1234
5, MAY 2023
Resilient and Safe Platooning Control of Connected
Automated Vehicles Against Intermittent
Denial-of-Service Attacks
Xiaohua Ge, Senior Member, IEEE, Qing-Long Han, Fellow, IEEE, Qing Wu, Member, IEEE, and
Xian-Ming Zhang, Senior Member, IEEE
Abstract— Connected automated vehicles (CAVs) serve as a
promising enabler for future intelligent transportation systems
because of their capabilities in improving traffic efficiency and
driving safety, and reducing fuel consumption and vehicle emis-
sions. A fundamental issue in CAVs is platooning control that
empowers a convoy of CAVs to be cooperatively maneuvered
with desired longitudinal spacings and identical velocities on
roads. This paper addresses the issue of resilient and safe pla-
tooning control of CAVs subject to intermittent denial-of-service
(DoS) attacks that disrupt vehicle-to-vehicle communications.
First, a heterogeneous and uncertain vehicle longitudinal dynamic
model is presented to accommodate a variety of uncertainties,
including diverse vehicle masses and engine inertial delays,
unknown and nonlinear resistance forces, and a dynamic platoon
leader. Then, a resilient and safe distributed longitudinal platoon-
ing control law is constructed with an aim to preserve simultane-
ous individual vehicle stability, attack resilience, platoon safety
and scalability. Furthermore, a numerically efficient offline design
algorithm for determining the desired platoon control law is
developed, under which the platoon resilience against DoS attacks
can be maximized but the anticipated stability, safety and scala-
bility requirements remain preserved. Finally, extensive numeri-
cal experiments are provided to substantiate the efficacy of the
proposed platooning method.
Index Terms—Connected automated vehicles (CAVs), cooperative
adaptive cruise control, denial-of-service (DoS) attacks, resilient con-
trol, vehicle platooning, vehicle-to-vehicle communication.
I. Introduction
ONNECTED automated vehicles (CAVs) have emerged
C as one promising intelligent transportation technology
and have gained significant popularity in both academia and
Manuscript received March 30, 2022; revised April 17, 2022; accepted
April 30, 2022. This work was supported in part by Australian Research
Council Discovery Early Career Researcher Award (DE210100273).
Recommended by Associate Editor Zidong Wang. (Corresponding author:
Qing-Long Han.)
Citation: X. Ge, Q.-L. Han, Q. Wu, and X.-M. Zhang, “Resilient and safe
platooning control of connected automated vehicles against intermittent
denial-of-service attacks,” IEEE/CAA J. Autom. Sinica, vol. 10, no. 5, pp.
1234–1251, May 2023.
X. Ge, Q.-L. Han, and X.-M. Zhang are with the School of Science,
Computing and Engineering Technologies, Swinburne University of
Technology, Melbourne VIC 3122, Australia (e-mail: xge@swin.edu.au;
qhan@swin.edu.au; xianmingzhang@swin.edu.au).
Q. Wu is with the School of Engineering and Technology, Central
Queensland University, Rockhampton QLD 4701, Australia (e-mail: q.wu@
cqu.edu.au).
Color versions of one or more of the figures in this paper are available
online at http://ieeexplore.ieee.org.
Digital Object Identifier 10.1109/JAS.2022.105845
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO.
the automotive industry in recent years. CAVs can potentially
improve the traffic throughout and energy/fuel consumption,
and reduce the risk of misoperation accidents by human
drivers, thereby leading to great economical, environmental
and social benefits. This has been well demonstrated and testi-
fied by the numerous successfully implemented CAV pro-
grams and challenges, such as the PATH program [1], the
Energy-ITS program [2], the Demo 2000 program [3], the
SARTRE program [4], and the Grand Cooperative Driving
Challenges in 2011 [5] and in 2016 [6].
CAVs have reinvigorated the relevant fields of vehicle
dynamics and control [7], AI-based learning [8]–[10], traffic
flow [11], route planning [12], [13], wireless communication
[14], [15], multi-agent systems [16], cyber security [17], [18]
and so forth. Among the many fundamental issues in CAVs,
vehicle platooning control has attracted intensive attention.
More specifically, vehicle platooning aims to guarantee a
string formation of a maneuvered vehicular platoon in terms
of some desired (fixed or time-varying) longitudinal spacings
and same velocities (and accelerations).
In order to fulfil a platooning control objective, a suitable
distributed cooperative longitudinal control strategy is deman-
ded to coordinate the vehicular platoon to further form and
maintain the desired longitudinal gaps. This, however, largely
relies on the available sensory technologies equipped by each
vehicle and the levels of inter-vehicle connectivity and intra-
vehicle automation. For example, by virtue of only on-board
sensors (e.g., radar and scanning lidar), adaptive cruise con-
trol (ACC) has been widely adopted at the early stage to
achieve a longitudinal vehicle-following control objective of
automated vehicles. Nevertheless, an ACC-based platooning
strategy often results in relatively large spacings between
adjacent vehicles, which degrades traffic throughout and
makes little contribution to fuel efficiency. Another limitation
of ACC-based vehicular platoons is the lack of a string stabil-
ity guarantee, which is a system-level stability requirement for
preventing inter-vehicle collisions. On the other hand, owe to
the mature IEEE 802.11p-based dedicated short range com-
munication technology and the emerging 5G cellular commu-
nication technology, cooperative adaptive cruise control
(CACC) has been prevalently exploited nowadays as it
enables each vehicle to possess certain wireless communica-
tion capability. More precisely, CACC-enabled CAVs can not
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
only be driven under partial or full automation using informa-
tion from on-board sensory devices, but also act coopera-
tively and responsively via vehicle-to-everything (V2X) com-
munications. Depending on platooning scenarios and applica-
tions, the V2X communications typically include vehicle-to-
vehicle (V2V, i.e., communication among adjacent vehicles)
communications, vehicle-to-infrastructure (V2I, e.g., road-
side units) communications and vehicle-to-pedestrian (V2P)
communications. Compared with an ACC-based platooning
control strategy, a CACC-based distributed cooperative longi-
tudinal platooning control strategy can guarantee the desired
platoon performance under smaller spacings without compro-
mising safety due to the additional wireless V2V communica-
tions beyond line-of-sight of onboard sensors.
Albeit V2V communications allow CAVs to learn about the
platoon dynamics and behaviors of their adjacent vehicles, the
introduction of a wireless network makes a vehicular platoon
system more exposed to external malicious actors. In other
words, adversaries may viciously hack into, interfere with or
interrupt the wireless network in order to disrupt the desired
platooning control objective. For example, the broadcast data
of interest between neighboring CAVs may be blocked from
reaching their destinations under denial-of-service (DoS)
attacks, or modified by maliciously altering their contents and
inserting falsified data under false data injection attacks [19].
In the presence of malicious attacks, the traditional platoon-
ing control methods without incorporating security countermea-
sures thus need to be re-evaluated, and novel platooning con-
trol strategies are highly desirable to ensure security and
safety for CAVs against attacks.
A. Literature Review
The existing security methods for safeguarding CAV pla-
toons can be arguably classified into three types: 1)
prevention-based methods, 2) detection-based methods, and 3)
resilience-based methods.
Prevention-based methods often leverage information assur-
ance techniques (e.g., advanced cryptographic algorithms,
data authentication, access control) to prevent adversaries
from getting access to the communication network and perfor-
ming malicious actions. For example, in [20], a secure IEEE
802.11p and VLC-based hybrid communication protocol, fea-
turing secret key establishment, message authentication and
jamming detection and reaction, is proposed for ensuring pla-
toon stability against data packet injection, channel overhea-
ring, jamming, and platoon maneuver attacks. It should be
noted that the prevention-based methods do not exploit the
compatibility of data with the vehicle dynamics and thus may
be ineffective against malicious attacks on vehicular system
components. A comprehensive review of this type of security
methods for CAVs is beyond the scope of this study. On the
other hand, adopting secure system components like smart
sensors and actuators that can report unusual actions also
offers certain level of prevention against external attacks.
Whereas, the cost of physically protecting the system compo-
nents or employing advanced secure components can be
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1235
excessively high, especially when the vehicle platoon system
involves a large number of such secure components.
Detection-based methods aim to detect the occurrence of a
particular type of attacks such as false data injection attacks.
From the physical protection viewpoint, CAVs may also
deploy additional secure sensors for detecting abnormal activ-
ities. From the perspective of system estimation and control,
however, the focus is placed on designing a suitable state esti-
mator or observer on each CAV, based on either Kalman fil-
tering theory, set-evaluated theory, adaptive estimation theory,
or neural networks, to estimate the corrupted vehicle dynami-
cal state in real-time and further set out a warning alarm when
attacks are detected. For example, in [21], a real-time sensor
anomaly detection method, combining a convolutional neural
network, a Kalman filter, and a well-established χ2-anomaly
detector, is presented to detect and identify unusual CAV
behaviors caused by either malicious cyber attacks or faulty
vehicle sensors. In [22], an observer-based method, which
leverages an adaptive extended Kalman filter and a previ-
ously-trained one class support vector machine model, is
developed to improve the anomaly detection performance in
CAV sensors. In [23], the DoS attacks are modeled as a time
delay in information processed by the network, and a set of
adaptive estimators and sliding mode observers are designed
to estimate the delay. The DoS occurrences are then identi-
fied via comparing the delay and some predefined threshold at
each time instant. In [24], a set-membership prediction and
estimation method is proposed to detect the occurrence of
cyber attacks on both sensor measurements and control com-
mands of CAVs. Two recovery mechanisms are presented to
restore the attacked CAVs to normal operations.
Resilience-based methods typically rely on some security-
inherited controllers or control laws that are robust and
resilient to the effects of attacks on the closed-loop system sta-
bility and performance. Here, resilience characterizes the sur-
vivability of the platoon control system to remain in operation
even in the presence of malicious attacks on CAVs. It is clear
that detection-based methods only provide the first step
towards secure monitoring of vehicle platoon systems, while
resilience-based methods deliver a further control goal of pre-
serving the security requirement of vehicle platoon systems.
Furthermore, most of the existing literature on resilient pla-
tooning control concerns two types of attacks on CAVs: DoS
attacks (or jamming attacks) and deception attacks. Specifi-
cally, DoS represents a common cyber attack strategy that
makes the data transmissions unavailable or inaccessible at the
receiver’s side, namely, disrupting the data availability. DoS
attacks on CAVs are typically accomplished by interfering
with the radio frequency of a vehicular communication net-
work or flooding the V2V network access with superfluous
requests in an attempt to overuse the network resources and
prevent legitimate vehicles from being connected. On the
other hand, deception attacks generally jeopardize the data
integrity or trustworthiness. Typical deception strategies
include false data injection, replaying, and spoofing. For
example, in [18], both false data injection attacks against on-
1236
board range sensors and message delay attacks against data
transmissions in the dedicated short range communication
protocol are considered for platooning CAVs. The reachabil-
ity analysis method is then applied to evaluate the impact of
two types of attacks on the safety performance of both ACC-
based and CACC-based platoons. In [25], the impact of
stochastic jamming attacks on vehicular CACC systems is
studied, where the jammer’s destructive signal is modeled as
an additive Gaussian noise. A sufficient condition on success-
ful packet delivery probability under which the mean string
stability of the platoon system remains stable is derived. In
[26], a secure adaptive synchronization-based control method
is developed for cooperative driving of CAVs subject to com-
munication delays and cyber attacks. It is shown that the
designed platoon controllers can be used to resist several dif-
ferent types of attacks, including spoofing attacks on vehicu-
lar accelerations, message falsification attacks on vehicular
positions and speeds, DoS attacks and burst transmission
attacks on data transmissions over the network. In [27], a
switching distributed secure platoon control technique is
devised for CAVs subject to DoS attacks. By modeling the
DoS attacks as a series of switching behaviors at sampling
instants, the resultant platoon control system is modeled as a
switched time-delay system. Similarly, a switching distri-
buted event-triggered controller is designed in [28] for vehi-
cle platooning under a class of periodic jamming attacks, and
a CACC-ACC switching control method is exploited in [29],
[30] for CAVs subject to inter-vehicle communication inter-
ruptions/losses. In [31], a neural adaptive secure distributed
platooning control approach is developed to cope with a class
of intermittent DoS attacks, wherein each platoon vehicle
equips a logical data packet processor to verify the time-
stamps of the received data packets and further identify the
DoS attack occurrence. In [32], by modeling DoS attacks as
consecutive packet dropouts, a hybrid platoon controller, com-
bining a continuous-time proportional-derivative regulator and
a zero-order-hold device, is proposed to guarantee required
platoon string stability and performance while maximizing
DoS resiliency.
B. Motivations
Most resilient platooning control methods aforementioned
for tolerating the effects of DoS attacks rely on certain
assumptions on the DoS attacks. For example, the DoS or
jamming attack signal in [25] is assumed to abide by a Gaus-
sian distribution noise of a priori statistical characteristics
(e.g., given mean and variance), the DoS attacks in [26] are
assumed to cause a delay effect and then lumped together as a
communication delay in data transmissions, the DoS attacks in
[27], [29] and [30] are required to be known (detected) in
advance such that the platoon controller can switch between
different control laws/strategies, and the DoS attacks in [28]
are assumed to occur periodically within some known (or
active) time intervals. Hence, it is desirable to establish a gen-
eral and realistic DoS attack model that requires a priori attack
knowledge as less as possible, which serves as the first moti-
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023
vation of this study.
While the platoon controller design of CACC-enabled
CAVs has been widely investigated, the majority of the exist-
ing design methods assume homogeneous vehicular platoons
in terms of same masses and engine inertial delays (a.k.a.,
actuator lags, power-train constants) [18], [26], [27], [31]–[34]
and/or linearized longitudinal vehicle dynamics [18], [25]–[30],
[32]–[34]. However, in practical platooning scenarios, auto-
mated vehicles are essentially heterogeneous (e.g., different
size and weight). The vehicle mass and power-train dynamics
can significantly affect the vehicle driving performance such
as fuel cost. Furthermore, the dynamic behavior of a vehicle
longitudinal model is considerably complicated and nonlinear,
involving engine, torque converter, transmission, drive-train,
throttle and brake actuators, external disturbances (e.g., wind
gust), and so on, which leads to inherently uncertain and non-
linear longitudinal vehicle dynamics. As a matter of fact,
cooperatively driving a platoon of vehicles has to overcome
the road friction, gravity and longitudinal aerodynamic drag
forces. In this sense, the existing platooning control methods
assuming homogeneous and/or linearized longitudinal vehicle
dynamics may need to be re-assessed, which gives rise to the
second motivation of this study.
Vehicle platooning control is subject to requirements related
to safety and scalability [35]. Specifically, a longitudinal vehi-
cle control system should exhibit stable platoon behaviors,
including individual vehicle stability (achieving stable spac-
ing error and velocity/acceleration tracking error systems) and
string stability (avoiding the amplification of disturbance
effects along the platoon), to prevent collisions. The defini-
tions of string stability are relatively diverse and ambiguous in
the literature. Interested readers are referred to the surveys
[36], [37] in detail. However, it is noteworthy that some
vehicular platoons achieve one form of string stability but
may remain unstable in another sense [36]. This thus calls for
an intrinsically safety-guaranteed or collision-free platoo-
ning control method. On the other hand, scalability represents
a key measure for evaluating applicability of a vehicle pla-
tooning control method in cases of variable platoon lengths
and dynamic maneuvers such as splitting and merging. Never-
theless, many existing platooning control methods are
restricted to length-fixed vehicle platoons and/or specific V2V
communication topologies [18], [25], [28]–[30], [32] and [35].
This indicates that the platoon controllers therein might need
to be re-designed in an attempt to ensure the desired stability
and performance requirements for the new platoon due to
length or topology changes. This aspect has not been adequa-
tely addressed in the literature, but is of utmost importance in
order to empower flexible and dynamic platoon maneuvers.
How to develop a scalable collision-free platooning control
method for CAVs is the third motivation of this study.
C. Contributions
Based on the observations above, in this paper, we investi-
gate a distributed cooperative platooning control problem for
CAVs in the presence of intermittent DoS attacks and uncer-
tain vehicle dynamics. The novelty of this study lies in the
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
development of a resilient and safe distributed longitudinal
platooning control method. To the best of the author’s knowl-
edge, this study is among the first few attempts to guarantee
simultaneously the platoon stability as well as resilience,
safety and scalability requirements of CAVs subject to DoS
attacks. The main contributions of this paper are summarized
as follows.
1) A heterogeneous and uncertain longitudinal vehicle
dynamic model is established. The model accounts for the
simultaneous presence of heterogeneous vehicle parameters
such as unknown vehicle masses and engine inertial delays,
uncertain and nonlinear resistance forces, and a dynamic pla-
toon leader.
2) A general DoS attack model is presented, which incorpo-
rates the intermittent nature of realistic DoS actions but
requires less a priori knowledge of the DoS attacks. In particu-
lar, the model constrains only the attacker actions in terms of
the attack duration without requiring specific statistical and
accurate knowledge of DoS attacks. Furthermore, the dura-
tion bound of intermittent DoS attacks is not required to be
precisely known. On one hand, a data packet analyser that can
be employed by each platoon vehicle is devised to identify the
occurrence of DoS attacks and further record the maximal
DoS duration over a certain time window. On the other hand,
a theoretical condition for estimating the maximal allowable
DoS duration is also derived. The concerned attack model can
be used to accommodate many different types of DoS attacks
including the wide-studied periodic DoS attacks, aperiodic
DoS attacks, and random DoS attacks.
3) A resilient and safe distributed longitudinal platooning
control law is developed. The proposed platoon controllers are
capable to withstand the adverse effects of intermittent DoS
attacks and adaptively slow down each platooning vehicle
once it gets close to its direct predecessor to avoid absolute
collisions. Another prominent feature of the proposed platoon-
ing control method is its scalability. It will be shown that the
distributed longitudinal control law can be implemented by
each platoon vehicle in a distributed fashion, i.e., each vehicle
only requires information recorded by its on-board sensors
and information gathered from its underlying neighbors speci-
fied by the V2V communication topology. It will be also illus-
trated that the platooning control method is flexible with
respect to V2V communication topologies (or information
flow topologies), thus eliminating the limitation to the spe-
cific predecessor-following topology in [18], [25], [28]–[30],
[32], [35].
4) A tractable offline design algorithm on the simultaneous
existence of the desired local state observers and platoon con-
trollers is provided. Furthermore, the boundedness of the
resultant platoon tracking errors and spacing errors against
various uncertainties and DoS attacks is formally proved. The
design algorithm is scalable over various V2V communica-
tion topologies in the sense that even in the event of vehicle
length variations the already designed platoon controller
parameters may be re-used for the new platoon. It will be also
demonstrated that the design algorithm can be used to achieve
a comprehensive trade-off analysis between desired platoon
performance and attack severity.
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1237
D. Outline of the Paper
The remainder of this paper is organized as follows. The
preliminaries and the problem formulation are presented in
Section II. The main results in terms of a design algorithm and
rigorous stability analysis are stated in Section III. The effec-
tiveness of the proposed platooning control method is vali-
dated through several numerical experiments in Section IV.
Section V concludes this paper.
II. Preliminaries and Problem Formulation
A. Notations
R denotes the set of real numbers. R≥0 denotes the set of
non-negative real numbers. Z≥0 denotes the set of non-nega-
tive integers. The transpose of a matrix or vector Φ is denoted
by ΦT . If a matrix is invertible, the superscript “ −1” repre-
sents the matrix inverse. For a matrix Φ, its minimum and
maximum singular values are denoted by σ(Φ) and σ(Φ) ,
respectively. For a real, positive definite, and symmetric
matrix Φ, its minimum and maximum eigenvalues are denoted
by λ(Φ) and λ(Φ), respectively. I (correspondingly, 0) repre-
sents the identity (correspondingly, zero) vector or matrix of
an appropriate size. diag{Φ1 , Φ2 , . . . , Φm } is used to denote an
m-block diagonal matrix with Φi , ∀ i = 1, 2, . . . , m , being the i-
th diagonal element. ∥ · ∥ denotes the Euclidean norm of a vec-
tor. ⊗ denotes the Kronecker product. Matrices, if not explic-
itly stated, are assumed to have compatible dimensions.
B. Uncertain Heterogeneous Longitudinal Vehicle Dynamics
Consider a group of N + 1 automated vehicles being maneu-
vered by using a cooperative longitudinal control strategy for
a resilient and safe vehicle-following objective on a sloping
road, as shown in Fig. 1 (a). The vehicle, indexed by 0, is
denoted as the leader and the other vehicles, indexed by
i ∈ V = {1, 2, . . . , N}, are assigned as the followers. Each vehi-
cle is modeled as a single point mass, and pi (t), vi (t) , ai (t), and
ȧi (t) ∈ R are used to denote the longitudinal position, velocity,
acceleration, and jerk of vehicle i at time t ∈ R≥0, respectively.
It is assumed that each platoon vehicle is equipped with 1) an
on-board radar that can measure the gap distance between any
two consecutive vehicles for collision detection, 2) a built-in
GPS sensor for measuring the vehicular longitudinal position
information, 3) a wireless transceiver for sharing information
of interest with its proximal vehicles via V2V communica-
tions, and 4) an engine control unit for calculating the desired
engine force/torque. Such an assumption is reasonable as the
sensing, communication and actuation units requested above
are available in modern CAVs, and thus does not require spe-
cific changes in the existing vehicle configuration.
A vehicle longitudinal control system mainly consists of
engine, throttle and brake actuators, drive train, transmission,
and torque converter. Under a variety of resistance forces, as
illustrated in Fig. 1(b), the longitudinal dynamics of each pla-
toon vehicle i can be modeled by the following force balance
equation:
mi ai (t) = fie (t) − Fire (t), t ∈ R≥0 (1)
where mi stands for the mass of vehicle i; fie (t)
is the desired
g
engine force acting on vehicle i ; and Fire (t) = fi (t) + fiw (t)+
1238 IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023

