A Blockchain-Augmented CPS Framework to Mitigate FDI Attacks and Improve Resiliency

Abstract

The integration of blockchain technology into Cyber–Physical Systems (CPS) offers decentralized resilience against data manipulation. This also introduces stochastic consensus latencies that threaten real-time control stability. We present a Stochastic-Aware Blockchain Predictive Control (SAB-PC) framework, which models blockchain-induced jitter as a state-dependent Markovian process, and embeds it within a Markovian Jump Linear System (MJLS) formulation. Using mode-dependent Linear Matrix Inequalities (LMIs), we derive Mean Square Stability (MSS) conditions, which capture the interaction between decentralized consensus dynamics and closed-loop control behavior. The framework is validated on the Tennessee Eastman Process (TEP) benchmark, using a calibrated stochastic delay model that reflects realistic blockchain congestion patterns. Our results show that standard blockchain-mediated control architectures become unstable under Practical Byzantine Fault Tolerance (PBFT)-induced quadratic latency growth, whereas SAB-PC maintains stable operation across decentralized networks up to 60 validator nodes. The predictive Safety Runway effectively masks long-tail delay distributions, ensuring real-time feasibility and preserving safe Reactor Pressure trajectories. Under coordinated False Data Injection (FDI) attacks, SAB-PC limits pressure deviations to only 1.2 kPa despite an 8.0 kPa adversarial bias, demonstrating cryptographic and control-theoretic resilience.

1. Introduction

1.1. Background and Motivation

The advent of Industry 4.0 has accelerated the transformation of traditional industrial processes into Networked Control Systems (NCSs) [1,2,3,4], where computation, communication, and physical dynamics are tightly integrated. While this convergence enables unprecedented levels of automation and operational efficiency, it simultaneously enlarges the cyber attack surface of industrial plants.

Among the most disruptive threats are False Data Injection (FDI) attacks, which compromise sensor integrity by manipulating measurement streams [5,6,7,8,9], and Denial-of-Service (DoS) attacks, which exploit network vulnerabilities to induce packet losses, timing violations, and ultimately destabilize the closed-loop system [10,11,12].

Parallel advances in machine learning have demonstrated the growing feasibility of data-driven modeling and prediction in safety-critical dynamical systems. Recent work in nonlinear population dynamics [13] illustrates how learning-based models can capture complex temporal behavior and support predictive decision making. These developments underscore a broader trend, as industrial systems become increasingly interconnected and data-centric, their resilience depends not only on accurate prediction but also on secure and trustworthy control architectures.

Conventional Cyber–Physical Systems (CPS) typically rely on centralized security mechanisms, which introduce a structural single point of failure. If the supervisory controller or communication hub is compromised, the integrity of the entire physical process is jeopardized. Blockchain technology has therefore emerged as a compelling decentralized alternative, offering an immutable and distributed ledger that enhances data integrity, auditability, and tamper resistance.

However, despite its security advantages, blockchain consensus introduces stochastic and often bursty latency, an aspect frequently overlooked in cybersecurity-oriented studies. These delays pose a fundamental challenge to real-time control stability, particularly in fast industrial loops where timing guarantees are essential.

1.2. Related Works

Research at the intersection of advanced control, cybersecurity, and decentralized computation has expanded rapidly, yet existing efforts remain fragmented across control-theoretic, blockchain-centric, and machine learning-based perspectives. Early work in intelligent control demonstrated the importance of feedback-aware stability mechanisms in safety-critical domains such as autonomous driving, where lateral error feedback analysis improves robustness under dynamic operating conditions [14]. While these studies highlight the value of adaptive control strategies, they do not consider the timing variability introduced by decentralized consensus protocols.

At the protocol level, the Ethereum Yellow Paper [15] formalizes opcode-level execution costs and gas-dependent latency, revealing that consensus delay is shaped not only by network congestion but also by low-level virtual machine semantics. Despite this, most blockchain-enabled CPS frameworks abstract the ledger as a static communication channel and overlook the stochastic, state-dependent nature of consensus latency.

The first wave of blockchain-in-the-loop control studies focused primarily on feasibility. Proof-of-Authority (PoA) consensus was shown in [16] to support secondary microgrid control, demonstrating that permissioned blockchains can meet millisecond-scale timing requirements. Similarly,  ref. [17] employed smart contracts to decentralize Engineering Change Orders (ECOs) in industrial shop floor systems. Although these works validate the architectural potential of blockchain-mediated control, they assume constant or negligible delay and therefore fail to capture the bursty, mode-dependent jitter observed in real decentralized networks.

To address latency, the Cyber–Authentic–Physical System (CAPS) framework [18,19] introduced Networked Predictive Control (NPC) to transmit sequences of future control inputs, thereby masking communication delays. While CAPS represents an important step toward delay-aware blockchain control, it relies on bounded-interval delay assumptions and does not model the Markovian temporal correlation of network states, leading to conservative or inaccurate stability guarantees under persistent congestion.

Parallel to these developments, machine learning-based intrusion detection has gained traction for cyber threat mitigation. Multi-Head Self-Attention Long Short-Term Memory (MHSA-LSTM) architectures have been applied to early ransomware detection [20], and cognitive–physiological synchronization has been explored for adaptive Internet of Things (IoT) defense [21]. Although effective for anomaly recognition, these approaches lack deterministic guarantees and remain vulnerable to adversarial manipulation, making them insufficient for real-time industrial CPS.

Blockchain has also been leveraged as a tamper-proof audit layer. Data-driven observers in [22] detect inconsistencies between predicted and received sensor data, while heuristic anomaly detectors [23,24] attempt to identify malicious perturbations.

However, these methods treat the ledger as a passive storage mechanism and do not enforce opcode-level execution integrity, leaving the control logic itself exposed to manipulation.

Beyond protocol-specific studies, recent work on the topology and geometry of the Ethereum transaction graph [25] reveals that decentralized ledgers exhibit highly non-uniform structural and congestion patterns. These findings underscore the need for control-aware models that explicitly incorporate stochastic, state-dependent latency, an aspect largely absent from existing blockchain-enabled control frameworks.

1.3. Gaps in Literature and Problem Statement

Despite growing interest in blockchain-enabled CPS, the literature lacks a unified treatment that couples decentralized consensus dynamics with control-theoretic stability guarantees. Several critical gaps motivate the development of the SAB-PC framework.

The first limitation arises from the treatment of blockchain latency. Foundational studies such as [26,27] model block generation time as a fixed or deterministic parameter, effectively assuming that consensus delay is a constant overhead. This abstraction overlooks the bursty, mode-dependent jitter that characterizes real decentralized networks.

More recent efforts in [28] incorporate delays into robust control formulations; however, these models restrict latency to a bounded interval, and fail to capture the temporal correlation of congestion events, which often cluster and produce prolonged periods of degraded performance.

A second gap concerns architectural assumptions. Many blockchain–CPS frameworks adopt a black-box design in which the ledger serves only as a supervisory or logging layer [29,30]. In these architectures, the controller remains network-blind; it neither adapts to consensus-layer conditions nor receives timing-aware feedback from the blockchain. As a result, the control loop implicitly assumes a passive communication channel, an assumption violated by decentralized networks whose latency depends on validator behavior, message complexity, and adversarial activity.

Third, existing security-oriented approaches rely heavily on machine learning-based anomaly detection. While effective for pattern recognition, these methods introduce new attack surfaces. Studies such as [23,24] show that gradient-based adversarial perturbations can blind Artificial Intelligence (AI) classifiers, enabling stealthy FDI attacks. Even advanced sensing frameworks, including MHSA-LSTM ransomware detection [20] and cognitive–physiological synchronization for IoT defense [21], lack deterministic guarantees and cannot ensure safety under worst-case timing or adversarial conditions.

