order to estimate the derivatives *δij*ð Þ*t* ∀*i* ¼ 1*,* …*, m*1*,* ∀*j* ¼ 1*,* …*, ri* of the output. *yi* in finite time, higher-order sliding mode differentiators [28] are used here

$$\begin{aligned} \dot{x}\_0^i &= \nu\_0^i, \nu\_0^i = -\dot{x}\_0^i \left| \mathbf{z}\_0^i - \boldsymbol{y}\_i(t) \right|^{(\gamma\_l/(\gamma+1))} \text{sign} \left( \mathbf{z}\_0^i - \boldsymbol{y}\_i(t) \right) + \mathbf{z}\_1^i, \dot{\mathbf{z}}\_1^i = \boldsymbol{v}\_1^i \\ \vdots \\ \dot{x}\_{r\_l-1}^i &= \boldsymbol{v}\_{r\_l-1}^i \nu\_{r\_l-1}^i = -\dot{\lambda}\_{r\_l-1}^i \left| \mathbf{z}\_{r\_l-1}^i - \boldsymbol{v}\_{r\_l-2}^i \right|^{(1/2)} \text{sign} \left( \mathbf{z}\_{r\_l-1}^i - \boldsymbol{v}\_{r\_l-2}^i \right) + \mathbf{z}\_{r\_l}^i, \dot{\mathbf{z}}\_{r\_l}^i = -\boldsymbol{\lambda}\_{r\_l}^i \text{sign} \left( \mathbf{z}\_{r\_l}^i - \boldsymbol{v}\_{r\_l-1}^i \right) \end{aligned} \tag{165}$$

for *i* ¼ 1*,* …*, m*1. By construction,

$$\begin{aligned} \dot{\delta}^1\_1 &= \dot{\eta}^1\_1(\mathbf{x}) = \mathbf{z}^1\_0, \dots \dot{\delta}^1\_1 = \dot{\eta}^1\_{r\_1}(\mathbf{x}) = \mathbf{z}^1\_{r\_1 - 1}, \dot{\delta}^1\_{r\_1} = \dot{\eta}^1\_{r\_1}(\mathbf{x}) = \mathbf{z}^1\_{r\_1} \\ \vdots \\ \dot{\delta}^{m\_1}\_1 &= \dot{\eta}^{m\_1}\_1(\mathbf{x}) = \mathbf{z}^{m\_1}\_0, \dots, \dot{\delta}^{m\_1}\_{r\_{m\_1}} = \dot{\eta}^{m\_1}\_{r\_{m\_1}}(\mathbf{x}) = \mathbf{z}^{m\_1}\_{r\_{m\_1} - 1}, \dot{\delta}^{m\_1}\_{r\_1} = \dot{\eta}^{m\_1}\_{r\_{m\_1}}(\mathbf{x}) = \mathbf{z}^1\_{r\_{m\_1}} \end{aligned} \tag{66}$$

Therefore, the following exact estimates are available in finite time:

$$\begin{aligned} \hat{\delta}\_i &= \left(\hat{\delta}\_{i1}, \hat{\delta}\_{i2}, \dots, \hat{\delta}\_{ir\_1}\right)^T = \left(\hat{\eta}\_{i1}(\hat{\mathbf{x}}), \hat{\eta}\_{i2}(\hat{\mathbf{x}}), \dots, \hat{\eta}\_{ir\_1}(\hat{\mathbf{x}})\right)^T \in \mathbb{R}^{r\_i} \\ \forall i &= \mathbf{1}, \dots, m\_1, \quad \hat{\delta} = \left(\hat{\delta}^1, \hat{\delta}^2, \dots, \hat{\delta}^{m\_1}\right)^T \in \mathbb{R}^{r\_i} \end{aligned} \tag{67}$$

Next, integrate Eq. (60) with *δ* replaced by ^*δ*; estimate of internal dynamics is

$$
\dot{\hat{\boldsymbol{\gamma}}} = \mathbf{g}\left(\hat{\boldsymbol{\delta}}, \hat{\boldsymbol{\gamma}}\right) \tag{68}
$$

and with some initial condition from the stability domain of the internal dynamics, a asymptotic estimate ^*γ* can be obtained locally

$$
\hat{\boldsymbol{\eta}} = \begin{pmatrix} \hat{\boldsymbol{\eta}}\_1 \\ \hat{\boldsymbol{\eta}}\_2 \\ \vdots \\ \hat{\boldsymbol{\eta}}\_{n-r} \end{pmatrix} = \begin{pmatrix} \hat{\boldsymbol{\eta}}\_{r+1}(\hat{\boldsymbol{\kappa}}) \\ \hat{\boldsymbol{\eta}}\_{r+2}(\hat{\boldsymbol{\kappa}}) \\ \vdots \\ \hat{\boldsymbol{\eta}}\_n(\hat{\boldsymbol{\kappa}}) \end{pmatrix} \tag{69}
$$