pi (t),
vi (t), where
fi w(t) ai (t)
fi e(t) xi (t) = [pi (t), vi (t), ai (t)]T , ∆i (t) = ∆i (vi , ai , ȧi )
fi g(t)
mi g
0 1 0 
  [ ]T
DoS (b) θi(t) fi r(t) 0 0 1  , B̌ = 0, 0, 1 .
Ǎ =  
 τ0
(t, x̂0(t)) 0 0 − τ10
Radar (t, x̂1(t))
(t, x̂2(t)) Due to the digital nature of wireless V2V communications,
the vehicular data are required to be sampled in a discretized
manner and then shared over the wireless V2V channels in a
DoS
packet-based manner. Besides, virtually all control algorithms
Attacker are implemented on digital modules, which means that pla-
(a)
toon controllers operate only at discrete instants in time. For
this purpose, under the sampling period h > 0, the discrete-
Fig. 1. Platooning control and dynamics of CAVs: (a) The schematic of time version of the longitudinal dynamics of (6) is given as
platooning control in the presence of DoS attacks; (b) The main longitudinal
xi (k + 1) = Axi (k) + B(ui (k) + ∆i (k)), k ∈ Z≥0 (7)
forces acting on a CAV.
where xi (k) = [pi (k), vi (k), ai (k)]T denotesr the vehicular state at
fir (t) denotes the lumped uncertain resistance force on vehicle h
time step k, A = exp(Ǎh), and B = 0 exp(Ǎs)ds B̌. It is
g
i. Specifically, fi (t) = mi g sin(θi (t)) represents the gravity
assumed that a dynamic platoon leader is present, which can
component parallel to the road surface with g = 9.81 m/s2 be a substantial human-driven vehicle or a fictitious leader
denoting the acceleration of gravity and differentiable θi (t) acting as some reference for the platoon. Specifically, the pla-
representing the inclination angle of the road; fiw (t) is the air toon leader evolves according to
resistance force satisfying fiw (t) = (1/2)ρC D AF (vi (t) + vw (t))2
with ρ being the air density; AF being the maximal cross-sectio- x0 (k + 1) = Ax0 (k) + Bu0 (k), k ∈ Z≥0 (8)
nal/frontal area of the vehicle; C D being the aerodynamic drag where x0 (k) = [p0 (k), v0 (k), a0 (k)] denotes the leader state at
T

coefficient; and vw (t) being the uncertain headwind speed; and time step k and u0 (k) denotes an unknown input that serves as
fir (t) = µR mi g cos(θi (t)) denotes rolling resistance force with the reference acceleration commands for the platoon.
µR being the coefficient of rolling resistance.
C. A Vehicular Position-Based Local State Observer
By modeling the engine inertial lag as a first-order filter, the
engine force fie (t) can be given by Different from the existing state-based platoon control
approaches which require the full state information xi (k) of
τi f˙ie (t) + fie (t) = uei (t), t ∈ R≥0 (2) each vehicle for platoon control and maneuver, we are inter-
with being the actual engine throttle/brake input and τi
uei (t) esting in constructing and designing some local observers for
denoting the unknown inertial lag. the follower vehicles based on only the available position
Substituting fiw (t) into (1) yields that measurements. More specifically, for each follower vehicle i,
the real-time noisy position measurement is given as
1
fie (t) = mi g sin(θi (t)) + ρC D AF (vi (t) + vw (t))2
2 yi (k) = pi (k) + ϑi (k) = Cxi (k) + ϑi (k), ∀i ∈ V (9)
+ µR mi g cos(θi (t)) + mi ai (t). (3) where yi (k) ∈ R denotes the measurement output recorded by
Note that τi can be rewritten as τi = τ0 + τ̃i with τ0 denoting the built-in GPS unit of each platoon member, C = [1, 0, 0],
the nominal part and τ̃i denoting the uncertain part. Then, cal- and ϑi (k) ∈ R denotes the unknown measurement noise.
culating the time derivative of (1) yields that To acquire a real-time and accurate estimate of the unavail-
able full state xi (k) , each follower vehicle i runs the following
τ0 ȧi (t) + ai (t) = ui (t) + ∆i (vi , ai , ȧi ), t ∈ R≥0 (4) local state observer based on the noisy position measurement:
where ui (t) = uei (t)/mi denotes the control input and 


 x̂i (k + 1) = A x̂i (k) + B(ui (k) + ∆ˆ i (k))
τi ρC D AF 


∆i (vi , ai , ȧi ) = − (vi (t) + vw (t))(ai (t) + v̇w (t)) 
 + L(C x̂i (k) − yi (k)) (10)
mi 