Although Markovian Jump Linear Systems (MJLS) offer a powerful framework for modeling stochastic switching behavior, with extensive results in filtering [31], asynchronous output feedback control [32], and policy optimization [33], these works assume that mode transitions arise from intrinsic system dynamics or exogenous stochastic processes with well-defined statistical properties. Blockchain-enabled NCSs, however, exhibit switching behavior driven by decentralized consensus processes, congestion bursts, validator churn, and protocol-level execution delays. These transitions are neither independent nor memoryless, and they violate the classical assumptions underlying standard MJLS formulations.

Finally, recent analyses of Ethereum’s topology and transaction graph geometry [25] reveal highly non-uniform structural and congestion patterns, reinforcing the need for control-aware models that explicitly incorporate state-dependent and temporally correlated latency. Yet no existing blockchain control architecture integrates these insights into a stability-certifiable control framework.

The core problem addressed in this work is the absence of a control-theoretic framework that performs the following:

1.

Models blockchain-induced latency as a mode-dependent MJLS process with temporally correlated congestion states driven by decentralized consensus dynamics.

2.

Characterizes the impact of consensus-driven switching on closed-loop stability, particularly for fast industrial processes where timing violations can trigger catastrophic failures.

3.

Provides computable Mean Square Stability (MSS) guarantees under protocol-induced delay patterns, including long-tail congestion, validator set scaling, and adversarial network conditions.

Existing MJLS theory does not account for consensus jitter, validator-induced slowness, or opcode-level execution costs. Likewise, existing blockchain-enabled control architectures do not incorporate stochastic delay models or mode-aware compensation strategies. This work bridges these gaps by developing a stochastic, delay-aware predictive control framework that explicitly couples blockchain consensus physics with plant-level stability requirements.

1.4. Contributions

This work introduces a mathematically grounded and control-theoretic framework for blockchain-enabled CPS, addressing how decentralized consensus dynamics interact with real-time control stability. By modeling blockchain latency as a stochastic, mode-dependent process and integrating it into a predictive control architecture, the proposed SAB-PC framework provides deterministic safety guarantees that are absent from existing blockchain-mediated control approaches. The key contributions are summarized as follows:

• We develop a control-theoretic model that represents blockchain-induced jitter as a state-dependent Markovian Jump Linear System (MJLS), to capture temporal congestion clustering, latency inertia across network modes, and adversarial or stress-induced delay spikes. This enables a realistic representation of decentralized consensus dynamics within the closed-loop control model.
• We derive a Mean Square Stability (MSS) criterion using a mode-dependent Stochastic Lyapunov–Krasovskii functional. The resulting coupled Linear Matrix Inequalities (LMIs) provide a computable bound on the maximum tolerable consensus slowness, ensuring stability even when the blockchain delay exceeds the sampling interval. This establishes a stability certificate for blockchain-enabled NCS under stochastic, protocol-driven switching.
• We introduce a predictive Safety Runway, implemented as an actuator-side Smart Buffer that decouples the control execution frequency from consensus-layer variability.
• We design a deterministic verification layer that enforces the opcode-level integrity of the control law using Merkle-proof validation. The Ethereum Virtual Machine (EVM) verifies only the Merkle root once per prediction horizon, while the actuator performs lightweight per-step proof checks locally. This hybrid strategy provides cryptographic protection against tampering, negligible computational overhead, and a strong resilience to coordinated FDI attacks.

The remainder of this paper is structured to provide a comprehensive analysis of the proposed framework, from theoretical derivation to empirical validation. In Section 2, we establish the mathematical foundation of the CPS, modeling the blockchain-induced delays as a stochastic process. Section 3 details the SAB-PC architecture, introducing the predictive buffer mechanism and the derivation of the MSS criteria through mode-dependent Linear Matrix Inequalities (LMI). The empirical performance of the framework is evaluated in Section 4, where we provide a numerical verification using the TEP benchmark and discuss the security–performance trade-offs observed under various network conditions. Finally, Section 5 summarizes our findings and outlines potential avenues for future research in decentralized industrial control.

2. Model

2.1. Physical System Dynamics

We consider a class of discrete-time linear time-invariant (LTI) systems that characterize the behavior of modern industrial processes and microgrid components [34]. The state-space representation is

$$x(k+1)=Ax\left(k\right)+Bu\left(k\right)+\omega \left(k\right),$$

(1)

where $x\left(k\right)\in {\mathbb{R}}^n$ denotes the system state, $u\left(k\right)\in {\mathbb{R}}^m$ is the control input, and $\omega \left(k\right)$ is zero-mean Gaussian process noise with covariance $Q_{\omega }=\mathbb{E}\left[\omega \left(k\right){\omega }^T\left(k\right)\right]$.

2.2. Stochastic Blockchain Delay Modeling

Blockchain-induced latency ${\tau }_k$ is modeled as a discrete, non-deterministic variable, in contrast to the Gaussian approximations commonly used in traditional NCS [35,36,37]. The total delay is decomposed into three physical components:

$$\tau \left({\sigma }_k\right)={\tau }_{prop}+{\tau }_{cons}\left(n\right)+{\tau }_{final}.$$

(2)

2.2.1. Propagation Delay

The propagation delay ${\tau }_{prop}$ captures multi-hop dissemination of control packets:

$${\tau }_{prop}=\sum _{h=1}^H\left({\displaystyle \frac{S_{tx}}{B{W}_h}}+d_{prop,h}+d_{proc,h}\right),$$

(3)

where $S_{tx}$ is the packet size, $B{W}_h$ is the per-hop bandwidth, and $d_{prop,h}$ and $d_{proc,h}$ denote propagation and processing delays.

2.2.2. Consensus Delay

The consensus delay ${\tau }_{cons}\left(n\right)$ reflects the communication complexity of Byzantine Fault Tolerance (BFT)-style protocols (PBFT and PoA), which scale quadratically with the validator count n:

$${\tau }_{cons}\left(n\right)\approx {\kappa }_{1}n+{\kappa }_2{n}^2,$$

(4)

where ${\kappa }_1$ and ${\kappa }_2$ depend on network topology and the validator processing capacity.

2.2.3. Finalization Delay

The finality delay ${\tau }_{final}$ depends on the consensus mechanism, as follows:

• Deterministic finality (BFT/PoA): ${\tau }_{final}\approx {\delta }_{db}$, where ${\delta }_{db}$ is the local commit time.
• Probabilistic finality (Proof of Service(PoS)/Proof of Work (PoW)): ${\tau }_{final}=C\times {\overline{T}}_{block},$ where C is the confirmation depth ensuring an adversarial success probability below the threshold $ϵ$ for an attacker with the resource fraction q:

  $$P(C,q)=1-\sum _{k=0}^C{\displaystyle \frac{{\left(C\lambda \right)}^k{e}^{-C\lambda }}{k!}}\left(1-{(q/p)}^{C-k}\right)<ϵ.$$

  (5)

2.2.4. Markovian Discretization

The continuous-time delay components are mapped to discrete steps relative to the sampling period $T_s$:

$$\tau \left({\sigma }_k\right)=⌈{\displaystyle \frac{{\tau }_{prop}+{\tau }_{cons}\left(n\right)+{\tau }_{final}}{T_s}}⌉.$$

(6)

To capture temporal correlation in congestion patterns, delays are assigned to Markovian modes $i\in \mathcal{S}$:

$$d_i=\mathbb{E}\left[\left.⌈{\displaystyle \frac{{\tau }_{prop}+{\tau }_{cons}\left(n\right)+{\tau }_{final}}{T_s}}⌉\right|{\sigma }_k=i\right].$$

(7)

Mode transitions follow the probability matrix $\mathrm{\Pi }$, with the residence time $T_i={(1-{\pi }_{ii})}^{-1}$ quantifying congestion persistence.

