Student, IEEE, Stéphane Rômulo Meira-Góes

IEEE Lafortune Fellow

Hervé Marchand
email: herve.marchand@inria.fr

S Lafortune

Synthesis of Supervisors Robust Against Sensor Deception Attacks

Keywords: cyber-physical systems, cyber-security, discreteevent systems, supervisory control

We consider feedback control systems where sensor readings may be compromised by a malicious attacker intending on causing damage to the system. We study this problem at the supervisory layer of the control system, using discrete event systems techniques. We assume that the attacker can edit the outputs from the sensors of the system before they reach the supervisory controller. In this context, we formulate the problem of synthesizing a supervisor that is robust against the class of edit attacks on the sensor readings and present a solution methodology for this problem. This methodology blends techniques from games on automata with imperfect information with results from supervisory control theory of partially-observed discrete event systems. Necessary and sufficient conditions are provided for the investigated problem.

Protection of feedback control systems against cyber-attacks in critical infrastructures is an increasingly important problem. In this paper, we consider sensor deception attacks at the supervisory layer of a feedback control system. We assume that the underlying cyber-physical system has been abstracted as a discrete transition system (the plant in this work), where sensor outputs belong to a finite set of (observable) events. These events drive the supervisory controller, or simply supervisor, that controls the high-level behavior of the system via actuator commands, which also belong to a finite set of (controllable) events. In the context of this event-driven model, we incorporate a malicious attacker that has compromised a subset of the observable events and is able to delete actual sensor readings or to inject fictitious ones in the communication channel to the supervisor. The goal of the attacker is to leverage its knowledge of the plant and the supervisor models, and to use its event-editing capabilities to steer the plant state to a critical state where damage to the plant occurs. In this work, we investigate the problem of synthesizing a supervisor robust against any attacker with these capabilities.

Several works have addressed in recent years problems of cyber-security in the above context. In [START_REF] Thorsley | Intrusion detection in controlled discrete event systems[END_REF], [START_REF] Carvalho | Detection and mitigation of classes of attacks in supervisory control systems[END_REF], [START_REF] Lima | Security against communication network attacks of cyber-physical systems[END_REF], the authors developed diagnostic tools to detect when controlled systems are being attacked. Their work is closely related to the work on fault diagnosis in discrete event systems, and it is applicable to both sensor and/or actuator attacks. Our problem differs from the problem considered in these works since we aim to compute a supervisor that is robust against attacks without using a separate diagnostic tool. However, their method only works for attacks that are detectable/diagnosable (non-stealthy). Moreover, once an attack is detected, their solution forces the supervisor to disable all controllable events.

There is also a vast literature in robust control in discrete event systems [START_REF] Lin | Robust and adaptive supervisory control of discrete event systems[END_REF], [START_REF] Cury | Robustness of supervisors for discrete-event systems[END_REF], [START_REF] Xu | Discrete event control under nondeterministic partial observation[END_REF], [START_REF] Takai | Maximizing robustness of supervisors for partially observed discrete event systems[END_REF], [START_REF] Rohloff | Bounded sensor failure tolerant supervisory control[END_REF], [START_REF] Alves | Robust supervisory control against intermittent loss of observations[END_REF], [START_REF] Lin | Control of networked discrete event systems: Dealing with communication delays and losses[END_REF]. However, robustness in the previous literature is related to communication delays [START_REF] Rohloff | Bounded sensor failure tolerant supervisory control[END_REF], [START_REF] Alves | Robust supervisory control against intermittent loss of observations[END_REF], loss of information [START_REF] Lin | Control of networked discrete event systems: Dealing with communication delays and losses[END_REF], or model uncertainty [START_REF] Lin | Robust and adaptive supervisory control of discrete event systems[END_REF], [START_REF] Cury | Robustness of supervisors for discrete-event systems[END_REF], [START_REF] Takai | Maximizing robustness of supervisors for partially observed discrete event systems[END_REF], [START_REF] Xu | Discrete event control under nondeterministic partial observation[END_REF]. Exceptions to that are [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], [START_REF] Lin | Towards bounded synthesis of resilient supervisors[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF], where the problem of synthesizing supervisors robust against attacks was investigated. The results of [START_REF] Lin | Towards bounded synthesis of resilient supervisors[END_REF] are related to actuator deception attacks.

In [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], [START_REF] Lin | Towards bounded synthesis of resilient supervisors[END_REF], [START_REF] Wang | Attack-resilient supervisory control with intermittently secure communication[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF], the problem of synthesizing supervisors robust against attacks was investigated. Our work differs from [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF] as we provide a general gametheoretical framework that solves the problem of synthesizing supervisors robust against general classes of sensor deception attacks. The solution methodology in [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF] follows the standard supervisory control solution methodology, where only results about one robust supervisor against a specific class of sensor deception attacks is provided. Conditions on the existence of robust supervisors against a possible set of sensor deception attacks with a normality condition on the plant are provided in [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF]. A methodology to synthesize the supremal controllable and normal robust supervisor against bounded sensor deception attacks is given in [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF]. The results of [START_REF] Lin | Towards bounded synthesis of resilient supervisors[END_REF] are related to actuator and sensor replacement deception attacks while actuator and sensor deception attacks are considered in [START_REF] Wang | Attack-resilient supervisory control with intermittently secure communication[END_REF]. However, the supervisory control framework in [START_REF] Wang | Attack-resilient supervisory control with intermittently secure communication[END_REF] differs from the standard framework since the authors assume that the supervisor can actively change the state of the physical process. Finally, [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF] provides a methodology to synthesize a maximal controllable and observable supervisor against unbounded sensor deception attacks.

The game-theoretical framework adopted in this paper provides necessary and sufficient conditions for the problems of existence and synthesis of robust supervisors against general classes of sensor deception attacks. This game-theoretical approach provides a structure that incorporates all robust supervisors against sensor deception attacks. Different robust supervisors can be extracted from this structure, e.g., maximal controllable and observable, supremal controllable and normal, etc. In fact, the robust supervisors from [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF] are embedded in this structure. Moreover, there is a natural extension of our solution methodology such that robust supervisors from [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF] are embedded in this structure as well.

In summary, our work does not impose any normality condition as imposed in [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF] and studies synthesis and existence of robust supervisors against any sensor deception attack. Our approach considers both bounded and unbounded sensor deception attacks. Moreover, necessary and sufficient conditions are provided for the existence and synthesis of robust supervisors, whereas in [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF] only existence conditions are provided and in [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF] only a sufficient condition is provided.

Of particular relevance to this paper is the work in [START_REF] Meira-Góes | Synthesis of sensor deception attacks at the supervisory layer of cyber-physical systems[END_REF], where the synthesis of stealthy sensor deception attacks assuming a fixed and known supervisor is considered; in this sense, [START_REF] Meira-Góes | Synthesis of sensor deception attacks at the supervisory layer of cyber-physical systems[END_REF] pertains to attack strategies. Herein, we consider the "dual" problem of synthesizing a supervisor that is robust against sensor deception attacks; thus, this paper is focused on defense strategies.

We wish to synthesize a supervisor that provably prevents the plant from reaching a critical state despite the fact that the information it receives from the compromised sensors may be inaccurate. Our problem formulation is based on the following considerations. The attack strategy is a parameter in our problem formulation, i.e., our problem formulation is parameterized by different classes of sensor deception attacks. If there is no prior information about the attack strategy, then an "all-out" attack strategy is considered. Our solution methodology comprises two steps and leverages techniques from games on automata under imperfect information and from supervisory control of partially-observed discrete event systems. We build a game arena to capture the interaction of the attacker and the supervisor, under the constraints of the plant model. The arena defines the solution space over which the problem of synthesizing supervisors with the desired robustness properties can be formulated. In this solution space, called meta-system, we use supervisory control techniques to enforce such robustness properties. We leverage the existing theory of supervisory control under partial observation [START_REF] Ramadge | Supervisory control of a class of discrete event processes[END_REF], [START_REF] Lin | On observability of discrete-event systems[END_REF], [START_REF] Cieslak | Supervisory control of discrete-event processes with partial observations[END_REF], [START_REF] Cho | On supremal languages of classes of sublanguages that arise in supervisor synthesis problems with partial observation[END_REF] to solve this meta-supervisory control problem. As formulated, the meta-supervisory control problem has a unique solution. This solution embeds all robust supervisors for the original plant, thereby providing a complete characterization of the problem addressed in this paper.

Our presentation is organized as follows. Section I introduces necessary background and the notation used throughout the paper. In Section II, we formalize the problem of synthesis of supervisors robust against this attack model. We define the construction of the game arena and present the solution of the (meta-)synthesis problem in Section III. Section IV discusses some benefits of our solution methodology. Finally, we conclude the paper in Section VI.

I. PRELIMINARIES

We assume that the given cyber-physical system has been abstracted as a discrete transition system that we model as a finite-state automaton. A finite-state automaton G is defined as a tuple G = (X G , Σ, δ G , x 0,G ), where X G is the finite set of states; Σ is the finite set of events;

δ G : X G × Σ → X G
is the partial transition function; x 0,G ∈ X G is the initial state. The function δ G is extended in the usual manner to domain X G × Σ * . The language generated by G is defined as L(G) = {s ∈ Σ * |δ G (x 0,G , s)!}, where ! means "is defined".

In the context of supervisory control of DES [START_REF] Ramadge | Supervisory control of a class of discrete event processes[END_REF], system G needs to be controlled in order to satisfy safety and liveness specifications. In this work, we consider only safety specifications. In order to control G, the event set Σ is partitioned into the set of controllable events and the set of uncontrollable events, Σ c and Σ uc . The set of admissible admissible control decisions is defined as Γ = {γ ⊆ Σ|Σ uc ⊆ γ}. A supervisor, denoted by S, dynamically disables events such that the controlled behavior is provably "safe". In other words, S only disables controllable events to enforce the specification on G.

In addition, when the system is partially observed due to limited sensing capabilities of G, the event set is also partitioned into Σ = Σ o ∪ Σ uo , where Σ o is the set of observable events and Σ uo is the set of unobservable events. Based on this second partition, the projection function

P ΣΣo : Σ * → Σ * o is defined for s ∈ Σ *
o and e ∈ Σ recursively as: P ΣΣo (ǫ) = ǫ and P ΣΣo (se) = P ΣΣo (s)e if e ∈ Σ o , P ΣΣo (s) otherwise.