Therefore, the asymptotic estimate for the mapping (63) is identified as

$$\Psi(\hat{\mathbf{x}}) = \text{col}\left\{ \hat{\eta}\_{11}(\hat{\mathbf{x}}), \dots, \hat{\eta}\_{1r\_1}(\hat{\mathbf{x}}), \dots, \hat{\eta}\_{m\_1 1}(\hat{\mathbf{x}}), \dots, \hat{\eta}\_{m\_1 r\_{m\_1}}(\hat{\mathbf{x}}), \hat{\eta}\_{r+1}(\hat{\mathbf{x}}), \dots, \hat{\eta}\_n(\hat{\mathbf{x}}) \right\} \tag{70}$$

^ *dy*ðÞ¼ *t D*<sup>1</sup>

degree *<sup>r</sup>* <sup>¼</sup> *<sup>r</sup>*1*;r*2*;* …*;rm*<sup>1</sup> f g and total relative degree *rt* <sup>¼</sup> <sup>P</sup>*m*<sup>1</sup>

*Lb*1*L<sup>r</sup>*1�<sup>1</sup>

*Lb*1*Lr*2�<sup>1</sup>

*Lb*1*L rm*1�1

where *<sup>δ</sup>* <sup>¼</sup> *<sup>δ</sup>*<sup>1</sup> *<sup>δ</sup>*<sup>2</sup> <sup>⋯</sup> *<sup>δ</sup><sup>m</sup>*<sup>1</sup> ½ �*<sup>T</sup>* and

*Lbj*

identify the variables *η<sup>r</sup>*þ<sup>1</sup>ð Þ *x ,* …*, ηn*ð Þ *x* which satisfy

*η<sup>i</sup>*1ð Þ *x η<sup>i</sup>*2ð Þ *x* ⋮ *ηir*1 ð Þ *x*

*δ<sup>i</sup>* þ

*yi* ð Þ *x Lf yi* ð Þ *x* ⋮ *Lf r*1�1 *yi* ð Þ *x*

**order sliding mode differentiator**

*<sup>y</sup>*<sup>1</sup> <sup>¼</sup> *<sup>y</sup>*<sup>1</sup> *<sup>y</sup>*<sup>2</sup> *,*…*, yp*<sup>1</sup> h i*<sup>T</sup>*

*Control Theory in Engineering*

*LbjLk f yi*

*LbjLri*�<sup>1</sup> *<sup>f</sup> yi*

*L x*ð Þ¼

degree *rt* can be rewritten as

01 0 ⋯ 0 00 1 ⋯ 0 ⋮⋮ ⋮⋯⋮ 00 0 0 0

*x*∈ Ω.

\_ *δ<sup>i</sup>* ¼

*γ*\_ ¼ *g*ð Þ *δ; γ*

*δi*1 *δi*2 ⋮ *δir*1

*δ<sup>i</sup>* ¼

**16**

�1

**5.3 The state and disturbance observer for nonlinear systems using higher-**

smooth vector fields defined on an open Ω ⊂ R*n*. According to (A5), we consider *p*<sup>1</sup> ¼ *m*<sup>1</sup> here. The following properties introduced by Isidori [36] are assumed for

**Assumption (A7):** The system in Eq. (11) is assumed to have vector relative

ð Þ¼ *x* 0 ∀*j* ¼ 1*,* …*, m*1*,* ∀*k* , *ri* � 1*,* ∀*i* ¼ 1*,* …*, m*<sup>1</sup>

ð Þ *x* 6¼ 0 for at least one 1≤*j*≤ *m*<sup>1</sup>

*<sup>f</sup> <sup>y</sup>*<sup>1</sup> *Lb*2*L<sup>r</sup>*1�<sup>1</sup>

*<sup>f</sup> <sup>y</sup>*<sup>2</sup> *Lb*2*Lr*2�<sup>1</sup>

*<sup>f</sup> ym*<sup>1</sup> *Lb*2*Lrm*�<sup>1</sup>

0 0 ⋮

*Lf ri yi* ð Þ *x*

**Assumption (A8):** The following Lie derivative matrix is of full rank.

Consider the locally stable system Eq. (11) where *y*<sup>1</sup> and *B*1ð Þ *x* are

*<sup>y</sup>*<sup>2</sup> � *<sup>C</sup>*2*x*^ � � (57)

, *<sup>B</sup>* <sup>¼</sup> *<sup>b</sup>*1*; <sup>b</sup>*2*;* …*; bm*<sup>1</sup> ½ �<sup>∈</sup> <sup>R</sup>*n*�*m*<sup>1</sup> , *bi* <sup>∈</sup> <sup>R</sup>*n,* <sup>∀</sup>*<sup>i</sup>* <sup>¼</sup> <sup>1</sup>*,* …*, m*<sup>1</sup> are

*i*¼1

*<sup>f</sup> y*<sup>1</sup> ⋯ *Lbm*<sup>1</sup>

*<sup>f</sup> y*<sup>2</sup> ⋯ *Lbm*<sup>1</sup>

*<sup>f</sup> ym*<sup>1</sup> ⋯ *Lbm*<sup>1</sup>

P*<sup>m</sup>*<sup>1</sup> *<sup>j</sup>*¼<sup>1</sup> *Lbj Lf ri*�1 *yi* ð Þ *x d t*ð Þ

⋮ ⋮⋮ ⋮

**Assumption (A9):** The distribution Γ ¼ *span b*f g <sup>1</sup>*; b*2*;* …*; bm*<sup>1</sup> is involutive [36]. The system given by Eq. (11) with the involutive distribution Γ and total relative

