Demand-Driven Resilient Control for Generation Unit of Local Power Plant Under Unreliable Communication

Abstract

The resilient control issue for the generation unit (GU) in a local power plant with unreliable communication is addressed in this article, where the communication may be jammed by denial-of-service (DoS) attacks. Based on the GU model of voltage and current at the point of common coupling, a demand-driven network communication protocol is proposed to decrease the number of scheduling signal transmissions, and an observer-based prediction method is provided to replenish the lack of dispatching data during transmission intervals when the demand has not changed. The closed-loop performance is analyzed for the GU system in the input-to-state stable framework with or without attack. According to the DoS attack model, which is described by the assumptions of frequency and duration, the conservativeness of the tolerable DoS attack index is reduced by using the thought of robustness to the maximum disturbance-induced error. Simulation examples are provided to verify the effectiveness of the approach proposed in this article.

1. Introduction

In recent decades, with the vigorous progress of renewable energy, the randomness of renewable generation such as wind power and photovoltaics has made the smooth scheduling of power systems a hot topic [1]. In order to enhance the flexible capacity and peaking capacity of the power system, voltage and frequency control of small generation units (GUs) in local power plants becomes necessary. Recently, the scheduling scheme based on network communication has been widely used in power systems [2]. However, the utilization of heterogeneous electrical and electronic components with networks has made the data transmission fairly open to various cyber attacks. This can lead to serious security consequences. Unlike the attacks on traditional systems that limit the influence to the cyber level, the physical world of power systems can be impacted by malicious cyber attacks [3], causing serious social and livelihood problems. Thus, these strong demands for power systems exist, despite malicious cyber attacks, designing analysis and synthesis approaches to ensure their reliability and security [4,5].

Typically, the various malicious attacks involve deception attacks and denial-of-service (DoS) attacks, where the latter attack leads to the information absence of the actuator and sensor by blocking the data transmission to their respective destinations. The DoS attack is very common in networked control systems, and lots of studies have been presented on networked power systems under DoS attacks. In [6], an $H_{\infty }$ load frequency control based on an event-triggered strategy is studied for multi-area power systems, and the resilient control approach is proposed to deal with the presence of DoS attacks. Security issues in remote state estimation with the existence of jamming attacks are investigated in [7] using a game-theoretic approach. In [8,9], the optimal DoS attack strategies for maximizing the deterioration on the system performance from the view of the adversary are investigated.

Stability analysis is a popular research topic on security problems of control systems under DoS attacks. In [10], the DoS attack model is characterized according to its frequency and duration, input-to-state stable (ISS) is demonstrated for the attacked closed-loop system, and transmission timing is scheduled based on this DoS attack model. Based on the analysis strategy proposed in [10], to maximize the attack intensity index according to the frequency and duration of the attack model with which the stability of the system is not destroyed, a resilient control framework is proposed in [11]. In [12], the controller design and analysis is investigated with this DoS attack model for nonlinear dynamics. In [13], based on the ISS control framework, the scenario of multiple transmission channels is considered for linear systems under DoS attacks. In [14], an output-based synthetical control design strategy for a class of hybrid nonlinear dynamics under DoS attacks is provided in a dynamic event-triggered framework. In [15], observer-based asynchronous control for switching power systems subject to DoS attacks is discussed. However, research on the resilient control of power systems under the condition of unreliable communication is still insufficient; particularly, the design of the output voltage and current control scheme of the GU via the network is still a challenging problem.

Traditionally, the control algorithms are executed in the time-scheduled strategy, in which the sampling and data communication are carried out periodically. Although the time-based periodic sampling might be preferable from the point of view of system analysis and design, it leads to the unnecessary waste of limited resources. Usually, network-based scheduling signals in power systems are not transmitted in real time but communicate when scheduling needs arise. In this way, the traditional time-triggered control method is no longer suitable. The event-triggered control scheme as a control strategy based on intermittent communication has been a wide concern for networked control systems [16,17,18], and it can be used to construct a demand-based control scheme for GUs. In [19], an event-triggered control (ETC) strategy with a periodic verification mechanism for linear systems is proposed, which is named periodic event-triggered control (PETC). By merging the time-scheduled strategy and ETC, the characteristic of PETC is to verify the triggering condition periodically—that is, whether to calculate and send new sampling data or new control data is determined at each periodic verification time. In [20], consider the scenario where both the sensor-to-controller channel and the controller-to-actuator channel are communicated via a network, a PETC algorithm is designed according to the retrievable system state space model. The above studies are all about networked control systems without attacks. Practically, power system scheduling also has a fixed sampling period; however, it is still a challenge to construct a resilient control scheme for the GU under unreliable communication using the idea of PETC.

For grid-connected power plants, the purpose of scheduling is to maintain the balance and stability of voltage and frequency, which are specified by the main grid when there are demands. However, for the local power plants tasked with flexibility and peaking, voltage and frequency outputs for GU are definitively controlled according to the networked scheduling signals, and it is necessary to save network resources. By introducing the concept of neutral interactions, the dynamic model of GU in this paper is established by exploiting quasi-stationary line approximations of line dynamics [21]. To improve the security of networked scheduling, the unreliable network communication channel is modeled as the communication interruption of the sensor channel due to the presence of a DoS attack. To construct the control framework, a smart sensor system is adopted in order to design the demand-driven mechanism (DDM)—that is, network communication is performed only when scheduling is required. Unfortunately, in the design of the control system, the load current of the unit connection is difficult to estimate. The conventional idea is to treat it as an unknown disturbance, but how to deal with the error term introduced by disturbance and noise is still a difficult point in the DDM design. To improve resilience against DoS attacks, a predictor is proposed in the controller system to compensate for the lack of data during communication intervals. Based on the ISS analysis framework, the stability when there are DoS attacks is proved and the maximum tolerable attack intensity index is quantified.

The prime innovations of this article are generalized below: First, the dynamic model of the GU for local power plant is established by exploiting quasi-stationary line approximations, and the unknown loads are treated as unmodeled disturbances, which can be restricted by the designed $H_{\infty }$ observer. At the same time, the effects of disturbance and noise during the DDM design can be addressed by the quantified $H_{\infty }$ performance index. Second, the advanced demand-driven resilient control method with a periodic verification strategy is presented to deal with the unreliable communication caused by DoS attacks, and the intermittent communication scenario meets the requirements of network scheduling for the GU by applying the prediction-based method. Third, based on the thought of robustness to the maximum disturbance accumulation error, the conservatism of the tolerable attack intensity in this result is decreased compared with [10,14].

The rest of this article is organized as follows: The GU model is described in Section 2, and the observer and the predictor are designed. In Section 3, the ISS of the demand-driven control approach is proved. Section 4 gives the resilient control strategy under DoS attacks. Section 5 provides simulation results. The conclusions of this paper are given in Section 6.