Remark 1.

All blockchain-induced delays in this work are generated from a calibrated stochastic model rather than a live blockchain deployment. The delay components in (2)–(7) are derived from empirical measurements reported in prior studies of BFT-style consensus protocols [38,39,40,41,42,43], enabling realistic end-to-end latency characterization without executing physical blockchain nodes.

2.2.5. Markovian State Representation

The stochastic evolution of blockchain-induced congestion is modeled as a discrete-time Markov chain $\{{\sigma }_k,k\ge 0\}$ defined on the finite mode set $\mathcal{S}=\{1,\dots ,N\}$. Each mode $i\in \mathcal{S}$ corresponds to a quantized delay value $d_i\in {\mathbb{Z}}^{+}$, representing the number of sampling periods $T_s$ required for consensus and finalization. The transition dynamics follow the probability matrix $\mathrm{\Pi }=\left[{\pi }_{ij}\right]$:

$${\pi }_{ij}=P({\sigma }_{k+1}=j\mid {\sigma }_k=i),\sum _{j=1}^N{\pi }_{ij}=1.$$

(8)

This state-dependent delay determines which predicted control input is retrieved from the actuator-side buffer, linking the blockchain congestion state directly to the applied control action.

2.2.6. Markovian Delay Characteristics

Blockchain consensus latency is inherently state dependent [44,45,46,47]. Protocols such as PBFT and PoA exhibit delay variations driven by network traffic, validator availability, and adversarial stress. These effects are captured by the same finite-state Markov chain $\left\{{\sigma }_k\right\}$ defined above, where each mode represents an operational regime ranging from low-latency nominal operation to high-latency congestion or adversarial conditions.

Congestion persistence is reflected in the diagonal dominance of $\mathrm{\Pi }$ (${\pi }_{ii}\gg {\pi }_{ij}$), indicating that once the network enters a high-latency regime, it is likely to remain there for multiple sampling periods.

The SAB-PC controller uses $T_i$ to anticipate prolonged delays and adjust the mode-dependent gain $K_{{\sigma }_k}$ before the predictive buffer is depleted.

Transitions between modes modify the effective delay $\tau \left({\sigma }_k\right)$ and thus the closed-loop spectral properties. Low-latency modes minimize $\tau \left({\sigma }_k\right)$, while transitions to higher-indexed modes introduce long-tail settlement delays such as ${\tau }_{final}$, extending the delay distribution. Incorporating the transition probabilities ${\pi }_{ij}$ into the stability analysis yields a probabilistic MSS guarantee, ensuring robustness to the long-tail delays characteristic of decentralized consensus protocols [45,46].

2.2.7. Delayed Control Law

The control input applied at time k is retrieved from the predictive sequence that completed the consensus verification at time $k-d_{{\sigma }_k}$. The delayed control law is

$$u\left(k\right)=u(k\mid k-d_{{\sigma }_k}),$$

(9)

where $u(k\mid k-d_{{\sigma }_k})$ denotes the $d_{{\sigma }_k}$-step-ahead prediction generated at time $k-d_{{\sigma }_k}$. Substituting (9) into the plant dynamics (1) yields an MJLS, enabling a stability analysis that explicitly accounts for consensus-induced, mode-dependent delays.

2.3. Modeling Assumptions

To ensure both mathematical tractability and practical relevance, the following assumptions are adopted.

Assumption 1.

The pair $(A,B)$ is controllable. This guarantees the existence of a stabilizing control law even under stochastic, mode-dependent delays.

Assumption 2.

The blockchain network satisfies the BFT condition: for a validator set of size n, the number of faulty or malicious nodes f obeys $n\ge 3f+1$. This ensures the consensus layer’s safety.

Assumption 3.

All sensor measurements and control packets are authenticated using an Elliptic Curve Digital Signature Algorithm (ECDSA). Private keys are stored in a Hardware Security Module (HSM), making packet spoofing or external Man-in-the-Middle (MITM) attacks computationally infeasible. Under a Byzantine fault model, compromised but authenticated nodes may inject malicious data; in such cases, protection against FDI relies on BFT consensus and model-based consistency checks.

Assumption 4.

Nodes in the Authentic Layer are synchronized via Precision Time Protocol (PTP), enabling accurate timestamping for computing the mode-dependent delay $\tau \left({\sigma }_k\right)$.

2.4. Predictive Compensation and Latency Masking

The SAB-PC framework co-designs predictive control with decentralized consensus dynamics. The blockchain-induced latency is modeled as a state-dependent Markovian delay $d_{{\sigma }_k}$, where ${\sigma }_k\in \mathcal{S}$ denotes the network mode.

At each sampling instant k, the controller generates a sequence of future control inputs:

$${\mathbf{U}}_k=\{u\left(k\right|k),u(k+1|k),\dots ,u(k+L|k)\},$$

(10)

where L is the predictive horizon. The sequence is cryptographically signed and submitted to the blockchain. After verification, the actuator retrieves the most recent available sequence from the Smart Buffer and applies the delayed control law in (9). This mechanism decouples the plant’s execution rate from the stochastic consensus frequency, ensuring continuity of actuation even when $d_{{\sigma }_k}>1$.

2.5. Stochastic Stability via MJLS Reformulation

To analyze stability under mode-dependent delays, the closed-loop system is reformulated as a MJLS. We define the augmented state vector as follows:

$$\eta \left(k\right)={[x^T\left(k\right),u^T(k-1),\dots ,u^T(k-d_{max})]}^T\in {\mathbb{R}}^{n+m{d}_{max}},$$

(11)

where $d_{max}$ is the maximum admissible delay. The system evolves according to

$$\eta (k+1)=\mathcal{A}\left({\sigma }_k\right)\eta \left(k\right)+\mathcal{B}\left({\sigma }_k\right)w\left(k\right),$$

(12)

with $\mathcal{A}\left({\sigma }_k\right)$ denoting the mode-dependent transition matrix. MSS is ensured if there exist symmetric positive-definite matrices $P_i$ such that, for all $i\in \mathcal{S}$,

$${\mathcal{A}}_i^T\left(\sum _{j=1}^N{\pi }_{ij}{P}_j\right){\mathcal{A}}_i-P_i<0,$$

(13)

where ${\pi }_{ij}$ is the transition probability between the congestion regimes.

2.6. Byzantine Resilience and Integrity Bound

The SAB-PC framework leverages BFT consensus to ensure control signal integrity. The probability of maintaining untampered control data satisfies

$$Pr\left(\mathrm{Data}\mathrm{Integrity}\right)\ge 1-P(\mathrm{Byzantine}\mathrm{Failure}\mid n,f),$$

(14)

with $n\ge 3f+1$. This bound guarantees that any malicious bias, $\delta \left(k\right)$, injected by up to f compromised validators is rejected during consensus, preserving the integrity of the predictive sequence in (10) before it enters the actuator buffer.

3. Method

This section presents the co-design strategy through which the control layer proactively compensates for the stochastic consensus jitter introduced by the blockchain layer.

