# Self-Healing Secure Blockchain Framework
in Microgrids

Suman Rath, Graduate Student Member, IEEE, Lam Duc Nguyen, Member, IEEE,
Subham Sahoo, Senior Member, IEEE and Petar Popovski, Fellow, IEEE This work
is partly supported by the Baltic-Nordic Energy Research programme via Next-
uGrid project and partly by the Villum Investigator Grant WATER from the Velux
Foundation, Denmark. Suman Rath is with the Department of Computer Science and
Engineering, University of Nevada, Reno, NV 89557, USA (e-mail:
srath@nevada.unr.edu)Lam Duc Nguyen is with Software Systems Research Group,
CSIRO’s Data61, Sydney 2015, Australia. (e-mail:
lam.nguyen@data61.csiro.au)Subham Sahoo is with the Department of Energy,
Aalborg University, 9220 Aalborg, Denmark (e-mail: sssa@energy.aau.dk).Petar
Popovski is with the Department of Electronic Systems, Aalborg University,
9220 Aalborg, Denmark<EMAIL_ADDRESS>
###### Abstract

Blockchain has recently been depicted as a secure protocol for information
exchange in cyber-physical microgrids. However, it is still found vulnerable
to consensus manipulation attacks. These stealth attacks are often difficult
to detect as they use kernel-level access to mask their actions. In this
paper, we firstly build a trusted and secured peer-to-peer network mechanism
for physical DC microgrids’ validation of transactions over Distributed
Ledger. Secondly, we leverage from a physics-informed approach for detecting
malware-infected nodes and then recovering from stealth attacks using a self-
healing recovery scheme augmented into the microgrid Blockchain network. This
scheme allows compromised nodes to adapt to a reconstructed trustworthy signal
in a multi-hop manner using corresponding measurements from the reliable nodes
in the network. Additionally, recognizing the possible threat of denial-of-
service attacks and random time delays (where information sharing via
communication channels is blocked), we also integrate a model-free predictive
controller with the proposed system that can locally reconstruct an expected
version of the attacked/delayed signals. This supplements the capabilities of
Blockchain, enabling it to detect and mitigate consensus manipulation
attempts, and network latencies.

###### Index Terms:

Blockchain, Microgrids, Cybersecurity, Self-Healing Mechanism.

##  I Introduction

Recent attempts to develop more efficient DC microgrid systems can be
attributed to their inherent cyber-physical capabilities that allow the smooth
integration of renewable energy sources (RESs), multiple electronic devices
(loads) and a variety of storage devices in both, the autonomous as well as
the grid-connected mode of operation. Such systems can have three different
types of control structures - centralized, distributed, and decentralized. The
distributed control framework is generally preferred over the other control
structures as it is resilient to single-point failures, thus enabling more
reliability and better scalability [1]. Moreover, distributed control
structures have a higher degree of tolerance to unavoidable cyber issues like
network latency, packet losses, and communication link failures. However,
these control structures can not be considered fully reliable as the
distributed framework can only enable partial information availability
(limited to neighboring units), which in turn, makes the microgrid vulnerable
to unauthorized manipulation of sensors and actuators [1]. Since cyber-
physical DC microgrids are integral components of mission-critical systems
(e.g., electric aircraft, hospitals, military bases, etc.), it is essential to
protect them from adversarial cyber attacks.

Networked microgrids, which may function either in the independent mode or in
collaboration with the rest of the network, can complicate the distribution
system’s operation. Conventionally, through supervisory control and data
acquisition (SCADA), microgrids are often controlled in a centralized manner
[2]. In particular, the network data is gathered, recorded, and then processed
at a centralized server. Considering the rapidly growing size and speed of the
measurement data, collecting and processing such a wide-range network in real-
time at a single server leads to overload for the centralized node and a
single point of failure problem. Centralized networks would also be vulnerable
to single-point attacks as hackers would only need to target the central host
computer server to compromise the entire network, as this is the single point
that issues control commands to all the other nodes [3]. In contrast,
attacking a distributed network is more challenging for attackers, especially
for the power grid that is distributed over a geographically wide-range area.
Hence, the computation and the trust are distributed over the network, which
can be useful for achieving a more secure power network.