2. System Formulation and Problem Description

First of all, the meanings of the symbols used in this paper are shown in the notation below. Then, the state space model of the GU is constructed, and the resilient control framework is designed based on it.

Notation: Let $\mathbb{R}$ and ${\mathbb{R}}^n$ be the sets of real and Euclidean spaces with dimension n, respectively. Let $\mathbb{N}$ be the natural number set and ${\mathbb{N}}_0=\mathbb{N}\cup \left\{0\right\}$. $∥x∥$ denotes the Euclidean norm for any vector $x\in {\mathbb{R}}^n$. $A^T$ is the transpose of a given matrix A, $∥A∥$ is the spectral norm, and ${\mu }_A$ is the logarithmic norm [22] with ${\mu }_A=max\left\{\lambda |\lambda \in \mathrm{spectrum}\left\{{\displaystyle \frac{A+A^T}{2}}\right\}\right\}$. For sets $S_1$ and $S_2$, denote $S_2\setminus S_1$ by the relative complement of $S_1$ in $S_2$. $\left|T(t_1,t_2)\right|=t_2-t_1$ denotes by the length of an interval $T=[t_1,t_2)$. For a measurable function $h\left(t\right)$ defined in $[0,t)$, the ${\mathcal{L}}_{\infty }$ norm of $h(·)$ is denoted by ${∥h_t∥}_{\infty }=ess{sup}_{s\in [0,t)}∥h\left(s\right)∥$.

2.1. Generation Unit Model

In this section, the dynamical model of the GU for a local power plant is presented. To simplify the analysis process, the realistic model of GU is assumed to consist of transformers, associated filters, and voltage source converters (VSCs) [21]. As shown in Figure 1, through a non-zero impedance three-phase line with $(R_{ij},L_{ij})$, the considered GU denoted by i is connected with other units j. The GU is made up of a VSC, a DC voltage source (representing a biomass or waste incineration unit), an inductance $L_t$, a series filter characterized by a resistance $R_t$, and a station step-up transformer $(Y-\Delta )$; further, at the point of common coupling (PCC) of the electrical network, the GUs are connected with each other through the transformer, where the transformer coefficients are represented by $R_t$ and $L_t$, and k is defined as the transformation ratio.

For the local loads that are connected to the PCC, consider the case where the GU proves the real and reactive powers. Suppose that the loads are time-varying and unknown, and the load current $I_L$ is treated as the disturbance for the GU. At the PCC of each local area, the effect of high-frequency harmonics of the load voltage is attenuated by using the shunt capacitance $C_t$. In the abc-frame, based on the dynamical equations of this scheme and by applying Park’s transformation, the model rotating with speed ${\omega }_0$ in the $dq$-frame is obtained as follows:

$$\begin{array}{c}\hfill \begin{array}{c}GUi:\left\{\begin{array}{c}{\displaystyle \frac{d{V}_{i,dq}}{dt}}+j{\omega }_0{V}_{i,dq}={\displaystyle \frac{k_i}{C_{ti}}}{I}_{ti,dq}+{\displaystyle \frac{1}{C_{ti}}}{I}_{ti,dq}-{\displaystyle \frac{1}{C_{ti}}}{I}_{Li,dq}\hfill \\ {\displaystyle \frac{d{I}_{ti,dq}}{dt}}+j{\omega }_0{I}_{ti,dq}=-{\displaystyle \frac{R_{ti}}{L_{ti}}}{I}_{ti,dq}-{\displaystyle \frac{k_i}{L_{ti}}}{V}_{i,dq}+{\displaystyle \frac{1}{L_{ti}}}{V}_{ti,dq}\hfill \end{array}\right.\hfill \end{array}\end{array}$$

(1)

$$\begin{array}{c}\hfill \begin{array}{c}Lineij:\left\{{\displaystyle \frac{d{I}_{ij,dq}}{dt}}+j{\omega }_0{I}_{ij,dq}={\displaystyle \frac{1}{L_{ij}}}{V}_{j,dq}-{\displaystyle \frac{R_{ij}}{L_{ij}}}{I}_{ij,dq}-{\displaystyle \frac{1}{L_{ij}}}\right.V_{i,dq}\hfill \end{array}\end{array}$$

(2)

where $V_{i,dq}$ is the output voltage at the PCC, and $V_{ti,dq}$ and $I_{ti,dq}$ are the output voltage and current of the GU, respectively. The states in (1) and (2) can be divided into two segments—that is, the $dq$ reference frame is divided as the real component d- and the imaginary component q-, respectively, and $I_{ij}$ is the line current. Modeling the load current $I_{Li,dq}$ as the disturbance, (1) and (2) can be represented through the following continuous time linear dynamic form:

$$\begin{array}{c}\hfill \begin{array}{c}\begin{array}{c}\dot{x}\left(t\right)=Ax\left(t\right)+Bu\left(t\right)+E\omega \left(t\right)\hfill \\ y\left(t\right)=Cx\left(t\right)+v\left(t\right)\hfill \end{array}\hfill \end{array}\end{array}$$

(3)

where $x={[V_{i,d},V_{i,q},I_{ti,d},I_{ti,q},I_{ij,d},I_{ij,q}]}^T$ is the state vector, $u={[V_{ti,d},V_{ti,q},V_{tj,d},V_{tj,q}]}^T$ is the control input, $\omega ={[I_{Li,d},I_{Li,q},I_{Lj,d},I_{Lj,q}]}^T$ is the unknown disturbance, $y={[V_{i,d},V_{i,q},V_{j,d},V_{j,q}]}^T$ is the measurement output, and $v\left(t\right)$ is the measurement noise. Suppose that $\omega \left(t\right)$ and $v\left(t\right)$ are bounded, where $∥\omega \left(t\right)∥\le {\delta }_{\omega }$, $∥v\left(t\right)∥\le {\delta }_v$. A, B, C, and E are system matrices to be determined later. This model is regarded as the master model here, since the states of the line are controlled by the GU i only for the control purpose.