ˆ
ρC D AF ∆i (k + 1) = ∆ˆ i (k) + F(C x̂i (k) − yi (k))
− (vi (t) + vw (t))2 − g sin(θi (t)) for any k ∈ Z≥0, where x̂i (k) = [ p̂i (k), v̂i (k), âi (k)]T is the vehic-
2mi
ular state estimate; ∆ˆ i (k) denotes an estimate of the unknown
− τi g cos(θi (t))θ̇i (t) − µR g cos(θi (t))
input signal ∆i (k); ui (k) denotes the desired control input sig-
+ τi µR g sin(θi (t))θ̇i (t) − τ̃i ȧi (t) (5) nal to be specified later; L and F are the observer gain matri-
represents the lumped uncertainties resulting from various ces to be designed.
resistance forces and uncertain dynamics. The above longitu-
D. V2V Communication
dinal dynamics can be rewritten in a compact form of
In order achieve the cooperative longitudinal platooning
ẋi (t) = Ǎxi (t) + B̌(ui (t) + ∆i (t)), t ∈ R≥0 (6) control objective, each platoon member i employs a wireless

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
transceiver, allowing its local vehicle information to be shared
with its underlying neighbors in accordance with certain V2V
communication topology over the network.
By regarding each follower vehicle as a node in a graph, the
V2V communication topology of the N-vehicle platoon can be
modeled by a weighted graph G = (V, E, A) , where V = {1,
2, . . . , N} is a node set, E ⊆ V × V is an edge set of paired
nodes with ( j, i) representing a directional edge from node j to
node i , and A = [ai j ] ∈ RN×N is a weighted adjacency matrix
with ai j ≥ 0 being the adjacency element of the edge ( j, i) . It is
assumed that self-loops are not contained in the graph, i.e.,
aii = 0 . The graph G is directed if A is a non-symmetric
matrix with ai j , a ji and undirected if A is a symmetric
matrix with ai j = a ji for all i, j ∈ V . The incoming neighbors
of node i is denoted by Niin = { j ∈ V : ( j, i) ∈ E} and the outgo-
ing neighbors of node i is denoted by Niout = { j ∈ V :(i, j) ∈ E}.
The Laplacian matrix associated with G is defined as
∑ ∑ ∑ collision avoidance function uoa
L = D − A with D = diag{ Nj=1 a1 j , Nj=1 a2 j , . . . , Nj=1 aN j }.
Let the leader vehicle be an additional node 0. Whether or
not a follower (node i) can receive information from the leader
(node 0) is specified by a nonnegative element ai0 ≥ 0 for any
j ∈ V ∪ {0}. Denote A0 = diag{a10 , a20 , . . . , aN0 }. For simplic-
ity but without loss of generality, it is assumed that the matrix
H = L + A0 is nonsingular. Then, there exists an invertible
matrix U such that H can be factorized as U −1 HU = Λ,
where Λ is the diagonal matrix whose diagonal elements are
the corresponding eigenvalues of H , i.e., Λii = λi for any
i ∈ V . Such an assumption is mild and can accommodate sev-
eral typical V2V communication topologies [38], including
predecessor following (PF) topology, leader-predecessor-fol-
lowing (LPF) topology, bidirectional (BD) topology, leader-
bidirectional (LBD) topology, two predecessor-following
(TPF) topology, and leader-two-predecessor-following (LTPF).
Assumption 1: For each follower vehicle i ∈ V , the local
state estimate x̂i (k) is shared with its underlying outgoing
neighbors specified by Niout .
Remark 1: It is much less demanding to exchange the vehic-
ular state estimate x̂i (k) than the unknown full state xi (k) for
each vehicle i ∈ V . This is because the real-time state compo-
nents, including position pi (k) , velocity vi (k) and acceleration
ai (k), are often obtained via on-board sensors. Some state
components such as the real-time velocity and acceleration are
difficult to measure accurately in practice. In contrast, the
state estimate x̂i (k) can be precisely provided by the local state
observer of each CAV.
E. Platoon Safety
When the vehicle longitudinal dynamics are linear and
deterministic, string stability is often analyzed using the fre-
quency domain approach for assessing platoon safety. How-
ever, considering the uncertain heterogeneous longitudinal
model (1) or (6) and the generic wireless communication
topology G as well as the intermittent DoS attacks, such a
string stability notion is difficult to be adopted here to evalu-
ate the platoon performance. Therefore, we propose an effec-
tive collision avoidance mechanism to guarantee safe behav-
iors of platooning vehicles.
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1239
Denote the relative distance between vehicle i and its prede-
cessor i − 1 at time t by
Ri (k) = pi−1 (k) − pi (k), ∀ i ∈ V (11)
which can be obtained in real time via an on-board radar
mounted in front of each vehicle. We next introduce the fol-
lowing collision avoidance function at vehicle i.
Definition 1: The collision avoidance function uoa i (Ri (k)) is
a piecewise continuous function of Ri (k) satisfying the follow-
ing properties:
i (Ri (k)) → ∞ if Ri (k) → 0;
1) uoa
i (Ri (k)) = 0 if Ri (k) > S 0; and
2) uoa
i (Ri (k)) is bounded if Ri (k) ≤ S 0;
3) uoa
where S 0 denotes the prescribed safe distance threshold.
Let Ωi (pi ) = {pi (k)| Ri (k) ≤ S 0 } be a compact set that speci-
fies the collision-risky zone for each vehicle i moving towards
its predecessor i − 1. Then it is clear from Definition 1 that the
i (Ri (k)) will not be activated if
vehicle i is far away from its predecessor, namely, pi (k) <
Ωi (pi ). However, as vehicle i enters the collision-risky zone,
the collision avoidance function uoa i (Ri (k)) comes into play
and pushes vehicle i away when vehicle i is getting close to its
predecessor from S 0.
F. Model of Intermittent DoS Attacks
For each platoon vehicle i ∈ V , the vehicular state estimate
x̂i (k) is encapsulated into a data packet with its time-stamp k,
namely, (k, x̂i (k)) . Furthermore, the encapsulated vehicular
data packets are broadcast and transmitted to their neighbors
over wireless V2V communication channels in a concurrent
manner for accomplishing a cooperative longitudinal control
objective. However, due to the existence of malicious adver-
saries, the data packets sent at time step k from each vehicle i
may not arrive at its neighboring vehicles immediately and
successfully at the same time step k. For example, one typical
attacking scenario is that a malicious vehicle driving aside the
platoon is to deliberately block desired information exchanges
between vehicles. Another possible attacking scenario is that a
signal jammer mounted on a flying drone over the platoon is
equipped with some signal broadcasting device in such a way
as to jam the V2V communication channels whenever the
vehicles transmit their information. A direct consequence of
such malicious attacks is that the real-time V2V communica-
tions are intermittently interrupted, resulting in the vehicular
data packet losses over the network. Our emphasis is then
placed on investigating the effects of such malicious DoS
attacks. To capture the intermittent behavior of DoS attacks,
we denote by Sm ≜ {tm |m ∈ N≥0 ; tm ∈ N≥0 ; t0 = 0} the set of
non-decreasing packet arriving time steps of the transmitted
data packets at their destinations and Im ≜ {tm , tm + 1, . . . , tm+1 −
1} the data packet arriving intervals between the last arriving
time step tm and the current time step tm+1 for any i ∈ V . Fur-
thermore, define Dm ≜ {tm+1 − tm |tm+1 − tm ≥ 1; m ∈ N≥0 } , wh-
ere each element in the set Dm is referred to as the DoS attack
duration. When the V2V communication channels are free of
DoS attacks, one has that tm+1 − tm = 1.
Given the time-stamped feature of the transmitted vehicular
data packets, a data packet analyser (DPA) is developed in
1240 IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023

To neighboring From neighboring

vehicles Wireless V2V communication vehicles

Transmitter WiFi Receiver

Noise ϑi(k)
(k, x^i(k)) {(tm, x^j(tm)), ∀j∈Ni}
pi(k) + yi(k) x^i(k) τM
GPS + Local state observer Data packet
(x^i(k), Δ^ i(k)) analyser {tm}

Ri(k) uioa(Ri(k)) ηi(k)

Radar Built-in collision Δ^ i(k) Attackid(k)
avoidance mechanism K

Engine control ui(k) High-level +

−
unit controller +
Kηi(k)

Fig. 2. The longitudinal control system architecture on each platoon vehicle i, where its main system components include sensor units (radar, GPS), a wire-
less transceiver (transmitter, receiver), data processing units (a local state estimator, a high-lever controller, a collision avoidance mechanism, a data packet
analyser), and an engine control unit.

Algorithm 1 for each platoon vehicle i ∈ V to manage the designed, ∆ˆ i (k) denotes the estimate compensation for the
transmissions of the data packets and also detect the intermit- lumped uncertainty, uoa i (Ri (k)) denotes the repulsive force
tent DoS attacks. More specifically, the main function of the input acting on each vehicle i in such a way as to avoid poten-
DPA includes: tial collision with its predecessor, and ηi (k) denotes the neigh-
1) Detecting attack occurrence at each time step and out- borhood tracking error defined as
putting an indication signal Attackid (k); ∑ ( )
2) Storing the data packet arriving instants {tm }; ηi (k) = ai j x̂i (tm ) − di − ( x̂ j (tm ) − d j ) (13)
3) Recording the maximal DoS attack duration τ M ; and j∈Niin ∪{0}
4) Outputting the aggregated data ηi (k) for each vehicle i to where di = [−i × d0 , 0, 0]T denotes the prescribed spacing vec-
form the feedback control input Kηi (k) in (12). tor associated with follower i with d0 representing the longitu-
Algorithm 1 Data Packet Analyser (DPA) i, ∀ i ∈ V dinal distance between follower i and the leader 0, and
x̂0 (tm ) = x0 (k), meaning that the leader’s state is secure during
Input: Monitoring start time k0 and window size T S network communication.
Last recorded data packet arrival instant tm
Output: τ M , {tm }, {Attackid (k)}, and {ηi (k)} H. Estimation Error and Tracking Error Dynamics
Data: (k, x̂i (k)) and {(k, x̂ j (k)), j ∈ Niin } For each follower i ∈ V , define the estimation errors as
1: for k = k0 : k0 + T S do
2: Broadcast (k, x̂i (k)) to its out-neighbors Niout over G x̃i (k) = x̂i (k) − xi (k), ∆˜ i (k) = ∆ˆ i (k) − ∆i (k)
3: if data packets {(k, x̂ j (k)), j ∈ Niin } arrived then and the local estimation tracking error as
4: Set Attackid (k) = “off ” δi (k) = x̂i (k) − x0 (k) − di .
5: if k − tm − 1 > τ M then Then, the tracking error ηi (k) in (13) can be rewritten as
6: Update the bound τ M ← k − tm − 1 ∑ ( )
7: end if ηi (k) = ai j δi (tm ) − δ j (tm ) . (14)
8: Update the packet arrival instant tm ← k j∈Niin ∪{0}
9: Compute the fusion data ηi (k) in (13)
For notational convenience, define the stacked vectors
10: Update the packet arrival instant index m = m + 1
11: else //* DoS attack occurs *// νi (k) = [ϑiT (k), ∆Ti (k + 1) − ∆Ti (k)]T
12: Set Attackid (k) = “on”
13: Retrieve the last packet arrival instant tm ξi (k) = [ x̃iT (k), ∆˜ Ti (k)]T , d = [d1T , d2T , . . . , dNT ]T
14: Compute the fusion data ηi (k) in (13) ν(k) = [ν1T (k), ν2T (k), . . . , νTN (k)]T
15: end if
16: end for ξ(k) = [ξ1T (k), ξ2T (k), . . . , ξNT (k)]T
δ(k) = [δT1 (k), δT2 (k), . . . , δTN (k)]T
G. A Resilient and Safe Platoon Tracking Control Law
x̃(k) = [ x̃1T (k), x̃2T (k), . . . , x̃TN (k)]T
As illustrated in Fig. 2 , we propose the following dis-
tributed cooperative longitudinal control law on follower vehi- ũ0 (k) = [u0 (k), u0 (k), . . . , u0 (k)]T
cle i ∈ V :
ũoa (k) = [uoa
1 (R1 (k)), u2 (R2 (k)), . . . , uN (RN (k))] .
oa oa T

ui (k) = Kηi (k) − ∆ˆ i (k) + uoa

i (Ri (k)), k ∈ Im (12) Combining (7) and (10), one obtains the following estima-
where K denotes a feedback control gain matrix to be tion error dynamics:

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS 1241

ξ(k + 1) = (I ⊗ Ā)ξ(k) + (I ⊗ Ē)ν(k) (15) Ē T = [LT , F T ] = Ě P̄−1. Furthermore, implementing the obser-
[A B] ver (10) under Ē , one can further derive the estimates x̂i (k)
where Ā =  + ÊC̄ and Ē = [−Ê, [0, −1]T ] with  = 0 1 , and ∆ˆ i (k) for each follower i ∈ V at time step k ∈ Z≥0.
[ ]
Ê = FL , and C̄ = [C, 0]. Step 2: Solve out the feedback control gain matrix K . For
In view of (8)−(10), (12) and (14), the platoon tracking error scalars κ1 > 0, κ2 > 0 , and a positive integer τ M , solve the fol-
dynamics are given as lowing linear matrix inequality:
[ ]
δ(k + 1) = Ãδ(k) + B̃δ(tm ) + ϖ(k), k ∈ Im (16) Ξ̌m Ṽ
< 0, m = 1, 2 (20)
ṼT −κ1 I
where à = I ⊗ A, B̃ = H ⊗ BK , and ϖ(k) = (I ⊗ LC) x̃(k)−
(I ⊗ B)ũ0 (k) + (I ⊗ B)ũoa (k) + (I ⊗ A)d − (I ⊗ L)v(k). to determine matrices Qq > 0, q = 1, 2, 3, 4 , and V, K , where
Ξ̌m is symmetric 4-by-4 block matrix whose nonzero entries
I. The Problem to be Addressed
are given by
The longitudinal platooning controller design aims to deter-
mine a desired distributed coordination control law ui (k), Ξ̌1,1 = Q2 − Q3 − α2 Q4 + (A − I)V + VT (A − I)T
i ∈ V , such that the N followers eventually reach the same Ξ̌1,2 = Q1 − V + κ2 VT (A − I)T
speed and acceleration as the leader 0; i.e.,
Ξ̌1,3 = α2 Q4 + ςm BK, Ξ̌1,4 = Q3
evi (k) = vi (k) − v0 (k) → 0, eai (k) = ai (k) − a0 (k) → 0
as k → ∞, while simultaneously maintaining a desired longitu- Ξ̌2,2 = Q1 + τ2M Q3 + Q4 − κ2 V − κ2 VT
dinal spacing d0 between any two adjacent vehicles; viz., the Ξ̌2,3 = ςm κ2 BK, Ξ̌3,3 = −α2 Q4
position tracking error edi (k) satisfies
Ξ̌4,4 = −Q2 − Q3 , V̌ = diag{V, V, V, V}
edi (k) = pi (k) − p0 (k) − di0 → 0 as k → ∞
with α = 2 sin(π/(2(2τ M + 1))), ς1 = min{λi } and ς2 = max{λi }.
where di0 = −i × d0 with d0 being the specified constant spac- If (20) is feasible, then one has that K = KV−1. Furthermore,
ing. Note that edi (k) → 0 implies that the spacing error under a specified V2V communication topology, form the
eis (k) = pi−1 (k) − pi (k) − d0 → 0. (17) neighborhood tracking error in (13) and determine the input
term Kηi (k) of ui (k) for each follower i ∈ V .
However, given the simultaneous presence of unknown Step 3: Design the collision avoidance term uoa i (Ri (k)). For
nonlinearity ∆i (k), leader control input u0 (k), collision avoid-
any i ∈ V , based on the real-time relative distance Ri (k), the
ance function uoai (k), and measurement noise ϑi (k) , it is gener- potential of the relative distance is chosen as
ally difficult to preserve the accurate asymptotic stability of
−βi ρi (k)
the platoon tracking errors edi (k), evi (k), eai (k), or equivalently, Fioa (Ri (k)) = Ωi (k) (21)
ei (k) = [edi (k), evi (k), eai (k)]T = xi (k) − x0 (k) − di (18) where βi ≥ 0 is a prescribed scalar, ρi (k) = 1 − sgn(Ri (k) − S 0 )
and Ωi (k) = 1 − γi Φ2i (k)/(1 + Φ2i (k)) with γi = 1 + S 0−4 and
to zero for all i ∈ V as k → ∞. Instead, we aim to address the
Φi (k) = R2i (k) − S 02 .
following platooning control problem.
Then, the repulsive force input for collision avoidance at
Problem 1: For the V2V-enabled vehicular platoon of the
vehicle i is defined as the negative gradient of the potential
uncertain longitudinal dynamics (7), the objective is to design
Fioa (Ri (k)) along pi (k) , i.e.,
an admissible DoS-resilient and collision-free distributed
i (Ri (k)) = − ∇ pi F i (Ri (k))
uoa
cooperative longitudinal control law ui (k) of the form (12) for oa

any k ∈ Iim such that the resulting estimation error ξi (k) in (15)
4γi βi ρi (k)Φi (k)Ri (k) −βi ρi (k)−1
and the platoon tracking error ei (k) in (18) are uniformly ulti- = Ωi (k). (22)
(1 + Φ2i (k))2
mately bounded against system uncertainties and attacks.

III. Main Results Remark 2: From (22), if Ri (k) → 0, then Ωi → 0 and thus
i (Ri (k)) → ∞. If Ri (k) > S 0, then ρi (k) = 0 and thus
uoa
A. A Three-Step Design Algorithm i (Ri (k)) = 0. On the other hand, if Ri (k) ≤ S 0, one has that
uoa
−βi ρi (k)−1
The following algorithm outlines the main design steps of i (Ri (k)) ≤ 4γi βi ρi (k)Φi (k)Ri (k)Ωi
uoa (k). Furthermore,
−βi ρi (k)−1
the observer-based platooning control laws in (10) and (12). βi ρi (k)Ωi (k) is bounded, one thus only needs to guar-
1
Step 1: Determine the local observer gain matrices L and F antee that the function f (Φi ) = 4γi Φi (Φi + S 02 ) 2 is bounded.
in (10), and derive the estimates x̂i (k) and ∆ˆ i (k). For a scalar Indeed, the maximal value of f (Φi ) can be readily found via
κ0 > 0 , find feasible matrices P̄ > 0 and Ě such that the extreme value theorem, which equals 8αi S 03 /3 2 at Φi =
3

 
 −P̄ ÂT P̄ + C̄ T Ě ÂT P̄ + C̄ T Ě  −(2/3)S 02 . As a result, uoa i (Ri (k)) in (22) is bounded. In other
 T  < 0 words, uoa (R (k)) in (22) is a valid collision function as speci-
P̄ Â + Ě C̄ −P̄
T (19)
0  i i
fied in Definition 1.
P̄ Â + Ě C̄
T T 0 −κ0 I
Remark 3: From Steps 1 and 2, it is clear that the observer
holds, where  and C̄ are given in (15). Then, one obtains that and controller gain matrices L, F and K can be both deter-