<sup>∈</sup> <sup>R</sup>*ri* <sup>∀</sup>*<sup>i</sup>* <sup>¼</sup> <sup>1</sup>*,* …*, m*1*, <sup>γ</sup>* <sup>¼</sup>

*ηi*ð Þ¼ *x* 0 ∀*i* ¼ *r* þ 1*,* …*, n,* ∀*j* ¼ 1*,* …*, m*<sup>1</sup> (62)

With an involutive distribution Γ as defined in (A9), it is always possible to

*ri, rt* ≤ *n*, i.e.,

*L<sup>r</sup>*1�<sup>1</sup> *<sup>f</sup> y*<sup>1</sup>

*η<sup>r</sup>*þ<sup>1</sup>ð Þ *x η<sup>r</sup>*þ<sup>2</sup>ð Þ *x* ⋮ *ηn*ð Þ *x*

*L<sup>r</sup>*2�<sup>1</sup> *<sup>f</sup> y*<sup>2</sup>

*L rm*1�1 *<sup>f</sup> ym*<sup>1</sup>

0 0 ⋮

> *γ*1 *γ*2 ⋮ *γ<sup>n</sup>*�*<sup>r</sup>*

(58)

(59)

*,* ∀*i* ¼ 1*,* …*, m*<sup>1</sup>

(60)

(61)

asymptotic estimate *x*^ of the state vector *x* can be identified via Eqs. (67) and (69)

$$
\hat{\mathfrak{x}} = \Psi^{-1}(\hat{\delta}, \hat{\mathfrak{y}}) \tag{71}
$$

where *s*∈ R*<sup>N</sup>* are the unknown inputs with no more than *j* nonzero entries, *ξ*∈ R*<sup>M</sup>* are the measurements, *ε*<sup>0</sup> is a measurement noise, and Φ ∈ R*M*�*<sup>N</sup>* is the

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode…*

constant *ς<sup>j</sup>* ∈ð Þ 0*;* 1 (*ς<sup>j</sup>* is as small as possible for computational reasons) of the

2 <sup>2</sup> ≤k k Φ*s* 2

<sup>1</sup> � *<sup>ς</sup><sup>s</sup>* <sup>≤</sup>*eig* <sup>Φ</sup>*<sup>T</sup>*

ð Þ 1 � *ςs* k k*s*

where ΦΓ is the sub-matrix of Φ with active nodes.

*<sup>s</sup>* <sup>∗</sup> <sup>¼</sup> arg min *<sup>s</sup>*<sup>∈</sup> <sup>R</sup>*<sup>N</sup>*

conditions hold, it can be replaced by ΘðÞ¼ *s* k k*s* <sup>1</sup>≜

matrix Φ, the estimation algorithm proposed in [37] is

*<sup>μ</sup>v t* \_ðÞ¼� *v t*ðÞþ <sup>Φ</sup>*<sup>T</sup>*<sup>Φ</sup> � *IN*�*<sup>N</sup>*

implementing system. d c*: <sup>β</sup>* <sup>¼</sup> j j*: <sup>β</sup>*

soft thresholding function:

of the nonzero terms.

*5.4.2 Attack reconstruction*

**19**

**Definition 1:** The Restricted Isometry Property (RIP) condition of *j*-order with

for any *j* sparse of signal *s*. Considering ΦΓ as the index set of nonzero elements

ΓΦΓ

The problem of SR is often cast as an optimization problem that minimizes a cost

k k *ξ* � Φ*s*

In Eq. (77) the original sparsity term is the quasi norm j j*s* 0; but as long as the RIP

Under the sparse assumption of *s* and the fulfillment of the j-RIP condition of the

where *<sup>v</sup>*<sup>∈</sup> <sup>R</sup>*<sup>N</sup>* is the state vector, ^*s t*ð Þ represents the estimate of the sparse signal *<sup>s</sup>* of (74), and *μ* . 0 is a time-constant determined by the physical properties of the

where *λ* . 0 is chosen with respect to the noise and the minimum absolute value

Under Definition 1, the state *v* of Eq. (78) converges in finite time to its equilib-

The measured output under attack *y* of the system Eq. (5) is fed to the input of

rium point *<sup>v</sup>* <sup>∗</sup> , and ^*s t*ð Þ in Eq.(78) converges in finite time to ^*<sup>s</sup>* <sup>∗</sup> of Eq. (77).

the low-pass filter that facilitates filtering out the possible measurement noise

� �*a t*ðÞ� <sup>Φ</sup>*<sup>T</sup><sup>ξ</sup>* � �*<sup>β</sup> ,* and ^*s t*ðÞ¼ *a t*ð Þ (78)

*sign*ð Þ*:* and *a t*ðÞ¼ *Hλ*ð Þ*v* where *Hλ*ð Þ*:* is a continuous

*Hλ*ð Þ¼ *v* maxð Þ j j *v* � *λ;* 0 sgn ð Þ*v* (79)

2

P

function constructed by leveraging the observation error term and the sparsity

1 2

is the balancing parameter and *s* <sup>∗</sup> is the *critical point*, i.e., the solution of Eq. (74). Typically, for sparse vectors *s* with j-sparsity, where *j* must be equal or smaller than

<sup>2</sup> [37], the solution to the SR problem is unique and coincides with the critical point of Eq. (74) providing that RIP condition for Φ with order 2*j* is verified. In other words, in order to guarantee the existence of a unique solution to the optimi-

zation problem Eq. (74), Φ should satisfy restricted isometry property [37].