To isolate the effects of other connected GUs on the grid, an approximate model is given to avoid the requirement of applying the line current in the GU’s dynamic equations. Let ${\displaystyle \frac{d{I}_{ij,dq}}{dt}}=0$; the quasi-stationary line approximations model is given as

$${\overline{I}}_{ij,dq}={\displaystyle \frac{V_{j,dq}}{(R_{ij}+j{\omega }_0{L}_{ij})}}-{\displaystyle \frac{V_{i,dq}}{(R_{ij}+j{\omega }_0{L}_{ij})}}.$$

Then, replace variable $I_{ij,dq}$ in (2) and divide the complex $dq$ quantities into the corresponding d and q components; the transformed model for GUi is formulated as follows:

$$\begin{array}{c}\hfill \begin{array}{c}GUi:\left\{\begin{array}{c}{\displaystyle \frac{d{V}_{i,d}}{dt}}={\omega }_0{V}_{i,q}+{\displaystyle \frac{k_i}{C_{ti}}}{I}_{ti,d}-{\displaystyle \frac{1}{C_{ti}}}{I}_{Li,d}+{\displaystyle \frac{1}{C_{ti}}}{\overline{I}}_{ij,d}\hfill \\ {\displaystyle \frac{d{V}_{i,q}}{dt}}=-{\omega }_0{V}_{i,d}+{\displaystyle \frac{k_i}{C_{ti}}}{I}_{ti,q}-{\displaystyle \frac{1}{C_{ti}}}{I}_{Li,q}+{\displaystyle \frac{1}{C_{ti}}}{\overline{I}}_{ij,q}\hfill \\ {\displaystyle \frac{d{I}_{ti,d}}{dt}}=-{\displaystyle \frac{k_i}{L_{ti}}}{V}_{i,d}-{\displaystyle \frac{R_{ti}}{L_{ti}}}{I}_{ti,d}+{\omega }_0{I}_{ti,q}+{\displaystyle \frac{1}{L_{ti}}}{V}_{ti,d}\hfill \\ {\displaystyle \frac{d{I}_{ti,q}}{dt}}=-{\displaystyle \frac{k_i}{L_{ti}}}{V}_{i,q}-{\displaystyle \frac{R_{ti}}{L_{ti}}}{I}_{ti,q}-{\omega }_0{I}_{ti,d}+{\displaystyle \frac{1}{L_{ti}}}{V}_{ti,q}\hfill \end{array}\right.\hfill \end{array}\end{array}$$

(4)

then, the dynamic model (1) of the GU is constructed as the following state space model form:

$$A=\left[\begin{array}{cccc}-{\displaystyle \frac{1}{C_{ti}}}({\displaystyle \frac{R_{ij}}{Z_{ij}^2}})& {\omega }_0-{\displaystyle \frac{1}{C_{ti}}}({\displaystyle \frac{X_{ij}}{Z_{ij}^2}})& {\displaystyle \frac{k_i}{C_{ti}}}& 0\\ -{\omega }_0+{\displaystyle \frac{1}{C_{ti}}}({\displaystyle \frac{X_{ij}}{Z_{ij}^2}})& -{\displaystyle \frac{1}{C_{ti}}}({\displaystyle \frac{R_{ij}}{Z_{ij}^2}})& 0& {\displaystyle \frac{k_i}{C_{ti}}}\\ -{\displaystyle \frac{k_i}{L_{ti}}}& 0& -{\displaystyle \frac{R_{ti}}{L_{ti}}}& {\omega }_0\\ 0& -{\displaystyle \frac{k_i}{L_{ti}}}& -{\omega }_0& -{\displaystyle \frac{R_{ti}}{L_{ti}}}\end{array}\right],B=\left[\begin{array}{cc}0& 0\\ 0& 0\\ {\displaystyle \frac{1}{L_{ti}}}& 0\\ 0& {\displaystyle \frac{1}{L_{ti}}}\end{array}\right],$$

$$C=\left[\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& 1& 0\\ 0& 0& 0& 1\end{array}\right],E=\left[\begin{array}{cc}-{\displaystyle \frac{1}{C_{ti}}}& 0\\ 0& -{\displaystyle \frac{1}{C_{ti}}}\\ 0& 0\\ 0& 0\end{array}\right].$$

where $X_{ij}={\omega }_0{L}_{ij}$, $Z_{ij}=\left|R_{ij}+j{X}_{ij}\right|$, $x\left(t\right)={[V_{i,d},V_{i,q},I_{ti,d},I_{ti,q}]}^T$, $u\left(t\right)={[V_{ti,d},V_{ti,q}]}^T$, and $\omega \left(t\right)={[I_{Li,d},I_{Li,q}]}^T$.

2.2. Control Framework

In order to meet the scheduling and control practice based on the network communication while guaranteeing the desirable scheduling performance of the GU, the control construction is designed as in Figure 2. A sensor system is designed to transmit the measurement information to the remote controller system based on the communication network. At the same time, the network communication is unreliable, which is caused by DoS attacks.

The smart sensor system with a demand-driven method and periodic verification strategy is designed to schedule the scheduling commands. The sensor system consists of an observer $\mathcal{O}$ that deals with disturbance and noise, and the time when information is needed to be sent to the controller system is decided by a designed DDM. Furthermore, the controller system contains a predictor $\mathcal{P}r$ that can compensate the GU’s state data loss during the transmission interval using the latest received data. To suppress the impact of disturbance and noise, the $H_{\infty }$ observer is designed as follows:

$$\begin{array}{c}\hfill Observer\mathcal{O}:{\dot{x}}_s\left(t\right)=A{x}_s\left(t\right)+Bu\left(t\right)+L(y\left(t\right)-C{x}_s\left(t\right))+Lv\left(t\right)\end{array}$$

(5)

where $x_s\left(t\right)$ denotes by the state estimation of the sensor system and L is the designed gain matrix. Denote $e_s\left(t\right)=x\left(t\right)-x_s\left(t\right)$ by the observation error; then, the error dynamic can be formulated as

$$\begin{array}{c}\hfill {\dot{e}}_s\left(t\right)={\Phi }_L{e}_s\left(t\right)+\Gamma \xi \left(t\right)\end{array}$$

(6)

where ${\Phi }_L=A-LC$, $\Gamma =[I-L]$, $\xi \left(t\right)=\left[\begin{array}{c}E\omega \left(t\right)\\ v\left(t\right)\end{array}\right]$. Based on continuous-time systems’ bounded real lemma [23], the gain matrix L is able to be calculated based on the LMI in (7) and ${∥e_s\left(t\right)∥}_2<\gamma {∥\xi \left(t\right)∥}_2$ is obtained.

$$\begin{array}{c}\hfill \left[\begin{array}{ccc}\overline{P}{\Phi }_L+{\Phi }_L^T\overline{P}& \overline{P}\Gamma & I\\ \ast & -\gamma I& 0\\ \ast & \ast & -\gamma I\end{array}\right]<0\end{array}$$

(7)

where $\overline{P}$ is a symmetric positive definite matrix and $\gamma$ is a small positive scalar, which represents the $H_{\infty }$ performance index. The predictor is given as

$$\begin{array}{c}\hfill Predictor\mathcal{P}r:\left\{\begin{array}{c}{\dot{x}}_p\left(t\right)=A{x}_p\left(t\right)+Bu\left(t\right),x_s\left(t\right)isnotreceived\hfill \\ x_p\left(t\right)=x_s\left(t\right),x_s\left(t\right)isreceived.\hfill \end{array}\right.\end{array}$$

(8)

Whether the observer data $x_s\left(t\right)$ are sent is determined by the demand of scheduling control, which is represented by the difference between the observed states of the GU and the predicted value of the remote controller. Then, the DDM is designed as follows:

$$\begin{array}{c}\hfill x_s\left(t\right)issent\iff ∥x_s\left(t\right)-x_p\left(t\right)∥>{\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho \end{array}$$

(9)

where $\rho =\gamma ∥C∥\delta +{\delta }_v$, $\delta =∥E∥{\delta }_{\omega }+{\delta }_v$, ${\sigma }_s$ and ${\sigma }_c$ are suitable positive demand parameters to be selected later, and $\gamma$ is obtained by solving LMI (7). Besides, when the DDM (9) is met, an acknowledgment (ACK) signal is required to affirm that the transmission attempt was successful, and this assumption is consistent with the TCP-type communication protocol.