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1242
mined in an offline manner via solving the linear matrix
inequalities (19) and (20). Regarding the positive integer τ M
in Step 2, the following two aspects are noted. First, given the
offline feature of the design algorithm above, the system
designers may use τ M as a tuning parameter for evaluating the
resilience of the proposed design algorithm against intermit-
tent DoS attacks. This enables a tradeoff analysis between pla-
toon performance and attack severity, which will be demon-
strated through a numerical case study in Section IV-B. In
particular, the maximal attack resilience can be determined by
finding a solution to an optimization problem τ∗M = max(τ M )
subject to (20). In this case, τ∗M represents an estimate of the
attack duration bound τ M in the DPA and can be interpreted as
the maximum allowable DoS duration bound under the pro-
posed platooning control law. Second, one may turn the pro-
posed controller design step into an online procedure to estab-
lish a direct relationship between the real-time network condi-
tion under DoS attacks and the adjustable control perfor-
mance. For example, the proposed DPA can be employed to
monitor the interrupted network condition and record the
attack duration τ M over some sliding window. Such a parame-
ter τ M is then used to achieve the resilient controller design in
Step 2.
Remark 4: A salient feature of the proposed design algo-
rithm above lies in its scalability to variable platoon lengths
under certain V2V communication topologies. In other words,
even when the number of platooning vehicles varies, the
implementing controllers may remain functional. For exam-
ple, under a PF topology, ς1 = ς2 = 1 in (20) holds for any
number of vehicles (i.e., N ); under LPF and TPF topologies,
ς1 = 1 and ς2 = 2 hold for any N ; under an LTPF topology,
ς1 = 1 and ς2 = 3 hold for any N. Although ς1 and ς2 are dif-
ferent under BD and LBD topologies when the vehicle length
varies, one may predict the potential maximum platoon length
and derive a worst-case platoon controller design. Such a scal-
able feature is promising for flexible platoon maneuvers, such
as platoon splitting and merging as well as lane changing.
B. Formal Stability Analysis
The following theorem states a formal stability analysis cri-
terion for the estimation error dynamics (15) and platoon
tracking error dynamics (16).
Theorem 1: For the vehicular platoon (7) and (8), under the
position-based local observer (10) and the intermittent pla-
toon tracking control law (12), all variables of the estimation
error dynamics (15) and the tracking error dynamics (16) are
uniformly ultimately bounded if 1) there exists a matrix P̄ > 0
such that the following discrete algebraic Riccati equation:
ĀT P̄Ā − P̄ + κ0−1 ĀT P̄P̄Ā = −Ū
holds, where k0 > 0 is a scalar and Ū > 0 is a matrix, and 2)
there exist matrices Q̄q = I ⊗ Qq > 0, q = 1, 2, 3, 4 , and V such
that the following linear matrix inequality:
Θ = Ξ + V̌ T Ǎ + ǍT V̌ + κ1−1 I < 0
holds, where κ1 , κ2 are positive scalars, τ M is a positive inte-
ger, Ξ = [Ξm,n ] is symmetric 4-by-4 block matrix with its
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023
nonzero entries given by
Ξ1,1 = Q̄2 − Q̄3 − α2 Q̄4 , Ξ1,2 = Q̄1 , Ξ1,3 = α2 Q̄4
Ξ1,4 = Q̄3 , Ξ2,2 = Q̄1 + τ2M Q̄3 + Q̄4
Ξ3,3 = −α2 Q̄4 , Ξ4,4 = −Q̄2 − Q̄3
V̌ = [I ⊗ V, I ⊗ κ2 V, 0, 0], Ǎ = [(Ã − I), −I, B̃, 0].
Furthermore, the spacing errors eis (k), i ∈ V , in (17) on each
follower vehicle can be regulated into some small neighbor-
hood around zero.
Proof: See Appendix. ■
Remark 5: It is noted from (23) that the observer gain matri-
ces L, F can not be directly solved out due to the coupling
with the Lyapunov matrix P̄ . The equivalence between the
Riccati equation (23) and the linear matrix inequality (19) can
be verified via the Schur complement [39]. On the other hand,
due to the nonlinear terms of V T BK in (24), it is difficult to
solve out the control gain K . Furthermore, (24) involves the
matrix H and the Kronecker product ⊗ . This means that the
control design criterion specified by (24) is not scalable to a
vehicular platoon of a variable or large size. To tackle the two
issues above, pre-multiplying and post-multiplying (24) by
diag{U −1 ⊗ I, U −1 ⊗ I,U −1 ⊗ I, U −1 ⊗ I} and its inverse, respec-
tively, and recalling U −1 HU = Λ, the left-hand side of the
resultant inequality is an N -block diagonal matrix. Applying
the Schur complement [39], one further has that
[ ]
Ξ̃ + Ṽ T Ai + ATi Ṽ I
Θ̃ = < 0, ∀ i ∈ V (25)
I −κ1 I
where Ξ̃ is symmetric 4-by-4 block matrix with its nonzero
entries given by
Ξ̃1,1 = Q2 − Q3 − α2 Q4 , Ξ̃1,2 = Q1
Ξ̃1,3 = α2 Q4 , Ξ̃1,4 = Q3 , Ξ̃2,2 = Q1 + τ2M Q3 + Q4
Ξ̃3,3 = −α2 Q4 , Ξ̃4,4 = −Q2 − Q3
Ṽ = [V, κ2 V, 0, 0], A = [(A − I), −I, λi BK, 0].
It is clear from the second diagonal element of Θ̃ that
κ2 (V + V T ) > Q1 + τ2M Q3 + Q4 > 0, which indicates that V is
nonsingular. Then, pre-multiplying and post-multiplying (25)
by diag{V −T , V −T , V −T , V −T } and its transpose, respectively,
and denoting V = V −1 , Qq = VT Qq V , q = 1, 2, 3, 4 , and K =
KV yield that
[ ]
Ξ̌i V̌
< 0, ∀ i ∈ V (26)
V̌T −κ1 I
where Ξ̌i shares the same structure with Ξ̌m in (20) except
replacing ςm in Ξ̌m by λi . It is noteworthy that the inequalities
(23) (26) are linear with respect to V, Qq , q = 1, 2, 3, 4 , and K for
fixed λi . As a result, it suffices to verify two inequalities in
terms of the largest and smallest eigenvalues ς1 and ς2 , which
straightforwardly leads to (20).
(24) IV. Numerical Experiments
In this section, the effectiveness and merits of the proposed
platooning control approach are validated via a convoy of
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
seven CAVs moving on a real-world 9.65 km section of road-
way measured by [40]. The road profile, including road length
and road elevation, is shown in Fig. 3(a).
350
340 120
Elevation (m)
90
330
320 80
310
300
290
0 1 2 3 4 5 6 7
Distance (km)
(a) Road profile
120
v0(t) (km/h)
100
80
60
40
0 50 100 150
200 250 300 350 400
Time (s)
(b) Commanded leader control input and leader speed
Fig. 3. The profile of a real-world 9.65 km section of roadway: (a) road ele-
vation [40] and (b) the commanded leader control input u0 (t) and speed v0 (t)
for achieving and maintaining the specified speed references (80 km/h, 120
km/h, 90 km/h, 40 km/h).
A. Platooning Scenarios and Parameter Setups
We consider the following two platooning scenarios.
(S1) A platoon of seven passenger vehicles: the heterog-
enous vehicle masses are chosen as {mi }6i=0 = {2.350 , 2.260 ,
2.393, 2.400 , 2.380 , 2.385, 2.295} ton.
(S2) A platoon of seven heavy-duty vehicles: the heterog-
enous vehicle masses are chosen as {mi }6i=0 = {38.5 , 37.5, 40.5,
41.1, 38.8, 39.5, 38.0} ton.
The other platoon parameters in both scenarios are outlined
as follows. The scalar parameters in the design algorithm are
taken as κ0 = 1000, κ1 = 0.5 and κ2 = 3.5. The safe distance
threshold is set as S 0 = 5 m. To characterize the air drag force
fiw (t), we assume a time-varying wind velocity vw (t) =
Aw sin(2π fw t) m/s (positive for headwind and negative for tail-
wind) on each follower vehicle i ∈ V during platoon maneu-
vering in both (S1) and (S2) scenarios, where Aw = 10 and the
excitation frequency fw = 0.01 Hz. Furthermore, ρ = 1.2
kg/m3, AF = 2.23 m2, Cd = 0.59 and µR = 0.01 in the (S1) sce-
nario; ρ = 1.29 kg/m3, AF = 10.26 m2, Cd = 0.6 and
µR = 0.007 in the (S2) scenario; the road inclination angle
θi (t) and its derivative in both scenarios are obtained based on
the road profile shown in Fig. 3(a). The platoon starts from the
origin with a constant cruise speed (p0 (0), v0 (0), a0 (0)) =
(0 m, 40 km/h, 0 m/s 2 ) and zero initial tracking errors. The
inertial delays for each platoon vehicle in either platoon sce-
nario above are taken as {τi }6i=1 = {0.770, 0.815, 0.820 , 0.805,
0.810 , 0.780} s with τ0 = 0.800 s. The desired spacing bet-
ween any two successive vehicles is set as d0 = 10 m. The
sampling period is chosen as h = 10 ms, and the simulation
time is taken as 418 s. The position measurements on each
vehicle suffer from some random noises ϑi (k) causing
[−0.1, 0.1] m fluctuations on the GPS position readings.
To simulate a dynamic maneuvering environment, we set
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1243
four speed references (80, 120, 90, 40 ) km/h during platoon
driving on the road segment shown in Fig. 3(a). Specifically,
the platoon maneuver includes two acceleration stages (from
initial 40 to 80 and then from 80 to 120) and two deceleration
stages (from 120 to 90 and then from 90 to 40). For this pur-
40 pose, the platoon leader is commanded according to the speci-
fied control input and speed reference as given in Fig. 3(b). It
is noteworthy that the varying road slopes and leader com-
mand changes above pose a significant challenge for preserv-
8 9 10
ing the platoon stability and performance.
In what follows, we further examine two typical V2V com-
0.5 munication topologies for each platoon scenario above.
0
1) Predecessor-Follower Topology (PF): Each follower
u0(t) (m/s2)
i ∈ V only obtains information (state estimate x̂i−1 (tm )) from
−0.5
its direct predecessor i − 1. Under this communication topol-
−1.0 ogy, the parameter τ M , if not elsewhere clarified, is set as 58,
namely, the maximal DoS attack duration is 0.58 s. During the
collision avoidance operation, the prescribed scalars βi are set
as {βi }6i=1 = {0.10 , 0.08, 0.07, 0.08, 0.09 , 0.12}.
2) Bidirectional Topology (BD): Each follower i ∈ V \ {N}
gathers information (state estimates x̂i−1 (tm ) and x̂i+1 (tm ))
from both its direct predecessor i − 1 and successor i + 1, while
the tail follower N receives information only from its prede-
cessor N − 1. Under this communication topology, if not else-
where clarified, τ M = 11, namely, the maximal DoS attack
duration is set as 0.11 s. During the collision avoidance opera-
tion, the prescribed scalars βi are set as {βi }6i=1 = {0.20 , 0.15,
0.18, 0.18, 0.10 , 0.10}.
B. Trade-Off Analysis Between Platoon Performance and Attack
Severity
In order to facilitate comparison and performance analysis,
we introduce a platoon performance metric Rave (t), called the
real-time average spacing (average inter-vehicle distance), at
the continuous time t , which is given by Rave (t) ≜ (1/N)×
∑N ∑N ( )
i=1 Ri (t) = (1/N) i=1 pi−1 (t) − pi (t) .
We first perform a trade-off analysis between resultant pla-
toon performance (characterized by Rave (t)) and different lev-
els of attack severity (specified by τ M ), under the above two
platooning scenarios (S1) and (S2) as well as the two topolo-
gies (PF) and (BD). More specifically, we focus on the
resilience of the controlled vehicular platoons. In other words,
an emphasis will be placed on examining how different val-
ues of the DoS duration bound τ M affect the platoon perfor-
mance and what is the possible maximal allowable DoS dura-
tion bound under each simulated platooning scenario. For this
reason, the proposed collision avoidance function uoai (Ri (k)) in
(22) is not applied in this case study.
Applying the three-step design algorithm in Section III-A,
the local observer gain matrices L, F and controller gain
matrix K can be designed in each case. For the sake of con-
cise, the matrices are not outlined here. Implementing the
designed local observer (10) and control law (12), we have the
simulation results in Fig. 4 under several numerical tests. It is
noteworthy that the DoS attacks subject to the constrained
duration bound τ M are simulated randomly in each case. For
example, τ M = 10 means that the simulated DoS attacks occur
1244 IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023

15 15

N Σi=1 Ri(t)
10 10

1 N
Safe zone τM = 1 (0.01 s) Safe zone τM = 1 (0.01 s)

Rave(t) = −
5 τM = 10 (0.1 s) 5 τM = 2 (0.02 s)
τM = 20 (0.2 s) τM = 4 (0.04 s)
τM = 30 (0.3 s) τM = 6 (0.06 s)
Risky zone τM = 40 (0.4 s) Risky zone τM = 8 (0.08 s)
0 τM = 50 (0.5 s)
0 Collided zone τM = 10 (0.1 s)
Collided zone τM = 60 (0.6 s) τM = 12 (0.12 s)

0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(a) Average interval-vehicle distance (S1-PF) (b) Average interval-vehicle distance (S1-BD)

15 15
N Σi=1 Ri(t)

10 10
1 N

Safe zone τM = 1 (0.01 s) Safe zone τM = 1 (0.01 s)

Rave(t) = −

5 τM = 10 (0.1 s) 5 τM = 2 (0.02 s)
τM = 20 (0.2 s) τM = 4 (0.04 s)
τM = 30 (0.3 s) τM = 6 (0.06 s)
Risky zone τM = 40 (0.4 s) Risky zone τM = 8 (0.08 s)
τM = 50 (0.5 s) τM = 10 (0.1 s)
0 Collided zone τM = 60 (0.6 s) 0 τM = 12 (0.12 s)
Collided zone
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(c) Average interval-vehicle distance (S2-PF) (d) Average interval-vehicle distance (S2-BD)

Fig. 4. The resultant average inter-vehicle distances Rave (t) under different scenarios and V2V topologies: (a) Platooning scenario (S1) and topology (PF); (b)
Platooning scenario (S1) and topology (BD); (c) Platooning scenario (S2) and topology (PF); (d) Platooning scenario (S2) and topology (BD).

intermittently and randomly with an upper duration bound of 60 1400

0.1 s. In a particular case, τ M = 1 means that there is no DoS
attack and the V2V communication channels are deemed to be
ideal. It can be clearly observed from Fig. 4 that the intermit-
tent DoS attacks exert a major and adverse impact on the
desired platoon performance. Specifically, as the attack sever-
ity increases (i.e., τ M goes larger), the platoon performance
becomes degraded (i.e., Rave (t) becomes larger). As shown in
Fig. 4(a), when the DoS duration bound is 0.6 s, the real-time
average spacing Rave (t) becomes negative at around t = 365 s,
which indicates serious collision of the simulated platoon in
the (S1-PF) case. Similar collision situations can be spotted in
Figs. 4(c) and 4 (d). Although Rave (t) is not negative under
τ M = 12 during the simulated time window in Fig. 4 (b), it is
found through the individual spacings Ri (t) that some vehicles
already collided with their predecessors.
In summary, the DoS attacks that intermittently prevent the
V2V data communications can significantly worsen the pla-
toon performance and even jeopardize the platoon stability.
On the other hand, even in the absence of the proposed colli-
sion avoidance mechanism, the derived design algorithm is
promising for conducting a trade-off analysis between satis-
factory platoon performance and tolerable attack severity.
C. Resilient and Safe Platooning With Guaranteed Collision
Avoidance
In this subsection, we investigate the security and safety
performance of the controlled vehicle platoons under the pro-
posed collision avoidance mechanism. For illustration pur-
poses, we set the DoS duration bound as τ M = 58 under PF
and τ M = 11 under BD. The distribution of the simulated inter-
mittent DoS attack durations is illustrated in Fig. 5.
First, we perform the numerical experiment without emplo-
ying the proposed collision avoidance function uoa i (Ri (k)) in
50 τM = 58 (0.58 s) 1200 τM = 11 (0.11 s)
40 1000
800
30
600
20 400
10 200
0 0
0 0.1 0.2 0.3 0.4 0.5 0.6 0 0.02 0.04 0.06 0.08 0.10
{tm+1 − tm}（s） {tm+1 − tm}（s）
(a) Distribution of attack durations (PF) (b) Distribution of attack durations (BD)
Fig. 5. The distribution of the simulated intermittent DoS attack durations
{tm+1 − tm }: (a) τ M = 58 under PF; (b) τ M = 11 under BD.
(22). Under the simulated DoS attacks in Fig. 5 , the relative
positions to the leader, i.e., p0 (t) − pi (t), and the real-time
inter-vehicle distances, i.e., Ri (t), in different cases are
depicted in Fig. 6 . It is clear that without adopting the pro-
posed collision avoidance mechanism, the platoon fails to
maintain its driving safety under the intermittent DoS attacks.
Next, we consider the collision avoidance function uoa i (Ri (k))
in (22) added into the desired platooning control law ui (k) as
in (12) and repeat the numerical experiment above. The results
are shown in Figs. 7 and 8. Specifically, Fig. 7 illustrates the
relative positions to the leader and the real-time inter-vehicle
distances in different cases. It is obvious that the real-time
spacings between any two consecutive vehicles in either case
are significantly enlarged in comparison with those in Fig. 6.
Simple calculations of the inter-vehicle distances show that
the minimal spacing of the simulated vehicular platoon is:
min∀i,t {Ri (t)} = 1.5715 m in the case (S1-PF); min∀i,t {Ri (t)} =
4.3700 m in the case (S1-BD); min∀i,t {Ri (t)} = 1.6117 m in the
case (S2-PF); and min∀i,t {Ri (t)} = 4.3727 m in the case (S2-
BD). It is noteworthy that the minimal safe inter-vehicle dis-
tance in either case above can be further enlarged by suitably
configuring the collision avoidance function and its parame-