The inverse projection P -1

ΣΣo : Σ * o → 2 Σ * is defined as

P -1 ΣΣo (t) = {s ∈ Σ * |P ΣΣo (s) = t}.
Supervisor S makes its control decisions based on strings of observable events. Formally, a partial observation supervisor is a (partial) function S : Σ * o → Γ. The resulting controlled behavior is a new DES denoted by S/G, resulting in the closed-loop language L(S/G), defined in the usual manner (see, e.g., [START_REF] Cassandras | Introduction to Discrete Event Systems[END_REF]). Normally, a supervisor S is encoded by an automaton R known as the supervisor realization, where every state encodes a control decision. Throughout the paper, we use interchangeably supervisor S and its realization R.

We also recall the notions of controllability, observability, and normality for a prefix-closed language K ⊆ L(G). We say the language K is

• controllable w.r.t. to Σ c , if KΣ uc ∩ L(G) ⊆ K; • observable w.r.t. to Σ o and Σ c , if (∀s ∈ K, ∀e ∈ Σ c : se ∈ K)[P -1 ΣΣo (P ΣΣo (s))e ∩ L(G) ⊆ K]; • normal w.r.t. to Σ o and Σ c , if K = P -1 ΣΣo (P ΣΣo (K)) ∩ L(G).
Example I.1. We use the following example as illustrative example throughout the paper. The plant G is depicted in Fig. 1(a) where Σ c = Σ o = {a, b}. The supervisor shown in Fig. 1(b) guarantees that state 4 is unreachable in the supervised system R/G.

For convenience, we define useful operators and notation that we use throughout this paper. First, Γ G (Q) is defined as the set of active events at the set of states Q ⊆ X G of the automaton G, given by:

Γ G (Q) := {e ∈ Σ|(∃x ∈ Q)[δ G (x, e)!]} (1)
By an abuse of notation, we use Fig. 1: Running example. Observable events have solid arrows and unobservable events have dashed arrows. Controllable events have marks across their arrows.

Γ G (x) = Γ G ({x}) for x ∈ X G .
The unobservable reach of the subset of states Q ⊆ X G under the subset of events γ ⊆ Γ is given by:

U R γ (Q) := {x ∈ X G | (∃t ∈ (Σ uo ∩ γ) * )[x ∈ δ G (Q, t)]} (2)
where

δ G (Q, t) = ∪ x∈Q {δ G (x, t)} and we consider δ G (x, t) = ∅ if δ G (x, t
) is not defined. The observable reach of the subset of states Q ⊆ X G given the execution of the observable event e ∈ Σ o is defined as:

N X e (Q) := δ G (Q, e) (3)
We define by trim(G, Q) the operation that returns the accessible subautomaton of G after deleting states Q ⊆ X G . For any string s ∈ Σ * , |s| is the length of s. We denote by e i s the i th event of s such that s = e1 s e2 s . . . e |s| s . Lastly, s i denotes the i th prefix of s, i.e., s i = e 1 s . . . e i s and s 0 = ǫ.

II. ROBUST SUPERVISORY CONTROL AGAINST DECEPTION ATTACKS

A. Notation

We first define useful notation for this section. Since we consider that the observability properties of the events are static, and not dynamic, we assume that the attacker only affects observable events; clearly, an insertion of an unobservable event would lead to immediate detection of the attacker by the supervisor (whose transition function is only defined for observable events). For this reason, we define the set Σ a ⊆ Σ o to be the compromised event set. These are the events that the attacker has the ability to alter, where "alter" means it can insert or delete events.

We define the set of inserted events Σ i a = {e i | e ∈ Σ a } and the set of deleted events Σ d a = {e d | e ∈ Σ a }. These sets represent the actions of an attacker, and we use subscripts to distinguish them from events generated by G such that

Σ i a ∩ Σ = Σ d a ∩ Σ = Σ i a ∩ Σ d a = ∅.
We call the events in Σ as legitimate events, events that are not insertion nor deletion. For convenience, we define The mask M removes subscripts, when present, from events in Σ m , P G projects an event in Σ m to its actual event execution in G, and P S projects an event in Σ m to its event observation by S.

Σ e a = Σ i a ∪ Σ d a , Σ o,e = Σ o ∪ Σ e

B. Modeling sensor deception attacks

We assume that the attacker hijacks the communication channel between the plant and the supervisor and it can modify the readings of events in Σ a , as depicted in Fig. 3. Intuitively, the attacker is modeled similarly as a supervisor. The attacker takes its actions based on observing a new event e ∈ Σ o from G and its memory of the past modified string. Note that, we assume that the attacker observes the same observable events as the supervisors. Formally, we model an attacker as a nondeterministic string edit function.

Definition II.1. Given a system G and a subset Σ a ⊆ Σ o , an attacker is defined as a partial function

f A : Σ * o,e × (Σ o ∪ {ǫ}) → 2 Σ * o,e \ ∅ s.t. f A satisfies the following constraints ∀s ∈ Σ * o,e and e ∈ Σ o : 1) f A (ǫ, ǫ) ⊆ Σ i a * ; f A (s, ǫ) = {ǫ} when s = ǫ; 2) If e ∈ Σ o \ Σ a : f A (s, e) ⊆ {e}Σ i a * ; 3) If e ∈ Σ a : f A (s, e) ⊆ {e, e d }Σ i a * .
The function f A captures a general model of deception attack. Namely, f A defines a substitution rule where the observation e is replaced by a string in the set f A (s, e). Condition (1) allows event insertions when the plant is in the initial state and constrains the substitution rule based on observation of events from G 1 . Condition (2) constrains the attacker from erasing e when e is outside of Σ a . However, the attacker may insert an arbitrary string t ∈ Σ i a * after the occurrence of e. Lastly, condition (3) allows events e ∈ Σ a to be edited to any string t ∈ {e, e d }Σ i a * .

For simplicity, we assume that the function f A has been encoded into a finite-state automaton A = (X A , Σ o,e , δ A , x 0,A ) where δ A is complete with respect to Σ o \ Σ a and for any (e ∈ Σ a , q ∈ X A ) then (δ A (q, e)! ∨ δ A (q, e d )!). This assumption will be used later when we explain the composition in the definition of the closed-loop behavior under attack. Let A encode an f A , then the function f A is extracted from A as follows:

∀s ∈ L(A) and e ∈ Σ o , f A (s, e) = {t ∈ {e, e d }Σ i a * | δ A (x 0,A , st)!}, f A (ǫ, ǫ) = {t ∈ Σ i a * | δ A (x 0,A , t)!}, and f A (s, e) is undefined for all s ∈ Σ *
o,e \ L(A) and e ∈ Σ o . In Appendix A, we show how to relax the above assumption on automaton A to encode attack functions.

This formulation provides a simple way to handle attack functions and it characterizes the behavior of the attacker. It also provides a way to define specific attackers that are more constrained than the constraints of Definition II.1, i.e., when some prior knowledge about the attacker is available. In other words, the automaton A can encode different attack strategies, e.g., replacement attack, bounded attack, etc.

One important attack strategy for this problem is the "allout" attack strategy introduced in [START_REF] Carvalho | Detection and mitigation of classes of attacks in supervisory control systems[END_REF], [START_REF] Lima | Security against network attacks in supervisory control systems[END_REF]. In this model, the attacker could attack whenever it is possible. Hereafter, if there is no prior information about the attack strategy, then we assume that the attacker follows the all-out attack strategy. The following example provides two attack strategies for Example I.1, one of these strategies is the all-out strategy.

Example II.2. Attack functions f A 1 and f A 2 for the system defined in Example I.1 and Σ a = {b} were encoded in automata A 1 and A 2 depicted in Fig. 2. Automaton A 1 encodes the all-out strategy for this example. Although the allout strategy is a nondeterministic strategy since the attacker can try all possible combinations of attacks, its automaton representation is a deterministic automaton. Only one state is necessary to encode the all-out strategy. Automaton A 2 encodes a one sensor reading deletion attack strategy. The attacker in the controlled system induces a new controlled language. Referring to Fig. 3, R, A and P S together effectively generate a new supervisor S A for the system G.

Fig. 3: Sensor deception attack framework

To characterize the interaction of attacker A with the system G and supervisor realization R, we must modify the behavior of G and R such that it takes into account possible modifications of A. We use the method in [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF], where G and R are augmented with attack actions providing an attacked system G a and an attacked supervisor R a .

Definition II.2. Given G and Σ a , we define the attacked plant G a as:

G a = (X Ga = X G , Σ m = Σ ∪ Σ e a , δ Ga , x 0,Ga = x 0,G ) where δ Ga (x, e) = δ G (x, P G (e)) and δ G (x, ǫ) = x.
Similarly to the construction of G a , we can modify the behavior of R to reflect the modifications made by an attacker on the communication channel.

Definition II.3. Given R and Σ a , we define the attacked supervisor as: R a = (X Ra = X R , Σ m , δ Ra , x 0,Ra = x 0,R ) where

δ Ra (x, e) :=    δ R (x, P S (e)) if M(e) ∈ Γ R (x) x if e ∈ Σ i a and M(e) ∈ Γ R (x) undefined otherwise
We assume that the supervisor "ignores" insertions of controllable events that are not enabled by the current control action at state x. This assumption is specified by the second condition in the definition of δ Ra . Namely, the insertion made by the attacker is ineffective at this state. In some sense, this means that the supervisor "knows" that this controllable event has to be an insertion performed by the attacker, since it is not an enabled event.

Based on G a , R a and A, we define the closed-loop language of the attacked system to be L

(S A /G) = P G (L(G a ||R a ||A)),
where || is the standard parallel composition operator [START_REF] Cassandras | Introduction to Discrete Event Systems[END_REF]. Recall that the transition function of A is complete with respect to Σ o \ Σ a and for any (e ∈ Σ a , q ∈ X A ) then δ A (q, e)! ∨ δ A (q, e d )!. Therefore, the attacker is incapable of disabling events of G.