Define ${\left\{t_k\right\}}_{k\in {\mathbb{N}}_0}$ as the sequence performing data transmission of control update, and denote ${\Delta }_k=t_{k+1}-t_k$ by the data transmission interval between two consecutive attempts, which

$$\begin{array}{c}\hfill 0<\underline{\Delta }\le {\Delta }_k\le \overline{\Delta }\end{array}$$

(10)

where $\overline{\Delta }$ and $\underline{\Delta }$ are upper and lower bounds of the intervals between two consecutive attempts, respectively.

Remark 1. 

The length of interval ${\Delta }_k$ is decided by the DDM (9), but it is necessary to set the lower and upper bound. Due to the characteristic of periodic verification strategy, the lower bound $\underline{\Delta }$ can be selected as the DDM verification period. Inspired by the pre-specified upper bound of inter-event times in [17], the upper bound $\overline{\Delta }$ is needed to force the sensor to send data to the remote controller if the transmission is not executed for long periods of time.

The sensor system transmits the latest estimation value $x_s\left(t\right)$ to the controller system by network communication to renew the state prediction $x_p\left(t\right)$ at ${\left\{t_k\right\}}_{k\in {\mathbb{N}}_0}$—that is, $x_p\left(t_k\right)=x_s\left(t_k\right)$, and it is the initial value for the state prediction when $t\in [t_k,t_{k+1})$. Then, $x_p\left(t\right)$ is calculated by (8) and the control value is able to be designed by the switching controller formulated as

$$\begin{array}{c}\hfill u\left(t\right)=\left\{\begin{array}{c}K{x}_p\left(t\right),x_s\left(t\right)isnotreceived\hfill \\ K{x}_s\left(t\right),x_s\left(t\right)isreceived.\hfill \end{array}\right.\end{array}$$

(11)

where K is the state feedback gain matrix. In order to improve the rate of convergence, region poles assignment lemma [23] is used to solve K with $\alpha$ stability margin. Let ${\Phi }_2=A+BK$; then, K can be obtained by solving the following LMI:

$$\begin{array}{c}\hfill P_2{\Phi }_2+{\Phi }_2^T{P}_2+2\alpha P_2<0\end{array}$$

(12)

where $\alpha >0$ is a given coefficient and $P_2$ is a symmetric positive definite matrix.

As in Figure 2, a replica of the predictor $\mathcal{P}r$ is run in the sensor system so that it can synchronize $x_p\left(t\right)$ that the controller system has and can judge whether (9) is satisfied. When the DDM (9) is not satisfied, $x_s\left(t\right)$ is not sent and the error between $x_p\left(t\right)$ and $x_s\left(t\right)$ is accumulated until (9) is satisfied; then, $x_s\left(t\right)$ is transmitted to the predictor $\mathcal{P}r$, and an ACK signal is sent and returned to the sensor from the controller system by the network to ascertain that the transmission attempt was triumphant.

3. Demand-Driven Control Strategy

This section gives the design process of the demand-driven control strategy—that is, the selection method of driven parameters under the premise of ensuring the control objective. First of all, the control objective is described as the definition provided below:

Definition 1 

([24]). Given the GU system (3) with control input (11), for each ${\omega }_t\in {\mathcal{L}}_{\infty }(\mathbb{R},\omega \ge 0)$ and $x\left(0\right)\in {\mathbb{R}}^n$, if there is a $\mathcal{K}L$-function $h_1(·)$ and a ${\mathcal{K}}_{\infty }$-function $h_2(·)$ such that

$$\begin{array}{c}\hfill ∥x\left(t\right)∥\le h_1(∥x\left(0\right)∥,t)+h_2\left({∥{\omega }_t∥}_{\infty }\right)\end{array}$$

(13)

holds for all $t\in \mathbb{R}$ with $t\ge 0$, the system is considered to be ISS. Besides, the system (3) is globally asymptotically stable if (13) is satisfied for ${\omega }_t\equiv 0$.

Then, the design process of the demand-driven parameters is given. For $t\in \mathbb{R},t\ge 0$, to measure the difference between the truth state $x\left(t\right)$ and the state prediction $x_p\left(t\right)$, which represents the demand of network communication, denote the prediction error by

$$\begin{array}{c}\hfill e\left(t\right)=x_p\left(t\right)-x\left(t\right)\end{array}$$

(14)

Then, the formula for the closed-loop GU system is given as

$$\begin{array}{c}\hfill \dot{x}\left(t\right)={\Phi }_{2}x\left(t\right)+BKe\left(t\right)+E\omega \left(t\right)\end{array}$$

(15)

Design the Lyapunov function as $V\left(t\right)=x^T\left(t\right)Px\left(t\right)$, where P is the unique solution of the following Lyapunov equation:

$$\begin{array}{c}\hfill P{\Phi }_2+{\Phi }_2^{T}P+Q=0\end{array}$$

(16)

where Q is any given positive definite symmetric matrix. Then, we have

$$\begin{array}{c}\hfill {\alpha }_1∥x\left(t\right)∥\le V\left(t\right)\le {\alpha }_2∥x\left(t\right)∥\end{array}$$

(17)

$$\begin{array}{c}\hfill \dot{V}\left(t\right)\le -{\gamma }_1{∥x\left(t\right)∥}^2+{\gamma }_2∥x\left(t\right)∥∥e\left(t\right)∥+{\gamma }_3∥x\left(t\right)∥∥\omega \left(t\right)∥\end{array}$$

(18)

for any $t\in \mathbb{R},t\ge 0$, where ${\alpha }_1$ and ${\alpha }_2$ are equal to the smallest and largest eigenvalues of P, respectively. ${\gamma }_1$ is the smallest eigenvalue of Q; ${\gamma }_2=∥2PBK∥$ and ${\gamma }_3=∥2PE∥$. Notice that $∥x_s\left(t\right)-x_p\left(t\right)∥\le {\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho$ is always true when $t\in [t_k,t_{k+1})$; then, it yields

$$\begin{array}{c}\hfill ∥x\left(t\right)-x_p\left(t\right)∥\le {\sigma }_s∥x\left(t\right)∥+{\sigma }_c\rho +\lambda {∥\xi \left(t\right)∥}_{\infty }\end{array}$$