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS 1245

Veh 1 Veh 2 Veh 3 Veh 4 Veh 5 Veh 6

80
20
Safe zone
60

pi−1(t) − pi(t)
p0(t) − pi(t)

40 10
20
Risky zone
0
0 Collided zone Collision occurred
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(a) Relative positions to leader (m) (b) Real-time interval-vehicle distances (m)

80
20
60 Safe zone

pi−1(t) − pi(t)
p0(t) − pi(t)

40
10
20
Risky zone
0
0 Collided zone Collision occurred
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(c) Relative positions to leader (m) (d) Real-time interval-vehicle distances (m)

80
20
Safe zone
60

pi−1(t) − pi(t)
p0(t) − pi(t)

40 10
20
Risky zone
0
0 Collided zone Collision occurred
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(e) Relative positions to leader (m) (f) Real-time interval-vehicle distances (m)
80
20
60 Safe zone

pi−1(t) − pi(t)
p0(t) − pi(t)

40
10
20
Risky zone
0
0 Collided zone Collision occurred
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(g) Relative positions to leader (m) (h) Real-time interval-vehicle distances (m)

Fig. 6. The resultant relative positions to the leader (i.e., p0 (t) − pi (t) ) and the real-time inter-vehicle distances (i.e., pi−1 (t) − pi (t)) without the proposed colli-
sion avoidance mechanism in different cases: The first row (S1-PF); The second row (S1-BD); The third row (S2-PF); The last row (S2-BD).

ters. We only demonstrate here that the proposed collision
avoidance function has a great potential to increase the inter-
vehicle distances in all cases in such a way as to avoid possi-
ble collisions. On the other hand, Fig. 8 depicts the trajecto-
ries of the collision avoidance function uoa i (Ri (k)). It can be
seen that only when vehicle i enters its potential collision-risk
zone specified by Ωi (pi ) = {pi | Ri ≤ 5 m}, the collision avoid-
ance function uoai (Ri (k)) is activated to push vehicle i away
from its direct predecessor i − 1 to circumvent collision.
D. Platoon Stability and Controller Performance
In this subsection, we take a close look at the stability of the
controlled vehicle platoon and the performance of the pro-
posed resilient platoon controllers. Two stability notions
including individual vehicle stability and string stability are
used here to verify the proposed design approach.
Specifically, the individual vehicle stability corresponds to
the estimation error stability and tracking error stability. On
the other hand, the string stability of a longitudinal platoon
control system generally depends on the desired platoon con-
trol law and spacing policy as well as the V2V communi-
cation topology configured. The notion of string stability
adopted in the existing literature is relatively diverse, among
which the L2-string stability [35], [41]–[43] and the L∞-string
stability [36], [43] are widely explored. In this study, we aim
to develop a scalable distributed platoon control approach that
accounts for generic communication topologies. Furthermore,
the proposed platoon control system exhibits the simultane-
ous presence of a variety of uncertainties (including unknown
heterogenous engine inertial delay, unknown resistance forces,
unknown measurement noise and leader input, intermittent
DoS attacks). These two observations make it difficult to for-
mally prove the uniform string stability of the concerned pla-

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1246 IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023

80
20
Safe zone
60

pi−1(t) − pi(t)
p0(t) − pi(t)
40 10
20
Risky zone
0 Collision avoided
0 Collided zone
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(a) Relative positions to leader (m) (b) Real-time interval-vehicle distances (m)

80
20
60 Safe zone

pi−1(t) − pi(t)
p0(t) − pi(t)

40
10
20
Risky zone
0 Collision avoided
0 Collided zone
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(c) Relative positions to leader (m) (d) Real-time interval-vehicle distances (m)

80
20
Safe zone
60

pi−1(t) − pi(t)
p0(t) − pi(t)

40 10
20
Risky zone
0 Collision avoided
0 Collided zone
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(e) Relative positions to leader (m) (f) Real-time interval-vehicle distances (m)
80
20
60 Safe zone

pi−1(t) − pi(t)
p0(t) − pi(t)

40
10
20
Risky zone
0
0 Collided zone Collision avoided
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(g) Relative positions to leader (m) (h) Real-time interval-vehicle distances (m)

Fig. 7. The resultant relative positions to the leader (i.e., p0 (t) − pi (t) ) and the real-time inter-vehicle distances (i.e., pi−1 (t) − pi (t)) with the proposed colli-
sion avoidance mechanism in different cases: The first row (S1-PF); The second row (S1-BD); The third row (S2-PF); The last row (S2-BD).

toon as in the literature [35], [36] and [41]–[43].
To provide an intuitional demonstration of the string stabil-
ity of the controlled platoon, we only revisit the heavy-duty
vehicle platoon scenario (S2) under the BD topology afore-
mentioned while imposing an additional external disturbance
εi (t) = 0.8 sin(2π(1/10)(t − 200)) m/s2, ∀ t ∈ [200, 230] s on
each platoon follower vehicle i . This can be done by adding
εi (t) into ∆i (vi , ai , ȧi ) in (8). It is clear that the imposed distur-
bance εi (t) causes each platoon vehicle’s acceleration to fluc-
tuate between −0.8 m/s2 and 0.8 m/s2 and has an adverse
effect on the platoon control system stability. Boxplots are
used here to depict the distribution of platoon tracking errors
in terms of position errors p0 (t) − pi (t) − i · d0 , speed errors
v0 (t) − vi (t) and acceleration errors a0 (t) − ai (t), as shown in
Figs. 9(a)−9(c). It can be observed that the platoon tracking
errors can be driven into small neighborhoods around zero.
Figs. 9(d)−9(i) shows the individual estimation (approxima-
tion) performance of the designed local state observers regard-
ing the lumped uncertainties ∆i (t) in vehicle longitudinal dyna-
mics, from which one can obviously see that the uncertainties
including the imposed disturbance on each vehicle can be well
estimated and the resulting estimation errors are regulated into
some small bounds.
Fig. 10(a) shows the resulting string stability in terms of the
L2-norms and L∞-norms of the spacing errors eis (t) = pi−1 (t)−
pi (t) − d0 on each platoon vehicle. It can be seen that the strict
L2-string stability (monotonically decreasing L2-norms) is
ensured. Even though the strict L∞-string stability is not
noticed, the L∞-norms of the spacing errors do not get ampli-
fied from platoon head to tail under the proposed platooning
approach.
Fig. 10(b) demonstrates the distribution of each vehicle’s
accelerations ai (t) during the simulated platoon driving sce-
nario. Specifically, the driving comfort of a heavy-duty pla-
toon vehicle can be specified by the maximum deceleration of
amin = −3 m/s2 and the maximum acceleration of amax =

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS 1247

0 0

−0.5 0 −1 0
uioa(t), i ∈ v −1.0 −2

uioa(t), i ∈ v
−1 −2
−1.5 −3
−2
−2.0 −4 −4

−2.5 −3 −5 −6
290 300 310 365 370 375 380
−3.0 −6
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(a) Collision avoidance function in (S1-PF) case (b) Collision avoidance function in (S1-BD) case

0 0

−0.5 0 −1 0
−1.0 −2 −1

uioa(t), i ∈ v
uioa(t), i ∈ v

−1
−1.5 −3 −2

−2.0 −2 −4 −3

−2.5 −3 −5 −4
370 380 390 292 294 296 298 300 302
−3.0 −6
0 50 100 150 200 250 300 350 400 450 0 50 100 150 200 250 300 350 400 450
Time (s) Time (s)
(c) Collision avoidance function in (S2-PF) case (d) Collision avoidance function in (S1-BD) case

Fig. 8. The collision avoidance functions uoa

i (Ri (t)) in different cases.

2
p0(t) − pi(t) − i·d0

10 1

a0(t) − ai(t)
v0(t) − vi(t)

0
0 0
−10
−20
−2 −1
1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6
Vehicle index i, i = 1, 2, …, 6 Vehicle index i, i = 1, 2, …, 6 Vehicle index i, i = 1, 2, …, 6
(a) Position tracking errors (b) Speed tracking errors (c) Acceleration tracking errors

1.0 1.0 1.0

Superposition of disturbance ε1(t) Superposition of disturbance ε2(t) Superposition of disturbance ε3(t)
0.5 0.5 0.5
0 0 0
−0.5 −0.5 −0.5
−1.0 Δ1(t) −1.0 Δ2(t) −1.0 Δ3(t)
Δ^ 1(t) Δ^ 2(t) Δ^ 3(t)
−1.5 −1.5 −1.5
0 100 200 300 400 0 100 200 300 400 0 100 200 300 400
Time (s) Time (s) Time (s)
(d) Estimation of uncertainty (e) Estimation of uncertainty (f) Estimation of uncertainty

1.0 1.0 1.0

Superposition of disturbance ε4(t) Superposition of disturbance ε5(t) Superposition of disturbance ε6(t)
0.5 −0.5 0.5
0 0 0
−0.5 −0.5 −0.5
−1.0 Δ4(t) −1.0 Δ5(t) −1.0 Δ6(t)
Δ^ 4(t) Δ^ 5(t) Δ^ 6(t)
−1.5 −1.5 −1.5
0 100 200 300 400 0 100 200 300 400 0 100 200 300 400
Time (s) Time (s) Time (s)
(g) Estimation of uncertainty (h) Estimation of uncertainty (i) Estimation of uncertainty

Fig. 9. Individual vehicle stability under platooning scenario (S2) and BD topology: (a)−(c) the distribution of the platoon position errors p0 (t) − pi (t) − i · d0,
speed errors v0 (t) − vi (t) and acceleration errors a0 (t) − ai (t); (d)−(i) the lumped uncertainties ∆i (t) (including the imposed disturbance εi (t) ) on vehicle i and its
estimate ∆ˆ i (t), i = 1, 2, . . . , 6.

2 m/s2 [44]. It is clearly shown that the accelerations of all the which meets certain driving comfort even in the presence of
platoon vehicles are guaranteed to lie in the range of uncertainties and malicious DoS attacks.
(−2.02, 0.65) m/s2 under the proposed platooning approach, Figs. 10(c) and 10(d) further illustrates the resultant engine

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1248 IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023

6
500 0.5

0
400 5

ai(t) (m/s2)
||esi(t)||L∞
||esi(t)||L2
−0.5
300 4 −1.0

200 −1.5
3
−2.0
1 2 3 4 5 6 1 2 3 4 5 6
Vehicle index i, i = 1, 2, …, 6 Vehicle index i, i = 1, 2, …, 6
(a) L2 and L∞ string stability (b) Driving comfort
50 40
0
30 −10
0 20 −20

f (t), i∈v
f ie(t), i∈v

120 125
10
0
0

re
−50

i
−10
−10
−20
118 120 122 124 −20
−100
0 100 200 300 400 0 50 100 150 200 250 300 350 400
Time (s) Time (s)
(c) Engine forces (kN) (d) Resistance forces (kN)

Fig. 10. String stability and controller performance under platooning scenario (S2) and BD topology: (a) The string stability in terms of the L2-norms and
L∞-norms of the spacing errors eis (t) = pi−1 (t) − pi (t) − d0 on each platoon vehicle i under the BD topology; (b) The distribution of each vehicle’s accelerations
g
ai (t) under the BD topology; (c) The resultant engine forces fie (t) on each platoon vehicle i; (d) The lumped resistance forces Fi (t) = fi (t) + fiw (t) + fir (t) on
each platoon vehicle i, i = 1, 2, . . . , 6.