Example II.3. We return to our running example. Figure 4 depicts the attacked system G a , the attacked supervisor R a , and the supervised attacked system G a ||R a ||A 1 , where A 1 is the all-out attack strategy shown in Fig. 2(a). Note that state 4 is reachable in the supervised attacked system. In [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], the nondeterministic attack function defined therein generates maximal and minimal attacked languages. Similar to the problem encountered in [START_REF] Shu | Supervisor synthesis for networked discrete event systems with communication delays[END_REF], the maximal language possibly contains strings that the supervised plant cannot generate while the minimal does not define all possible strings that this controlled plant generates. This issue does not arise in our context. Our language definition also differs from the one in [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF]. Even though an attacker could have a string of insertions to send to the supervisor, it does so by sending one event at the time. On the other hand in [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], the attacker sends the entire string modification to the supervisor.

D. Robustness against deception attacks

We investigate the problem of synthesizing a supervisor R robust against the attack strategy A. We assume that the plant G contains a set of critical states defined as X crit ⊂ X G ; these states are unsafe in the sense that they are states where physical damage to the plant might occur. Although damage is defined in relation to the set X crit , it could be generalized in relation to any regular language by state space refinement.

Definition II.4. Supervisor R is robust (against sensor deception attacks) with respect to G, X crit and A, if for any

s ∈ L(S A /G) then δ G (x 0,G , s) ∈ X crit .
The definition of robustness is dependent on the attack strategy A. Recall that the all-out strategy encompasses all other attack strategies [START_REF] Carvalho | Detection and mitigation of classes of attacks in supervisory control systems[END_REF]. Therefore, a supervisor that is robust against the all-out strategy is robust against any other A [14].

Problem II.1 (Synthesis of Robust Supervisor). Given G, X crit and an attack strategy A, synthesize a robust supervisor R, if one exists, with respect to G, X crit and A.

We are asking that the robust supervisor should prevent the plant from reaching a critical state regardless of the fact that it might receive inaccurate information. In other words, the supervisor will react to every event that it receives, but since it was designed to be robust to A, the insertions and deletions that A performs will never cause G to reach X crit . This will be guaranteed by the solution procedure presented in the next section.

III. META-SUPERVISOR PROBLEM

In this section, we present our approach to solve Problem II.1. We briefly explain the idea of our approach. Figure 5 shows the connection of the problem formulation space (left box) and the solution space (right box). The connection between these two spaces is given by the arrows that cross the two boxes. These arrows are labeled by results provided in this section.

In the left box of Fig. 5, we have the problem formulation space where the supervisor R is unknown. Based on G, Σ o , Σ c and A, we construct a meta-system, called A, in a space where all supervisors are defined. This construction is given in Definition III.5. The meta-system is part of the proposed solution space and it is represented in the right box of Fig. 5.

Although all supervisors are defined in A, which is shown by Proposition III.1, we are only interested in robust supervisors. In order to obtain robust supervisors, we use techniques of partially observed supervisory control theory [START_REF] Cieslak | Supervisory control of discrete-event processes with partial observations[END_REF], [START_REF] Cho | On supremal languages of classes of sublanguages that arise in supervisor synthesis problems with partial observation[END_REF] in the meta-system. The structure A sup is obtained via Definition III.7 and it contains all robust supervisors against sensor deception attacks on Σ a .

Finally, to return to our problem formulation space, we extract one supervisor, if one exists, from A sup . Such extraction is given by Algorithm 1. Fig. 5: Relation of the system and the meta-system

A. Definition

Inspired by the techniques of two-player reachability games, we construct an arena as it is constructed in these games. In the arena, player 1 represents the supervisor while player 2 represents the adversarial environment. The arena exhaustively captures the game between the supervisor and the environment, where the supervisor selects control decisions (Γ) and the environment executes events (Σ o,e ). In the arena, player 1's transitions record a control decision made by the supervisor. On the other hand, player 2's transitions represent actions of the plant G or actions of the attacker A. Formally, the arena is defined as follows.

Definition III.5. Given plant G and attack function A, we define the arena A as 4-tuple:

A = (Q 1 ∪ Q 2 , A 1 ∪ A 2 , h 1 ∪ h 2 , q 0 ) (4)
where,

• Q 1 ⊆ 2 XG × X A is the set of states where the supervisor issues a control decision. Its states have the form of (S 1 , S 2 ), where S 1 is the estimate of the states (as it is executed by the plant) of G and S 2 is the attacker's state. For convenience we define the projection operators

I i ((S 1 , S 2 )) = S i for i ∈ {1, 2}; • Q 2 ⊆ 2 XG ×X A ×Γ×({ǫ}∪Σ a )
is the set of states where the adversarial environment issues a decision. Its states have the form (S 1 , S 2 , γ, σ), where S 1 and S 2 are defined as in Q 1 states, γ is the last control decision made by the supervisor, and σ is related to inserted events. The event σ is equal to e ∈ Σ a if the last transition was e i ∈ Σ i a , otherwise it is equal to ǫ. We use the same projection operators I i for states in Q 2 for i ∈ {1, 2};

• A 1 = Γ and A 2 = Σ o,e are respectively the actions/decisions of player 1 and player 2;

• h 1 : Q 1 × A 1 → Q 2 is built as follows: for any q 1 = (S 1 , S 2 ) ∈ Q 1 and γ ∈ A 1 h 1 (q 1 , γ) := U R γ (S 1 ), S 2 , γ, ǫ (5)
• h 2 :

Q 2 × A 2 → Q 1 ∪ Q 2 is built as follows for any q 2 = (S 1 , S 2 , γ, σ) ∈ Q 2 : Let e ∈ Σ o : h 2 (q 2 , e) =        N X e (S 1 ), δ A (S 2 , e) if (e ∈ Γ G (S 1 ) ∩ γ)∧ (e ∈ Γ A (S 2 )) ∧ (σ = ǫ) S 1 , S 2 if (σ = e) undefined otherwise (6)
Let e ∈ Σ a :

h 2 (q 2 , e i ) =    S 1 , δ A (S 2 , e i ), γ, e if (e i ∈ Γ A (S 2 ))∧ (σ = ǫ) undefined otherwise ( 7
)
h 2 (q 2 , e d ) =        U R γ (N X e (S 1 )), δ A (S 2 , e d ), γ, ǫ if (e ∈ Γ G (S 1 ) ∩ γ)∧ (e d ∈ Γ A (S 2 )) ∧ (σ = ǫ) undefined otherwise (8)
• q 0 ∈ Q 1 is the initial S-state: q 0 := ({x 0,G }, x 0,A ).

We explain the definition of the transition functions h 1 and h 2 in detail. The definition of h 1 is simple and it defines a transition from player 1 to player 2, which records a control decision made by the supervisor, and it updates G's state estimate according to this decision. On the other hand, h 2 is more complex since player 2 has two types of transitions.

The first type is transitions from player 2 to player 1 which characterizes the visible decision made by the environment and is related to events in Σ o . These transitions are defined in Eq. ( 6), and they are illustrated in Fig. 6. In Fig. 6(a), an event e ∈ Σ o that is feasible in G from some state in S 1 is selected; thus, both the state estimate and the attacker's state are updated. In Transitions from player 2 to itself characterize invisible, from the supervisor's perspective, decisions. They are only defined for events in Σ e a . These transitions are defined by Eqs. [START_REF] Takai | Maximizing robustness of supervisors for partially observed discrete event systems[END_REF][START_REF] Rohloff | Bounded sensor failure tolerant supervisory control[END_REF]. An attacker can insert any event in e ∈ Σ a , as long as e i is allowed in the current attacker's state. The inserted events e ∈ Σ i a are not going to be seen by the supervisor, as only the attacker knows it decided to insert the event.

Insertions will be seen by the supervisor as genuine events. But e i represents here (in the context of the game arena) the intention of the attacker to insert. Equation (7) (depicted in Fig. 7(a)) is the unobservable part, where an insertion decision was selected and the attacker's state and the fourth component of q 2 ∈ Q 2 are updated. The observable part is shown by Fig. 6(b). In the case of a deleted event, from the supervisor's perspective, it is seen as an ǫ event as well. That is, the supervisor cannot change its control decision when the attacker deletes an event, as shown in Fig. 7(b). Remark 1: The elements of Q 1 and Q 2 are defined such that they incorporate the "sufficient information" (in the sense of information state in system theory) that each player needs to make its respective decision. Equations (5-8) guarantee by construction that the updates of the information states are consistent with the plant dynamics and the actions of the attacker. Overall, the arena constructed thereby captures the possible attacks and all possible supervisors in a finite structure. We prove both results later on.

Example III.4. We return to our illustrative example to show results on the construction of the arena. We construct A for the system G, X crit = {4} and A 1 depicted in Fig. 2(a). Since we construct A for the all-out attack strategy, we can omit the attacker state. The arena has a total of 26 states. For convenience, we extend the definition of h 2 based on a given control decision. Namely, we define a transition function H 2 that always start and end in Q 2 states. This notation simplifies walks in A.

Definition III.6. We define the function

H 2 : Q 2 ×Σ o,e ×Γ → Q 2 as: H 2 (q, e, γ) :=        h 1 (h 2 (q, e), γ), if e ∈ Σ o h 2 (q, e) if e ∈ Σ d a h 1 (h 2 (h 2 (q, e), M(e)), γ), if e ∈ Σ i a undefined, otherwise (9)

B. Properties

For a fixed supervisor R and attacker A, we obtain the language L(G a ||R a ||A) which contains the possible string executions in the attacked system, e.g., strings of events in Σ m = Σ ∪ Σ e a . Given a string s ∈ P ΣmΣo,e (L(G a ||R a ||A)), we can find the state estimate of G a after execution of s, i.e., the state estimate of G a under supervision of R a and attack strategy A. Formally, this state estimate is

RE(s) ={x ∈ X Ga | x = δ Ga (x 0,Ga , t) for t ∈ P -1 ΣmΣo,e (s) ∩ L(G a ||R a ||A)} (10)
In the construction of A, we allow the attacker to insert events that are not allowed by the current control decision (see Eq. ( 7)). Therefore, given a supervisor R, we need to define its control decisions for all s ∈ Σ * o , differing from the usual definition only for s ∈ P ΣΣo (L(G)). For this reason, we extend the function δ R to be a complete function in

Σ o . ∆ R (x, e) = δ R (x, e) if e ∈ Γ R (x) x otherwise (11)
for x ∈ R and e ∈ Σ o . Intuitively, ∆ R extends δ R by simply ignoring the events that are not defined in δ R . The function ∆ R is extended to s ∈ Σ * o as δ R is extended. Lastly, we define the control decision of R for any s ∈ Σ * o as: Proposition III.1. Given a system G, a supervisor R, an attack function A and arena A, then for any s ∈ P ΣmΣo,e (L(G a ||R a ||A)), we have that

C R (s) = Γ R (∆ R (x 0,R , s)) (12)
H 2 (x 0 , s, γ 1 . . . γ |s| )! (13) I 1 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = RE(s) (14)
I 2 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = δ A (x 0,A , s) (15)
where

x 0 = h 1 (q 0 , C R (ǫ)) and γ i = C R (P S (s i )).
Recall that in the left box of Fig. 5 the supervisor is unknown. Equation ( 13) tells us that the arena captures all possible interactions between any supervisor R and attack function A with the plant G. It captures all possible interactions since Proposition III.1 is true regardless of the supervisor R and of the attack function A. This is one of the main benefits of constructing the arena A. It defines a space where all supervisors and attacker actions based on A for the plant G exist. Moreover, Eqs. (14-15) says that the arena correctly captures the interaction between the attacker, supervisor and plant. Equation ( 14) computes G's state estimate of based on the modified string s ∈ P ΣmΣo,e (L(G a ||R a ||A)) and the control decisions taken by R along the observed string. These estimates capture an agent that has full knowledge of the modification on the string s and the decisions taken by R. On the other hand, Eq. ( 15) establishes the correct state of the attacker A in the construction of A.

