Supervisory Control under Indefinite Actuator and Sensor Attacks: Prescribed Resilience

We study a new security problem in discreteevent systems with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">indefinite actuator and sensor attacks: Any controllable events disabled by the supervisor can be re-enabled, and any observable events can be concealed by attackers. We consider that the plant contains unsafe states, each of which is associated with a safety requirement specifying the number of attacks on actuators and the number of attacks on sensors that should be withstood by the supervisor to prevent the plant from entering the unsafe state. Thus, these safety requirements capture the prescribed resilience of the supervisor to be designed. To that end, we first construct an “unreliable plant” which includes all possible attacks in the plant, and derive a model of limited behavior of the unreliable plant according to the safety requirements, which is called an “attackcompromised plant”. We then identify the unsafe states in the attack-compromised plant, and develop a synthesis procedure to compute a feasible partial-observation and it physically-admissible supervisor (if one exists) with prescribed resilience. Physical admissibility is a novel property which indicates that no disabled event is subject to a sensor attack.</i>