Abstract

Many real-world large-scale systems, such as power systems, water distribution networks, and transportation networks, are examples of cyber-physical systems where physical processes are tightly coupled with digital devices. These systems are monitored and controlled via wired or wireless communications, leaving the systems vulnerable to malicious attackers. Recent reports have shown the disastrous consequences of malware for industrial control systems and power grids [1, 2]. The challenge of securely estimating states under malicious activities has been widely addressed [3, 4, 5, 6, 7, 8, 9], given their crucial role in control systems. This paper contributes to secure state estimation by considering asynchronous and non-periodic measurements under false data attacks.

To deal with the problem of secure state estimation against false data injection attacks, three research directions consisting of the sliding window method, the estimator switching method, and the local decomposition-fusion method, have been developed in recent years [5, 6, 3, 4]. The sliding window method considers past sensor measurements in a finite-time horizon to provide state estimates via batch optimization [10, 5]. The estimator switching method maintains multiple parallel estimators, each utilizing measurements from a subset of all sensors [11, 6]. The local decomposition-fusion method deploys multiple decentralized estimators, each of which samples the measurement of one local sensor. Then, local state estimates are fused by a convex optimization problem to generate secure state estimates [3, 4].

Denial-of-service (DoS) attacks block the measurement transmitted to the state estimator, undoubtedly worsening the state estimation performance. To handle such attacks conducted to multiple transmission channels, a partial observer is proposed to provide reliable partial state estimates in [8]. The authors in [12] propose a detection-compensation scheme to detect the presence of DoS attacks and then effectively reconstruct missing state estimates through past available states, eventually mitigating the attack’s impact on the state estimation performance. Event-triggered mechanisms are proven to be effective against DoS attacks in synchronous sampled systems such as the dynamic event-triggered scheme proposed in [9].

The asynchronous and non-periodic sampling scheme opens up new opportunities for the adversaries. In this paper, we propose a novel false data attack model for such systems, which was also introduced in the preliminary version [13] (see Fig.  1). This attack model includes both integrity attacks such as false-data injection [7], and availability attacks such as DoS attacks [8, 9]. We also investigate the influence of time-stamp manipulation caused by malicious attackers. Apart from these attacks, generating completely new false data packages into authentic measurement streams is also a serious threat. Our attack model unifies all the above attacks into one framework including the possibility of their combinations.

To the best of our knowledge, little progress has been made toward studying time-stamp manipulation on state estimation performance, especially on asynchronous sampled systems. Li et al. [14] and Guo et al. [15] propose Kalman filter (KF) algorithms for non-uniformly sampled multi-rate systems. To deal with the problem of asynchronous sampled systems, the authors in [16] propose an observer for continuous-time systems with discrete measurements, resulting in a differential Riccati equation. Ding et al.[17] analyze the observability degradation problem of multi-rate and non-periodic sampled systems. For time-stamp attacks, malicious impacts of time synchronization attacks on smart grids is studied in [18].

The main contribution of the paper is a secure estimation algorithm that recovers the system state in the presence of spatio-temporal false data attacks. The algorithm has the following merits:

1. The algorithm is built upon the decomposition of KF, which provides local state estimates. We first introduce a weighted least square optimization-based fusion of local state estimates. We show that the result of the fusion is exactly the same as the optimal state estimates obtained by KF in the absence of attacks. As a result, the proposed fusion achieves the minimum covariance estimation error.
2. To enhance security against attacks, we improve the weighted least square optimization-based fusion by adding an \( \ell_1\) -regularization. In the absence of attacks, we provide a sufficient condition on design parameters under which state estimates provided by the \( \ell_1\) -regularized fusion, the fusion without \( \ell_1\) -regularization, and KF are identical. Therefore, the estimation performance of the \( \ell_1\) -regularized fusion remains unchanged.
3. In the presence of attacks, the \( \ell_1\) -regularized fusion provides a secure state estimate whose estimation error is independent of attacks and is directly related to the estimation error of an oracle KF operating in the attack-free scenario. This merit highlights the effectiveness of the \( \ell_1\) -regularized fusion in mitigating the impact of attacks.