<sup>2</sup> ≤ ð Þ 1 þ *ςs* k k*s*

2

� �≤<sup>1</sup> <sup>þ</sup> *<sup>ς</sup><sup>s</sup>* (76)

<sup>2</sup> þ *λ*Θð Þ*s* (77)

*<sup>i</sup> si* j j. Note that *λ* . 0 in Eq. (77)

<sup>2</sup> (75)

dictionary where *M* ≪ *N*.

inducing term [37], i.e.,

*M*�1

of *s*, then Eq. (75) is equivalent to [23]:

*DOI: http://dx.doi.org/10.5772/intechopen.88669*

matrix Φ yields

Since the finite-time exact estimates ^\_ *δiri* of \_ *δiri* , ∀*i* ¼ 1*,* …*, m*<sup>1</sup> are available via the higher-order sliding mode differentiator, and using the estimates ^*δ,* ^*γ* for *δ, γ*, an asymptotic estimate ^ *d t*ð Þ of disturbance *d t*ð Þ in Eq. (11) is identified as [28].

$$\hat{d}(t) = L^{-1}(\Psi^{-1}(\hat{\delta}, \dot{\boldsymbol{\rho}})) \left[ \begin{pmatrix} \hat{\delta}\_{1r\_1} \\ \hat{\delta}\_{2r\_2} \\ \vdots \\ \hat{\delta}\_{m\_1r\_{m\_1}} \end{pmatrix} - \begin{pmatrix} L\_f^{r\_1} \boldsymbol{\nu}\_{11}(\Psi^{-1}(\hat{\delta}, \dot{\boldsymbol{\rho}})) \\ L\_f^{r\_1} \boldsymbol{\nu}\_{12}(\Psi^{-1}(\hat{\delta}, \dot{\boldsymbol{\rho}})) \\ \vdots \\ L\_f^{r\_{m\_1}} \boldsymbol{\nu}\_{1m\_1}(\Psi^{-1}(\hat{\delta}, \dot{\boldsymbol{\rho}})) \end{pmatrix} \right] \tag{72}$$

where *L* Ψ�<sup>1</sup> *δ* ^*;* ^*<sup>γ</sup>* � � � � <sup>¼</sup> <sup>P</sup>*<sup>m</sup>*<sup>1</sup> *<sup>j</sup>*¼<sup>1</sup> *Lbj Lf ri*�1 *y*1*i* ð Þ *<sup>x</sup>* . Finally, *x t* ^ð Þ and ^ *d t*ð Þ are obtained. from Eqs. (71) and (72).

**Remark 3:** The convergence ^ *d* ! *d* can be achieved only locally and as time increases due to the local asymptotic stability of the norm-bounded solution of the internal dynamics *γ*\_ ¼ *g*ð Þ *δ; γ* . However convergence will be achieved *in finite time* if the total relative degree *r* ¼ *n* and no internal dynamics exist.

Considering Eq. (11) and *D*<sup>1</sup> is full rank, sensor attack can be reconstructed as

$$
\hat{d}\_{\mathbf{y}}(\mathbf{t}) = \overline{D}\_1^{-1} \left( \overline{\mathbf{y}}\_2 - \mathbf{C}\_2(\hat{\mathbf{x}}) \right) \tag{73}
$$

#### **5.4 Attack reconstruction in nonlinear system by sparse recovery algorithm**

In some applications, there are a limited number of measurements, *p*, and more sources of attack, *m*. Previously, we investigated the cases where *p* . *m*. Now, consider system (5) with more attacks than measurements, *m* . *p*.

Notice that a more general format of (5) is considered here where matrix *D* is a function of *x* as well.

**Assumption (A11):** Assume that the attack vector *d t*ð Þ is sparse, meaning that numerous attacks are possible, but the attacks are not coordinated, and only few nonzero attacks happen at the same time.

#### *5.4.1 Sparse recovering algorithm*

The problem of recovering an unknown input signal from measurements is well known, as a left invertibility problem, as seen in several works [30, 37], but this problem was only treated in the case where the number of measurements is equal or greater than the number of unknown inputs. The left invertibility problem in the case of fewer measurements than unknown inputs has no solution or more exactly has an infinity of solutions.

In particular, the objective of exact recovery under sparse assumptions denoted for the sake of simplicity as "sparse recovery" (SR) is to find a concise representation of a signal using a few atoms from some specified (over-complete) dictionary,

$$
\xi = \Phi \overline{\mathfrak{s}} + \varepsilon\_0 \tag{74}
$$

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode… DOI: http://dx.doi.org/10.5772/intechopen.88669*

where *s*∈ R*<sup>N</sup>* are the unknown inputs with no more than *j* nonzero entries, *ξ*∈ R*<sup>M</sup>* are the measurements, *ε*<sup>0</sup> is a measurement noise, and Φ ∈ R*M*�*<sup>N</sup>* is the dictionary where *M* ≪ *N*.

