Min Xie - Cyber-Physical Distributed Systems

CPSs perform critical tasks in many industrial applications, for example, manufacturing systems [152], transportation systems [153,154], and power systems [18,155]. The components of control systems, that is, actuators and sensors, are subject to degradation when operating under severe working conditions [155–159].

Sudden load variations in electric power systems are often balanced by promptly changing the output of natural gas power plants following the LFC strategy [160]. However, the degradation of gas turbine compressors, that is, the deviation of compressor flow capacity and isentropic efficiency [161], and the degradation of PMUs, that is, measurement drifts and errors [162,163], reduce the LFC performance by decreasing the available balancing power, and by producing inaccurate frequency readings. Deteriorated LFC performance may result in power system failures because the system frequency exceeds its maximum allowable drop or fails to attain the steady‐state frequency tolerance band in the required time in compliance with ISO 8528‐5 [164]. As a result, power system failures are determined by the LFC performance, stemming from the partial information on the power system conditions, that is, the health indexes of gas turbines (flow capacity and isentropic efficiency), and measurement drift. Therefore, it is necessary to study these degradation processes to predict the real‐time LFC performance loss and ensure adequate LFC through proper maintenance activities.

Lifetime prognostic studies of gas turbines [165] have shown that the failure time of these systems varies between 24 000 h and 35 000 h. Such variability stems from different working conditions [166] and different starting points of the degradation paths [167]. Therefore, the degradation model should reflect the unit‐to‐unit variability in the degradation process of gas turbines [168]. Moreover, many condition‐based maintenance (CBM) models determine maintenance activities based on the estimated remaining useful lifetime (RUL) of gas turbines using health indexes (reduction in flow capacity and isentropic efficiency [161]) derived from on‐line measurements, for example, rotor speed, inlet temperature, and pressure [169,170]. Maintenance activities are scheduled based on the two health indexes. However, in control systems, failures are determined by the system performance [171] and not by the health indexes of individual components, that is, they are system‐level failures rather than component‐level failures [172–174]. Control systems may still operate normally even if the component health indexes exceed failure thresholds [157,175]. In addition, the feedback control mechanisms hide the explicit mapping from the individual component degradation state to the control performance loss [175]. It is easy to estimate the RUL of an individual component, but difficult for degraded control systems, because their failure time cannot be described by any particular distribution [171,176]. Therefore, when applied to degraded control systems, general CBM models should connect the component degradation and the control performance loss, so that maintenance activities depend on the reduction of control performance [176].

The Wiener process is often employed in degradation models because of its favorable mathematical properties; in particular, it can capture non‐monotonic degradation signals frequently encountered in practical applications, because consecutive independent increments are normally distributed [172]. Therefore, this stochastic process has been widely applied to characterize the path of degradation in realistic scenarios, where fluctuations are observed in the degradation process, for example, brake‐pad wear for automobiles [177], bearing degradation [174,178], gyroscopes in inertial navigation systems [172,179,180], contact image sensors in copy machines [181], the resistance of carbon‐film resistors [159], and the pitting corrosion process [167]. To overcome the aforementioned limitations, the Wiener degradation model with unit‐to‐unit variability is introduced to describe gas turbines exhibiting different lifetimes. The Wiener model considers the random starting time of the degradation process, which follows a non‐homogeneous Poisson process [167,182]. Furthermore, the drift parameter, which denotes the aging rate, is also variable and follows a normal distribution, where the mean denotes the average aging rate and the variance represents the variability in the aging rate [170,183–186]. These parameters can be estimated from the lifetime dataset via an expectation‐maximization (EM) algorithm [172,180,183–186].

Thus, the data‐driven degradation model with unit‐to‐unit variability is integrated into the control system model described by control block diagram, resulting in a real‐time simulation model. In such control models, the interplay among the reduction in the control signal due to component degradation, the transfer functions of the subsystems, and the feedback control loop, provides the mapping between the component degradation states and the system performance loss. This interaction is modeled via control‐block diagrams, which implement the feedback control mechanism and quantify the control signal by comparing the control performance to the setpoint. Therefore, such an integrated model does not require explicit mapping from the component degradation states to the system performance loss and is well‐suited to represent a degraded control system. As such, this simulation model realistically predicts the performance of the control system at different operating times and degradation stages.

Attacks on complex systems, for example, CPSs, are fundamentally different from traditional internal failures (e.g., degradation and design) and external failures (e.g., natural disasters) [187–190]. Many attack models for complex systems embrace a partial perspective, which only focuses on component vulnerability, and neglects the dependence of system performance on it [191–193]. As a result, the insights provided by these models are not adequate for providing general recommendations in realistic applications. To address this limitation, recent studies investigate the influence of component vulnerability (attacks at the component level) on system performance [194–197].

Pioneering works [192198–202] develop optimal defense strategies to minimize the attachment vulnerability of parallel systems, assuming that attackers maximize either the damage probability or the expected damage over a time horizon. They also consider general features, that is, imperfect false target techniques and genuine targets [201,203]. These defense strategies reach a trade‐off between increasing the protection of existing components and providing redundancy by allocating additional components [192,203–205].

System performance is an essential feature in CPSs that can still operate if some components are unavailable and, therefore, are characterized by multiple performance levels [206–211]. System performance degrades with increasing component destruction or unavailability; if the system performance level decreases, the required demand may be partially unsatisfied. Two risk measures can be used for multi‐state complex systems [203–205]: 1) the probability that the demand is not satisfied is considered for complex systems that fail if performance cannot meet demand, for example, automatic train protection and block systems [212,213], and power system dynamic security systems [190]; 2) the expected damage proportional to the unsupplied demand is considered for complex systems that can operate even if the demand is partially supplied, for example, mobile ad hoc networks [191], NCSs [214,215], supervisory control and data acquisition (SCADA) systems [216,217], water distribution networks [218], and electric power grids [219–221].