The arena A has, in worst-case,

|X A |2 |XG| Q 1 -states and |X A |(|Σ a | + 1)2 |XG|+|Σc| Q 2 -states given that |Γ| ≤ 2 |Σc| .
Consequently, the worst-case running time of the construction of the arena

A is O(|X A ||Σ o | 2 2 |XG|+|Σc| ) since Σ a ⊆ Σ o .
We can construct A starting from its initial state and performing a breadth-first search based on equations h 1 and h 2 .

C. Solution of the Meta-Control problem

Our approach to solve Problem II.1 is to consider the above-constructed arena A as the uncontrolled system in a meta-control problem, which is posed as a supervisory control problem for a partially-observed discrete event system, as originally considered in [START_REF] Lin | On observability of discrete-event systems[END_REF]. For that reason, we will refer to A as the meta-system. As will become clear in the following discussion, this supervisory control approach naturally captures our synthesis objectives, and moreover supervisory control theory provides a complete characterization of the solution. Such a methodology was previously used in [START_REF] Yin | A uniform approach for synthesizing propertyenforcing supervisors for partially-observed discrete-event systems[END_REF], [START_REF] Wu | Synthesis of optimal insertion functions for opacity enforcement[END_REF] for instance; however, in these works the meta-control problem is a control problem under full observation. The same situation does not apply in our case, where events in Σ e a are unobservable (from the supervisor's perspective).

To formally pose the meta-control problem, we need a specification for the meta-system. In fact, the specification emerges from the corresponding specification in Problem II.1, which states that the controlled system should never reach any state in X crit . The same specification is to be enforced in A, where the state estimate of G represents the reachable states of G. Thus, the specification for the meta-control problem is that the meta-controlled system should never reach any state

q ∈ Q 1 ∪ Q 2 such that I 1 (q) ∩ X crit = ∅.
The next step in the meta-control problem formulation is to specify the controllable and observable events in the metasystem A. We already mentioned that all e ∈ Σ e a are unobservable events. In fact, they are the only unobservable events in A since they are moves of the attacker that the supervisor does not directly observe. In regard to the controllable events, the supervisor makes decisions in order to react to the decisions made by the environment. Therefore, the events in A 1 \ {Σ uc } are controllable, while those in A 2 ∪{Σ uc } are uncontrollable. Note that, we explicitly exclude the control decision composed only of uncontrollable events as a meta-controllable event; the supervisor should always be able to at least enable the uncontrollable events, otherwise it would not be admissible. In this way, the supervisor can always issue at least one control decision, i.e., enable all uncontrollable plant events. We are now able to formulate the meta-control problem.

Definition III.7. Given A constructed with respect to G and A, with events E = A 1 ∪ A 2 , E c = A 1 \ {Σ uc } as the set of controllable events and E uo = Σ e a as the set of unobservable events. Let A trim = trim(A, M ) be the specification automaton, where

M = {q ∈ Q A 1 ∪ Q A 2 |I 1 (q) ∩ X crit = ∅} 2 .
Calculate the supremal controllable and normal sublanguage of the language of A trim with respect to the language of A, and let this supremal sublanguage be generated by the solutionarena denoted by A sup .

Note that all controllable events in the meta-control problem are also observable, i.e., E c ⊆ E o . Therefore, the controllability and observability conditions are equivalent to the controllability and normality conditions. Hence, in this case, the supremal controllable and observable sublanguage exists and is equal to the supremal controllable and normal sublanguage; see, e.g., §3.7.5 in [START_REF] Cassandras | Introduction to Discrete Event Systems[END_REF]. As consequence a supremal and unique solution of the meta-control problem exists. This solution is the language generated by the solution-arena A sup .

The state structure of A sup will depend on the algorithm used to compute the supremal controllable and normal sublanguage of A trim . One example of the structure of A sup is provided.

Example III.5. We return to our running example. Based on A, we obtain A sup using an integrated (for controllability and normality) iterative algorithm to compute the supremal controllable and normal sublanguage that is based on preprocessing the input automata to satisfy simultaneously a strict sub-automaton [START_REF] Cassandras | Introduction to Discrete Event Systems[END_REF] condition and a State Partition Automaton [START_REF] Jirásková | On properties and state complexity of deterministic state-partition automata[END_REF] condition. As part of the algorithm, one needs to refine A so that its observer is a state partition automaton (using algorithm in [START_REF] Jirásková | On properties and state complexity of deterministic state-partition automata[END_REF]), i.e., to compute A||Obs(A), where Obs is the observer operation with respect to E uo [START_REF] Cassandras | Introduction to Discrete Event Systems[END_REF]. The resulting A sup is depicted in Fig. Regardless of the algorithm to obtain A sup , it has a structure with Q 1 -like states and Q 2 -like states, since it accepts a sublanguage of A trim . Namely, it has states where only control decisions are allowed (Q 1 states) and states where only transitions with events in Σ o,e are defined (Q 2 states). Thus, we can use the functions previously defined for A in A sup .

Remark III.2. The worst-case running time to obtain the supremal controllable and normal sublanguage is exponential in product of the number of states of the system and the specification [START_REF] Brandt | Formulas for calculating supremal controllable and normal sublanguages[END_REF]. Therefore, the worst-case running time to obtain the

A sup is O(2 (|Q1|+|Q2|) 2 ).
The way A is constructed is such that it embeds the set of all supervisors for the original plant G. Therefore, the uniqueness of the language generated by A sup and the fact that it is the supremal solution of the meta-control problem means that the structure A sup embeds a family of supervisors S, where the controlled behavior generated by each member of that family does not reach any state in X crit . Moreover, since A is constructed taking into account the attack function A, this family of supervisors is robust with respect to A. This leads us to the following result. Its proof is in Appendix B.

Theorem

III.1. A supervisor R is a robust supervisor with respect to A if and only if

(∀s ∈ P ΣmΣo,e (L(G a ||R a ||A)))[H A sup 2 (x 0 , s, γ 1 . . . γ |s| )!], where x 0 = h 1 (q A sup 0 , C R (ǫ)) and γ i = C R (P S (s i )).
Corollary III.1. A sup = ∅ if and only if there does not exist any robust supervisor R with respect to attacker A.

Theorem III.1 states that a supervisor is robust if and only if it is embedded in A sup . Next, Corollary III.1 gives a necessary and sufficient condition for the existence of a solution for Problem II.1. Given that there exists a robust supervisor, we provide an algorithm3 to extract a supervisor that solves Problem II.1. First, we define function H 1 as we defined H 2 .

Definition III.8. Let the function

H 1 : Q 1 × Σ o,e × Γ → Q 1 be defined as: H 1 (q, e, γ) :=        h 2 (h 1 (q, γ), e), if e ∈ Σ o q if e ∈ Σ d a h 2 (h 2 (h 1 (q, γ), e), M(e)), if e ∈ Σ i a undefined, otherwise (16)

Algorithm 1 Robust Supervisor Extraction

Input: A sup Output: R r = (X Rr , Σ, δ Rr , x 0,Rr ) 1: x 0,Rr = q A sup 0 2: X Rr ← {x 0,Rr }, δ Rr ← ∅ 3: Expand(x 0,Rr ) 4: procedure EXPAND(x)

5: select γ ∈ Γ A sup (x) s.t. ∀γ ′ ∈ Γ A sup (x) : γ ⊂ γ ′ 6:
for all e ∈ Σ ∩ γ do 7:

if e ∈ Σ o then 8: y = H A sup 1 (x, e, γ), δ Rr ← δ Rr ∪ (x, e , y) 9:
X Rr ← X Rr ∪ {y} δ Rr ← δ Rr ∪ (x, e, x)

Algorithm 1 starts at the initial state of A sup and performs a Depth First Search by selecting the largest control decisions at each state that it visits. By largest, we mean that it selects a control decision that is not a subset of any other control decision defined at state x, as described by line 5. Note that, it is possible to have more than two decisions that satisfy this condition. In this case, the algorithm selects one of the possible decisions in a nondeterministic manner. The algorithm terminates since A sup is finite. Moreover, the algorithm only traverses player 1 states, where the control decisions are defined.

Corollary III.2. A supervisor R r constructed by Algorithm 1 is a solution for Problem II.1.

Remark III.3. The worst-case running time of Algorithm 1 is linear in the number of state of A sup . For this reason, the running time of the entire synthesis procedure is exponential in the number of states of A. Since the number of states of A is exponential in the number of states of G, the overall worst-case running time is double exponential in the number of states of G, which is one exponential order smaller than in [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF] and one exponential order higher than in [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF], two references that were reviewed in Section I.

Example III.6. To conclude this section, we provide two supervisors extracted via Algorithm 1. These two supervisors are depicted in Fig. 10.