(19)

where the inequality comes from the triangle inequality and the fact that $∥e_s\left(t\right)∥=∥x\left(t\right)-x_s\left(t\right)∥<\gamma {∥\xi \left(t\right)∥}_{\infty }$. Then, ${∥\xi \left(t\right)∥}_{\infty }\le ∥E∥{\delta }_{\omega }+{\delta }_v=\delta$ yields

$$\begin{array}{c}\hfill ∥e\left(t\right)∥=∥x\left(t\right)-x_p\left(t\right)∥\le {\sigma }_s∥x\left(t\right)∥+{\sigma }_{\delta }\delta \end{array}$$

(20)

where ${\sigma }_{\delta }=\gamma {\sigma }_c∥C∥+\gamma +{\sigma }_c$. Then, $\dot{V}\left(t\right)\le -({\gamma }_1-{\sigma }_s{\gamma }_2){∥x\left(t\right)∥}^2+({\gamma }_3+{\sigma }_{\delta }{\gamma }_2)∥x\left(t\right)∥\delta$ can be obtained by substituting (20) into (18) and indicates that when ${\gamma }_1-{\sigma }_s{\gamma }_2>0$ holds,

$$\begin{array}{c}\hfill V\left(x\left(t\right)\right)\le e^{-{\theta }_{1}t}V\left(x\left(0\right)\right)+{\gamma }_4{\delta }^2\end{array}$$

(21)

where ${\theta }_1={\displaystyle \frac{{\gamma }_5}{2{\alpha }_1}}$, ${\gamma }_4={\displaystyle \frac{{({\gamma }_3+{\sigma }_{\delta }{\gamma }_2)}^2}{2{\gamma }_5{\theta }_1}}$, and ${\gamma }_5={\gamma }_1-{\sigma }_s{\gamma }_2$.

The use of the prediction method makes the controller system able to simulate the true state value; then, the discrepancy accumulated in the transmission interval is degraded by the information compensation. From (14), it yields for any $t\in [t_k,t_{k+1})$ that the dynamic of the prediction error can be formulated as

$$\begin{array}{c}\hfill \begin{array}{c}\dot{e}\left(t\right)={\dot{x}}_p\left(t\right)-\dot{x}\left(t\right)\hfill \\ =Ae\left(t\right)-E\omega \left(t\right)\hfill \end{array}\end{array}$$

(22)

then, we have the upper bound of the error as

$$\begin{array}{c}\hfill \begin{array}{c}∥e\left(t\right)∥\le {\int }_{t_k}^t{e}^{{\mu }_A(t-\tau )}(∥A∥∥e_s\left(t_k\right)∥+∥E∥∥\omega \left(\tau \right)∥)d\tau \hfill \\ <f(t-t_k)(\gamma ∥A∥\delta +∥E∥{\delta }_{\omega })\hfill \\ =\epsilon (\gamma ∥A∥\delta +∥E∥{\delta }_{\omega })\hfill \end{array}\end{array}$$

(23)

where $f(t-t_k)={\int }_{t_k}^t{e}^{{\mu }_A(t-\tau )}d\tau$ and $\epsilon =\left\{\begin{array}{c}{\Delta }_k,{\mu }_A\le 0\hfill \\ {\displaystyle \frac{1}{{\mu }_A}}(e^{{\mu }_A{\Delta }_k}-1),{\mu }_A>0\hfill \end{array}\right.$.

Because the DDM (9) is periodically validated in the case of a continuous system process, it is necessary to investigate the transmission attempt sequence ${\left\{t_k\right\}}_{k\in {\mathbb{N}}_0}$ to eliminate continuous transmissions within each validation period. Denote the estimation–prediction error by $e_p\left(t\right)=x_s\left(t\right)-x_p\left(t\right)$; then, the dynamic of this error is

$$\begin{array}{c}\hfill {\dot{e}}_p\left(t\right)=A{e}_p\left(t\right)+L\overline{y}\left(t\right)\end{array}$$

(24)

where $\overline{y}\left(t\right)=C{e}_s\left(t\right)+v\left(t\right)$. Since $e_p\left(t_k\right)=0$ for any $t\in [t_k,t_{k+1})$, it yields

$$\begin{array}{c}∥e_p\left(t\right)∥\le ∥L∥{\int }_{t_k}^t{e}^{{\mu }_A(t-\tau )}∥\overline{y}\left(\tau \right)∥d\tau \hfill \\ \le ∥L∥{\int }_{t_k}^t{e}^{{\mu }_A(t-\tau )}d\tau (∥C∥∥e_s\left(t\right)∥+{∥v\left(t\right)∥}_{\infty })\hfill \\ \le \left\{\begin{array}{c}\rho ∥L∥(t-t_k),{\mu }_A\le 0\hfill \\ \rho {\displaystyle \frac{∥L∥}{{\mu }_A}}(e^{{\mu }_A(t-t_k)}-1),{\mu }_A>0\hfill \end{array}\right.\hfill \end{array}$$

where $\rho =\gamma \delta ∥C∥+{\delta }_v$ as in (9); further, it yields that if $t-t_k\ge \underline{\Delta }$ with

$$\begin{array}{c}\hfill \underline{\Delta }=\left\{\begin{array}{c}{\displaystyle \frac{{\sigma }_c}{∥L∥}},{\mu }_A\le 0\hfill \\ {\displaystyle \frac{1}{{\mu }_A}}log({\displaystyle \frac{{\mu }_A{\sigma }_c}{∥L∥}}+1),{\mu }_A>0\hfill \end{array}\right.\end{array}$$

(25)

then for any ${\sigma }_c>0$, the DDM (9) cannot be satisfied if $t\in [t_k,t_k+\underline{\Delta })$.

Remark 2. 

Notice that the threshold part of the mechanism is divided into two items. One influences the stability of the system and is determined by the parameter ${\sigma }_s$. If the selected parameter ${\sigma }_s$ is large, the demand error will be too large compared to the updated data $x_s\left(t\right)$, and the updated data may not stabilize the system. The other parameter is ${\sigma }_c$, which determines the influence of the disturbance and noise to the DDM. The selection of ${\sigma }_c$ directly determines the minimum transmission interval $\underline{\Delta }$, and ${\sigma }_c$ can be chosen based on the quantitative relationship (25).

4. Resilient Control with Unreliable Communication

Notice that when the demand-driven control strategy is designed, the status of the communication is unknown. In other words, the prediction-based control algorithm is a passive resilient scheme. When a DoS attack occurs, the active communication scheduling protocol is another resilient scheme, which is presented in this section. Besides, the stability analysis under DoS attacks is given.