**Definition 1:** The Restricted Isometry Property (RIP) condition of *j*-order with constant *ς<sup>j</sup>* ∈ð Þ 0*;* 1 (*ς<sup>j</sup>* is as small as possible for computational reasons) of the matrix Φ yields

$$(\mathbf{1} - \mathfrak{S}) \|\overline{\mathfrak{s}}\|\_2^2 \le \|\Phi \overline{\mathfrak{s}}\|\_2^2 \le (\mathbf{1} + \mathfrak{S}) \|\overline{\mathfrak{s}}\|\_2^2 \tag{75}$$

for any *j* sparse of signal *s*. Considering ΦΓ as the index set of nonzero elements of *s*, then Eq. (75) is equivalent to [23]:

$$\mathbf{1} - \boldsymbol{\varsigma}\_{\mathfrak{S}} \le \operatorname{eig}\left(\boldsymbol{\Phi}\_{\Gamma}^{T}\boldsymbol{\Phi}\_{\Gamma}\right) \le \mathbf{1} + \boldsymbol{\varsigma}\_{\mathfrak{S}} \tag{76}$$

where ΦΓ is the sub-matrix of Φ with active nodes.

The problem of SR is often cast as an optimization problem that minimizes a cost function constructed by leveraging the observation error term and the sparsity inducing term [37], i.e.,

$$\mathfrak{T}^\* = \arg\min\_{\mathfrak{T} \in \mathbb{R}^N} \frac{1}{2} ||\mathfrak{f} - \mathfrak{G}\mathfrak{F}||\_2^2 + \lambda \Theta(\mathfrak{F}) \tag{77}$$

In Eq. (77) the original sparsity term is the quasi norm j j*s* 0; but as long as the RIP conditions hold, it can be replaced by ΘðÞ¼ *s* k k*s* <sup>1</sup>≜ P *<sup>i</sup> si* j j. Note that *λ* . 0 in Eq. (77) is the balancing parameter and *s* <sup>∗</sup> is the *critical point*, i.e., the solution of Eq. (74). Typically, for sparse vectors *s* with j-sparsity, where *j* must be equal or smaller than *M*�1 <sup>2</sup> [37], the solution to the SR problem is unique and coincides with the critical point of Eq. (74) providing that RIP condition for Φ with order 2*j* is verified. In other words, in order to guarantee the existence of a unique solution to the optimization problem Eq. (74), Φ should satisfy restricted isometry property [37].

Under the sparse assumption of *s* and the fulfillment of the j-RIP condition of the matrix Φ, the estimation algorithm proposed in [37] is

$$\mu \dot{\boldsymbol{v}}(t) = -\left[\boldsymbol{v}(t) + \left(\boldsymbol{\Phi}^T \boldsymbol{\Phi} - I\_{N \times N}\right) \boldsymbol{a}(t) - \left.\boldsymbol{\Phi}^T \boldsymbol{\xi}\right|^\beta, \text{and} \, \hat{\boldsymbol{\xi}}(t) = \boldsymbol{a}(t) \tag{78}$$

where *<sup>v</sup>*<sup>∈</sup> <sup>R</sup>*<sup>N</sup>* is the state vector, ^*s t*ð Þ represents the estimate of the sparse signal *<sup>s</sup>* of (74), and *μ* . 0 is a time-constant determined by the physical properties of the implementing system. d c*: <sup>β</sup>* <sup>¼</sup> j j*: <sup>β</sup> sign*ð Þ*:* and *a t*ðÞ¼ *Hλ*ð Þ*v* where *Hλ*ð Þ*:* is a continuous soft thresholding function:

$$H\_{\lambda}(\boldsymbol{\nu}) = \max(|\boldsymbol{\nu}| - \lambda, \mathbf{0}) \operatorname{sgn}(\boldsymbol{\nu})\tag{79}$$

where *λ* . 0 is chosen with respect to the noise and the minimum absolute value of the nonzero terms.

Under Definition 1, the state *v* of Eq. (78) converges in finite time to its equilibrium point *<sup>v</sup>* <sup>∗</sup> , and ^*s t*ð Þ in Eq.(78) converges in finite time to ^*<sup>s</sup>* <sup>∗</sup> of Eq. (77).

#### *5.4.2 Attack reconstruction*

The measured output under attack *y* of the system Eq. (5) is fed to the input of the low-pass filter that facilitates filtering out the possible measurement noise

asymptotic estimate *x*^ of the state vector *x* can be identified via Eqs. (67)

*<sup>x</sup>*^ <sup>¼</sup> <sup>Ψ</sup>�<sup>1</sup> *<sup>δ</sup>*

higher-order sliding mode differentiator, and using the estimates ^*δ,* ^*γ* for *δ, γ*, an

1

CCCCCCA �

increases due to the local asymptotic stability of the norm-bounded solution of the internal dynamics *γ*\_ ¼ *g*ð Þ *δ; γ* . However convergence will be achieved *in finite time* if

Considering Eq. (11) and *D*<sup>1</sup> is full rank, sensor attack can be reconstructed as

�1

**5.4 Attack reconstruction in nonlinear system by sparse recovery algorithm**

sources of attack, *m*. Previously, we investigated the cases where *p* . *m*. Now,

consider system (5) with more attacks than measurements, *m* . *p*.