IV. SELECTING SUPERVISORS IN THE ROBUST ARENA

Algorithm 1 provides one way of extracting robust supervisors from A sup . As we explained before, it selects maximal control decisions in the Q 1 states that the algorithm visits. Example III. [START_REF] Xu | Discrete event control under nondeterministic partial observation[END_REF] shows that this extraction does not provide specific information about the language generated by supervised system once a supervisor is selected, other than the fact that we are choosing a locally maximal control decision. While supervisor R 1 in Fig. 10(a) generates a live language, supervisor R 2 in Fig. 10(b) is Nonetheless, the space defined in A sup provides maximum flexibility in extracting different supervisors since all robust supervisors are embedded in A sup . The methods in [START_REF] Wakaiki | Supervisory control of discrete-event systems under attacks[END_REF], [START_REF] Su | Supervisor synthesis to thwart cyber attack with bounded sensor reading alterations[END_REF], [START_REF] Meira-Góes | Towards resilient supervisors against sensor deception attacks[END_REF] do not provide the flexibility of A sup since they exploit algorithms of Supervisory Control Theory where only one supervisor can be obtained at a time. In fact, when explicit comparisons can be made, the supervisors obtained by their methods are embedded in the corresponding A sup .

Another benefit of the construction of A sup is the ability to exploit results in the area of turn-based two-player graphgames. Results from these areas can be leveraged to study different manners of extracting robust supervisors, e.g., to study quantitative versions of the robust supervisor problem under some cost model [START_REF] Cassez | Synthesis of opaque systems with static and dynamic masks[END_REF], [START_REF] Ji | Mean payoff supervisory control under partial observation[END_REF], [START_REF] Meira-Góes | Synthesis of sensor deception attacks for systems modeled as probabilistic automata[END_REF].

We provide an example of a supervisor extraction algorithm based on a quantitative measure. First, we define a measure over the supervised system R/G, i.e., over the states of the automaton G||R. Let the set X dead = {x ∈ X G||R | Γ G||R (δ G||R (x, s)) = ∅ for s ∈ Σ * uo } be the set of states in G||R that can reach a deadlock state via an unobservable string. We define r : X G||R → [0, +∞) ∪ {-∞} to be a reward function for any (x, y) ∈ X G||R and c ∈ [0, ∞) as:

r((x, y)) =    -∞ if x ∈ X crit 0 if (x, y) ∈ X dead c otherwise (17)
The reward function r punishes states from where the system G||R might deadlock. Based on the reward function r, we define the following total reward for the supervised system G||R.

Reward(R, G) = x∈X G||R r(x) (18)
We can generalize Algorithm 1 to incorporate this quantitative measure such that it extracts a supervisor from A sup that maximizes the measure Reward(R, G). In our running example, this new method extracts supervisor R 1 . Further, we can assume that the attacker tries to minimize Reward(R, G) in this extraction method. In this scenario, we would pose a min max problem in order to select a supervisor from A sup . We leave these extensions for future work.

V. ROBOT MOTION PLANNING EXAMPLE

We developed a tool 4 to automatically construct A, as in Definition III.5, and to compute A sup . Moreover, Algorithm 1 is also implemented in our tool. Our evaluation was done on a Linux machine with 2.2GHz CPU and 16GB memory.

We consider a robot moving in a possibly hostile environment. The robot is assumed to have four different movement modes that are modeled as controllable and observable events. The robot moves freely in the workspace shown in Fig. 11(a). Its initial state is the blue cell denoted as q 0 and the red cells are considered to be obstacles. Moreover, the shaded region is assumed to be hostile and the sensor readings of the robot could be under attack. This uncontrolled system is modeled by the automaton depicted in Fig. 11(b). We want to design a robust supervisor that enforces the following properties: (1) the robot must avoid the obstacles; (2) the robot can always access states q 0 and q 1 .

The set of compromised events is Σ a = {E * , W * , N * , S * } since we consider that the sensor readings in the shaded area might be under attack. First, we construct the arena A considering the all-out attack strategy. The number of states in A is 18649 states. The state space explosion is due to the number of control decisions: there are 256 possible control decisions.

After constructing A, we obtain A sup as described in Definition III.7. To compute the supremal controllable and normal sublanguage, we used the algorithm described in Example III.5. The number of states in A sup is 65358 states. Note that A sup has more states than A. The larger state space in A sup is due to necessary preprocessing done by the iterative algorithm for the computation of the supremal controllable and normal sublaguage. Finally, any supervisor selected from A sup is robust against the all-out attack strategy, i.e., it satisfies property (1). Therefore, we must select a supervisor that satisfies property [START_REF] Carvalho | Detection and mitigation of classes of attacks in supervisory control systems[END_REF]. For this reason, we modify Algorithm 1 to extract a supervisor from A sup such that property (2) is satisfied. This supervisor is depicted in Fig. 12. We have considered a class of problems in cyber-security where sensor readings in a feedback control system may be manipulated by a malicious attacker. By formulating the problem at the supervisory control layer of a cyber-physical system, we were able to leverage techniques from games on automata under partial information and from supervisory control of partially-observed discrete event systems to develop a solution methodology to prevent damage to the system when some sensor readings may be edited by the attacker. Our problem formulation is parameterized by an attacker strategy over a set of compromised events. In this manner, synthesis of robust supervisors against sensor deception attack strategies is considered, e.g., bounded attack strategies, replacement attack strategies, etc. Moreover, if there is no prior information about the attacker strategy, then we consider the general all-out attack strategy. A supervisor robust against the all-out attack strategy is robust against any other sensor deception attack strategy.

The space defined in A sup provides maximum flexibility in extracting different supervisors since all robust supervisors are embedded in A sup . As discussed in Section IV, it would be interesting to investigate methods to extract supervisors from A sup in order to satisfy additional constraints, such as optimality with respect to some quantitative criterion [START_REF] Ji | Mean payoff supervisory control under partial observation[END_REF], [START_REF] Cassez | Synthesis of opaque systems with static and dynamic masks[END_REF]. Finally, identifying ways to reduce the state space of the arena by exploiting a suitable notion of state equivalence is another important research direction.

APPENDIX A ATTACK FUNCTION ENCODING

In Section II, we assume that the automaton A that encodes an attack function f A has a transition function complete with respect to Σ o \ Σ a and for any (e ∈ Σ a , q ∈ X A ) then (δ A (q, e)! ∨ δ A (q, e d )!). To encode any attack function f A as an automaton, this assumption does not need to be satisfied. However, this means that the attacker might "block" the controlled system if it receives an unexpected event executed by the plant, i.e., f A (s, e) is undefined.

Based on the above assumption, we relax the completeness assumption of δ A in order to encode any attack function f A as an automaton. Namely, the partial transition function δ A of A must satisfy one of the following conditions for any q ∈ X A :

(1)

(∀e ∈ Σ o \ Σ a )[δ A (q, e)!] and (∀e ∈ Σ a )[δ A (q, e)! ∨ δ A (q, e d )!]; or (2) (∀e ∈ Σ o ∪ Σ d a )
[δ A (q, e) is not defined] and (∃e ∈ Σ i a )[δ A (q, e)!]; Condition (2) allows attack strategies where event insertion is faster than the plant executes events. Note that condition (2) violates controllability since it temporarily blocks the plant from executing events. The practicality of this assumption will depend on the plant's response time, i.e., this attack condition is application dependent. Condition (1) remains unchanged, i.e., the attacker does not block the plant in states that satisfy this condition.

APPENDIX B PROOFS Proposition III.1

Proof. The result is proved by induction on the length of the string s ∈ P ΣmΣo,e (L(G a ||R a ||A)).

Before we start the induction proof, we state two important results. First, we define C Ra in the same manner as C R , but the control decisions of R a are defined over Σ m . It can be shown by induction that the following equality holds for any s

∈ L(G a ||R a ||A): C R (P S (s)) = C Ra (s) ∩ Σ (19)
Intuitively, Eq. ( 19) follows since R a is a copy or R with insertion and deletions events added based on P S . Second, the function RE can also be computed recursively as follows for s ∈ P o,e (L(G a ||R a ||A)) and e ∈ Σ o,e :

RE(se) ={x ∈ X Ga | x = δ Ga (δ Ga (RE(s), e), t) for t ∈ (Σ uo ∩ C Ra (se)) * } (20)
Σ uo defines the unobservable events of G a . Then, only supervisor R a disables events in Σ uo to be executed in G a since A is defined over Σ o,e . For this reason, Eq. 20 is equivalent to Eq. 10. Induction basis: s = ǫ.

We have that H 2 (x 0 , ǫ, ǫ) = h 1 (q 0 , C R (ǫ)) is well defined since h 1 is complete with respect to Γ. It also follows that

δ A (x 0,A , ǫ) = I 2 (x 0 ) since ǫ ∈ L(G a ||R a ||A) and I 2 (x 0 ) = x 0,A . We have that I 1 (H 2 (x 0 , ǫ, ǫ)) = U R CR(ǫ) (x 0,G ).

RE(ǫ)

Eq.( 10

) = {x ∈ X Ga | x = δ Ga (x 0,Ga , t) for t ∈ P -1 ΣmΣo,e (ǫ) ∩ L(G a ||R a ||A)} (21)
Def.II.2 PΣ mΣo,e = {x ∈ X G | x = δ G (x 0,G , t) for t ∈ Σ * uo ∩ L(G a ||R a ||A)} (22)
Def.II.3

= {x ∈ X G | x = δ G (x 0,G , t) for t ∈ (Σ uo ∩ C Ra (ǫ)) * } (23)
Eq.( 19)

= {x ∈ X G | x = δ G (x 0,G , t) for t ∈ (Σ uo ∩ C R (ǫ)) * } (24)
Eq.( 2) gives us H 2 (x 0 , s, γ 1 . . . γ |s| )!, I 1 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = RE(s), and I 2 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = δ A (x 0,A , s). Let q = H 2 (x 0 , s, γ 1 . . . γ |s| ).

= U R CR(ǫ) (x 0,G ) (25)
Since se ∈ L(G a ||R a ||A) then it follows that H 2 (q, e, γ |se| )!. Moreover, it follows that I 2 (H 2 (x 0 , se, γ 1 . . . γ |se| )) = δ A (x 0,A , se) by construction of A.

For equality of Eq. ( 14), we divide the event e into three cases.

First, e ∈ Σ d a . Then, γ |se| = γ |s| Based on the construction of A, we have that I 1 (H 2 (q, e, γ |se| )) = U R γ |s| (N X P G (e) (I 1 (q))).