The effectiveness of the secure state estimation algorithm is validated through the IEEE 14-bus system. We conclude this section by introducing the notation that will be utilized throughout this paper.

{Notation}: The sets of positive integers, non-negative integers, and non-negative real numbers are denoted as \( {\mathbb{Z}}_{>0},{\mathbb{Z}}_{\geq0}\) , and \( {\mathbb{R}}_{\geq0}\) , respectively. For a real number \( x\) , \( \lceil x \rceil\) represents \( x\) rounded up to the nearest integer. The cardinality of a set \( {\mathcal{S}}\) is denoted as \( |{\mathcal{S}}|\) . Denote the span of row vectors of matrix \( A\) as \( \text{rowspan}(A)\) . We denote \( I\) as an identity matrix with an appropriate dimension. The spectrum of matrix \( A\) is denoted as \( \rm{sp}(A)\) . For a vector \( x\) , \( [x]_j\) stands for its \( j\) -th entry. We denote the continuous time index in a pair of parenthesis \( (\cdot)\) and the discrete-time index in a pair of brackets \( [\cdot]\) . Let \( \partial f(x)\) be the subgradient of function \( f\) at \( x\) .

We first introduce the system, the modeling of asynchronous measurements, and several assumptions that will be used throughout this paper. Secondly, we present a general notion of spatio-temporal false data attacks. Finally, the secure estimation problem is formulated.

2.1 Systems with asynchronous measurements

2.2 Spatio-temporal false data attacks

We introduce a new spatio-temporal false data attack that generalizes integrity attacks and availability attacks (see Fig. 1). More specifically, the adversary may manipulate the entire measurement triple (3) rather than only the measurement. Let us denote \( {\mathcal{S}}(t)\) as the set of all authentic measurement triples with time-stamp \( t\) :

\[ \begin{align*} {\mathcal{S}}(t) \triangleq \left\{(i, \, t, \, y_i(t))~|~i\in{\mathcal{I}} \right\}. \end{align*} \]

Moreover, \( {\mathcal{S}}^a(t)\) denotes the set of measurement triples with time-stamp \( t\) after being manipulated by the attacker. Denote the set of corrupted sensors as \( {\mathcal{C}}\) , which is supposed to be fixed over time and unknown to the operator. Now, we are ready to define the spatio-temporal false data attack as follows:

Definition 1 (Spatio-temporal false data attacks)

Attackers can manipulate measurement triples given by corrupted sensor \( i\in{\mathcal{C}}\) in the following four ways where \( (i, \, t, \, y_i(t)) \in {\mathcal{S}}(t) \) is an authentic measurement triple, \( y^a_i(t)\) and \( t^a\) are manipulated values from \( y_i(t)\) and \( t\) , respectively, and \( ( i, \, t^f, \, y^f_i(t))\notin {\mathcal{S}}(t)\) is a newly generated false measurement triple.

1. false-data injection:

   \[ S^a(t) \triangleq \big[ S(t) \setminus (i, \, t, \, y_i(t)) \big] ~\bigcup~ (i, \, t, \, y^a_i(t)) \]

2. time-stamp manipulation:

   \[ S^a(t) \triangleq \big[ S(t) \setminus (i, \, t, \,y_i(t)) \big] ~\bigcup~ (i, \, t^a, \,y_i(t)) \]

3. denial-of-service:

   \[ {\mathcal{S}}^a(t) \triangleq {\mathcal{S}}(t)\setminus ( i, \, t, \,y_i(t)) \]

4. false-data generation:

   \[ {\mathcal{S}}^a(t) \triangleq {\mathcal{S}}(t) ~\bigcup~ ( i, \, t^f, \, y^f_i(t) ) \]

Further, if the set of corrupted sensors satisfies \( |{\mathcal{C}}|\leq p\) , the attack is called \( p\) -sparse. \( \triangleleft \)

We mainly study \( p\) -sparse spatio-temporal false data attacks. Next, we introduce observability redundancy in the following assumption, which is a necessary condition and commonly used in literature (see [10, 8, 6, 11, 20]).