In this regard, as the energy sector needs significant time reduction for the
management of economic transactions and the possibility of getting rid of
third-party authorities [4], the concept of transactive energy has appeared as
one of the most interesting technologies since the 2017 Gartner Hype cycle
[5]. There is a need to switch from a centralized energy system with
intermediary components to a decentralized system that can detach the related
financial transactions from the centralized energy control unit. For example,
the authors in [6] introduced an approach using Blockchain technology for
handling loss allocation and a timing mechanism for transacting intended
energy exchanges and losses.

A type of Distributed Ledger Technology (DLT) known as Blockchain consists of
blocks, which are lists of data items that are constantly growing.
Transactions of all kinds, including those involving money, energy,
transportation, data, logic, and even programs, can be recorded in blocks.
Blocks are tied together in chronological order, timestamped, unchangeable,
and verifiable. Every DLT node keeps a copy of the ledger, and any changes to
the blocks’ content or order are quickly detected by a check of the
authenticity of the blocks. Among the concerned untrusted parties, Blockchain
encourages immutable and transparent information sharing [7]. DLTs are viewed
as a crucial enabler for trustworthy and dependable distributed observation
systems in addition to their function in financial transactions. DLTs’
authentication procedure depends on network consensus across numerous nodes.
Blockchain technology is a noteworthy invention that can be applied in various
microgrid domains.

Recently, Blockchain has become more popular in the integration with
microgrids. There are several prominent applications of Blockchain
technologies in microgrids, e.g., peer-to-peer energy trading [8], energy
exchange [9], electric vehicle charging [10]. Besides, several start-ups and
companies have applied Blockchain technologies in microgrids system for
managing and sharing energy as well as building innovative products, e.g., the
energy market of PowerLedger [11], a decentralized data exchange platform for
energy sector GridSingularity [12]. More applications of Blockchain in
microgrids can be found in [13]. The authors in [14] have discussed a
Blockchain-based scheme for secure energy transactions. In conventional
Blockchain-based schemes, the trustworthiness of each block is decided through
a consensus-based mechanism where the majority of nodes in the system must
agree on its validity. Such schemes are often vulnerable to 51$\%$ attacks
[15]. In general, 51$\%$ attacks refer to an attack strategy where the hacker
can access the system’s internal mining capabilities and use this access to
mine compromised blocks. Further, this access is also used to manipulate the
consensus-based validation strategy by forcing individual nodes to stop the
confirmation of authentic blocks and make them validate fabricated blocks
generated by the attacker itself. 51$\%$ attacks can be executed using
stealthy, kernel-level malware like rootkits [16].

Although the Blockchain111Throughout this article, the words DLT and
_Blockchain_ will be used interchangeably. Blockchains are a particular sort
of DLT where each node keeps a copy of the ledger, and chains of blocks are
made up of digital pieces of information called transactions. is being used in
many power electronic applications, it is also essential to evaluate whether
Blockchain could be a feasible tool for exchanging voltage/frequency control
signals in the microgrid test system. This evaluation is essential because,
even though the Blockchain is an essential tool for cyber-secure control, the
time delay created as a consequence of mining new blocks may have a
detrimental effect on microgrid stability [17]. Mahmud et al. in [18] have
proposed the use of Blockchain for control in microgrids with distributed
energy resources and presented results showing that the proposed framework can
perform well even under time delays. However, the current studies have not
addressed how to prevent stealth & hijacking attacks in their proposed control
mechanism.

The conventional control framework in cyber-physical microgrids critically
relies on a centralized database and communication channels, both of which are
vulnerable to adversaries to manipulate the system operation. An effective
solution for countermeasures is the detection and mitigation of such threats.
However, mitigation techniques may be vulnerable to adversarial attacks
designed with knowledge of the system dynamics (e.g., adversarial attacks on
learning-based anomaly detectors, reward poisoning attacks against
reinforcement learning, etc.). Hence, a significantly better approach is the
prevention of these threats in the first stage itself. Since the DLT
technology offers great potential due to its advanced data protection and
attack prevention capabilities based on the natural security strength of the
cryptographic system and consensus mechanism [19], we propose to augment these
salient features of the DLT into the dynamic physical properties of microgrids
to enhance its resiliency against cyber-attacks (along with physics-informed
attack detection metrics to identify any type of consensus-manipulating attack
vector that tries to inject false data into the network). To recover from such
attacks upon detection, we introduce a self-healing recovery mechanism for
Blockchain-based microgrids that: i) provides a transparency and immutability
microgrids system; ii) addresses the garbage-in garbage-out problem of the
current Blockchain-based systems.