RE(se)

Eq.( 20 = U R γ |s| (N X P G (e) (RE(s))) (29) = U R γ |s| (N X P G (e) (I 1 (q)))

Let, e ∈ Σ i a . Based on the construction of A, we have that I 1 (H 2 (q, e, γ |se| )) = U R γ |se| (I 1 (q)).

RE(se)

Eq.( 20

Lastly, e ∈ Σ o . Based on the construction of A, we have that I 1 (H 2 (q, e, γ |se| )) = U R γ |se| (N X e (I 1 (q))).

RE(se)

Eq.( 20 = U R γ |se| (N X e (RE(s))) (39) = U R γ |se| (N X e (I 1 (q)))

(40)

This concludes our proof.

Theorem III.1

Proof. We start with the only if part. Let R be a robust supervisor. Proposition III.1 guarantees that H A 2 (x 0 , s, γ 1 . . . γ |s| ) is defined for any s ∈ L(G a ||R a ||A) and for any attack function representation A. To analyze the meta-system A, we have to define some notation for it.

We are analyzing A as a meta-system, namely as an automaton. The function h is a the combination of the functions h 1 and h 2 . Let E = A 1 ∪ A 2 be the event set of A, E o = E \ Σ a e the observable event set, E c = A 1 \ {Σ uc } the controllable event set. Moreover, the function η : E * → Σ * o projects strings in E * to strings in Σ * o . Intuitively, for any s ∈ L(A) the function η(s) returns the string that is observed by the supervisor.

We construct the language L ⊂ L(A) recursively as: 1) ǫ ∈ L 2) s ∈ L ∧ h(q 0 , s) ∈ Q A 2 ⇒ se ∈ L, ∀e ∈ Γ A (h(q 0 , s)) 3) s ∈ L∧h(q 0 , s) ∈ Q A

1 ∧ e = {Σ uc }∨e = C R (η(s)) ⇒ se ∈ L The language L is by construction controllable w.r.t. E c and L(A); we show that L is normal w.r.t. E o and L(A). The result is shown by contradiction. Assume that L is not normal, then there exist shortest s ∈ L and t ∈ L(A) \ L s.t. P (s) = P (t).

In the construction of L, player 2 is not constrained, meaning that the shortest strings that belong to L(A) \ L end with an event in A 1 (control decisions). For this reason, e and P EEo (s |s|-1 ) = P EEo (t |t|-1 ). It implies that η(s |s|-1 ) = η(t |t|-1 ) and C R (η(s |s|-1 )) = C R (η(t |t|-1 )). By the definition of L, t ∈ L. This contradicts our assumption.

It is also true that L ⊆ L(A trim ), otherwise R would not be a robust supervisor. Intuitively, the actions made by player 2 are not constrained in the construction of L. This guarantees that L embeds all actions of attacker A. The actions of player 1 are constrained based on R and {Σ uc }. R is robust and changing any of its control actions for any string by {Σ uc } will preserve robustness since {Σ uc } ⊆ γ for any γ ∈ Γ.

Definition III.7 defines L(A sup ) to be the supremal controllable and normal sublanguage of L(A trim ) w.r.t. E c , E o and L(A). Since L ⊆ L(A trim ) and it is controllable and normal, then L ⊆ L(A sup ). Therefore, H A sup 2 (x 0 , s, γ 1 . . . γ |s| )! holds for all s ∈ P ΣmΣo,e (L(G a ||R a ||A)).

For the if part, the result follows from the construction of A, A trim and the properties of A sup .

  Plant G with Σc = {a, b} and Σo = {a, b}.

a

  and Σ m = Σ ∪ Σ e a . We define three projection operators with Σ m as domain and Σ as co-domain: (1) M is defined as M(e i ) = M(e d ) = M(e) = e for e ∈ Σ; (2) P G (e) = M(e) for e ∈ Σ ∪ Σ d a and P G (e) = ǫ for e ∈ Σ i a ; (3) P S (e) = M(e) for e ∈ Σ ∪ Σ i a and P S (e) = ǫ for e ∈ Σ d a .

1 a

 1 ,b,b d, b i (a) A 1 -all-out strategy.

Fig. 2 :

 2 Fig. 2: Representation of two attack functions

Fig. 4 :

 4 Fig. 4: Supervisory control under sensor deception attack

Fig. 6 :

 6 Fig. 6: Transition function h 2 from player 2 to player 1

Fig. 7 :

 7 Fig. 7: Transition function h 2 from player 2 to player 2

  Figure 8 illustrates arena A constructed with respect to A 1 and G. We can observe the encoding of insertion and deletion in this arena. For example, at state ({1}, {a, b, c}, ǫ) the transition b i goes to state ({1}, {a, b, c}, b) and then transition b takes state ({1}, {a, b, c}, b) to state ({1}).

  The function H 2 can be recursively extended for strings s ∈ Σ * o,e given a sequence of control decisions γ 1 . . . γ |s| , i.e., H 2 (q, s, γ 1 . . . γ |s| ) = H 2 (H 2 (q, s |s|-1 , γ 1 . . . γ |s|-1 ), e |s| s , γ |s| ).

Fig. 8 :

 8 Fig. 8: Full arena A

Fig. 9 :

 9 Fig. 9: A sup

Fig. 10 :

 10 Fig. 10: Robust supervisors with respect to A 1

Fig. 11 :

 11 Fig. 11: Robot workspace and attack simulation

Fig. 12 :

 12 Fig. 12: Robust supervisor for robot in a hostile environment

Induction hypothesis: H 2

 2 (x 0 , s, γ 1 . . . γ |s| )!, I 1 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = RE(s) and I 2 (H 2 (x 0 , s, γ 1 . . . γ |s| )) = δ A (x 0,A,s) for all s ∈ L(G a ||R a ||A) and |s| = n. Induction step: Let e ∈ Σ o,e , s ∈ L(G a ||R a ||A), |s| = n and se ∈ L(G a ||R a ||A). The induction hypothesis

  ) = {x ∈ X Ga | x = δ Ga (δ Ga (RE(s), e), t) for t ∈ (Σ uo ∩ C Ra (se)) * } (26) Def.II.2 Eq.(19) = {x ∈ X G | x = δ G (δ G (RE(s), P G (e)), t) for t ∈ (Σ uo ∩ C R (P S (se))) * } (27)Eq.(3)γ |s| =γ |se| = {x ∈ X G | x = δ G (N X P G (e) (RE(s)), t) for t ∈ (Σ uo ∩ γ |s| ) * }(28)Eq.(2)

  ) = {x ∈ X Ga | x = δ Ga (δ Ga (RE(s), e), t) for t ∈ (Σ uo ∩ C Ra (se)) * } (31) Def.II.2 Eq.(19) = {x ∈ X G | x = δ G (δ G (RE(s), P G (e)), t) for t ∈ (Σ uo ∩ C R (P S (se))) * }(32)P G (e)=ǫ = {x ∈ X G | x = δ G (RE(s), t) for t ∈ (Σ uo ∩ γ |se| ) * }(33)Eq.(2)= U R γ |se| (RE(s)) (34) = U R γ |se| (I 1 (q))

  ) = {x ∈ X Ga | x = δ Ga (δ Ga (RE(s), e), t) for t ∈ (Σ uo ∩ C Ra (se)) * } (36) Def.II.2 Eq.(19) = {x ∈ X G | x = δ G (δ G (RE(s), P G (e)), t) for t ∈ (Σ uo ∩ C R (P S (se))) * }(37)Eq.(3)P G (e)=e = {x ∈ X G | x = δ G (N X e (RE(s)), t) for t ∈ (Σ uo ∩ γ |se| ) * }(38)Eq.(2)

Observe that clause (1) of Def. II.1 corrects a mistake in the corresponding clause (1) of Def.

in[START_REF] Meira-Góes | Synthesis of sensor deception attacks at the supervisory layer of cyber-physical systems[END_REF], where ∅ was inadvertently used instead of {ǫ} for initializing f A (s, ǫ).

We use superscripts to differentiate the different arena structures, e.g., A, A trim , etc.

There are different manners for a designer to extract a robust supervisor.

Our software tool is available at: URL. URL will be included upon final acceptance of the paper.

ACKNOWLEDGMENT

It is a pleasure to acknowledge many useful discussions with Loïc Hélouët in the preparation of this paper. The authors are also grateful to the reviewers for their insightful comments.

The work of R.Meira-Góes and S. Lafortune was supported in part by US NSF grants CNS-1421122, CNS-1446298 and CNS-1738103.


domain: info spi

text:
Sam Ban
email: sam.ban@mines-albi.fr

Matthieu Lauras
email: matthieu.lauras@mines-albi.fr

Sarot Srang
email: srangsarot@itc.edu.kh

Toward Physical Internet-Enabled Supply Chain and Logistics Networks in Developing Countries

Keywords: Physical Internet, Supply chain, Logistics, Networks, Developing countries, Cambodia

Developing countries have numerous challenges to manage in terms of supply chain and logistics networks such as safety, corruption, pollution, congestion, old and/or unsuitable vehicles, long lead times, economy, wastes and of course poor infrastructures and so on. While developed countries have started to change their mindset and toolboxes for managing their material flows all along their logistics networks, it is not yet the case for developing countries. This research work intends to study potentials benefit for these countries if there are drastic changes of the way physical of material flows are managed. In such a context, Physical Internet paradigm is considered as an interesting avenue for improvement. The objective of this paper is to draft an options that would be necessary to assess and to design the associated research methodology. Insights regarding an ongoing field-oriented research work in Cambodia are developed to highlight the potential.