Assumption 3

The system \( (A,C)\) is \( 2p\) -sparse observable, i.e., the system \( (A,C_{{\mathcal{I}}\setminus{\mathcal{M}}})\) is observable for any subset \( {\mathcal{M}}\subset{\mathcal{I}}\) where \( |{\mathcal{M}}| = 2p\) and the matrix {\( C_{{\mathcal{I}}\setminus{\mathcal{M}}}\) } represents the matrix composed of rows of \( C\) with row indices in \( {\mathcal{I}}\setminus{\mathcal{M}}\) . \( \triangleleft \)

The manipulated time-stamp set \( \Gamma^a\) is defined as follows:

\[ \begin{align} \Gamma^a\triangleq &\bigcup_{i=1}^m \Gamma^a_i,&\Gamma^a_i\triangleq \{t~|~(i, \, t, \, y_i(t))\in{\mathcal{S}}^a(t)\}. \\\end{align} \]

(4)

Due to various delays, received measurement time-stamps may not be in increasing order, resulting in the out-of-sequence problem [21, 22, 23]. This problem is generally dealt with by utilizing a buffer that sorts received measurement triples based on their time-stamps in increasing order [21, 22, 23]. We assume a buffer before the secure estimator, enabling us to employ the following assumption.

Assumption 4

The received measurement triples are in an order such that their corresponding time-stamps are in an increasing order, i.e., \( \Gamma^a=\{t_0,t_1,t_2,\dots\}\) and \( 0 = t_0 < t_i \leq t_{i+1}, \forall \, i \in{\mathbb{Z}}_{>0}\) . \( \triangleleft \)

2.3 Secure state estimation problem

We first introduce the sampled-data KF with asynchronous sampling measurements. The remainder of the section presents the decomposition of the sampled-data KF and how it recovers state estimates provided by the sampled-data KF.

3.1 Asynchronous sampled-data KF

3.2 Linear decomposition of the sampled-data KF

3.3 Structure of \( G_i[k]\)

3.4 Least-square state estimation fusion

In this section, we propose a secure state estimation algorithm against \( p\) -sparse spatio-temporal false data attacks introduced in Definition 1. Prior to the algorithm, we present an analysis of spatio-temporal attacks in the following subsection.

4.1 Attack analysis

4.2 Secure fusion

To validate the obtained results, the proposed secure state estimation algorithm Code is available at https://tinyurl.com/sec-asyn-est (21) is implemented in the IEEE 14-bus system [27], which contains 28 state variables (a phase angle and an angular frequency variables for each bus) and 42 sensors (an electric power, a phase angle, and an angular frequency sensors for each bus). The code for the simulation can be found at By levering the structure of the block diagonal \( \boldsymbol{V}[k]\) and the asynchronous sampling, the elements of \( \boldsymbol{V}[k] \boldsymbol{\zeta}[k]\) in (21), which correspond to off-sampling sensors, are true since they are computed based on system modeling. Consequently, we can set elements of \( \vartheta[k]\) in (21), which correspond to those true values, are zero in the implementation. In the following, we validate the results obtained in Theorems 1-3.

In the first scenario, we conduct the state estimation using KF, the proposed least square (18), and the proposed secure least square (21) with two different values of \( \gamma\) , i.e., \( \gamma = 2\) and \( \gamma = 400\) , in the absence of attacks. The estimation errors of the three methods are shown in Fig. 3. No noticeable difference is witnessed among the three methods, validating the results of Theorems 1-2.

