Guaranteed model-based fault detection in cyber–physical systems: A model invalidation approach

Abstract

This paper presents a sound and complete fault detection approach for cyber-physical systems represented by hidden-mode switched affine models with time varying parametric uncertainty. The fault detection approach builds upon techniques from model invalidation. In particular, a set-membership approach is taken where the noisy input-output data is compared to the set of behaviors of a nominal model. As we show, this set-membership check can be reduced to the feasibility of a mixed-integer linear programming (MILP) problem, which can be solved efficiently by leveraging the state-of-the-art MILP solvers. In the second part of the paper, given a system model and a fault model, the concept of T -detectability is introduced. If a pair of system and fault models satisfies T -detectability property for a finite T , this allows the model invalidation algorithm to be implemented in a receding horizon manner, without compromising detection guarantees. In addition, the concept of weak-detectability is introduced which extends the proposed approach to a more expressive class of fault models that capture language constraints on the mode sequences. Finally, the efficiency of the approach is illustrated with numerical examples motivated by smart building radiant systems.

Guaranteed fault detection and isolation for switched affine models

“…Moreover, SOS-1 constraints, which are by nature integral constraints, make the branch and bound search procedures noticeably faster (see, e.g., [28, Section 3.3.4] for a discussion). Our new model invalidation problem using SOS-1 constraints is presented below, which we will demonstrate to be much faster than an earlier formulation [20], [29] in Section VI-A.…”

“…Thus, given two SWA models and an integer T , the T -distinguishability problem is to check whether the two models are T -distinguishable or not. This problem can be addressed using a Satisfiability Modulo Theory approach [20], or a MILP feasibility check [29]. As with model invalidation in the previous section, we will also propose an alternative MILP formulation for checking T -distinguishability, which employs SOS-1 type constraints and as before, is more intuitive and computationally superior (cf.…”

“…Note that in the following T -distinguishability test, we have added a decision variable δ that will be important in a later discussion, which can be computed with little additional computational cost. 1 When the pair of models consists of the nominal system model and the fault model, this is also known as T -detectability [20], [29].…”

Securing state reconstruction under sensor and actuator attacks: Theory and design

“…In contrast, the method proposed in this paper is guaranteed to construct the state correctly in spite of attacks on sensors and/or actuators if the number of attacked components is below a specified threshold that depends on the system. In a recent work [15], Harirchi et. al.…”

“…The authors pursued a worst-case scenario approach and therefore their framework is suitable for security. However, necessary and sufficient conditions for state estimation in a general adversarial setting were not investigated in [15]. In this paper, we precisely characterize the class of systems, by providing necessary and sufficient conditions, for which state reconstruction is possible despite sensor and/or actuator attacks.…”