Introduction

Studies like [START_REF] Chheang | FDI, services liberalisation, and logistics development in Cambodia[END_REF] demonstrated that supply chain and logistics play an important role and contribute significantly to economic growth and competitiveness of a country. However, many developing countries have issues and challenges such as corruption and informal payments, lack of institutional capacity and coordination, poor infrastructure and low-quality transportations, weak urban-rural and cross-border transportation networks, restricted participation of the private sector, lack of skilled human resources, and low public and private investments. As mentioned by [START_REF] Masood | Transportation problems in developing countries Pakistan: a case-in-point[END_REF], identifying and solving supply chain and logistics networks problems like these are the key issues of developing countries. Despite efforts and investments that are made to improve the supply chain and logistics networks means of these countries, the problems remain critical. Basically, these countries must cope with numerous supply chain and logistics networks problems such as safety, corruption, pollution, congestion, old and/or unsuitable vehicles, long lead times, wastes and of course poor infrastructures. Therefore, developing countries have a major crisis on their hands [START_REF] Masood | Transportation problems in developing countries Pakistan: a case-in-point[END_REF] if they want to sustainably support their economy. This is particularly true for countries like Cambodia whose economy is mainly based on agricultural productions and distribution of imported materials. In such a context, supply chain and logistics networks must be transformed into a more efficient and effective way. In parallel, we have to consider that the supply chain and logistics networks are running to the industry 4.0 era [START_REF] Tang | The strategic role of logistics in the industry 4.0 era[END_REF]. This new time is composed of technologies such as advanced robotics, artificial intelligence (AI), blockchain, autonomous vehicles, drones or Internet of Things (IoT) for instance, and of new supply chain and logistics paradigms such as Servitization [START_REF] Baines | Servitization: revisiting the state-of-the-art and research priorities[END_REF] or Physical Internet (PI) [START_REF] Montreuil | Physical internet foundations[END_REF]. If most of the developed countries are involved in enhancing their supply chain and logistics networks through these approaches and technologies, developing countries are not outdone. However, there are still tons of questions about how to benefit from these new approaches and technologies in developing countries which have major issues such as poor infrastructures, transportations networks, lesstrusted logistics services, information of technology, etc. The current research work is studying this issue by investigating the potentiality of implementing PI paradigm to developing countries in order to enhance their supply chain and logistics networks capabilities. This work is divided into three sections. First section discusses some key points on the literature which focus on the latest research works. Based on author knowledge, this new idea has not been conducted yet in developing countries. The second section develops avenues for implementing PI to supply chain and logistics networks in developing countries. It also suggests a framework able to objectively assess the potential benefits and limits of them and gives some insights regarding an ongoing Cambodian case study. The last section is about conclusion and future work.

Literature Review and Research Statement

Developing Countries Supply Chain and Logistics Networks Features

Some research works like [START_REF] Ul-Hameed | Remedies of low performance among Pakistani e-logistic companies: the role of firm's IT capability and information communication technology (ICT)[END_REF][START_REF] Mahbubulhye | Factors affecting on elogistic: mediating role of ICT & technology integration in retail supply chain in Malaysia[END_REF] or [START_REF] Liu | A study on the factors affecting e-logistics system in Chinese logistics industry[END_REF] studied the consequences of low performance supply chain and logistics networks in developing countries. They highlighted that the main issues came from weak capabilities regarding both human and machine means, poor track & trace systems and poor innovative and collaborative approaches. Another report by [START_REF] Yang | Crucial factors influencing international logistics operations for African landlocked countries[END_REF] indicates that the most important factor affecting the international logistics process of African countries was limited information integration, poor infrastructures, and specific local country risks such as corruption. As shown by [START_REF] Chen | Malaysian container seaport-hinterland connectivity: status, challenges and strategies[END_REF], around 98% of material flows in developing countries like Malaysia highly depend on the road while infrastructures are generally not good. On their side, [START_REF] Kavirathna | Transshipment hub port competitiveness of the port of Colombo against the major Southeast Asian hub ports[END_REF] revealed that the port of developing countries such as Sri Lanka was lower performance of transshipment hub ports comparing to developed countries like Singapore or Netherlands. All these situations caused several issues by leading to increase cost of logistics, CO 2 emission and transport time and to decrease service quality to end-customers [START_REF] Chen | Malaysian container seaport-hinterland connectivity: status, challenges and strategies[END_REF]. To conclude, developing countries supply chain and logistics networks do not seem to be effective.

Additionally, other studies demonstrated that developing countries have some issues regarding the efficiency of their supply chain and logistics networks. For instance, [START_REF] Karim | Empirical evidence on failure factors of warehouse productivity in Malaysian logistic service sector[END_REF] introduced the top three factors impacting warehousing process efficiency which were labor productivity, warehouse utilization and inventory space utilization. Most of the time, logistics plants (i.e. warehouses or distribution centers) in developing countries are under-used. In parallel, [START_REF] Dang | Weighing the key factors to improve Vietnam's logistics system[END_REF] pointed out that the position of the country's ranking for Vietnam in the LPI fell from 48 in 2014 to 64 in 2016 due to higher logistics costs. As a result, they noted that one might pay more attentions to the efficiency of logistics service providers (LSPs) and technologies in developing countries. The increase in volume of both people and material flows in developing countries implied critical stakes regarding last-mile deliveries and urban logistics [START_REF] Rossolov | A two-echelon green supply chain for urban delivery[END_REF]. These growing processes can cause a major problem not only for the cities, but also for the countries. Inappropriate material flows and lack of supply chain and logistics networks strategies will cause an increase in the final cost of products and traffic flow deterioration. These will affect to the GDP of both developed and developing countries. Last but not least, researchers such as [START_REF] Noletto | Intelligent packaging and the Internet of Things in Brazilian food supply chains: the current state and challenges[END_REF] showed that most of the developing countries did not yet adopt supply chain and logistics networks technologies like Intelligent Packaging (IP) or Internet of Thing (IoT). They found that cost and lack of knowledge were the main barriers. This is a questionable situation considering that at the same time people in developing countries are more and more used to live with connected devices such as smartphones.

The Physical Internet Opportunity

The original manifesto of PI consists in changing the manner in which physical items are managed, delivered, transported, stored, realized, supplied and used to achieve global logistics efficiency and sustainability [START_REF] Montreuil | Physical internet foundations[END_REF]. In practice, PI is an emergent and innovative concept of interconnected logistics networks capitalizing on the opportunity of sharing assets and capabilities. PI totally challenges in the supply chain foundations. Nowadays, companies are part of a specific and stable network and possess their warehouses, manufacturing plants or fleets. PI takes the opposite of this view and induces that assets should be shared between all the stakeholders part of this global network and used on a need basis.

PI has now been used for many research-works to improve supply chain and logistics networks. However, most of the researches on PI have been being conducted in developed countries like Canada, USA, China, France and some other countries in Europe while developing countries have probably their own issues and challenges regarding PI implementation. [START_REF] Montreuil | Modular design of physical internet transport, handling and packaging containers[END_REF] showed that supply chains and logistics networks are more and more intensely interconnected on multiple layers, ultimately anytime, anywhere. The interconnectivity layers notably include digital, physical, operational, business, legal and personal layers. They name this new state "hyperconnectivity".

In practice, PI paradigm already implies several innovative proposals and demonstrated its potential benefits. For instance, in the specific context of logistics and transportation in urban environment, [START_REF] Crainic | Physical internet enabled hyperconnected city logistics[END_REF] showed that the PI initiative enables hyperconnected logistics which is capable of transforming the freight transport fragmentation, logistics and distribution industries into a single manufacturing. Goods would be encapsulated and designed in standard for logistics that are modular, smart and reusable PI-containers, all size (from small cases up to the cases of cargo containers). [START_REF] Crainic | Physical internet enabled hyperconnected city logistics[END_REF] indicated also that these smart containers (PI container) can be routed from end to end through open hubs by developing real-time identification, tracking, and communication systems. Also, PI containers can store data or information required during different operations in terms of handling and transportation.

On their side, [START_REF] Hofman | Semantic technology for enabling logistics innovations-towards intelligent Cargo in the physical internet[END_REF] introduced semantic technology for enabled innovative supply chain and logistics networks as adaptive synchromodal planning by improving visibility and consequently predictability of turnaround times at container terminals. The study intended to address the notion of synchromodal transport and the PI. In another research work, [START_REF] Ben Mohamed | Modelling and solution approaches for the interconnected city logistics[END_REF] investigated the issue of urban transportation in a PI-enabled setting by applying multiple types of vehicles. They found that PI interconnectivity and extra hubs could improve urban transport planning regarding to routing efficiency and postponed services. [START_REF] Fazili | Physical Internet, conventional and hybrid logistic systems: a routing optimisation-based comparison using the Eastern Canada road network case study[END_REF] studied the comparison of PI performance and conventional logistics system to measure the advantages and disadvantages of PI. The analysis show that PI could reduce truck driving distances, times, cost and carbon emission. Instead, it increased the number of PI-container transfers within the PI logistics centers. Inspired by PI concepts, [START_REF] Chen | Using taxis to collect citywide E-commerce reverse flows: a crowdsourcing solution[END_REF] exploited the extra loading capacity of taxis to collect the reverse flows of goods in the city using simulation modelling method. Although the solution resulted in greater distances and higher lead times for the return flows compared to an ideal case. With these results, they highlighted that it was hard to directly compare between real world cases and the proposed solution of the model. The actual cases had very different selection strategies. However, they still claimed that their proposed model was more feasible in the following aspects. With another perspective, [START_REF] Yang | Mitigating supply chain disruptions through interconnected logistics services in the physical internet[END_REF] introduced the mitigation of supply chain networks disruptions on hubs and factory plants and investigated the inventory model resilience through the PI framework of interconnected logistics services. They wanted to introduce PI disruption mitigation strategies by using simulation modelling technique when plants, warehouses, hubs and distribution centers became unserviceable for a period of time. The results of this technique helped to deal with disruptions in terms of penalty, transport and total costs.

Research Statement Formulation

The current research wants to use the concepts and technologies of the PI initiative imagined few years ago. Basically, one goal of our research is to demonstrate the potential benefits of PI in the context of developing country (economic, social and environmental dimensions) of physical object mobility.

The main idea of this research is finally to demonstrate (i) the benefits of managing transportation activities through a "connected" approach in developing countries and (ii) the feasibility of such an evolution on one hand, and in developing (iii) the first decision support tools that will allow concretizing this on the other hand.

This research has the following concrete objectives for a developing country: (i) reduce transportation lead times; (ii) improve on-time delivery ratio; (iii) avoid useless travelled distance; (iv) limit waste of goods due to bad transportation; (v) improve carriers' profitability; (vi) allow transportation multimodality; (vii) allow real time tracking of goods; (viii) optimize transportation costs; and (ix) reduce carbon footprint impact of transportation.

It is important to notice here that the current research work did not focus on the technological dimensions of the PI (devices and connected assets, etc.). The research work only focuses on the use of the PI paradigm to better manage the material flows in a specific context of developing countries.