It remains to validate the result of Theorem 3. In the second scenario, we conduct spatio-temporal attacks: false data injection on the phase angle sensor of bus \( 3\) , time-stamp manipulation on the power sensor of bus \( 5\) , DoS on the angular frequency sensor of bus \( 4\) , and false data generation on the power sensor of bus \( 2\) (see Fig. 4). The state estimates provided by the sampled-data KF (6) without attacks and the secure least square problem (21) with \( \gamma =2\) under attacks are illustrated in Fig. 5. A clearly observable difference between the estimation errors is witnessed in Fig. 6. While the state estimate provided by the secure least square problem (21) is resilient to the attacks, that provided by the sampled-data KF exhibits a very large error. This illustration shows the effectiveness of our proposed secure state estimation algorithm.

This paper presents a secure state estimation algorithm for continuous LTI systems with non-periodic and asynchronous measurements under spatio-temporal false data attacks. The secure state estimation is developed based on the decomposition of the sampled-data KF to provide the state estimate which is exactly the same as the one provided by the sampled-data KF in the absence of attacks and resilient to spatio-temporal false data attacks. The effectiveness of the proposed secure state estimation is validated through an IEEE benchmark for power systems.

Before showing the proof of Lemma 4, we present the following supporting results. Their proofs can be found in [25].

Proof of Lemma 4: We first prove the upper bound. Based on Lemma 5, we have \( \sum_{j=1}^{m}\boldsymbol{W}_{ij}[k]=P[k]G^{\top}_i[k]\) for all \( k\in{\mathbb{Z}}_{\geq 0}\) . Summing both sides over \( i\) and recalling that \( \sum_{i=1}^{m}G_i[k]=I\) from Lemma 2, one obtains \( \sum_{i=1}^{m}\sum_{j=1}^{m}\boldsymbol{W}_{ij}[k]=P[k]\) , where \( P[k]\) is the estimation covariance of asynchronous Kalman estimator defined in (6.b). On the other hand, the result of Proposition 1 can yield \( \underline{\alpha}\cdot I \preceq P[k] \preceq \overline{\alpha}\cdot I\) , resulting in that for each index \( i\) , the diagonal block satisfy \( \boldsymbol{W}_{ii}[k]\preceq \overline{\alpha} I\) considering that every block \( \boldsymbol{W}_{ij}[k]\) is semi-positive definite. As a result, there exists a constant \( \overline{W}\) such that \( \boldsymbol{W}[k]\preceq \overline{W}\cdot I\) holds for all time index \( k\) . \(\square\)

Firstly, since \( \boldsymbol{V}[k]\) is non-singular based on Lemma 1, we multiply both sides of (18.b) with \( \boldsymbol{V}^{-1}[k]\) . After using the notations \( \boldsymbol{G}[k] \triangleq \big[ G_1^\top[k],\,G_2^\top[k],…,\,G_m^\top[k] \big]^\top\) and \( \hat \theta[k] = \boldsymbol{V}^{-1}[k] \theta[k]\) , one obtains the following least square problem, equivalent to (18):

Secondly, we prove that if the initial value of \( \boldsymbol{W}[k]\) is Hermitian and strictly positive definite and satisfies \( \sum_{j=1}^{m} \boldsymbol{W}_{ij}[0]=\Sigma\cdot G_i^{\top}[0]\) , for all \( i\in{\mathcal{I}}\) , then Theorem 1 holds. This initialization \( \boldsymbol{W}[0]\) and Lemma 5 imply that the following holds for all \( k\in{\mathbb{Z}}_{\geq 0}\) :

which resulting in

On the other hand, the solution to (26) is given by

Since \( \sum_{i=1}^{m}G_i[k]=I\) from Lemma 2, we finally concludes that

where the second equality comes from (27) and the third equality comes from (9). Finally, the existence of \( \boldsymbol{W}[0]\) is shown in [25, Appendix A.9]. \(\square\)