To summarize the key features, the contributions of this paper are as follows:

  * •

Firstly, we formulate a general model of a DLT-based transactive DC microgrid
system, including infrastructure and security mechanisms.

  * •

Secondly, we evaluate the response of the general Blockchain model to stealth
attacks and propose the addition of new physics-informed detection metrics
based on the secondary control dynamics of each node to identify such attacks
and alleviate the detection accuracy of DLT.

  * •

Finally, we also present a self-healing recovery mechanism in the form of a
reconstructed signal to compensate for any compromised data/signal at any
node. This recovery mechanism is independent of the physical topology of
multiple converters, and will always provide system resiliency, provided at
least one node in the network is trustworthy. The presented strategy is
resilient against several attack variants and potential network issues
including FDIA, denial-of-service (DoS), and random communication delays.

The remainder of this paper is organized as follows. In Section II, we
introduce the background knowledge of DLTs/Blockchain and the integration of
Blockchain into microgrids. Section III highlights the operating principles
and security issues in cyber-physical microgrids. Section IV presents the
Blockchain-based strategy adopted for cyber-secure control in the DC
microgrid. The effectiveness and robustness of the proposed strategy to
illustrate its resilient behavior under different attack scenarios and
physical topologies of microgrids are presented in Section V. Experimental
results demonstrating the robustness of the proposed self-healing strategy are
presented in Section VI. Finally, Section VII presents the conclusion of the
paper.

##  II Background Knowledge

###  II-A DLTs/Blockchain Concept

A Distributed Ledger Technology (DLT) system provides a distributed, tamper-
proof ledger that is spread throughout a network of interacting nodes, which
share a common initial block of data known as the genesis block [20]. When
publishing data to the ledger, each node adds data formatted in the form of
transactions in a block that also contains a pointer to its preceding block.
This produces a chain of blocks, or ”Blockchain,” referred to as the
Blockchain. To receive a reward, a block that is generated by a particular
node often needs to solve a mathematical crypto-puzzle [21] and provide the
result as evidence of its effort. Mining is the name of this process. The
network’s overall computing or mining power changes the crypto-level puzzles
of difficulty. Since every DLT node in the network maintains a copy of all
committed transactions in the ledger, every transaction recorded in the
distributed ledger is practically unchangeable [22]. Additionally, the
integrity of the data blocks in the DLTs is ensured by cryptographic methods,
including hash functions, asymmetric encryption algorithms, and digital
signatures. As a result, the DLTs can guarantee transaction non-repudiation.
Each transaction is also timestamped historically and given a unique ID,
allowing each user to be assigned to it. The life cycle of a transaction in
DLT-based networks is explained in detail in Fig. 1. Blockchain clients, e.g.,
physical devices and home alliances, generate or collect data, and transform
it into Blockchain transaction format. The transactions are subsequently put
into blocks, which are validated by peers via the mining process. In the
distributed ledger, the transactions are finally immutably recorded and
accessible to clients. After the transactions are recorded in the distributed
ledger, they can be queried by clients.

###  II-B Cyber Attacks on Microgrids

Blockchain is regarded as a typical distributed data storage system and
encompasses a number of other technologies as well, including
decentralization, distributed consensus procedures, and cryptography.
Blockchain has been studied in both research and applications due to the
benefit of creating safe, dependable, and decentralized autonomous ecosystems
for a variety of scenarios [23]. Blockchain is suited for applications
involving the security protection of cyber-physical systems (CPSs) because it
is a novel and fundamental technical feature.

Recent cyber attacks against critical physical systems, for example, the
attacks on the Ukrainian power grid in 2015-2016, have motivated multiple
studies on security and privacy aspects for cyber-physical systems,
particularly the power grid [24]. The work in [25] demonstrated that false
data injection (FDI) could inject data measurements to induce error in the
operation of the power system. A malicious attacker can also affect forecast
systems, which are used to plan the operation and activities of power systems
by exploiting vulnerabilities of artificial intelligence models [26]. In
general, FDI attacks need to gather information about the current state of the
system or the models used for making decisions, for example, the state of the
system, topology structure, or machine learning prediction models [27].

