Chapter 17 — Control and feedback basics
Lesson map
Lesson 17 published. Map, example, EX034.
flowchart TD
N0["Learning outcomes and connection"]
N1["17.1 Feedback"]
N2["17.2 PI control"]
N3["17.3 False data and the trusting controller"]
N4["17.4 Residual-based detection"]
N5["17.6 Practical activity: Lab 7"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX034"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["17.1 Feedback"]
N2["17.2 PI control"]
N3["17.3 False data and the trusting controller"]
N4["17.4 Residual-based detection"]
N5["17.6 Practical activity: Lab 7"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX034"]
[Learning outcomes and connection]
|
v
[17.1 Feedback]
|
v
[17.2 PI control]
|
v
[17.3 False data and the trusting controller]
|
v
[17.4 Residual-based detection]
|
v
[17.6 Practical activity: Lab 7]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX034]
Learning outcomes and connection
After this chapter you can (1) describe open- and closed-loop control, setpoints, error and actuator limits; (2) explain proportional–integral (PI) control and integrator wind-up; (3) analyse how false sensor data — a false-data injection — drives a correct controller to an unsafe state; and (4) design residual-based detection using independent physical measurements and state its blind spots. It builds on Chapter 6 and prepares Chapters 27 and 33.
17.1 Feedback
A closed-loop controller measures a process variable, compares it with a setpoint and adjusts an actuator to reduce the error. Feedback makes systems robust to disturbances and model errors — and makes them trust their sensors completely. Åström and Murray's Feedback Systems, freely available online, is the reference text for this chapter.
At Hollin Hill, the PI controller adjusts PS3's inlet flow to hold the reservoir level at its setpoint. It sees the reservoir only through the level transmitter, so whatever that transmitter reports is, for the controller, the truth. The rest of this chapter follows the consequence of that trust.
17.2 PI control
A proportional controller sets actuator output $u = K_p e$; it leaves a steady-state error when a constant disturbance must be balanced. Adding an integral term, $u = K_p e + K_i\int e\,dt$, removes steady-state error because the integral keeps growing until the error is zero. Actuators saturate — a pump cannot deliver more than its maximum flow — and while saturated, the integral keeps growing (wind-up), causing overshoot when the actuator comes out of saturation. Anti-wind-up stops integration while saturated.
17.3 False data and the trusting controller
If an attacker adds a bias $b$ to the level measurement, the controller regulates the measured level to the setpoint, so the true level settles at setpoint minus $b$. The controller is functioning perfectly; the process is not. This is the core of process-aware attacks: Stuxnet, as analysed by Langner (2011), manipulated centrifuge speeds while replaying normal-looking values to operators. Defences cannot rely on the same sensor stream the attacker controls.
At Hollin Hill, a biased level transmitter would lower the true level while the operator's screen showed the setpoint, so the defence must come from an independent measurement.
17.4 Residual-based detection
A residual is the difference between what a measurement says and what an independent model predicts. For a reservoir, mass balance predicts level change from independently metered inflow and outflow: $\Delta h = (q_{in} - q_{out})\Delta t / A$. Two detectors: a step residual compares the change in measured level with the predicted change over one step; a cumulative residual compares the measured level with the level integrated from flows since the last trusted calibration. The step detector catches abrupt bias but not slow drift; the cumulative detector catches drift but accumulates meter error, so it needs periodic recalibration and a threshold above normal meter drift. An attacker who also controls the flow meters defeats both — independence of measurement paths is the real control.
17.5 Worked example: Hollin Hill level attack (synthetic)
Lab 7 simulates PI control of Hollin Hill (plan area 1,000 m², setpoint 3.0 m, outflow 300 m³/h, inlet pump 0–600 m³/h) for 48 h. A +1.5 m step bias at 10 h drives the true level down to 1.5 m; both detectors alarm at 10.0 h. A +0.04 m bias — small enough to resemble sensor error — is caught only by the cumulative detector. A slow ramp of 0.05 m/h evades the step detector entirely; the cumulative detector alarms at 10.6 h, by which time the bias is about 0.03 m. Without detection, the ramp leaves the true level at 1.1 m after 48 h.