4.1. DoS Attack Model

To extend the application range of resilient control as far as possible, the unreliable communication caused by DoS attacks is considered here, and a general attack model is adopted that restricts the attack behavior by only posing constraints in time on their duration and frequency. Denote ${\left\{d_n\right\}}_{n\in {\mathbb{N}}_0}$ by the DoS off/on transitions sequence with $d_0\ge 0$—that is, the time instant set in which attack behavior turns from zero (communication channel is reliable) to one (transmissions are jammed). The nth DoS time-interval is $D_n=\left\{d_n\right\}\cup [d_n,d_n+{\tau }_n)$, and ${\tau }_n\in \mathbb{R},{\tau }_n\ge 0$ is the length. Then, $D_n$ is a single pulse if ${\tau }_n=0$. Suppose that ${\left\{D_n\right\}}_{n\in \mathbb{N}}$ has no overlap; then, consider an interval $[t,\zeta )$ with $0\le t<\zeta$ and let

$$\begin{array}{c}\hfill \mathcal{D}(t,\zeta )=\underset{n\in {\mathbb{N}}_0}{\cup }{D}_n\cap [t,\zeta )\end{array}$$

(26)

$$\begin{array}{c}\hfill \mathcal{H}(t,\zeta )=[t,\zeta )\setminus \mathcal{D}(t,\zeta )\end{array}$$

(27)

be the subset of time intervals in $[t,\zeta )$ where the network is in attack status and healthy, respectively. Denote $n(t,\zeta )$ by the number of DoS off/on transitions over $[t,\zeta )$. Referring to [10], the following assumptions are proposed to restrict the frequency and duration of DoS attacks.

Assumption A1. 

For any $0\le t<\zeta$, there exist scalars $\kappa \in \mathbb{R},\eta \ge 0$ and ${\tau }_D\in \mathbb{R},{\tau }_D\ge \underline{\Delta }$ such that

$$\begin{array}{c}\hfill n(t,\zeta )\le \kappa +{\displaystyle \frac{\zeta -t}{{\tau }_D}}\end{array}$$

(28)

Assumption A2. 

For any $0\le t<\zeta$, there exist scalars $\varsigma \in \mathbb{R},\varsigma \ge 0$ and $T\in \mathbb{R},T>1$ such that

$$\begin{array}{c}\hfill \left|\mathcal{D}(t,\zeta )\right|\le \varsigma +{\displaystyle \frac{\zeta -t}{T}}\end{array}$$

(29)

Remark 3. 

The frequency and duration assumptions for DoS attacks are necessary. Take into account the worst scenario without the limitations: firstly, if $n(t,\zeta )$ is sufficient large, each transmission attempt may be overridden by attack pulses; secondly, when $\left|\mathcal{D}(t,\zeta )\right|$ is sufficient large, an attack interval may never stop in any given $[t,\zeta )$. In both cases, all the transmissions can be jammed and the scheduling control performance cannot be guaranteed. Besides, the two assumptions can be understood in terms of attack energy. Assume that an attacker having confined energy to carry out attack behaviors is reasonable and the usable energy is proportional to the length of time interval $[t,\zeta )$ with a scale factor. The energy expended by each attack off/on transition is ${\tau }_D$, and for each unit of time, the required energy to sustain an attack execution is T. Furthermore, κ and ς can be considered as regularized scalars.

4.2. Control Update Protocol Under DoS Attacks

Define the first time instant where the DDM is verified to be true after a data communication success at $t_k$ as

$$\begin{array}{c}\hfill {\lambda }_k=inf\{t\in \mathbb{R},t>t_k|∥x_s\left(t\right)-x_p\left(t\right)∥\ge {\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho \}\end{array}$$

(30)

If a data transmission appears in an attack interval $D_n$, the attempt cannot be successful. Define $\mathcal{F}=\{k\in {\mathbb{N}}_0|t_k\in \underset{n\in {\mathbb{N}}_0}{\cup }{D}_n\}$ as the set of integers associated with communication attempts that occur under attack. During the attack intervals, the control strategy of the GU system is converted to a periodic communication protocol—that is, the selected communication attempt period is smaller than or equal to the demand-driven control scheduling interval for the purpose of decreasing the communication delay introduced by the jamming attack. For any $k\in {\mathbb{N}}_0$, the time when that communication attempt occurs is described below:

$$\begin{array}{c}\hfill t_{k+1}=\left\{\begin{array}{c}{t}_k+{\Delta }^{*},ifk\in \mathcal{F}\hfill \\ t_k+\overline{\Delta },ifk\notin \mathcal{F}\vee \overline{\Delta }<{\lambda }_k-t_k\hfill \\ {\lambda }_k,\mathrm{otherwise}\hfill \end{array}\right.\end{array}$$

(31)

where the control update period during the jamming attack intervals is denoted by ${\Delta }^{*}$, which satisfies $0<{\Delta }^{*}\le \underline{\Delta }$.

Remark 4. 

Equation (31) provides the resilient update protocol against the jamming attack behaviors described in Assumptions 1 and 2. If the sensor can receive the ACK signal at $t_k$, then the data transmission at $t_k$ succeeds. Then, the next data transmission will be attempted at ${\lambda }_k$ when $\overline{\Delta }\ge {\lambda }_k-t_k$. If $\overline{\Delta }<{\lambda }_k-t_k$, then the next data transmission will be attempted at $t_k+\overline{\Delta }$. If the ACK signal cannot be received at $t_k$ for the sensor, it indicates that an attack off/on transition appeared before $t_k$, and from $t_k$, the data communication is performed at the periodic update rate appointed by ${\Delta }^{*}$ tentatively until the sensor is able to receive the ACK signal again.

Remark 5. 

The resilience is achieved based on an active and passive combined control scheme. First, the predictor provides predicted values as close as possible to the state of the system when there is no data transmission. In this way, when malicious communication interferences occur and data cannot be transmitted, the predictor can compensate for the missing data, thereby improving resilience to unreliable communications actively. Meanwhile, the resilient update protocol designed in this paper is able to minimize the additional transmission periods caused by communication interruptions, so that the system can resume data transmission as early as possible at the end of the attack. This is a passive resilience improvement method.