Let us introduce two new variables \( \alpha[k]\) and \( \beta[k]\) as the deviations between the two solutions to the problems (18) and (21) such that \( \alpha[k] \triangleq \check{x}[k] - x_{\text{ls}}[k]\) and \( \beta[k] \triangleq \mu[k] - \theta[k]\) . The proof will be completed if we show that \( \alpha[k] = 0\) and \( \beta[k] = 0\) in the absence of the attacks. It is worth noting that the absence of the attacks implies the same \( \boldsymbol{\zeta}[k]\) in (18) and (21), resulting in \( \boldsymbol{H} \alpha[k] + \beta[k] + \vartheta[k] = 0\) . As a result of utilizing the new deviation variables \( \alpha[k]\) and \( \beta[k]\) , solving (21) is equivalent to solving the following problem:

Let us consider the second term of the objective function (28) which can be rewritten based on its constraint as follows:

where the equality comes from the fact that \( \theta[k]^\top \tilde{\boldsymbol{W}}^{-1}[k] \boldsymbol{H} = 0\) based on the KKT condition of the problem (18).

On the other hand, the condition (22) implies the following property for an arbitrary vector \( \vartheta[k]\) :

where the equality occurs if, and only if, \( \vartheta[k] = 0\) . This result together with (29) implies that the minimum value of the objective (28) is zero if, and only if, \( \tilde{\boldsymbol{W}}^{-1} [k] \beta[k] =0\) and \( \vartheta[k] = 0\) . The empty null space of \( \tilde{\boldsymbol{W}}^{-1} [k]\) gives us \( \beta[k] = 0\) . As a consequence, the constraint (28) results in \( \alpha[k] = 0\) since the matrix \( \boldsymbol{H}\) has an empty null space. The proof is completed. \(\square\)

Before going to the proof of Theorem 3, let us introduce a support result in the following lemma.

Proof of Theorem 3: Recall the analysis in Section 4.1 and (20), let us consider the problem (18) with the oracle local estimator \( \boldsymbol{\zeta}^o[k]\) . Note that the fusion does not know the oracle value of \( \boldsymbol{\zeta}^o[k]\) to find the optimal state estimate \( x_{\text{ls}}[k]\) . However, this optimal solution \( (x_{\text{ls}}[k],\, \theta[k])\) can be utilized as a ground truth. On the other hand, we consider the problem (21) in the presence of the attacks, i.e., the corrupted local estimator \( \boldsymbol{\zeta}[k] \neq \boldsymbol{\zeta}^o[k]\) where \( \zeta_i[k]\) is defined in (20).

Let us reuse the two deviation variables \( \alpha[k]\) and \( \beta[k]\) in Appendix 10 such that \( \alpha[k] \triangleq \check{x}[k] - x_{\text{ls}}[k]\) and \( \beta[k] \triangleq \mu[k] - \theta[k]\) . Next, we plan to show that \( \left\lVert\alpha[k]\right\rVert\) lies in a small ball and is independent of the malicious activities. The constraint of (21) in the presence of attacks and the constraint of (18) in the absence of attacks give us the following relationship: \( \beta[k] = \boldsymbol{V}[k] \boldsymbol{\zeta}^f[k] - \boldsymbol{H} \alpha[k] - \vartheta[k]\) . As a consequence, solving (21) in the presence of attacks is equivalent to solving the following problem:

Let us denote \( \hat \vartheta[k] \triangleq \boldsymbol{V}[k] \boldsymbol{\zeta}^f[k] - \vartheta[k]\) and \( \check \vartheta[k] \in \partial\big \lVert \hat \vartheta[k] \big \rVert_1\) , i.e., the sub-gradient with respect to \( \vartheta[k]\) . It is worth noting that the \( i\) -th element of the sub-gradient \( \check \vartheta[k]\) takes a value between \( -1\) and \( 1\) . Since \( \boldsymbol{V}[k]\) is a block diagonal matrix, we have the following property: \( \boldsymbol{V}_i[k] \boldsymbol{\zeta}^f_i[k] \neq 0\) when \( i \in {\mathcal{C}}\) and \( \boldsymbol{V}_i[k] \boldsymbol{\zeta}^f_i[k] = 0\) otherwise.