Proposal

As the objective is to improve both efficiency and effectiveness of supply chain and logistics networks in developing countries, there is one obvious option that consists drastically in modernizing the infrastructures (roads, buildings, etc.) and the logistics means which are used (vehicles, IT systems, machines, etc.). But building new and modern infrastructures (underground, bridge, highway, flyover) or investing in new transportation means for instance is a very expensive and time-consuming step. Within an opposite view, our suggestion involves in thinking about potential evolutions that might be implemented now, on the basis of existing or accessible means. In the following we first suggest some recommendations for looking for such an improvement inspired by the PI paradigm. Second, we develop a methodological approach allowing us to assess the potential impacts of these different recommendations. Third, we will draft the field-research application which is ongoing in Cambodia and its expected results.

Putting PI into Practice for Developing Countries

Nowadays, developing countries (like other countries) are using connected devices such as smartphones boosting the network sharing through Internet connectivity. But these technologies are not used or used inappropriately on supply chain and logistics activities while it could be very useful for them. Within an hyperconnected perspective, all the supply chain and logistics networks stakeholders (suppliers, shippers, carriers, customers, etc.) could be connected altogether and allow a set of PI levers that should be implemented in developing countries.

Open-Hubs Initiatives

In the current state of supply chain and logistics networks in developing countries, the product flows are formed by suppliers (mostly from oversea), warehouses and retailers or wholesalers, market and supermarket… As normal, the physical flow goes from one actor to another directly, on a one-to-one basis and through ownership assets. Hyperconnected supply chain and logistics networks will allow more collaboration by means of multiple open hubs in different places. All of these open hubs are composed of a network and would connect each other. It will be possible for any company to access to these open hubs on demand without agreeing for a long period. This consists in applying the concept of SaaS (Software as a Service) to the supply chain and logistics networks assets. As a result, the flow of products would transit much more efficiently and effectively from one hub to another before reaching its customers, and benefits from mutualization of means all along the value chain. Through the web open hubs strategy, products are not committed as a priori to one plant, the products are consolidated from different sources by multiple carriers and moving toward the same direction to final customers as shown in

Dynamic Transportation Chartering and Use

As considering on the supply chains in developing countries, most of shippers and carriers are chartering dedicated vehicles which could be for material and/or people moving, for shipments from one company to another. Within a PI perspective, transportation means (such as motorcycle taxi, bajaj, tuk-tuks, taxis, vans, etc.) might be connected to a common platform in real time. Then, it would be possible to charter dynamically this or this vehicle for a delivery based on geo-localization opportunities or capacity opportunities. Additionally, deliveries might be organized as a relay race between the source and the delivery point in order to accelerate the flow, to limit the cost and better use the available capacities. As a consequence, quality improvement and cost reduction in transport seem to be possible by using modern IT systems able to support the hyperconnectivity concept. Then, an efficient combination of transport modes/vehicles can be optimized by route-planning to guarantee an efficient use of the available resources and by bundling transport streams at certain points to minimize the frequency of transports (especially in cities). Combining different transport modes (multimodal transport) could be useful for transport-quality improvement and cost reduction. The concept of synchromodality can also be seen as a first step towards the PI, synchromodality aims to create a flexible and cooperative transport network by using the different available transport resources. As a consequence, reliability, robustness and resilience of the transport network should be increased by introducing real-time monitoring of the transport chains and real-time mode and route choice. For the connection between the actors, the infrastructure and the different transport modes are essential for the PI and lead to a comprehensive interconnectivity. Sharing all relevant information and guaranteeing the topicality of the data in a real-time manner are also crucial elements for the concept of the PI.

Dynamic Planning and Scheduling

Within a hyperconnected perspective, we could monitor and predict all aspects in real time where the goods are, what the available vehicles are and what the current disruptions are that exist on the infrastructures. This would allow managing the material flows from suppliers to customers much more efficiently and effectively than today. In addition to this kind of behavior, one can also plan proactive measures by considering seasonality or expected or unexpected events. For instance, considering that typhoon season will start in few weeks and that this road might be flooded, then we can prepare in advance some rerouting plans or transportation mode changes. Also, we can avoid road congestion dynamically accordingly to some real-time event management. In such a context, managers would have access to a centralized transportation planning and scheduling system (see Fig. 2). Such a system could estimate their needs, by geographical zone, in terms of transportation, inventory and maybe production for the next periods. First, this would mean that decision makers will have the opportunity to negotiate capacities on-demand and on-the-fly with their providers to avoid shortage situations or brutal increase of unitary costs for instance. Second, this would mean that managers will have the possibility to assess different alternatives a priori to fit supply chain and logistics decisions with established demands and opportunities.

Pick-Up and Asynchronous Deliveries

Additionally, in developing countries, majority of the material flows are home delivery. This implies important difficulties as delays and hazards are frequent. In a PI perspective, the supply chain and logistics networks might organize deliveries close to end-customers instead of parcel handed personally to increase the quality of service. Generalization of solutions such as lockers, permanent pick up points and/or temporary pick up points would be a significative change that would have to be assessed. Obviously, it would be hard to involve all these factors into a general supply chain model applicable for every developing country. In the following of this research, we will have to focus on a specific use case, such as Cambodia, before extending to other clusters of developing countries.

Performance Assessment Framework

Our suggested methodology framework is broken down into four phases:

1. Phase one is data gathering. As our research work is field-oriented, a concrete dataset is needed and has to be extracted from a real network in order to have a clear vision about the business processes and the material flows of a real system. Obviously, this step can be difficult in the context of networks that might have limited maturity in terms of legacy IT systems. Typically, the dataset that has to be gathered is composed of the following elements: a. General features about the network and its environment: it might include information about the business model of the company, business perspectives, market positioning, etc. b. Static features about assets which are involving in the considered Supply Chain: it might include information about vehicles, warehouses, items description, supplier description, customer descriptions, etc. c. Dynamic features about material flows which are managed by the considered Supply Chain: it might include information about the customer orders, inventories, supplier orders, transportation orders, etc. 2. Phase two consists in analyzing the dataset to transform it into knowledge, to set the problem formulation and to build the model conceptualization. As an output of this step, we should get an accurate and exhaustive map of the studied network. 3. Phase three is related to the design of potential solutions inspired by the PI paradigm and the modelling of them onto a dynamic model able to assess quantitatively the impacts of them on the supply chain and logistics networks. In our case, we have chosen to work through a discrete event simulation approach that is currently ongoing. Basically, this phase will include modelling simulation and validation by experimen. The experiment will consist in defining scenarios that correspond to the AS-IS situation of the material flow management in a developing country use case, and to define a set of TO-BE scenarios representative of PI paradigms in order to assess potential benefits and limits of evolving in that direction. 4. Phase four consists in exploiting the simulation results obtained from the previous phase to make concrete recommendations in terms of organization for developing countries supply chain and logistics networks. Obviously, these recommendations will be made by considering both the assumptions made and the sensitivity of the used model.

Ongoing Field-Oriented Research

Based on the previous framework, we are working on a Cambodian e-commerce supply chain and logistics network case. This company is located in Phnom Penh and offers apparel, footwear, bags, accessories, electronics, books, automotive, baby, kid toy, and beauty and health products. Consumers can also directly buy products from this company in 3 different stores located in Phnom Penh. The delivery services of products are made by their own employees for Phnom Penh and through 3 rd Party Logistics Providers for provinces and countryside. Customers order products every day. The delivery services are shipped these items to customer's home every day. Most of the times, the company manages the delivery services by its own employees. Currently, the company has 200 employees in total and 30 employees for delivery purpose of products to end-customers in Phnom Penh. Currently, the majority of products in warehouses and showrooms are imported from different sources of different suppliers located in Thailand, Vietnam and China. Until now there are over 100,000 items in the warehouses and shops, there are more than 1000 customer orders per day with different items of products each time. The majority of products are clothes which is 80% of the products of selling. Until now, the supply chain provides about 70% of product sales to customers in Phnom Penh and 30% at province of Cambodia. The studied supply chain is represented on the following Fig. 3.

At the starting point of the study, this supply chain and logistics network might be considered as very representative of a developing country's economy stakeholder. They noticed poor effectiveness of the means and resources involved in their network on one hand, and a poor efficiency of their network (numerous shortages, low quality of service, long lead-time…) on the other hand. In the following months, the current research work will intend to study the implementation of PI solutions described previously and to objectively assess the expected impacts for this network in terms of both effectiveness and efficiency. Significant improvements are expected.

Conclusion and Research Perspectives

While the current research work is in its infancy, we have demonstrated in this paper that developing countries supply chain and logistics networks have great stakes regarding both efficiency and effectiveness. We made the assumption that applying Physical Internet paradigm to this specific context will be useful and bring more benefits for supply chain and logistics in Cambodia. Within this objective, we suggested in this paper a set of concrete options to activate in developing countries and set the basis to make in a near future a concrete and objective assessment of them. A very first draft of an ongoingfield-oriented approach is also mentioned in this paper. Obviously, numerous research perspectives arise from this starting research work. The next steps will consist of finalizing the data gathering process with the Cambodian company in order to feed our future simulation model. Then the development of a discrete event simulation model able to mimic the existing supply chain and logistics network behaviors and to envisage the future ones, based on a PI approach, will be continued. The objective of this model will be to compare the results in terms of Supply Chain performance of developing countries' networks based on classical approaches of material flow management with the same networks running on PI basis. To do so, a structured experiment plan will have to be designed and run to get quantitative and objective results allowing us to make clear and complete recommendations.

Fig. 1 .

 1 This Figure shows the comparison between a simple delivery without PI (Fig. 1(a)) and with PI (Fig. 1(b)). Basically, Fig. 1(b) considers shared warehouses, transportation assets and hyperconnected flows. Each color of the Figure represents different destinations of delivery. As a result, Fig. 1 (b) with hyperconnected could save more times and costs by reducing travel distances and maximizing utilization rate of assets. In such a context, it has been demonstrated that PI can reduce, in developed countries situation, logistics costs by about 75%, carbon emission by 60% and travelled distance by 15% [17]. The remaining question is what we can expect in the context of developing countries?

Fig. 1 .

 1 Fig. 1. Simple one-to-one flows (a) vs hyperconnected and web open hubs (b).

Fig. 2 .

 2 Fig. 2. PI-oriented supply chain and logistics networks for developing countries

Fig. 3 .

 3 Fig. 3. Supply Chain flow map in Cambodia