Define $\widehat{\mathcal{H}}(t_1,t_2)$ as the union of time subintervals in which the DDM (9) is not held in $[t_1,t_2)$ with $0\le t_1<t_2$—i.e., the union of healthy subintervals in $[t_1,t_2)$—and define the union of valid attack subintervals in which DDM (9) is true as $\widehat{\mathcal{D}}(t_1,t_2)$; then, the disjoint union of $\widehat{\mathcal{H}}(t_1,t_2)$ and $\widehat{\mathcal{D}}(t_1,t_2)$ is the whole interval $[t_1,t_2)$ for any $0\le t_1<t_2$, and $\widehat{\mathcal{D}}(t_1,t_2)=[t_1,t_2)\setminus \widehat{\mathcal{H}}(t_1,t_2)$. Denote

$$\begin{array}{c}\hfill {\rho }_n=\left\{\begin{array}{c}0,if\mathcal{F}=\varnothing \hfill \\ t_{sup\{k\in \mathcal{F}\}}-d_n,otherwise\hfill \end{array}\right.\end{array}$$

(32)

$$\begin{array}{c}\hfill {\Lambda }_n=\left\{\begin{array}{c}0,if\mathcal{F}=\varnothing \hfill \\ {\Delta }_{sup\{k\in \mathcal{F}\}}={\Delta }^{*},otherwise\hfill \end{array}\right.\end{array}$$

(33)

then, ${\widehat{H}}_n=\left\{d_n\right\}\cup [d_n,d_n+{\rho }_n+{\Lambda }_n)$ is the n-th effective attack subinterval. It is worth noting that ${\widehat{H}}_n$ and ${\widehat{H}}_n+1$ may overlap since $d_{n+1}$ may be located in ${\widehat{H}}_n$. For convenience, the two overlapped subintervals can be considered as an incorporative, effective attack interval. Define ${\left\{{\varphi }_m\right\}}_{m\in {\mathbb{N}}_0}$ as the sequence of off/on transitions of the m-th effective attack interval—that is,

$$\begin{array}{c}\hfill {\varphi }_0=d_0,{\varphi }_{m+1}=inf\{d_n>{\varphi }_m|d_n>d_{n-1}+{\rho }_{n-1}+{\Lambda }_{n-1}\}\end{array}$$

(34)

and the length of the m-th effective attack interval is ${\nu }_m={\displaystyle \underset{{\varphi }_m\le d_n<{\varphi }_{m+1}}{\sum _{n\in {\mathbb{N}}_0}}}\left|{\widehat{H}}_n\setminus {\widehat{H}}_{n+1}\right|$; then, $\widehat{\mathcal{D}}(t_1,t_2)={\displaystyle \bigcup _{m\in {\mathbb{N}}_0}}[{\varphi }_m,{\varphi }_m+{\nu }_m)\cap [t_1,t_2)$ and $\widehat{\mathcal{H}}(t_1,t_2)={\displaystyle \bigcup _{m\in {\mathbb{N}}_0}}[{\varphi }_m+{\nu }_m,{\varphi }_{m+1})\cap [t_1,t_2)$. From Assumptions 1 and 2, it can be obtained that the upper bound of the time interval for the impact of an attack is

$$\begin{array}{c}\hfill \begin{array}{c}\left|\widehat{\mathcal{D}}(t_1,t_2)\right|\le \left|\mathcal{D}(t_1,t_2)\right|+(n(t_1,t_2)+1){\Delta }^{\ast }\hfill \\ \le {\varsigma }^{\ast }+{\displaystyle \frac{t_2-t_1}{T^{\ast }}}\hfill \end{array}\end{array}$$

(35)

where ${\varsigma }^{\ast }=\varsigma +(\eta +1){\Delta }^{\ast }$ and ${\displaystyle \frac{1}{T^{\ast }}}={\displaystyle \frac{{\Delta }^{\ast }}{{\tau }_D}}+{\displaystyle \frac{1}{T}}$. The following lemma gives a quantitative characterization of the interval between two successive successful transmissions.

Lemma 1. 

Define ${\left\{z_m\right\}}_{m\in {\mathbb{N}}_0}$ as the time sequence at which the data transmissions succeed. For the communication update protocol as in (31), and considering the DoS attacks satisfying Assumptions 1 and 2, $z_{m+1}-z_m\le \Omega +\overline{\Delta }$ holds for $z_0\le \Omega$, where $\Omega =(\varsigma +\kappa {\Delta }^{\ast }){(1-{\displaystyle \frac{{\Delta }^{\ast }}{{\tau }_D}}-{\displaystyle \frac{1}{T}})}^{-1}$.

Remark 6. 

Inspired by a similar result in [11], the above lemma gives an upper bound on the interval between two successful transmissions with a demand-driven strategy. Since the inner-demand interval is unknown, the time interval between transmission attempts during $D_n$ is also unknown. Fortunately, based on the known upper bound of the communication interval $\overline{\Delta }$, the worst case of the data updates can be bounded. Evidently, ${\displaystyle \frac{1}{T^{\ast }}}<1$ is necessary, and it is the loosest restriction to achieve closed-loop stability under any DoS attacks satisfying Assumptions 1 and 2, as discussed in [11].

According to Lemma 1, (22) and (23) yield the upper bound of the prediction error $e\left(t\right)$ as

$$\begin{array}{c}\hfill {∥e\left(t\right)∥}_{\infty }<\overline{\epsilon }(\gamma ∥A∥\delta +∥E∥{\delta }_{\omega })\end{array}$$

(36)

for any $t\in [z_m,z_{m+1})$, where $\overline{\epsilon }=\left\{\begin{array}{c}\Omega +\overline{\Delta },{\mu }_A\le 0\hfill \\ {\displaystyle \frac{1}{{\mu }_A}}(e^{{\mu }_A(\Omega +\overline{\Delta })}-1),{\mu }_A>0\hfill \end{array}\right.$. It indicates that the prediction error between $x_p\left(t\right)$ and $x\left(t\right)$ is bound even under DoS attacks. By applying (36), we have the main results as the following theorem.

Theorem 1. 

Consider the GU system (3) with a control structure that consists of the observer $\mathcal{O}$ and the predictor $\mathcal{P}r$, the scheduling control input (11), and the DDM (9), and select the parameters such that ${\gamma }_1-{\sigma }_s{\gamma }_2>0$ holds. Under Assumptions 1 and 2, if for any DoS attacks with arbitrary scalars ς, κ, ${\tau }_D$, and T such that

$$\begin{array}{c}\hfill {\displaystyle \frac{{\Delta }^{\ast }}{{\tau }_D}}+{\displaystyle \frac{1}{T}}<1\end{array}$$

(37)

holds, where ${\Delta }^{\ast }$ is a positive constant and satisfies ${\Delta }^{\ast }\le \overline{\Delta }$, then the GU control system is ISS with the periodic update protocol (31).

Proof. 

The proof is provided in Appendix A. □

Remark 7. 

The conservatism of the results in [10,20] results from decomposing the timeline into attack intervals and non-attack intervals. In fact, the attack intervals can also be decomposed into valid attack intervals and invalid attack intervals; the latter are the subintervals where the DDM has not been met—that is, $∥x_s\left(t\right)-x_p\left(t\right)∥<{\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho$. The actual effective attack intervals are the subintervals where the DDM is verified to be true and the data transmissions fail. Due to the unknown time at which the attack behavior’s off/on transition occurs, the conservatism of the resilience cannot be decreased by splitting the timeline. Based on the maximum disturbance–accumulation error, which is calculated from (36), the procedure can be understood in turn as the difference converging from the maximum error to ${\sigma }_s∥x_s\left(t_k\right)∥+{\sigma }_c\rho$ with $k=inf\{k\in \mathcal{F}|t_k\in \underset{n\in {\mathbb{N}}_0}{\cup }{D}_n\}$; in this way, the optimal bound of the tolerable intensity of a DoS attack can be achieved.