In some applications, there are a limited number of measurements, *p*, and more

Notice that a more general format of (5) is considered here where matrix *D* is a

**Assumption (A11):** Assume that the attack vector *d t*ð Þ is sparse, meaning that numerous attacks are possible, but the attacks are not coordinated, and only few

The problem of recovering an unknown input signal from measurements is well known, as a left invertibility problem, as seen in several works [30, 37], but this problem was only treated in the case where the number of measurements is equal or greater than the number of unknown inputs. The left invertibility problem in the case of fewer measurements than unknown inputs has no solution or more exactly

In particular, the objective of exact recovery under sparse assumptions denoted for the sake of simplicity as "sparse recovery" (SR) is to find a concise representation of a signal using a few atoms from some specified (over-complete) dictionary,

^\_ *δ*1*r*<sup>1</sup> ^\_ *δ*2*r*<sup>2</sup> ⋮ ^\_ *δ<sup>m</sup>*1*rm*<sup>1</sup>

0

BBBBBB@

*<sup>j</sup>*¼<sup>1</sup> *Lbj Lf ri*�1 *y*1*i*

the total relative degree *r* ¼ *n* and no internal dynamics exist.

^ *dy*ðÞ¼ *t D*<sup>1</sup> *δiri* of \_ *δiri*

*d t*ð Þ of disturbance *d t*ð Þ in Eq. (11) is identified as [28].

*Lr*1

0

BBBB@

*Lr*2

*L rm*1

*<sup>f</sup> <sup>y</sup>*<sup>11</sup> <sup>Ψ</sup>�<sup>1</sup> *<sup>δ</sup>* ^*;* ^*γ* � � � �

*<sup>f</sup> <sup>y</sup>*<sup>12</sup> <sup>Ψ</sup>�<sup>1</sup> *<sup>δ</sup>* ^*;* ^*γ* � � � �

ð Þ *<sup>x</sup>* . Finally, *x t* ^ð Þ and ^

⋮

*<sup>f</sup> <sup>y</sup>*1*m*<sup>1</sup> <sup>Ψ</sup>�<sup>1</sup> ^*δ;* ^*<sup>γ</sup>* � � � �

*d* ! *d* can be achieved only locally and as time

*<sup>y</sup>*<sup>2</sup> � *<sup>C</sup>*2ð Þ *<sup>x</sup>*^ � � (73)

*ξ* ¼ Φ*s* þ *ε*<sup>0</sup> (74)

Since the finite-time exact estimates ^\_

^*;* ^*γ* � � � �

^*;* ^*<sup>γ</sup>* � � � � <sup>¼</sup> <sup>P</sup>*<sup>m</sup>*<sup>1</sup>

nonzero attacks happen at the same time.

*5.4.1 Sparse recovering algorithm*

has an infinity of solutions.

**18**

^*;* ^*γ* � � (71)

, ∀*i* ¼ 1*,* …*, m*<sup>1</sup> are available via the

1

*d t*ð Þ are obtained.

(72)

CCCCA

and (69)

asymptotic estimate ^

*Control Theory in Engineering*

where *L* Ψ�<sup>1</sup> *δ*

function of *x* as well.

*d t*ðÞ¼ *<sup>L</sup>*�<sup>1</sup> <sup>Ψ</sup>�<sup>1</sup> *<sup>δ</sup>*

from Eqs. (71) and (72). **Remark 3:** The convergence ^

^

$$\dot{z} = \frac{1}{\tau}(-z + C(\varkappa) + D(\varkappa)d(t))\tag{80}$$

**Remark 4:** The derivatives ϒ\_ <sup>1</sup>

*DOI: http://dx.doi.org/10.5772/intechopen.88669*

**Assumption (A12):** The matrix *L<sup>θ</sup>*

*g, <sup>g</sup>* <sup>þ</sup> *<sup>L</sup><sup>θ</sup> g,l <sup>L</sup><sup>θ</sup> l,l* � ��<sup>1</sup> *Lθ l, g* � � �*M*�<sup>1</sup>

*g,l <sup>L</sup><sup>θ</sup> l,l* � ��<sup>1</sup> *Pθ* � � *, Bθω* <sup>¼</sup> *<sup>M</sup>*�<sup>1</sup>

**6. Case study**

\_ *δ ω*\_ " # ¼

*<sup>P</sup>θω* <sup>¼</sup> *<sup>M</sup>*�<sup>1</sup>

*M*�<sup>1</sup> *<sup>g</sup>* �*L<sup>θ</sup>*

*<sup>g</sup> <sup>P</sup><sup>ω</sup>* � *<sup>L</sup><sup>θ</sup>*

**6.1 Simulation setup**

*ω* ∈ R<sup>3</sup>

*υ*\_ ¼ *φδ*ð Þ *δ; ω ,*

8 >< >:

**21**

*<sup>ω</sup>*\_ <sup>¼</sup> *φω*ð Þþ *<sup>δ</sup>; <sup>ω</sup> <sup>P</sup>θω* <sup>þ</sup> *<sup>M</sup>*�<sup>1</sup>

*C<sup>δ</sup>*1*B* ¼ 0 *, C<sup>δ</sup>*1*AB* 6¼ 0 *C<sup>δ</sup>*2*B* ¼ 0 *, C<sup>δ</sup>*2*AB* 6¼ 0 *C<sup>δ</sup>*3*B* ¼ 0 *, C<sup>δ</sup>*3*AB* 6¼ 0

*y*<sup>1</sup> ¼ *C*1*υ, y*<sup>2</sup> ¼ *C*2*ω* þ *D*1*<sup>ω</sup>dy*ð Þ*t*

2 4 *r*1 *,* …*,* ϒ\_ *<sup>p</sup>*

are under stealth attack and plant is under deception attack.