With the help of the KKT condition of (18), which is \( \theta[k]^\top \tilde{\boldsymbol{W}}^{-1}[k] \boldsymbol{H} = 0\) , the optimization problem (31) can be solved by considering the following optimization problem:

where

Let us denote \( (\hat \vartheta^\star[k],\,\alpha^\star[k])\) as the solution to (32), which satisfies

Then, substituting (34) into (33) and leveraging \( \theta[k]^\top \tilde{\boldsymbol{W}}^{-1}[k] \boldsymbol{H} = 0\) , which is the KKT condition of (18), give us the following:

For the state with index \( j\) , let us recall the index set of sensors that observe state \( j\) , which was denoted as \( {\mathcal{E}}_j\) in (11), and the structure of the matrix \( H_i\) in Lemma 1, resulting in

where \( [\alpha^\star[k]]_j\) is the \( j\) -th element of \( \alpha^\star[k]\) . In the following, we consider the function \( L_j(\hat \vartheta^\star[k],\,\alpha^\star[k])\) that is a collection of terms containing \( [\alpha^\star[k]]_j\) in \( L(\hat \vartheta^\star[k],\,\alpha^\star[k])\) as follows:

Due to the fact that the system is \( 2p\) -observable, one has \( 2 \lvert {\mathcal{E}}_j \bigcap {\mathcal{C}} \rvert \leq 2 \lvert {\mathcal{C}} \rvert \leq 2p < \lvert {\mathcal{E}}_j \rvert\) , resulting in \( \lvert {\mathcal{E}}_j \bigcap {\mathcal{C}} \rvert < \lvert {\mathcal{E}}_j \setminus {\mathcal{C}} \rvert\) . This result implies that the number of \( [\alpha^\star[k]]_j\) in the first term of (37) is less than that of \( [\alpha^\star[k]]_j\) in the second term of (37). This observation enables us to apply the result of Lemma 6 to (37) together with the definition \( [\alpha^\star[k]]_j = \big[ \check x[k] \big]_j - \big[ x_{\text{ls}}[k] \big]_j\) , resulting in (23). The proof is completed. \(\square\)

The second equality of (12) holds by the definition of the observability matrix \( O_i\) and \( H_i\) . By induction method, we show the first equality of (12). Let us assume \( \text{rowspan}(G_i[k])= \text{rowspan}(O_i)\) . We need to show that \( \text{rowspan}(G_i[k+1])= \text{rowspan}(O_i)\) .

According to Assumption 5, one obtains

and \( \text{rowspan}(\Pi[k]G_i[k]A^{-1}[k])= \text{rowspan}(O_i)\) . Moreover, since \( \text{rowspan}(K_i[k+1]C_i)\subseteq \text{rowspan}(O_i)\) and one obtains that \( \text{rowspan}(G_i[k+1]) \subseteq \text{rowspan}(O_i)\) .

If \( ((A[k]-K[k+1]CA[k])G_i[k] A^{-1}[k] +K_i[k+1]C_i )^\top \boldsymbol{e}_j = 0\) , we alter \( K_i[k+1]\) slightly so that the equation does not hold while the performance of the estimator is not influenced. As a result, \( \text{rowspan}((A[k]-K[k+1]CA[k])G_i[k] A^{-1}[k] +K_i[k+1]C_i)=\text{rowspan}(G_i[k+1])\) and the proof is completed. \(\square\)