5. Simulation Examples

In this section, the GU model constructed in Section 2.1 is applied to validate the resilient control performance of the designed methods. The parameters of the GU system are shown as follows: $f_0=1\mathrm{Hz}$, ${\omega }_0=6.283\mathrm{rad}/\mathrm{s}$, $R_{ij}=1.3\times {10}^{-3}\Omega$, $C_{ti}=62.86\mathrm{F}$, $k_i=0.0435$, $L_{ij}=0.6\mathrm{H}$, $L_{ti}=9.26\times {10}^{-3}\mathrm{H}$, $R_{tj}=1.3\times {10}^{-3}\Omega$. The system matrices of the GU model can be calculated as follows:

$$A=\left[\begin{array}{cccc}-1.3& 2.516& 0.691& 0\\ -2.516& -1.3& 0& 0.691\\ -4.69& 0& -0.14& 6.283\\ 0& -4.69& -6.283& -0.14\end{array}\right],B=\left[\begin{array}{cc}0& 0\\ 0& 0\\ 1.07& 0\\ 0& 1.07\end{array}\right],C=\left[\begin{array}{cccc}1& 0& 0& 0\\ 0& 1& 0& 0\\ 0& 0& 1& 0\\ 0& 0& 0& 1\end{array}\right].$$

In the simulation, the unknown disturbance $\omega \left(t\right)$ is assumed as stochastic signals with a uniform distribution in $[-0.4,0.4]$ and noise $v\left(t\right)$ is $v\left(t\right)=asin\left({\Omega }_y\right),{\Omega }_y\in [0,2\pi ]$, where a is a stochastic number with a uniform distribution bounded in $[0,0.2]$. The initial conditions are $x\left(0\right)=x_p\left(0\right)={[0.8,-1,0,0.3]}^T$. The control objective is to track the reference signal ${[0.08-0.09-0.12-0.63]}^T$. Selecting $\lambda =5.97$, the gain matrices of observer and controller can be calculated by solving the LMIs (7) and (12) as follows:

$$L=\left[\begin{array}{cc}0.5755& 0.5755\\ -0.1981& 3.8506\\ 1.1000& -3.8657\\ -5.5976& -6.8427\end{array}\right],K=\left[\begin{array}{cccc}0.0630& -0.2771& -0.3848& -0.0003\\ 0.2788& 0.1109& -0.0003& -0.3278\end{array}\right].$$

The relative parameters can be obtained such that $∥{\Phi }_2∥=8.1528$, ${\alpha }_1=1.4768$, ${\alpha }_2=0.3375$, ${\gamma }_1=1$, ${\gamma }_2=1.4976$, and ${\gamma }_3=2.9536$. Thus ${\sigma }_s$ has to be chosen such that ${\sigma }_s<0.6677$. Setting ${\sigma }_s=0.66$, and $\overline{\Delta }=0.5s$ and $\underline{\Delta }=0.01$ s, the demand-driven parameter ${\sigma }_c$ is chosen as ${\sigma }_c=0.004$. When there are no DoS attacks, the state responses of the controlled system, the evolution of the transmission times, and the demand-driven conditions $∥x_s\left(t\right)-x_c\left(t\right)∥$ and ${\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho$ are exhibited in Figure 3 and Figure 4, respectively. From the above figures, it is obvious that the demand-driven control algorithm is able to ensure that the state responses of the GU system track the reference values while the number of network transmissions is decreased significantly. From Figure 4, when the demand (black) exceeds the transmission condition (red), the data are transmitted over the network (such as at 9.8 s). The black line quantifies the information difference between the controller side and the sensor side, which represent the control requirements in real application scenarios. The red line quantifies the acceptable demand threshold. If the information difference does not exceed the threshold, it indicates that the impact of the difference on system performance during actual application is tolerable, and no data transmission is required.

When DoS attacks occur, the transmission protocol is provided in (31), and the transmission attempt period is ${\Delta }_{\ast }=0.01$ s. In the simulation time domain of 15 s, the DoS attack is executed randomly and satisfies $n(0,15)=12$ and $\left|\mathcal{D}(0,15)\right|=10.93$ s. According to the duration and frequency of the attack, we have ${\tau }_D\approx 1.25$ and $T\approx 1.372$; then, ${\displaystyle \frac{{\Delta }^{\ast }}{{\tau }_D}}+{\displaystyle \frac{1}{T}}\approx 0.737$. Then, the state responses of the closed-loop GU system, the evolution of the transmission times, and the demand-driven condition $∥x_s\left(t\right)-x_p\left(t\right)∥$ and ${\sigma }_s∥x_s\left(t\right)∥+{\sigma }_c\rho$ are exhibited in Figure 5, Figure 6 and Figure 7, respectively. Finally, the control input of the GU model is given in Figure 8.

From Figure 5, it can be observed that the states of the GU model can also track the reference values under DoS attacks. However, compared with Figure 3 and Figure 5, it is shown that the time it takes for the wave of states under DoS attacks to end is significantly longer than that without DoS attacks, which indicates the influence of the DoS attacks to the networked control strategy. As can be observed from Figure 6 and Figure 7, the demand-driven algorithm still works, and the transmission attempts succeed during the no-attack intervals when the demand exceeds the transmission condition (such as at 6.07 s) while the transmission mode switches to periodic attempts during the attack intervals (such as 10.52 s). As can be seen from the above figures, the demand-driven control scheme also has a certain potential resilience in practical applications. For instance, from Figure 7, it can be seen that the DoS attacks before the demand (black) exceeds the threshold (red) are invalid. In these intervals, there is no transmission attempt, which can be observed in Figure 6 before 10.52 s.

6. Conclusions

This paper focuses on the secure control problem for the GU of a local power plant under unreliable communication, and the demand-driven control strategy has been investigated. The unreliable communication in consideration is caused by DoS attacks, and the resilient control algorithm is designed to handle the problem of performance degradation in this scenario. An $H_{\infty }$ observer-based prediction method is provided, and the DDM is designed based on the error between the state estimation and prediction. In this way, the communication resources are saved while the ideal scheduling control performance is obtained. Based on the ISS analysis, the sufficient conditions on the DoS attack model are provided to ensure the stability of the GU system. Finally, simulation results were presented to demonstrate the effectiveness of the designed methods.

The technical novelties are summed up as follows: First, the $H_{\infty }$ observer-based prediction method is able to remove the influence of unknown load currents to the system and compensate the loss of state data in the interval between any two continuous transmissions of scheduling signals. Second, the advanced demand-driven strategy with periodic verification is presented to schedule the intermittent communication. Third, by using the thought of robustness to the maximum disturbance-induced error, the conservatism of the tolerable attack intensity is decreased.