If (A12) holds, then the variable *θ* can be rewritten as

*<sup>θ</sup>* <sup>¼</sup> *<sup>L</sup><sup>θ</sup> l,l* � ��<sup>1</sup> �*R<sup>θ</sup>*

Substituting (87) into (1), then it follows that

a. The three sensors of rotor angles, *δ*∈ R<sup>3</sup>

, are assumed to be attacked.

*<sup>g</sup> dx*ð Þ*t*

*Ca* ¼

**Remark 5:** *D*1*<sup>ω</sup>* satisfies RIP condition defined in Eq. (75).

*C*1 *C*1*A C*2 *C*2*A C*3 *C*3*A*

¼

0 *Ip*�*<sup>p</sup>*

*<sup>g</sup> Eg*

*<sup>g</sup> <sup>B</sup><sup>ω</sup>* � *<sup>L</sup><sup>θ</sup>*

*g,l <sup>L</sup><sup>θ</sup> l,l* � ��<sup>1</sup> *Bθ*

but the three sensors of the generator speed deviations from synchronicity,

b. The *B*1*<sup>ω</sup>* ¼ *I*3*, B*1*<sup>θ</sup>* ¼ 06�<sup>3</sup>*, D<sup>δ</sup>* ¼ 03�<sup>6</sup> are given, and then Eq. (88) is reduced to

In the first step of attack reconstruction, *dx*ð Þ*t* is estimated by using protected measurements *y*<sup>1</sup> and the SMO described in Section 5.2. It is easy to verify that

*, where C*<sup>1</sup> ¼ *C*<sup>2</sup> ¼ *I*<sup>3</sup>�<sup>3</sup>*, D<sup>ω</sup>* ¼

� �

3 5 *δ ω* " # þ 0 *<sup>P</sup>θω* " # <sup>þ</sup>

higher-order sliding mode differentiators [28] discussed in Eqs. (65) and (66).

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode…*

Consider the mathematical models (1)–(4) of the US Western Electricity Coordinating Council (WECC) power system [8] with three generators and six buses (**Figure 1**) when the sensors of the generator speed deviations from synchronicity

*l,l* in (3) is nonsingular.

*l, <sup>g</sup>δ* þ *P<sup>θ</sup>* þ *Bθd*

*rp* are computed exactly in finite time using

� � (87)

*<sup>B</sup>θω* " #*d t*ð Þ*, y* <sup>¼</sup> *<sup>C</sup>*

, are assumed protected from attack,

2 6 4

*, ya* ¼

*δ ω* " # þ *D<sup>δ</sup> D<sup>ω</sup>* " #*d t*ð Þ

012 011 100 210 001 010

(88)

3 7 5

(89)

*y*1 *μ y*<sup>1</sup> � ^*y*<sup>1</sup> � �

*y*2 *μ y*<sup>2</sup> � ^*y*<sup>2</sup> � �

*y*3 *μ y*<sup>3</sup> � ^*y*<sup>3</sup> � �

(90)

*Bδ*

The filter output *z*∈ R*<sup>p</sup>* is available. Then, system Eq. (5) with filter Eq. (80) is rewritten as

$$\begin{cases} \dot{\xi} = \eta(\xi) + \Omega d(t) \\ \boldsymbol{\nu} = \overline{\mathbf{C}} \xi \end{cases} \tag{81}$$

where *ψ* ∈ R*p*, and

$$\begin{aligned} \xi &= \begin{bmatrix} x \\ \mathbf{x} \end{bmatrix}\_{(p+n)\times 1}, \quad \eta(\xi) = \begin{bmatrix} -\mathbf{1}\_{p\times p} & \mathbf{0} \\ \mathbf{0} & \mathbf{0} \end{bmatrix} \begin{bmatrix} \mathbf{z} \\ \mathbf{x} \end{bmatrix} + \begin{bmatrix} \mathbf{1}\_{p}(\mathbf{x}) \\ \mathbf{f}(\mathbf{x}) \end{bmatrix}, \\\ \mathbf{C} &= \begin{bmatrix} C\_{1} & C\_{2} & \dots & C\_{p+n} \end{bmatrix} = \begin{bmatrix} I\_{p\times p} & \mathbf{0}\_{p\times n} \end{bmatrix} \\\ \mathbf{\Omega} &= \begin{bmatrix} \mathbf{1}\_{p}\mathbf{D}(\mathbf{x}) \\ \mathbf{f}(\mathbf{x}) \end{bmatrix} = \begin{bmatrix} \mathbf{\Omega}\_{1} & \mathbf{\Omega}\_{2} & \dots & \mathbf{\Omega}\_{m} \end{bmatrix} \quad , \mathbf{\Omega}\_{i} \in \mathbb{R}^{p+n} \quad \forall i = \mathbf{1}, \dots, m \end{aligned}$$