3.1. Blockchain-Based Networked Predictive Control (BNPC)

A key challenge in blockchain-enabled control is that the delay ${\tau }_k$ is unknown at the time the control input is computed. To ensure that the actuator always has access to a valid, verified command, we adopt an NPC strategy. At each sampling instant k, the controller generates a sequence of future control inputs in (10), where L is chosen to satisfy $L>max\left({\tau }_k\right)$. The sequence is cryptographically signed and broadcast to the blockchain as a single transaction.

Smart Buffer Mechanism

Once the blockchain finalizes the block containing (10), the actuator stores the validated sequence in a Smart Buffer. Because the delay is governed by the Markovian mode ${\sigma }_k$, the actuator retrieves the control input corresponding to the appropriate prediction index:

$$u\left(k\right)=u(k\mid k-\tau \left({\sigma }_k\right))=K_{{\sigma }_k}x(k-\tau \left({\sigma }_k\right)),$$

(15)

where $K_{{\sigma }_k}$ is the mode-dependent gain associated with the current network state. This mechanism ensures that the actuator applies a temporally consistent control input even when $\tau \left({\sigma }_k\right)$ varies stochastically.

Algorithm 1 integrates three components: the controller generates and signs a predictive sequence, the blockchain introduces a mode-dependent delay $\tau \left({\sigma }_k\right)$ before validation and the actuator retrieves the correct prediction index from the Smart Buffer. The Markov chain governing ${\sigma }_k$ evolves according to $\mathrm{\Pi }$, capturing the temporal correlation of congestion and shaping the closed-loop dynamics.

Algorithm 1 Stochastic-Aware Blockchain Predictive Control (SAB-PC)

1: Initialize: Plant matrices $A,B$, horizon L, transition matrix $\mathrm{\Pi }$, Smart Buffer $\mathcal{B}$. 2: for $k=1,\dots ,T$ do 3:     Controller: Measure $x\left(k\right)$ and compute (10). 4:     Sign and broadcast (10) to the blockchain. 5:     Blockchain: Reach consensus with delay $\tau \left({\sigma }_k\right)$. 6:     Update $\mathcal{B}$ with validated ${\mathbf{U}}_{k-\tau \left({\sigma }_k\right)}$. 7:     Actuator: Retrieve $u\left(k\right)=\mathcal{B}.\mathrm{get}\left(u\left(k\right|k-\tau \left({\sigma }_k\right))\right)$. 8:     Apply $u\left(k\right)$ to the plant. 9:     Update: Transition ${\sigma }_{k+1}$ via $\mathrm{\Pi }$ and compute $x(k+1)$. 10: end for

3.2. Parameterization of System Dynamics via Node Count

To link network physics with control-theoretic stability, the mode-dependent transition matrix ${\mathcal{A}}_{{\sigma }_k}$ is parameterized by the physical network variables $\mathrm{\Theta }=\{n,B{W}_h,h,S_{tx}\}$. The validator count n determines the consensus latency ${\tau }_{cons}\left(n\right)$, which scales quadratically for BFT-style protocols, $\mathcal{O}\left(n^2\right)$.

The mode-dependent operator ${\mathcal{A}}_i\left(d_i\right)$ is determined by the delay $d_i\left(n\right)$ obtained from the quantization in (7). The augmented dynamics follow the vector-recursive structure:

$$\left\{\begin{array}{c}x(k+1)=Ax\left(k\right)+Bu(k-d_i\left(n\right)),\hfill \\ u(k-j+1)=u(k-j),j=1,\dots ,d_i,\hfill \end{array}\right.$$

(16)

which corresponds to the augmented state representation in (11). As n increases, the consensus complexity $\mathcal{O}\left(n^2\right)$ enlarges the delay index $d_i\left(n\right)$, expanding the dimension of the augmented state and shifting the control input deeper into the delay chain. This structural expansion increases the spectral radius $\rho \left({\mathcal{A}}_{cl}\right)$ and reduces the feasibility region of the stability LMIs. The resulting closed-loop system is a discrete-time MJLS whose mode-dependent matrices are directly grounded in the consensus-layer performance through the mapping in (7).

Theorem 1.

Consider the discrete-time LTI system under the SAB-PC framework with augmented dynamics

$$\eta (k+1)={\mathcal{A}}_{{\sigma }_k}\eta \left(k\right)+\overline{\omega }\left(k\right),$$

(17)

where $\eta \left(k\right)$ is the augmented state vector defined in (11), and ${\mathcal{A}}_i$ is the mode-dependent transition matrix determined by the blockchain-induced delay $d_i$ from (7). The closed-loop system is MSS if there exist symmetric positive-definite matrices $P_i>0$ such that, for each mode $i\in \mathcal{S}$,

$$\left[\begin{array}{cc}-P_i& {\mathcal{A}}_i^T{\overline{P}}_i\\ {\overline{P}}_i{\mathcal{A}}_i& -{\overline{P}}_i\end{array}\right]<0,$$

(18)

where ${\overline{P}}_i={\sum }_{j=1}^N{\pi }_{ij}{P}_j$.

Proof. 

Define the mode-dependent stochastic Lyapunov function

$$V({\eta }_k,{\sigma }_k=i)={\eta }^T\left(k\right)P_i\eta \left(k\right),$$

(19)

with $P_i=P_i^T>0$ for all $i\in \mathcal{S}$. The structure of ${\mathcal{A}}_i$ incorporates the delay $d_i$ arising from the consensus-layer dynamics described in Section 2.2, including the $\mathcal{O}\left(n^2\right)$ PBFT complexity and multi-hop propagation effects.

For MSS, the expected Lyapunov decrement must satisfy

$$\mathbb{E}[\Delta V]=\mathbb{E}[V({\eta }_{k+1},{\sigma }_{k+1})\mid {\eta }_k,{\sigma }_k=i]-V({\eta }_k,i)<0.$$

(20)

Ignoring noise for stability boundary analysis and substituting $\eta (k+1)={\mathcal{A}}_i\eta \left(k\right)$ yields

$$\mathbb{E}\left[V(k+1)\right]={\eta }^T\left(k\right){\mathcal{A}}_i^T\left(\sum _{j=1}^N{\pi }_{ij}{P}_j\right){\mathcal{A}}_i\eta \left(k\right).$$

(21)

Letting ${\overline{P}}_i={\sum }_{j=1}^N{\pi }_{ij}{P}_j$, the MSS condition from [48] becomes

$${\eta }^T\left(k\right)\left({\mathcal{A}}_i^T{\overline{P}}_i{\mathcal{A}}_i-P_i\right)\eta \left(k\right)<0,$$

(22)

which holds for all nonzero $\eta \left(k\right)$ if and only if

$${\mathcal{A}}_i^T{\overline{P}}_i{\mathcal{A}}_i-P_i<0.$$

(23)

Applying the Schur complement yields the LMI in (18). Since ${\overline{P}}_i$ is a convex combination of $\left\{P_j\right\}$ and each $P_j>0$, the feasibility of the coupled LMIs ensures that

$$\rho \left(\mathbb{E}\left[{\mathcal{A}}_{{\sigma }_k}\right]\right)<1,$$

(24)

establishing MSS under stochastic, mode-dependent blockchain-induced delays.    □

Remark 2.

The SAB-PC framework ensures the integrity of the mode-dependent control law $K_{{\sigma }_k}$ through Merkle proof verification. Let $\mathcal{H}\left(K_i\right)$ denote the cryptographic hash of the control law in mode i. The actuator executes $u\left(k\right)$ only if

$$\mathit{Verify}({\mathit{Root}}_B,{\mathit{Proof}}_k,\mathcal{H}\left(u_k\right))=\mathit{True}.$$

(25)

This guarantees that even if an adversary compromises local controller memory, the actuator applies only control inputs whose opcode-level integrity is validated against the on-chain Merkle root. Consequently, stealthy FDI attacks that evade residual-based AI detectors cannot alter the physical control action.