forces fie (t) and the lumped resistance forces Fi (t) on each develop effective platooning controllers that further guarantee
platoon vehicle i. Generally, the platoon vehicles require more satisfactory operational performance, such as fuel efficiency
traction forces to maintain speed uphill. In particular, during a and improved riding comfort, serves as an interesting and sig-
sharp deceleration stage, more braking forces are necessary nificant topic. As another potential extension, a resilient and
for the platoon vehicles to maintain speed transition and per- safe platooning control design method that can distinguish and
form safe driving, as shown in Fig. 10(c) over the time inter- further deal with simultaneous network-induced V2V commu-
val [360, 380] s. nication failures and DoS-incurred communication interrup-
Summarizing the above results, it can be concluded that the tions is preferable. Furthermore, it would be promising to pro-
proposed resilient and safe platooning control approach is pose resilient scalable platooning control solutions that deal
promising for preserving both DoS-resilience and collision- with various and concurrent network-induced constraints (e.g.,
free safety under the simultaneous model uncertainties and communication delays, finite bit rate, data quantization and
malicious DoS attacks in various maneuvering scenarios.
disorder, channel fading, random topologies [45], [46]).
V. Conclusions
Appendix
In this paper, the resilient and safe distributed cooperative Proof of Theorem 1
longitudinal platooning control problem is investigated for
The proof is divided into two parts.
CAVs in the presence of intermittent DoS attacks. An uncer-
tain nonlinear heterogenous longitudinal vehicle dynamical 1) Proof of the Boundedness of Estimation Errors: Choose
model is proposed, which incorporates unknown heteroge- the Lyapunov functional candidate as V1 (k) = ξT (k)(I⊗ P̄)ξ(k) .
nous masses and engine time lags, realistic resistance forces, The forward difference of V1 (k) along (15) is calculated as
and dynamic leader. To solve the platooning problem, a novel DV1 (k) = V1 (k + 1) − V1 (k)
platooning control law is developed to guarantee the simulta- ( )
neous individual vehicle stability, attack resilience, and driv- = ξT (k) I ⊗ (ĀT P̄Ā − P̄) ξ(k)
( )
ing safety. Furthermore, theoretical stability analysis and con- + νT (k) I ⊗ (Ē T P̄Ē) ν(k)
trol design conditions are derived such that the resultant spac- ( )
ing errors and platoon tracking errors are uniformly ulti- + 2ξT (k) I ⊗ (ĀT P̄Ē) ν(k).
mately bounded. Numerical experiments are finally presented By Young’s inequality, its last term is bounded as
to demonstrate the efficacy and advantages of the proposed ( )
2ξT (k) I⊗ (ĀT P̄Ē) ν(k)
platooning control method.
( )
The main focus of this study is on preserving the desired ≤κ0−1 ξT (k) I ⊗ (ĀT P̄P̄Ā) ξ(k)
platoon control performance, including individual vehicle sta- ( )
bility, driving safety, scalability, and attack resilience. How to + κ0 νT (k) I ⊗ (Ē T Ē) ν(k)

Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
where κ0 is some positive scalar. To ensure the boundedness
of all variables in the resulting estimation error dynamics (15),
without loss of generality, the unknown measurement noise ϑi
and the variation of the lumped nonlinearity ∆i (k) are sup-
posed to be continuous and bounded; i.e., ∥ν(k)∥ ≤ ν , where
ν > 0 is not necessarily known. Then, one has that
DV1 (k) ≤ −ξ (k)Uξ(k) + ϵ2 ν ≤ −ϵ1 ∥ξ(k)∥ + ϵ2 ν
T 2 2 2
where ϵ1 = σ(U) and ϵ2 = σ(Ē T P̄Ē) + κ0 σ(Ē T Ē). Note that
1 bounded. Clearly, the bound of the spacing error eis (k) is
DV1 (k) is negative when ∥ξ(k)∥ > ν(ϵ2 /ϵ1 ) 2 , and thus the esti-
mation error system (15) is uniformly ultimately bounded
[47], which further implies that x̃i (k) and ∆˜ i (k) are bounded.
2) Proof of the Boundedness of Platoon Tracking Errors
and Spacing Errors: We next choose the following Lyapunov
functional candidate V2 (k) = Vτ2 (k) + Vm2 (k), k ∈ Im , where
∑
k−1
Vτ2 (k) = δ (k)Q̄1 δ(k) +
T
δ (s)Q̄2 δ(s)
T [1] X.-Y. Lu and S. Shladover, “ Truck CACC system design and DSRC
s=k−τ M
∑
0 ∑
k−1
+ τM δ̆T (r)Q̄3 δ̆(r)
s=−τ M +1 r=k+s−1
∑
k−1
Vm
2 (k) = δ̆T (s)Q̄4 δ̆(s) − α2 λ(k)
s=−τ M
∑
with δ̆(r) = δ(r + 1) − δ(r), λ(k) = k−1 s=tm ρ (s) Q̄4 ρ(s) if
T k∈
Im \ {tm } and λ(k) = 0 if k = tm , ρ(s) = δ(s) − δ(tm ). By noting
that δ̆(s) = ρ(s + 1) − ρ(s), it can be readily derived that
Vm2 (k) ≥ 0 [48]. Therefore, V2 (k) > 0 for any k ∈ Im .
Calculating the forward difference of V2 (k) along (16)
yields that
DV2 (k) ≤ 2δT (k)Q̄1 δ̆(k) + δ̆T (k)Q̄1 δ̆(k) + δT (k)Q̄2 δ(k)
− δT (k − τ M )Q̄2 δ(k − τ M )
+ δ̆T (k)(τ2M Q̄3 + Q̄4 )δ̆(k)
− (δ(k) − δ(k − τ M ))T Q̄3 (δ(k) − δ(k − τ M ))
− α2 (δ(k) − δ(tm ))T Q̄4 (δ(k) − δ(tm ))
where the discrete-time Jensen inequality [48] is applied. On
the other hand, from the closed-loop system (16), it is true that
there exists a matrix V̌ such that
[ ]
2ϕT (k)V̌ T Ǎϕ(k) + ϖ(k) = 0
where
ϕ(k) = [δT (k), δ̆T (k), δT (tm ), δT (k − τ M )]T
V̌ = [I ⊗ V, I ⊗ κ2 V, 0, 0], Ǎ = [(Ã − I), −I B̃, 0].
By virtue of Young’s inequality, one has that
2ϕT (k)V̌ T ϖ(k) ≤ κ1−1 ϕT (k)Iϕ(k) + κ1 ϖT (k)V̌ V̌ T ϖ(k).
Furthermore, the leader control input u0 (k) is supposed to be
continuous and bounded. On the other hand, uoa (Ri (k)) is also
bounded. Then, the augmented unknown input ϖ(k) satisfies
that ∥ϖ(k)∥ ≤ ϖ M . From (24), the forward difference of V2 (k)
then can be calculated as
DV2 (k) ≤ −ϕT (k)Θϕ(k) + ϵ4 ≤ −ϵ3 ∥δ(k)∥2 + ϵ4
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1249
where ϵ3 = σ(Θ), and ϵ4 = κ1 σ(V̌ V̌ T )ϖ2M . Similarly, the inequ-
1
ality above is negative as long as ∥δ(k)∥ > (ϵ4 /ϵ3 ) 2. Therefore,
the platoon tracking error system (16) is uniformly ultimately
bounded.
Furthermore, it is clear that
∥e s (k)∥2 ≤ ∥e(k)∥2 = ∥δ(k)− x̃(k)∥2 ≤ ∥ x̃(k)∥2 + ∥δ(k)∥2
which implies that the spacing error eis (k) for any i ∈ V is also
closely related to the magnitude-bounds ν, ϖ M as well as the
designed parameters κ0 , κ1 , P̄, Ū, V, Θ . By suitably adjusting
these parameters, the spacing error can be driven into some
small neighborhood around zero. ■
References
messages,” FHWA Explor. Adv. Res. Program Cooperat. Agreement,
Task 2.1-Design CACC Control Syst. Trucks, Pleasanton, USA, Res.
Rep. DTFH61-13-H00012, 2018.
[2] S. Tsugawa, “ Results and issues of an automated truck platoon within
the energy ITS project,” in Proc. IEEE Intell. Vehicles Symp., Dearborn,
USA, Jun. 2014, pp. 642–647.
[3] S. Kato, S. Tsugawa, K. Tokuda, T. Matsui, and H. Fujii, “Vehicle
control algorithms for cooperative driving with automated vehicles and
intervehicle communications,” IEEE Trans. Intell. Transp. Syst., vol. 3,
no. 3, pp. 155–161, Sept. 2002.
[4] E. Chan, “SARTRE automated platooning vehicles,” in Towards Innov.
Freight Logistics. Hoboken, USA: Wiley, 2016, pp. 137–150.
[5] J. Ploeg, S. Shladover, H. Nijmeijer, and N. van deWouw, “Introduction
to the special issue on the 2011 grand cooperative driving challenge,”
IEEE Trans. Intell. Transp. Syst., vol. 13, no. 3, pp. 989–993, Sept. 2012.
[6] C. Englund, L. Chen, J. Ploeg, E. Semsar-Kazerooni, A. Voronov, H.
Bengtsson, and J. Didoff, “ The grand cooperative driving challenge
2016: Boosting the introduction of cooperative automated vehicles,”
IEEE Wireless Commun., vol. 23, no. 4, pp. 146–152, Aug. 2016.
[7] T. Ersal, I. Kolmanovsky, N. Masoud, N. Ozay, J. Scruggs, R.
Vasudevan, and G. Orosz, “ Connected and automated road vehicles:
State of the art and future challenges,” Veh. Syst. Dyn., vol. 58, no. 5,
pp. 672–704, May 2020.
[8] F.-Y. Wang, N.-N. Zheng, D. Cao, C. Martinez, L. Li, and T. Liu,
“Parallel driving in CPSS: A unified approach for transport automation
and vehicle intelligence,” IEEE/CAA J. Autom. Sinica, vol. 4, no. 4,
pp. 577–587, Oct. 2017.
[9] J. Zhang and K. Letaief, “ Mobile edge intelligence and computing for
the Internet of vehicles,” Proc. IEEE, vol. 108, no. 2, pp. 246–261, Feb.
2020.
[10] Y. Ma, Z. Wang, H. Yang, and L. Yang, “ Artificial intelligence
applications in the development of autonomous vehicles: A survey,”
IEEE/CAA J. Autom. Sinica, vol. 7, no. 2, pp. 315–329, Mar. 2020.
[11] H. Yu, R. Jiang, Z. He, Z. Zheng, L. Li, R. Liu, and X. Chen,
“Automated vehicle-involved traffic flow studies: A survey of
assumptions, models, speculations, and perspectives,” Transp. Res. Part
C: Emerg. Technol., vol. 127, p. 103101, Jun. 2021.
[12] C. Zu, C. Yang, J. Wang, W. Gao, D. Cao, and F.-Y. Wang,
“Simulation and field testing of multiple vehicles collision avoidance
algorithms,” IEEE/CAA J. Autom. Sinica, vol. 7, no. 4, pp. 1045–1063,
Jul. 2020.
[13] M. Fanti, A. Mangini, A. Favenza, and G. Difilippo, “ An eco-route
planner for heavy duty vehicles,” IEEE/CAA J. Autom. Sinica, vol. 8,
no. 1, pp. 37–51, Jan. 2021.
[14] W. Xu, H. Zhou, N. Cheng, F. Lyu, W. Shi, J. Chen, and X. Shen,
“Internet of vehicles in big data era,” IEEE/CAA J. Autom. Sinica,
vol. 5, no. 1, pp. 19–35, Jan. 2018.
[15] H. Zhou, W. Xu, J. Chen, and W. Wang, “Evolutionary V2X technolo-
gies toward the Internet of vehicles: Challenges and opportunities,”
Proc. IEEE, vol. 108, no. 2, pp. 308–323, Feb. 2020.
1250
[16] X. Ge, Q.-L. Han, L. Ding, Y.-L. Wang, and X.-M. Zhang, “Dynamic
event-triggered distributed coordination control and its applications: A
survey of trends and techniques,” IEEE Trans. Syst., Man, Cybern.,
Syst., vol. 50, no. 9, pp. 3112–3125, Sept. 2020.
[17] S. Parkinson, P. Ward, K. Wilson, and J. Miller, “Cyber threats facing
autonomous and connected vehicles: Future challenges,” IEEE Trans.
Intell. Transp. Syst., vol. 18, no. 11, pp. 2898–2915, Nov. 2017.
[18] M. Sun, A. Al-Hashimi, M. Li, and R. Gerdes, “Impacts of constrained
sensing and communication based attacks on vehicular platoons,” IEEE
Trans. Vech. Technol., vol. 69, no. 5, pp. 4773–4787, May 2020.
[19] S. Xiao, X. Ge, Q.-L. Han, and Y. Zhang, “ Secure and collision-free
multi-platoon control of automated vehicles under data falsification
attacks,” Automatica, vol. 145, p. 110531, Nov. 2022.
[20] S. Ucar, S. Ergen, and O. Ozkasap, “ IEEE 802.11p and visible light
hybrid communication based secure autonomous platoon,” IEEE Trans.
Vech. Technol., vol. 67, no. 9, pp. 8667–8681, Sept. 2018.
[21] F. van Wyk, Y. Wang, A. Khojandi, and N. Masoud, “Real-time sensor
anomaly detection and identification in automated vehicles,” IEEE
Trans. Intell. Transp. Syst., vol. 21, no. 3, pp. 1264–1276, Mar. 2020.
[22] Y. Wang, N. Masoud, and A. Khojandi, “ Real-time sensor anomaly
detection and recovery in connected automated vehicle sensors,” IEEE
Trans. Intell. Transp. Syst., vol. 22, no. 3, pp. 1411–1421, Mar. 2021.
[23] Z. Biron, S. Dey, and Pisu, “ Real-time detection and estimation of
denial of service attack in connected vehicle systems,” IEEE Trans.
Intell. Transp. Syst., vol. 19, no. 12, pp. 3893–3902, Dec. 2018.
[24] E. Mousavinejad, F. Yang, Q.-L. Han, X. Ge, and L. Vlacic, “Distribu-
ted cyber attacks detection and recovery mechanism for vehicle
platooning,” IEEE Trans. Intell. Transp. Syst., vol. 21, no. 9, pp. 3821–
3834, Sept. 2020.
[25] A. Alipour-Fanid, M. Dabaghchian, and K. Zeng, “Impact of jamming
attacks on vehicular cooperative adaptive cruise control systems,” IEEE
Trans. Vech. Technol., vol. 69, no. 11, pp. 12679–12693, Nov. 2020.
[26] A. Petrillo, A. Pescapé, and S. Santini, “ A secure adaptive control for
cooperative driving of autonomous connected vehicles in the presence
of heterogeneous communication delays and cyberattacks,” IEEE Trans.
Cybern., vol. 51, no. 3, pp. 1134–1149, Mar. 2021.
[27] D. Zhang, Y.-P. Shen, S.-Q. Zhou, X.-W. Dong, and L. Yu,
“Distributed secure platoon control of connected vehicles subject to
DoS attack: Theory and application,” IEEE Trans. Syst., Man, Cybern.,
Syst., vol. 51, no. 11, pp. 7269–7278, Nov. 2021.
[28] Z. Li, B. Hu, and Z. Yang, “ Co-design of distributed event-triggered
controller for string stability of vehicle platooning under periodic
jamming attacks,” IEEE Trans. Vech. Technol., vol. 70, no. 12, pp. 13115–
13128, Dec. 2021.
[29] Y. Harfouch, S. Yuan, and S. Baldi, “ An adaptive switched control
approach to heterogeneous platooning with intervehicle communication
losses,” IEEE Trans. Control Netw. Syst., vol. 5, no. 3, pp. 1434–1444,
Sept. 2018.
[30] G. Guo, J. Kang, H. Lei, and D. Li, “ Finite-time stabilization of a
collection of connected vehicles subject to communication
interruptions,” IEEE Trans. Intell. Transp. Syst., vol. 23, no. 8, pp. 10627–
10635, Aug. 2022.
[31] S. Xiao, X. Ge, Q.-L. Han, and Y. Zhang, “Secure distributed adaptive
platooning control of automated vehicles over vehicular ad-hoc
networks under denial-of-service attacks,” IEEE Trans. Cybern., vol. 52,
no. 11, pp. 12003–12015, Nov. 2022.
[32] R. Merco, F. Ferrante, and P. Pisu, “ A hybrid controller for DOS-
resilient string-stable vehicle platoons,” IEEE Trans. Intell. Transp.
Syst., vol. 22, no. 3, pp. 1697–1707, Mar. 2021.
[33] X. Ge, S. Xiao, Q.-L. Han, X.-M. Zhang, and D. Ding, “Dynamic event-
triggered scheduling and platooning control co-design for automated
vehicles over vehicular ad-hoc networks,” IEEE/CAA J. Autom. Sinica,
vol. 9, no. 1, pp. 31–46, Jan. 2022.
[34] X. Ge, Q.-L. Han, J. Wang, and X.-M. Zhang, “ A scalable adaptive
approach to multi-vehicle formation control with obstacle avoidance,”
IEEE/CAA J. Autom. Sinica, vol. 9, no. 6, pp. 990–1004, Jun. 2022.
[35] J. Ploeg, D. Shukla, N. van de Wouw, and H. Nijmeijer, “Controller
synthesis for string stability of vehicle platoons,” IEEE Trans. Intell.
Transp. Syst., vol. 15, no. 2, pp. 854–865, Feb. 2014.
[36] S. Stüdli, M. Seron, and R. Middleton, “ From vehicular platoons to
general networked systems: String stability and related concepts,” Annu.
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
IEEE/CAA JOURNAL OF AUTOMATICA SINICA, VOL. 10, NO. 5, MAY 2023
Rev. Control, vol. 44, pp. 152–172, Oct. 2017.
[37] S. Feng, Y. Zhang, S. Li, Z. Cao, H. Liu, and L. Li, “String stability for
vehicular platoon control: Definitions and analysis methods,” Annu.
Rev. Control, vol. 47, pp. 81–97, Jun. 2019.
[38] X. Ge, Q.-L. Han, J. Wang, and X.-M. Zhang, “ Scalable and resilient
platooning control of cooperative automated vehicles,” IEEE Trans.
Veh. Technol., vol. 71, no. 4, pp. 3595–3608, Apr. 2022.
[39] K. Gu, V. Kharitonov, and J. Chen, Stability of Time-Delay Systems.
Boston, USA: Birkhäuser, 2003.
[40] E. Wood, E. Burton, A. Duran, and J. Gonder, “ Appending high-
resolution elevation data to GPS speed traces for vehicle energy
modeling and simulation,” National Renewable Energy Laboratory,
Golden, USA, Technical Report NREL/TP-5400-61109, 2014,
[41] D. Swaroop and K. Hedrick, “ String stability of interconnected
systems,” IEEE Trans. Autom. Control, vol. 41, no. 3, pp. 349–357, Mar.
1996.
[42] J. Monteil, M. Bouroche, and D. Leith, “ L2 and L p stability analysis of
heterogeneous traffic with application to parameter optimization for the
control of automated vehicles” IEEE Trans. Control Syst. Technol.,
vol. 27, no. 3, pp. 934–949, May 2019.
[43] E. van Nunen, J. Reinders, E. Semsar-Kazerooni, and N. van de Wouw,
“String stable model predictive cooperative adaptive cruise control for
heterogeneous platoons,” IEEE Trans. Intell. Veh., vol. 4, no. 2, pp. 186–
196, Jun. 2019.
[44] Q. Deng, “A general simulation framework for modeling and analysis of
heavy-duty vehicle platooning,” IEEE Trans. Intell. Transp. Syst.,
vol. 17, no. 11, pp. 3252–3262, Nov. 2016.
[45] X. Ge, Q.-L. Han, X.-M. Zhang, L. Ding, and F. Yang, “Distributed
event-triggered estimation over sensor networks: A survey,” IEEE
Trans. Cybern., vol. 50, no. 3, pp. 1306–1320, Mar. 2020.
[46] H. Geng, H. Liu, L. Ma, and X. Yi, “Multi-sensor filtering fusion meets
censored measurements under a constrained network environment:
Advances, challenges and prospects,” Int. J. Syst. Sci., vol. 52, no. 16,
pp. 3410–3436, Dec. 2021.
[47] J. Sarangapani, Neural Network Control of Nonlinear Discrete-Time
Systems. Boca Raton, USA: CRC Press, 2006.
[48] A. Seuret and E. Fridman, “ Wirtinger-like Lyapunov-Krasovskii
functionals for discrete-time delay systems,” IMA J. Math. Control Inf.,
vol. 35, no. 3, pp. 861–876, Sept. 2018.
Xiaohua Ge (Senior Member, IEEE) received the
Ph.D. degree in computer engineering from Central
Queensland University, Australia in 2014. From
2015 to 2017, he was a Research Fellow with the
Griffith School of Engineering, Griffith University,
Australia. He is currently a Senior Lecturer with the
School of Software and Electrical Engineering,
Swinburne University of Technology, Australia. His
research interests include networked, secure, and
intelligent control and estimation theories, and their
applications in electric vehicles, intelligent robotic vehicles, connected auto-
mated vehicles, intelligent transportation systems and so on.
Dr. Ge is an Associate Editor of IEEE Transaction on Systems, Man, and
Cybernetics: Systems, IEEE Transactions on Intelligent Vehicles, IEEE
Transactions on Circuits and Systems —II: Express Briefs, and IEEE/CAA
Journal of Automatica Sinica.
Qing-Long Han (Fellow, IEEE) received the B.Sc.
degree in mathematics from Shandong Normal Uni-
versity, in 1983, and the M.Sc. and Ph.D. degrees in
control engineering from East China University of
Science and Technology, in 1992 and 1997, respec-
tively. He is Pro Vice-Chancellor (Research Quality)
and a Distinguished Professor at Swinburne Univer-
sity of Technology, Australia. He held various aca-
demic and management positions at Griffith Univer-
sity and Central Queensland University, Australia.
His research interests include networked control systems, multi-agent sys-
tems, time-delay systems, smart grids, unmanned surface vehicles, and neural
networks.
Professor Han was awarded The 2021 Norbert Wiener Award (the High-
est Award in systems science and engineering, and cybernetics) and The 2021
GE et al.: RESILIENT AND SAFE PLATOONING CONTROL OF CAVS AGAINST INTERMITTENT DOS ATTACKS
M. A. Sargent Medal (the Highest Award of the Electrical College Board of
Engineers Australia). He was the recipient of The 2021 IEEE/CAA Journal of
Automatica Sinica Norbert Wiener Review Award, The 2020 IEEE Systems,
Man, and Cybernetics (SMC) Society Andrew P. Sage Best Transactions
Paper Award, The 2020 IEEE Transactions on Industrial Informatics Out-
standing Paper Award, and The 2019 IEEE SMC Society Andrew P. Sage
Best Transactions Paper Award.
Professor Han is a Member of the Academia Europaea (The Academy of
Europe). He is a Fellow of The International Federation of Automatic Con-
trol (IFAC) and a Fellow of The Institution of Engineers Australia (IEAust).
He is a Highly Cited Researcher in both Engineering and Computer Science
(Clarivate Analytics). He has served as an AdCom Member of IEEE Indus-
trial Electronics Society (IES), a Member of IEEE IES Fellows Committee, a
Member of IEEE IES Publications Committee, and Chair of IEEE IES Tech-
nical Committee on Networked Control Systems. Currently, he is Editor-in-
Chief of IEEE/CAA Journal of Automatica Sinica, Co-Editor-in-Chief of
IEEE Transactions on Industrial Informatics, and Co-Editor of Australian
Journal of Electrical and Electronic Engineering.
Qing Wu (Member, IEEE) received the B.Eng.
degree in vehicle engineering (mechanical) from
Southwest Jiaotong University, in 2010, the M.Eng.
degree in vehicle engineering (mechanical) from
State Key Laboratory of Traction Power, in 2012,
and the Ph.D. degree in engineering (multiobjective
optimization and parallel computing) from Central
Queensland University, Australia in 2016. From
2012 to 2013, he was a Research Assistant with the
State Key Laboratory of Traction Power, Southwest
Jiaotong University. From 2016 to 2018, he was a Senior Research Officer
with the School of Engineering and Technology, Central Queensland Univer-
sity, Australia. He is currently a Research Fellow with the same school. His
research interests include mechanical system dynamics, parallel computing,
Authorized licensed use limited to: CQUniversity. Downloaded on September 03,2023 at 05:53:29 UTC from IEEE Xplore. Restrictions apply.
1251
multiobjective optimization, dynamics control, and their applications in road
and railway vehicles.
Dr. Wu is the recipient of the Discovery Early Career Award funded by
the Australian Research Council. He is on editorial boards of Journal of Traf-
fic and Transport Engineering, and Railway Engineering Science and a Guest
Editor for several Special Issues.
Xian-Ming Zhang (Senior Member, IEEE) received
the M.Sc. degree in applied mathematics and the
Ph.D. degree in control theory and control engineer-
ing from Central South University, in 1992 and 2006,
respectively. From 2007 to 2014, he was a Post-Doc-
toral Research Fellow and a Lecturer with the School
of Engineering and Technology, Central Queensland
University, Australia. From 2014 to 2016, he was a
Lecturer with the Griffith School of Engineering,
Griffith University, Australia. In 2016, he joined the
Swinburne University of Technology, Australia, where he is currently an
Associate Professor with the School of Science, Computing and Engineering
Technologies. His current research interests include H-infinity filtering,
event-triggered control systems, networked control systems, neural networks,
multi-agent systems, offshore platforms and time-delay systems.
Associate Professor Zhang was a recipient of second National Natural Sci-
ence Award in China in 2013, jointly with Prof. M. Wu and Prof. Y. He. He
was also the recipient of The 2021 IEEE/CAA Journal of Automatica Sinica
Nobert Wiener Review Award, The 2020 IEEE Transactions on Industrial
Informatics Outstanding Paper Award, The 2019 IEEE Systems, Man, and
Cybernetics Society Andrew P. Sage Best Transactions Paper Award, and The
2016 IET Control Theory and Applications Premium Award. He is an Asso-
ciate Editor of the IEEE Transactions on Cybernetics, Journal of the Franklin
Institute, International Journal of Control, Automation, and Systems, Neuro-
computing, and Neural Processing Letters.