If assumption (A2), (A7), and (A9) hold for system Eq. (81), i.e., the relative degree vector of Eq. (81) is *r* ¼ *r*1*;r*2*;* …*;rp* � �, the distribution

Γ ¼ *span*f g Ω1*;* Ω2*;* …*;* Ω*<sup>m</sup>* is involutive, and if zero dynamics exist, they are assumed asymptotically stable and may be left alone. Here it is assumed that there are no zero dynamics in system Eq. (81) and it is presented as

$$\mathbf{Y}\_{i} = \begin{bmatrix} 0 & 1 & 0 & \cdots & 0 \\ 0 & 0 & 0 & \cdots & 0 \\ \vdots & \vdots & \vdots & \cdots & \vdots \\ 0 & 0 & 0 & 0 & 0 \end{bmatrix} \mathbf{Y}\_{i} + \begin{bmatrix} 0 \\ 0 \\ \vdots \\ 0 \\ L\_{f}^{r} \psi\_{i}(\xi) \end{bmatrix} + \begin{bmatrix} 0 \\ 0 \\ \vdots \\ 0 \\ \sum\_{j=1}^{m} L\_{\Omega} L\_{f}^{r-1} \psi\_{i}(\xi) d\_{j} \\ \vdots \\ \mathbf{Y}\_{r}(\xi) \end{bmatrix}, \quad \mathbf{Y}\_{i} = \begin{bmatrix} \mathbf{Y}\_{1}^{i}(\xi) \\ \mathbf{Y}\_{2}^{i}(\xi) \\ \vdots \\ \mathbf{Y}\_{r}^{i}(\xi) \end{bmatrix} = \begin{bmatrix} \boldsymbol{\mu}\_{i}(\xi) \\ \boldsymbol{L}\_{f} \boldsymbol{\mu}\_{i}(\xi) \\ \boldsymbol{L}\_{f}^{r-1} \boldsymbol{\mu}\_{i}(\xi) \end{bmatrix} \tag{83}$$

for *i* ¼ 1*,* …*, p*, where *ψi*ð Þ*ξ* is the *i th* entry of vector *ψ ξ*ð Þ and satisfies

$$\dot{\Upsilon}\_{r\_i}^i(\xi) = L\_f^{r\_i} \nu\_i(\xi) + \sum\_{j=1}^m L\_{\Omega\_j} L\_f^{r\_i - 1} \nu\_i d\_j, \quad i = 1, \dots, p \tag{84}$$

Then, the following algebraic equation is found from Eq. (84):

$$Z\_p = F(\xi)d(t) \tag{85}$$

where *Zp* <sup>∈</sup> <sup>R</sup>*<sup>p</sup>*, *<sup>F</sup>*ð Þ*<sup>ξ</sup>* <sup>∈</sup> <sup>R</sup>*<sup>p</sup>*�*<sup>m</sup>*, and

$$Z\_p = \begin{bmatrix} \mathbf{Y}\_{r\_1}^1 \\ \vdots \\ \mathbf{Y}\_{r\_p}^p \end{bmatrix} - \begin{bmatrix} L\_f^{r\_1} \boldsymbol{\nu}\_1(\xi) \\ \vdots \\ L\_f^{r\_p} \boldsymbol{\nu}\_p(\xi) \end{bmatrix}, \quad F(\xi) = \begin{bmatrix} L\_{\Omega\_l} L\_f^{r\_1 - 1} \boldsymbol{\nu}\_1 & L\_{\Omega\_l} L\_f^{r\_1 - 1} \boldsymbol{\nu}\_1 & \cdots & L\_{\Omega\_l} L\_f^{r\_1 - 1} \boldsymbol{\nu}\_1 \\ L\_{\Omega\_l} L\_f^{r\_2 - 1} \boldsymbol{\nu}\_2 & L\_{\Omega\_l} L\_f^{r\_2 - 1} \boldsymbol{\nu}\_2 & L\_{\Omega\_l} L\_f^{r\_2 - 1} \boldsymbol{\nu}\_2 \\ \vdots & & \vdots \\ L\_{\Omega\_l} L\_f^{r\_p - 1} \boldsymbol{\nu}\_p & L\_{\Omega\_l} L\_f^{r\_u - 1} \boldsymbol{\nu}\_p & \cdots & L\_{\Omega\_l} L\_f^{r\_p - 1} \boldsymbol{\nu}\_p \end{bmatrix} \tag{86}$$

Finally, filtered system Eq. (5), as it is rewritten in Eq. (85), is in the same form of Eq. (74). Then, sparse recovery algorithm discussed in Section 5.4.1 is applied to Eq. (85) to reconstruct *d t*ð Þ.

*Secure State Estimation and Attack Reconstruction in Cyber-Physical Systems: Sliding Mode… DOI: http://dx.doi.org/10.5772/intechopen.88669*

**Remark 4:** The derivatives ϒ\_ <sup>1</sup> *r*1 *,* …*,* ϒ\_ *<sup>p</sup> rp* are computed exactly in finite time using higher-order sliding mode differentiators [28] discussed in Eqs. (65) and (66).