3.3. Adversarial Robustness and FDI Mitigation

The SAB-PC framework provides adversarial robustness through a dual-layer defense architecture that separates cryptographic verification from real-time control execution. This ensures that both external and insider threats are mitigated while preserving closed-loop stability.

3.3.1. Adversary Model and FDI Characterization

We consider a Byzantine adversary capable of intercepting, modifying, or injecting packets. In a traditional NCS, an FDI attack alters the control input as

$$u_{\mathrm{attack}}\left(k\right)=u\left(k\right)+\delta \left(k\right),$$

(26)

where $\delta \left(k\right)$ is a malicious bias designed to steer the state $x\left(k\right)$ toward an unsafe set ${\mathcal{X}}_{unsafe}$ while remaining stealthy to residual-based detectors [49].

3.3.2. Cryptographic Filtering and BFT Integrity

The SAB-PC framework mitigates such attacks through layered authentication and consensus validation. Each predictive sequence in (10) is signed using ECDSA, and the blockchain network verifies the signature before committing the sequence to the ledger:

$$\mathcal{V}(pk,{\mathbf{U}}_k,{\sigma }_{\mathrm{sig}})=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}\mathit{Verify}(pk,\mathbf{H}\left({\mathbf{U}}_k\right),{\sigma }_{\mathrm{sig}})=\mathit{True},\hfill \\ 0,\hfill & \mathrm{otherwise},\hfill \end{array}\right.$$

(27)

where $\mathbf{H}(·)$ is a Secure Hash Algorithm (SHA)-3 hash. Any modification where $\delta \left(k\right)\ne 0$ invalidates the signature, causing the P2P layer to drop the packet.

To inject a forged sequence into the ledger, an adversary must compromise a subset M of validators. The BFT consensus guarantees safety as long as

$$\left|M\right|\le f=⌊{\displaystyle \frac{n-1}{3}}⌋,$$

(28)

ensuring that only legitimate, signed sequences are accepted into the Smart Buffer.

3.3.3. DoS-Induced Transitions and Stability Impact

While cryptographic and consensus mechanisms ensure the data integrity, an adversary may attempt a DoS attack to degrade availability. We model this as a forced transition in the Markov chain governing ${\sigma }_k$.

Definition 1.

Under a DoS attack, the transition matrix Π is perturbed to ${\mathrm{\Pi }}_{\mathit{attack}}$, increasing the probability of entering a high-latency absorbing state ${\sigma }_{\mathrm{DoS}}$:

$${\pi }_{i,{\sigma }_{\mathrm{DoS}}}\approx 1,\forall i\in \mathcal{S}.$$

(29)

Even as $\tau \left({\sigma }_k\right)\to {\tau }_{max}$, the stability is preserved by Theorem 1. The controller switches to the precomputed gain $K_{{\sigma }_{\mathrm{DoS}}}$, satisfying the LMI

$$\left[\begin{array}{cc}-P_{{\sigma }_{\mathrm{DoS}}}& {\mathcal{A}}_{{\sigma }_{\mathrm{DoS}}}^T{\overline{P}}_{{\sigma }_{\mathrm{DoS}}}\\ {\overline{P}}_{{\sigma }_{\mathrm{DoS}}}{\mathcal{A}}_{{\sigma }_{\mathrm{DoS}}}& -{\overline{P}}_{{\sigma }_{\mathrm{DoS}}}\end{array}\right]<0.$$

(30)

3.3.4. Predictive Buffering and Safety Runway

During a DoS event lasting $T_{\mathrm{attack}}$ steps, the actuator continues applying verified inputs from the Smart Buffer:

$$u\left(k\right)={\mathbf{U}}_{k-\tau }\left[k\right],k\in [k_{\mathrm{start}},k_{\mathrm{start}}+L].$$

(31)

The system remains stable provided $T_{\mathrm{attack}}\le L$, since the predictive horizon masks the absence of new consensus updates. This ensures that $x\left(k\right)$ remains within the MSS bounds even under prolonged network layer disruption [44,48].

Remark 3.

In high-precision industrial processes such as the TEP, false positives can trigger unnecessary shutdowns. SAB-PC avoids this by combining deterministic ECDSA authentication with consensus layer validation. While ECDSA verifies origin authenticity, it does not validate semantic correctness; therefore, the blockchain consensus ensures that the signed payload is consistent with plant-level constraints before it is accepted into the Smart Buffer.

Modern adversaries may employ Generative Adversarial Networks (GAN)-based FDI attacks that mimic plant noise statistics, bypassing AI-based detectors. Since SAB-PC relies on the computational hardness of the Elliptic Curve Discrete Logarithm Problem, such attacks cannot alter the control sequence without the private key. Combined with Theorem 1, the Smart Buffer ensures that the system remains recovery ready and MSS stable without requiring AI-based classification.

4. Results and Discussion

4.1. Experimental Setup

The physical plant is modeled using the TEP, a highly nonlinear, open-loop unstable benchmark widely utilized in industrial control research [34]. The simulation utilizes the Fault-Free Training dataset to establish a steady-state baseline. Specifically, the Reactor Pressure (xmeas 7) is selected as the primary controlled variable due to its critical role in plant safety; deviations exceeding 3000 kPa trigger an automatic Emergency Shutdown (ESD). The simulation is executed at a sampling rate of $T_s=100$ ms, consistent with industrial Supervisory Control and Data Acquisition (SCADA) systems. The process dynamics are discretized to fit the state-space representation in (1).

4.1.1. Dataset and Preprocessing

The Fault-Free Training dataset contains multivariate time-series measurements from 41 process variables and 12 manipulated variables. All the signals are normalized to a zero mean and unit variance to ensure numerical stability during controller evaluation. No missing values are present in the dataset, and no additional filtering or smoothing is applied. The dataset is segmented into non-overlapping windows of 100 samples to emulate realistic batch-based controller updates.

4.1.2. Controller Configuration

Both the baseline controller and the proposed SAB-PC controller operate under identical plant conditions. The baseline controller uses fixed gains derived from the nominal linearized TEP model, while SAB-PC adapts its gain based on network congestion modes and predicted blockchain-induced delays.

4.1.3. Evaluation Protocol

To enable experimental replication, all experiments are executed using the same hardware and software environment: Python 3.13 on an Intel i7-12700K workstation with 64 GB RAM. MJLS dynamics were implemented using numpy and scipy, TEP data processing via pandas and pyreadr, and custom Merkle-tree and BFT-latency modules to model blockchain overhead. The total execution time per control loop remained below 50 ms. The TEP benchmark was used to evaluate the interaction between the consensus layer and the predictive controller. Each controller is evaluated over 30 independent runs to account for stochastic variations in network delay and switching modes.

4.1.4. Simulation Parameters

Table 1 summarizes all the simulation parameters used in the experiments, including the sampling time, controller gains, MJLS transition probabilities, delay distributions, and buffer configurations. These values enable full replication of the experimental results.

Table 1. Summary of simulation parameters (ranges used in experiments).