17.6 Practical activity: Lab 7
# Lab 7 - PI level control under sensor-bias attacks, and two residual detectors (synthetic, offline)
def run(attack=None, hours=48, dt=0.1):
A = 1000.0 # m2 reservoir plan area: level h (m), volume A*h (m3)
h, integ, sp, kp, ki = 3.0, 7.5, 3.0, 400.0, 40.0 # integ preloaded so u = 300 at start
est = h # mass-balance estimate from independently metered flows
prev_meas, step_t, cum_t, hmin = h, None, None, h
for k in range(int(hours / dt)):
t = k * dt
b = attack(t) if attack else 0.0
meas = h + b
err = sp - meas
u = kp * err + ki * integ
q_in = min(max(u, 0.0), 600.0) # pump limits 0..600 m3/h
if 0.0 < u < 600.0: integ += err * dt # anti-windup
q_out = 300.0
if k > 0 and step_t is None and abs((meas - prev_meas) - (est - est_prev)) > 0.05: step_t = round(t, 1)
if cum_t is None and abs(meas - est) > 0.03: cum_t = round(t, 1)
prev_meas, est_prev = meas, est
h += (q_in - q_out) / A * dt; est += (q_in - q_out) / A * dt
hmin = min(hmin, h)
return round(h, 2), round(hmin, 2), step_t, cum_t
print("columns: true final level m, true min level m, step-detector alarm h, cumulative-detector alarm h")
print("no attack ", run())
print("step bias +1.5 m ", run(lambda t: 1.5 if t >= 10 else 0.0))
print("step bias +0.04 m", run(lambda t: 0.04 if t >= 10 else 0.0))
print("ramp 0.05 m/h ", run(lambda t: 0.05 * (t - 10) if t >= 10 else 0.0))
Expected output:
columns: true final level m, true min level m, step-detector alarm h, cumulative-detector alarm h
no attack (3.0, 3.0, None, None)
step bias +1.5 m (1.5, 1.4, 10.0, 10.0)
step bias +0.04 m (2.96, 2.95, None, 10.0)
ramp 0.05 m/h (1.1, 1.1, None, 10.6)
Read the four rows against the worked example. Without an attack the level stays at three metres and neither detector fires. The large step bias is caught by both detectors at once, and the true level settles a metre and a half too low. The small step and the slow ramp are where the detectors differ: only the cumulative detector sees them, and the ramp, left alone, drags the true level to about one metre. Remember that the lab's flow meters are perfect, so real detection times would be later.
17.7 Common errors and limits
- Equating "the controller worked" with "the process is safe".
- Detection that uses the same data path as the control loop.
- Thresholds set without measuring normal noise and drift.
- Ignoring wind-up and saturation in safety reasoning.
- Simulation results presented as plant behaviour; Lab 7 is a simplified model with perfect flow meters.
For Hollin Hill, EX034 shows the dependence problem plainly: the level sensor and the inlet flow meter are both wired to RTU3, so compromising one RTU defeats both sides of the residual.
Exercises — chapter 17
EX033 — Threshold trade-off. Objective: tune a detector. Inputs: Lab 7. Steps: (1) add Gaussian noise of standard deviation 0.01 m to the measured level (seed 17) and count false alarms of the cumulative detector in the no-attack case at thresholds 0.03 and 0.05; (2) report detection time of the ramp at both thresholds; (3) recommend a threshold. Expected evidence: table and recommendation. Rubric: 3 = experiment correctly implemented, trade-off explained, recommendation linked to response time; 2 = one threshold only; 1 = not run; 0 = none.
EX034 — Independence argument. Objective: argue detection independence. Inputs: LRWA's architecture: level sensor and inlet flow meter both wired to RTU3; outlet flow meter at PS4 on RTU4. Steps: identify which attacker positions defeat the residual detector, and propose an architectural change that improves independence. Expected evidence: half page. Rubric: 3 = compromise of RTU3 defeats both level and inflow, change proposes separate path (e.g., independent level transmitter to a separate logger or physical gauge check); 2 = partial; 1 = generic; 0 = none.
Chapter synthesis
Feedback makes systems robust and credulous. A biased sensor drives a correct controller to an incorrect physical state. Detect with residuals built from independent physics, use step and cumulative tests for abrupt and slow attacks, set thresholds from measured noise, and remember that independence of measurement paths — not cleverness of the algorithm — is what defeats a capable attacker.
Continue studying — chapter 17 of 50
← Chapter 16 · Course chapter index · Chapter 18 →
Continue to the next authored lesson.