The proof is presented by the induction. Assume that \( \sum_{i=1}^{m} G_i[k]=I\) and we show that \( \sum_{i=1}^{m} G_i[k+1]=I\) :

where the second equality comes from the assumption that \( \sum_{i=1}^{m} G_i[k]=I\) and the last equality comes from the definition of \( \Pi[k]\) in (7). \(\square\)

According to the definition of \( \epsilon_i[k]\) , we have

where the last equality comes from (10). The proof is completed. \(\square\)

According to (16), we know that \( \boldsymbol{W}_{i j}[k]\) satisfies:

where scalar \( R_{i j}[k+1]\) is the element of the matrix \( R[k+1]\) on \( i\) -th row and \( j\) -th column. On the other hand, since \( \sum_{i=0}^{m}G_i[k]=I\) is shown in Lemma 2, one finds that

In the following, we prove that \( P[k]G_j^{\top}[k]\) satisfies the same dynamics with \( \sum_{i=1}^{m} \boldsymbol{W}_{i j}[k]\) , where \( P[k]\) is defined in (6.b). According to (6), \( P[k]\) and \( K[k]\) satisfy the following:

Considering the dynamics of \( G_j[k]\) in (10) gives us the following:

From (38)-(40), one obtains \( \sum_{j=1}^{m} \boldsymbol{W}_{i j}[k]=P[k] G_i^{\top}[k]\) . \(\square\)

Construct

where

One can verify that, if the following three constraints are satisfied, \( \boldsymbol{W}[0]\) is Hermitian, strictly positive definite and satisfies \( \sum_{j=1}^{m} \boldsymbol{W}_{ij}[0]=\Sigma\cdot G_i^{\top}[0]\) .

1. \( \boldsymbol{D}=\boldsymbol{D}^\top\) ,
2. \( \boldsymbol{D}\succ 0\) ,
3. \( \sum_{j=1}^{m} \boldsymbol{D}_{ij}= G_i[0]\) for all \( i\in{\mathcal{I}}\) .

We design the blocks \( \boldsymbol{D}_{ij}\) to be the following diagonal matrices:

where \( I_n\) represents an \( n\times n\) identity matrix.

By definition (41), the conditions (1) and (3) are satisfied. We proceed to prove that \( \boldsymbol{D}\) is positive definite. Denote \( \boldsymbol{D}^{[k]}_{ij}\) as the \( k\) -th diagonal element of \( \boldsymbol{D}_{ij}\) . We have that \( \boldsymbol{D}^{[k]}_{ii}\geq\sum_{j\neq i}\left| \boldsymbol{D}^{[k]}_{ij} \right|\) for all \( k\in{\mathcal{J}}\) since \( G_i[0]\) is non-negative diagonal matrix. According to Gershgorin circle theorem, \( \boldsymbol{D}\) is positive semi-definite.

We proceed to prove that \( \boldsymbol{D}\) is positive definite after elementary matrix operation. Since the system is observable, for each state index \( j\in{\mathcal{J}}\) , there exists a sensor \( i\) such that \( i\in{\mathcal{E}}_j\) . Denote such index \( i\) as \( \iota(j)\) . For each \( j\in{\mathcal{J}}\) , we do the following examination procedure. For all \( i\in{\mathcal{I}}\) , if \( i\notin {\mathcal{E}}_j\) , then multiply the \( 1/\boldsymbol{D}^{(j)}_{\iota(j)j}\) times of \( (\iota(j)-1)n+j\) -th row of \( \boldsymbol{D}\) on \( (i-1)n+j\) -th row of \( \boldsymbol{D}\) . After this elementary matrix operation, one can verify that every diagonal matrix of \( \boldsymbol{D}\) satisfies \( \boldsymbol{D}^{[k]}_{ii}>\sum_{j\neq i}\left| \boldsymbol{D}^{[k]}_{ij} \right|\) for all \( k\in{\mathcal{J}}\) . Therefore, \( \boldsymbol{D}\) is positive definite according to the fact that matrix rank does not degrade after an elementary matrix operation. \(\square\)