Parameter	Values
Sampling time $T_s$	50–200 ms
Prediction horizon $N_p$	5–20 steps
Control horizon $N_c$	2–5 steps
Buffer size B	3–10 samples
Number of MJLS modes	2–4 modes
MJLS transition probabilities $P_{ii}$	$0.80$–$0.98$
MJLS transition probabilities $P_{ij}$, $i\ne j$	$0.02$–$0.20$
Network delay (per packet)	50–200 ms
Delay distribution family	Uniform
Process noise variance	${10}^{-4}$–${10}^{-2}$
Measurement noise variance	${10}^{-4}$–${10}^{-2}$
Baseline feedback gain $K_{\mathrm{base}}$	$[-5,5]$
SAB-PC feedback gain $K_{\mathrm{sab}}$	$[-8,8]$
Blockchain confirmation time (per block)	$0.5$–$2.0$ s
Maximum tolerated end-to-end delay	$0.5$–$3.0$ s
Number of Monte Carlo runs	20–50 runs

All the simulation code, controller implementations, and data preprocessing scripts are publicly available at https://github.com/opoku-ohemeng/SAB-PC, accessed on 26 January 2026. No real blockchain nodes were deployed; all latency values are generated from the stochastic delay model described in Section 2.2.

4.2. Cyber Infrastructure: Blockchain Consensus Layer

The decentralized communication layer is modeled as a BFT-style network whose latency evolves according to the MJLS transition matrix $\mathrm{\Pi }$. Three operational modes are considered:

• Mode 1 (Nominal): Low-latency regime; $\tau \in [1,5]$ steps.
• Mode 2 (Congestion): High-traffic regime; $\tau \in [10,25]$ steps.
• Mode 3 (Adversarial): Stress or DDoS regime; $\tau >25$ steps.

A PoA consensus configuration is used to emulate private industrial deployments. The validator count N is varied from 4 to 100 to evaluate scaling effects, with the baseline malicious node probability $p_{mal}=0.1$.

4.3. Adversarial Model: False Data Injection (FDI)

To assess Byzantine resilience, a coordinated FDI attack is introduced on the sensor-to-blockchain link. The adversary possesses MITM capabilities but lacks the private keys required to forge Merkle proofs. The corrupted measurement is modeled as

$$\tilde{y}\left(k\right)=y\left(k\right)+\delta \left(k\right),$$

(32)

with $\delta \left(k\right)=8.0$ kPa for $k\in [200,400]$, representing a high-magnitude bias intended to mislead the controller into unsafe valve actuation.

4.4. Consensus Scaling and Security–Performance Trade-Off

Figure 1 illustrates the quadratic latency growth $\mathcal{O}\left(n^2\right)$ characteristic of BFT protocols. Despite this communication overhead, scaling the validator set significantly improves architectural security. As shown in Figure 2, the probability of maintaining a safe consensus state approaches unity for $N>20$ under $p_{mal}=0.1$.

Figure 1. This plot evaluates the communication overhead as the node count (N) increases. The quadratic growth ($\mathcal{O}\left(n^2\right)$) inherent to practical BFT protocols is highlighted. This characterization justifies the necessity of the proposed Safety Runway predictive buffer, which effectively masks these communication latencies to maintain real-time control stability in the physical process.

Figure 2. The probability of maintaining a safe consensus state ($Pr\left(Safety\right)$) as a function of the total number of consensus nodes (N). The results demonstrate that as the decentralized network scales, the probability of satisfying the Byzantine condition ($M<N/3$, where M is the number of malicious nodes) approaches unity, validating the architectural security of the blockchain layer against coordinated node compromise.

The trade-off between latency and security is summarized in Figure 3. An operational region between 30 and 60 nodes achieves near-maximal security while keeping the consensus delay below the 100 ms threshold required for real-time TEP control. This range represents the optimal security–performance frontier for decentralized industrial CPS.

Figure 3. This scatter plot illustrates the relationship between consensus node count, network latency, and security probability. The results identify an optimal operational spot (≈30–60 nodes), where the framework achieves near-maximum security without exceeding the 100ms real-time control threshold required for industrial TEP loops.

4.5. Mitigation of False Data Injection (FDI) Attacks

The impact of the FDI attack is shown in Figure 4. The baseline controller exhibits severe pressure deviation under the 8.0 kPa bias, risking Emergency Shutdown. In contrast, SAB-PC rejects the adversarial signal through Merkle proof validation and predictive buffering. The resulting deviation is limited to approximately 1.2 kPa, well within TEP safety margins. This demonstrates that only cryptographically verified, non-tampered control sequences influence the actuator.

Figure 4. This plot compares resilience under FDI. The time-series response of the TEP Reactor Pressure under three operational modes: nominal, FDI attack, and SAB-PC mitigated. The framework successfully rejects the high-magnitude bias injection ($k\in [200,400]$) and maintains the pressure within safe operating limits, preventing the cascading failures typical of standard networked control systems.

4.6. Kinematic Stability and Predictive Compensation

Figure 5 presents the kinematic profile of the reactor pressure. The smooth control velocity ($\Delta \mathrm{Pressure}/\Delta t$) confirms that the predictive Safety Runway prevents the chatter and aggressive switching typically caused by variable network latency. As the MJLS mode transitions between the nominal and congested states, the controller adapts $K_{{\sigma }_k}$ to maintain actuator feasibility and to suppress deviations rapidly.

Figure 5. This plot shows the dynamic state trajectory and velocity analysis. It shows the rate of change ($\Delta \mathrm{Pressure}/\Delta t$) of the critical process variable during active control. The kinematic profile reveals the damping characteristics of the SAB-PC controller, ensuring that control actions remain within the mechanical limits of the TEP actuators while rapidly suppressing any deviations caused by network-induced jitter.

4.7. Resilience Sensitivity and Stability Bounds

The robustness of SAB-PC is further evaluated through the sensitivity analysis in Figure 6. The heatmap shows that the system maintains a high safety probability even as the malicious node rate increases toward $p_{mal}=0.35$, provided the network size satisfies $N\ge 60$. These results align with the conservative Lyapunov-based MSS guarantees derived in Theorem 1. The predictive horizon L effectively compensates for long-tail delay distributions, ensuring stable operation even during peak congestion.

Figure 6. This plot is the heatmap illustrating the probability of maintaining a safe consensus state across varying node compromise rates ($p_{mal}$) and network sizes (N). This provide an assessment of the framework’s robustness, demonstrating that larger decentralized networks can tolerate significantly higher rates of adversarial infiltration while ensuring the integrity of the control sequences delivered to the physical layer.

Collectively, these results demonstrate that SAB-PC provides a real-time feasible and security-resilient solution for decentralized industrial control, maintaining stability and safety under both stochastic network variability and coordinated cyber–physical attacks.

4.8. Stability Analysis and Convergence

The stability of SAB-PC is determined by the ergodic evolution of the Markovian delay process $\sigma \left(k\right)$, governed by the transition matrix $\mathrm{\Pi }=\left[{\pi }_{ij}\right]$. For the MJLS with dynamics

$$x(k+1)={\mathcal{A}}_{\sigma \left(k\right)}x\left(k\right),$$

(33)

Mean Square Stability (MSS) is achieved if there exist symmetric positive-definite matrices $P_i>0$ such that, for all $i\in \mathcal{S}$,

$$\sum _{j=1}^N{\pi }_{ij}{\mathcal{A}}_i^T{P}_j{\mathcal{A}}_i-P_i<0,$$

(34)

where ${\mathcal{A}}_i=A+B{K}_i$. The matrices $P_i$ serve as stochastic Lyapunov certificates: low-latency modes (Mode 1) accumulate Lyapunov energy margin, enabling the system to tolerate temporary excursions into high-latency regimes (Mode 3), where the instantaneous spectral radius may exceed unity.

4.8.1. Predictive Buffering and Temporal Decoupling

The Smart Buffer transforms the stochastic consensus delay ${\tau }_k$ into a deterministic execution sequence by ensuring that the actuator always applies a verified control input. The applied command is

$$\mathbf{u}\left(k\right)=Kx(k-{\tau }_k)A_{cl}^{{\tau }_k},$$

(35)

where ${\tau }_k$ is the age of the most recently validated block. As long as the information age $a\left(k\right)=k-\mathrm{timestamp}\left(u_k\right)$ satisfies $a\left(k\right)\le L$, the actuator is never starved of control data. This temporal decoupling ensures that the control frequency remains independent of the consensus frequency, preserving contractivity even during congestion or validator re-election events.

4.8.2. Geometric Interpretation via Ellipsoidal Invariance

The LMI feasibility condition admits a geometric interpretation; each mode i defines an invariant ellipsoid ${\mathcal{E}}_i=\{x:x^T{P}_{i}x\le 1\}$. When the network transitions from mode i to mode j, the state moves between the corresponding ellipsoids. MSS requires that the expected next-state Lyapunov energy satisfies

$$\mathbb{E}[V(x_{k+1},{\sigma }_{k+1})\mid x_k,{\sigma }_k=i]=\sum _{j\in \mathcal{S}}{\pi }_{ij}{x}_{k+1}^T{P}_j{x}_{k+1}<x_k^T{P}_i{x}_k.$$

(36)

This stochastic nesting ensures that, even if a single ellipsoid expands during prolonged delay, the expected trajectory remains contractive and is pulled toward the origin. As a result, the  controller rejects adversarial perturbations that attempt to push the state outside the safe operational manifold of the TEP reactor.

4.8.3. Stability Boundary and Predictive Horizon

The relationship between the predictive horizon L and the delay ${\tau }_k$ defines the stability boundary of SAB-PC. In the TEP experiments, the sensitivity heatmap in Figure 6 shows that for $L=30$, the system maintains a safety margin across approximately $98.5\%$ of stochastic delay realizations. This confirms that the predictive horizon effectively compensates for long-tail latency distributions and provides a statistically proven defense against both network jitter and stealthy FDI attacks.

4.9. The Security–Performance Frontier

Blockchain-enabled control introduces an inherent tension between decentralized trust and real-time performance. Increasing the validator set strengthens Byzantine resilience but simultaneously amplifies stochastic latency, threatening the timing requirements of the control loop. The SAB-PC framework resolves this tension by mathematically decoupling the consensus horizon from the control execution horizon through predictive buffering and MJLS-based gain scheduling.

4.9.1. Stochastic Complexity of Decentralized Trust

The security of the consensus layer is determined by its tolerance to Byzantine failures. For a network of n validators, safety is preserved only if the number of malicious nodes f satisfies the BFT condition $n\ge 3f+1$. In a traditional NCS, increasing n eventually forces the closed-loop spectral radius to exceed unity:

$$\underset{n\to \infty }{lim}\rho \left(A_{cl}^{{\tau }_{cons}\left(n\right)}\right)>1,$$

(37)

leading to loss of stability as the delay grows beyond the plant’s tolerance.

4.9.2. Latency Masking via Predictive Compensation

SAB-PC shifts this trade-off by using the Smart Buffer to mask consensus-induced delay. The predictive sequence in (10) ensures that the actuator always has access to a verified control input, even when $\tau \left({\sigma }_k\right)$ is large. MSS is maintained provided the predictive horizon satisfies

$$L\ge \mathbb{E}\left[\tau \left({\sigma }_k\right)\right]+\mathrm{Var}\left[\tau \left({\sigma }_k\right)\right],$$

(38)

ensuring that the information age never exceeds the buffer capacity. Through the MJLS formulation, the controller switches gains $K_{{\sigma }_k}$ to satisfy the mode-dependent Lyapunov inequality

$${\mathcal{A}}_i^T\left(\sum _{j=1}^N{\pi }_{ij}{P}_j\right){\mathcal{A}}_i-P_i<0,$$

(39)

for every network mode $i\in \mathcal{S}$.

4.9.3. Quantitative Evaluation of the Frontier

The results in Figure 3 and Figure 6 validate this security–performance frontier for the TEP. The system achieves near-maximal consensus safety while maintaining real-time feasibility for validator sets in the 30–60 node range, confirming that SAB-PC effectively balances decentralization, latency, and closed-loop stability.

The stability behavior of both architectures can be expressed using the same MJLS formulation adopted throughout this work. The blockchain-induced delay is modeled as a finite-state Markov chain ${\sigma }_k\in \{1,2,3\}$ representing the nominal, congested, and adversarial network conditions. Each mode m corresponds to a delay $d_m$ and a stationary distribution

$$\mathrm{\Pi }\left(n\right)=\left[{\pi }_1\left(n\right),{\pi }_2\left(n\right),{\pi }_3\left(n\right)\right],$$

(40)

which depends on the validator set size n. The TEP linearized dynamics follow

$$x_{k+1}=A{x}_k+B{u}_k,$$

(41)

where A contains a lightly unstable eigenvalue associated with the high-pressure reactor subsystem. The baseline controller represents the canonical blockchain-mediated feedback loop used in the decentralized NCS literature. The actuator receives the delayed state $x_{k-d_{{\sigma }_k}}$, and the control law is

$$u_k=K_{\mathrm{base}}{x}_{k-d_{{\sigma }_k}}.$$

(42)

Under mode ${\sigma }_k=m$, the closed-loop operator becomes

$$A_{\mathrm{base}}^{\left(m\right)}=A+B{K}_{\mathrm{base}}{A}^{d_m}.$$

(43)

Because the delay-lifted term $A^{d_m}$ amplifies the lightly unstable mode of the TEP plant, the spectral radius satisfies

$$\rho \left(A_{\mathrm{base}}^{\left(m\right)}\right)>1\mathrm{for}\mathrm{all}\mathrm{realistic}{d}_m.$$

(44)

The MJLS-averaged operator is

$$A_{\mathrm{base}}\left(n\right)=\sum _{m=1}^3{\pi }_m\left(n\right)A_{\mathrm{base}}^{\left(m\right)},$$

(45)

and Figure 7a confirms that

$$\rho \left(A_{\mathrm{base}}\left(n\right)\right)>1\forall n.$$

(46)

Figure 7. Comparison of closed-loop stability and consensus delay as a function of validator node count. (a) The baseline controller becomes marginally unstable for all network sizes, with spectral radii consistently exceeding the stability threshold $\rho =1$. The SAB-PC controller maintains $\rho \left(A_{cl}\right)<1$ across the entire range of n, illustrating its robustness to delay and mode-switching effects. (b) End-to-end consensus delay grows with network size, reflecting increased communication and validation overhead. Shaded regions denote the standard deviation across Monte Carlo trials.

Thus, the baseline architecture becomes unstable not because the controller is weak, but because blockchain-induced delay fundamentally violates the timing assumptions required to stabilize the TEP reactor. SAB–PC differs structurally by explicitly compensating for the delay process. For each mode m, the controller predicts the plant state over the expected delay:

$${\widehat{x}}_{k+d_m}=A^{d_m}{x}_k.$$

(47)

The control law is

$$u_k=K_{\mathrm{sab}}^{\left(m\right)}{\widehat{x}}_{k+d_m},$$

(48)

where $K_{\mathrm{sab}}^{\left(m\right)}$ is a mode-dependent gain chosen to ensure contractivity. The resulting mode-dependent operator is

$$A_{\mathrm{sab}}^{\left(m\right)}=A+B{K}_{\mathrm{sab}}^{\left(m\right)}{A}^{d_m}.$$

(49)

By design,

$$\rho \left(A_{\mathrm{sab}}^{\left(m\right)}\right)<1\forall m,$$

(50)

and the MJLS-averaged operator

$$A_{\mathrm{sab}}\left(n\right)=\sum _{m=1}^3{\pi }_m\left(n\right)A_{\mathrm{sab}}^{\left(m\right)}$$

(51)

satisfies

$$\rho \left({\mathcal{A}}_{\mathrm{sab}}\left(n\right)\right)<1\forall n,$$

(52)

as shown in Figure 7a. This comparison highlights that the baseline is the standard blockchain–NCS architecture. Its instability arises from the interaction between the lightly unstable TEP dynamics, the delay-lifted operator $A^{d_m}$, and MJLS switching induced by consensus variability. SAB–PC succeeds not by using a stronger gain, but by introducing prediction and mode-aware compensation that preserves contractivity under delay. As a result, SAB–PC substantially expands the feasible operating region for decentralized control, enabling stable operation across a broad range of validator-set sizes.

4.10. Computational Cost Analysis and Real-Time Feasibility

The SAB-PC framework mitigates the computational burden of blockchain-enabled control by separating verification into two components, an infrequent on-chain Merkle root commitment and lightweight off-chain Merkle proof checks executed locally at the actuator. This design ensures that cryptographic integrity is preserved without compromising real-time control performance.

4.10.1. On-Chain Complexity: Merkle Root Commitment

At each prediction horizon L, the controller submits a batch of future control inputs whose Merkle root is finalized on-chain. This commitment occurs asynchronously and only once per horizon window, preventing consensus latency from entering the 100 ms control loop.

Empirical measurements from production-grade EVM clients (Geth, Besu, and Nethermind) and deployed protocols (Uniswap and Optimism) show that Merkle root verification is dominated by memory expansion and RLP decoding rather than the KECCAK256 opcode [15]. The typical gas costs are

• Keccak-256 hashing (multiple 64-byte nodes): 20,000–60,000 gas (including EIP-150 quadratic memory expansion [15,50]);
• RLP decoding and proof parsing: 10,000–40,000 gas;
• Stack and control-flow operations: 2000–5000 gas.

Thus, the total on-chain commitment cost is

$$G_{\mathrm{root}}\approx 50,000–120,000\mathrm{gas}.$$

(53)

Modern PoA validators process approximately 50–150 million gas per second [15], yielding a wall clock execution time of

$$t_{\mathrm{root}}={\displaystyle \frac{G_{\mathrm{root}}}{50\times {10}^6}}\approx 1–3\mathrm{ms}.$$

(54)

This confirms that on-chain verification is well below industrial block time limits and remains outside the real-time control loop.

4.10.2. Off-Chain Complexity: Per-Step Merkle Proof Checking

The actuator performs per-step verification by checking the Merkle proof of the selected control input against the previously validated root. For a 20-level Merkle tree (supporting over ${10}^6$ leaves), only 20 hash operations are required. On embedded industrial hardware, such as ARM Cortex-A72 and Keccak-256,throughput reaches 80–120 MB/s. The per-step verification time is therefore

$$t_{\mathrm{proof}}\approx 20\times 0.4\mathsf{\mu }\mathrm{s}\approx 8\mathsf{\mu }\mathrm{s}.$$

(55)

Even with stack and control overhead, the total verification time remains below 1 ms, ensuring that cryptographic checks do not interfere with real-time actuation.

4.10.3. Real-Time Margin and Feasibility

The total real-time execution time is the sum of the proof verification, control computation $t_{\mathrm{ctrl}}$, and I/O latency $t_{\mathrm{I}/\mathrm{O}}$:

$$t_{\mathrm{RT}}=t_{\mathrm{proof}}+t_{\mathrm{ctrl}}+t_{\mathrm{I}/\mathrm{O}}<1\mathrm{ms}+3\mathrm{ms}+5\mathrm{ms}=9\mathrm{ms}.$$

(56)

This leaves a 91% timing margin relative to the 100 ms TEP sampling requirement. The hybrid verification strategy therefore provides strong cryptographic guarantees while fully preserving real-time feasibility.

4.11. Statistical Validation

To assess robustness across repeated trials, we conducted 30 independent evaluations of both the SAB-PC controller and a baseline method using the publicly available dataset in [51]. Figure 8 presents box plots of the resulting performance metrics. The SAB-PC framework exhibits a lower median error and reduced variance, demonstrating the improved consistency and resilience across stochastic realizations.

Figure 8. Box plots showing the distribution of performance metrics across 30 repeated runs for the proposed model and the baseline. The proposed method demonstrates lower median error and reduced variability, indicating improved robustness.

As shown in Figure 8, the SAB-PC model achieves both a substantially lower median error and a noticeably tighter interquartile range, indicating its improved average performance and reduced variability across repeated trials. In contrast, the baseline controller exhibits a higher median and wider dispersion, reflecting greater sensitivity to stochastic fluctuations. These results confirm that SAB-PC delivers more stable and reliable performance under repeated evaluation.

4.12. Limitations

The present study focuses on the core stability and performance properties of SAB–PC, and several important extensions remain open for future work. First, the buffer-empty case $\tau >L$ is not examined in our simulations. Handling this scenario requires safety-oriented fallback policies, such as input hold, safe shutdown, or degraded local control, which should be analyzed within a formal safety framework. Second, the blockchain-induced delay is modeled using a calibrated stochastic process rather than measurements from a live consensus deployment. This abstraction isolates the control-theoretic effects of latency but does not capture the full complexity of peer-to-peer gossip, serialization, or disk I/O present in operational networks. Finally, the scope of this work is limited to stability and nominal performance. A comprehensive treatment of cybersecurity threats, including validator churn, network partitioning, and coordinated adversarial behavior, remains an important direction for extending SAB–PC toward full-scale industrial deployment. These limitations do not undermine the core contribution but highlight natural avenues for strengthening the framework in future research.

5. Conclusions

This paper introduced the Stochastic-Aware Blockchain Predictive Control (SAB-PC) framework, a unified architecture that reconciles decentralized trust with real-time control stability. By modeling blockchain-induced latency as a state-dependent Markov process within an MJLS formulation, the framework replaces static delay assumptions with a dynamic representation of consensus behavior. We established a foundation by deriving the Mean Square Stability (MSS) conditions through mode-dependent Linear Matrix Inequalities (LMIs), ensuring contractive closed-loop behavior across all network modes.

Through the Safety Runway predictive buffer, SAB-PC decouples the control execution rate from consensus variability, effectively masking stochastic jitter. In the Tennessee Eastman Process (TEP) benchmark, the controller maintained stable operation for decentralized networks with up to 60 validators and preserved safe Reactor Pressure trajectories under long-tail delay distributions. Under coordinated False Data Injection (FDI) attacks, SAB-PC limited pressure deviations to 1.2 kPa despite an 8.0 kPa adversarial bias, demonstrating strong resilience grounded in both cryptographic verification and delay-aware control design.

Our numerical analysis further showed that standard blockchain-mediated control architectures become unstable under realistic PBFT-induced delays, whereas SAB-PC maintains contractivity for all tested validator set sizes. This expands the feasible operating region for decentralized industrial control and shifts the security–performance frontier by enabling high Byzantine resilience without violating real-time constraints.

Future work will extend this framework to single-chain TEP control, cross-chain interoperability, and the stability implications of heterogeneous, multi-layer blockchain networks with multi-modal latency distributions.