Besides, the attacker also exploits the lack of security mechanisms of
embedded IoT sensors [16] to affect the operation of power grid systems. The
target of adversaries could be embedded sensors such as environmental sensors,
smart meters, appliances, or end-user systems to affect the power systems. The
authors in [28] introduced a novel form of attack named manipulation of demand
via IoT and documented that if an attacker compromised thousands of nodes,
they could cause various problems to the power grid, including line failures,
frequency instabilities, increased operating costs. In another aspect, the
adversaries can compromise IoT devices responsible for communicating or
exchanging data and payments with other power systems by changing their bids
[29]. In the scope of this work, we propose to augment the physical
properties, dynamics, and principles of microgrid operation into Blockchain-
based attack detection and mitigation.

Figure 1: Schematic of a DLT-based system.

##  III Cyber-Physical Microgrids

###  III-A Operating Principle

A single-line diagram depicting a cyber-physical DC microgrid network with
$N=4$ sources and corresponding DC/DC buck converters is shown in Fig. 2. Each
source with the corresponding converter is called an agent. Further, the
agents are connected to each other via transmission lines. Besides the
physical interconnections, the agents are also connected to one another
through a communication network that aids in the exchange of information
between themselves. The information received from the communication network is
fed as input to the local controller associated with each agent. As shown in
Fig. 2, the local control framework consists of voltage and current
controllers for the management of the DC/DC converter. Apart from that, the
secondary control framework consists of an average voltage regulator for
facilitating the regulation of global voltage, and a current regulator to
achieve proportionate load sharing through the imposition of voltage offsets
from each of the layers.

An undirected, interconnected graph of cyber elements is shown in Fig. 2. In
this graph, the nodes represent the agents, and are denoted by
$\textbf{x}=\\{{x}_{1},{x}_{2},\ldots,{x}_{N}\\}$). The nodes are connected to
each other using edges through an associated adjacency matrix,
${\mathbf{A}_{\text{G}}}=[{a}_{kj}]\in{R^{N\times{N}}}$, where the
communication weight (represented by $a_{kj}$, i.e., from node $j$ to node
$k$) is formulated as: $a_{kj}>$ 0, if ($\psi_{k}$, $\psi_{j}$) $\in$
$\mathbf{E}$, where $\mathbf{E}$ represents an edge connecting two different
nodes, with $\psi_{k}$ and $\psi_{j}$ representing a local node and its
neighboring node, respectively. If the cyber link connecting $\psi_{k}$ and
$\psi_{j}$ is absent, $a_{kj}$ = 0. In this framework, an agent (say at
$\psi_{k}$ node) shares local voltage and current measurements with its
neighbors $N_{k}=\\{{j}\ |\ ({\psi}_{j},{\psi}_{k})\in\mathbf{E}\\}$. The
matrix showing input and output information can be represented as
$\mathbf{D}_{\text{in}}=\texttt{diag}\\{{d}_{k}^{in}\\}$ and
${\mathbf{D}_{\text{out}}}=\texttt{diag}\\{{d}_{k}^{out}\\}$ respectively,
where, ${d}_{k}^{in}=\sum_{j\in N_{k}}a_{kj}$ and ${d}_{k}^{out}=\sum_{i\in
N_{j}}a_{jk}$. Combining the transmitted and received information, a single
Laplacian matrix can be obtained, which is denoted by $\mathbf{L}$ =
[${l}_{kj}$]. The elements of the matrix are represented by $l_{kj}$ and
obtained using $\mathbf{L}$ =
${\mathbf{D}_{\text{in}}}-{\mathbf{A}_{\text{G}}}$.

As previously mentioned, the role of the cooperative control framework is to
achieve average global regulation and proportional sharing of load current. To
fulfill these objectives, a reference value of the voltage setpoint is
determined through the use of two voltage correction terms, as defined below:

$\displaystyle\Delta V_{1k}(t)$ $\displaystyle=K_{P}^{H_{1}}(V_{\rm
dcref}-\bar{V}_{i}(t))+K_{I}^{H_{1}}\int(V_{\rm ref}-\bar{V}_{k}(t))dt$ (1)
$\Delta
V_{2i}(t)=K_{P}^{H_{2}}\delta_{k}{(t)}+K_{I}^{H_{2}}\int\delta_{k}{(t)}dt$ (2)

where $\bar{V}_{i}$ represents the estimated average value of the voltage at
the $i^{\text{th}}$ agent; ${V}_{\rm ref}$ represents the nominal value of
voltage; $\delta_{k}$ represents the current mismatch error (in (4)) for the
$k^{\text{th}}$ agent between the local per-unit output current and the
neighbors’ per-unit output current. The output from the voltage observer and
power-sharing controller in Fig. 3 can be mathematically depicted as:

$\bar{V}_{k}(t)=V_{{k}}(t)+\int\sum_{j\in
N_{k}}a_{kj}(\bar{V}_{j}(t-\tau)-\bar{V}_{k}(t-\tau))dt$ (3)
$\delta_{k}{(t)}=\sum_{j\in
N_{k}}ca_{kj}\left(\frac{I_{{j}}(t-\tau)}{I_{{j}}^{max}}-\frac{I_{{k}}(t-\tau)}{I_{{k}}^{max}}\right)$
(4)

where, $\tau$ is the communication delay between the $k^{\text{th}}$ & the
$j^{\text{th}}$ agent and $c$ represents the coupling gain. Further, $I_{{k}}$
and $I_{{j}}$, $I_{{k}}^{max}$ and $I_{{j}}^{max}$ represent the measured and
the maximum output currents for the $k^{\text{th}}$ and the $j^{\text{th}}$
agent, respectively.

The local reference value of voltage $V_{k}^{*}$ for the $k^{\text{th}}$
agent, determined by using the two voltage correction terms as depicted in
(1)-(2) can be given by:

$V_{k}^{*}(t)=V_{\rm ref}+\Delta V_{1k}(t)+\Delta V_{2k}(t).$ (5)

For a well-connected cyber graph in a networked DC microgrid, based on the
cooperative consensus algorithm, the global control objectives can be given
by:

$\lim_{k\rightarrow\infty}\bar{V}_{k}(t)=V_{\rm
ref},\quad\lim_{k\rightarrow\infty}\delta_{k}(t)=0.\quad\forall k\in N$ (6)

TABLE I: Stealth Attacks in DC Microgrids in [1] and [30] Affected Counterparts | Modeling
---|---
Voltage [1] |  $\mbox{\bf{W}}{x}^{V}_{attack}$ = 0
Current [30] |  $\mbox{\bf{W}}{x}^{I}_{attack}$ = 0
Figure 2: Networked DC microgrid with $N$ = 4 distributed generations (DGs)
operating with a cooperative ring-based cyber graph. Figure 3: Distributed
controller for microgrids under consideration in $k^{th}$ DG.

###  III-B Cybersecurity Issues

Fig. 2 shows how malicious attackers may inject false data into the sensors,
actuators, controllers and other cyber devices in the DC microgrid system to
disrupt the objectives depicted in (6). These attacks may also be performed in
a coordinated fashion in order to deceive microgrid system operators and hide
the actions of the attack vector by adding additional inputs in (3)-(4), as
given by:

$\displaystyle\mbox{\bf{u}}^{a}(t)=\mbox{\bf{L}}\mbox{\bf{x}}(t)+\mbox{\bf{W}}\mbox{\bf{x}}_{attack}$
(7)

where, $\mbox{\bf{u}}^{a}$ is the vector representation of the manipulated
control input $u^{a}_{k}$ = {$u^{Va}_{k},u^{Ia}_{k}$}. Further,
$\mbox{\bf{x}}_{attack}$ and
$\mbox{\bf{x}}=\\{\bar{\mbox{\bf{V}}},\mbox{\bf{I}}\\}$ represent the attack
elements $x_{attack_{i}}$ = [$x^{V}_{attack_{k}},x^{I}_{attack_{k}}]^{T}$ and
the non-compromised measurements, respectively. Moreover, the attack
distribution matrix W = [$w_{kj}$] represents row-stochasticity, where its
elements can be given by:

$\displaystyle w_{kj}={\begin{cases}\frac{1}{N_{k}+1},\ j\in N_{k}\\\
1-\sum_{j\epsilon N_{k}}w_{kj},\ j=k\\\ 0,j\not\in N_{k},j\neq k\end{cases}}$
(8)

The detection strategies for both the stealth attacks (in Table I) are
provided in Table II. More details on its formulation can be referred from [1]
and [30]. As it can be seen in Table II that since the detection strategies
primarily depend on local as well as neighboring measurements, this leaves a
tactical opportunity for an attacker to infiltrate the communicated
measurements used for the design of the detection strategies. As a result,
such consecutive intrusion may affect the detectability of these attacks when
the criteria in Table II are not met.

Figure 4: Performance of detection strategies in response to stealth attack on
current and voltages at t = 1-2 sec and 4 sec, respectively – the detection
strategies can further be manipulated.

For more clarity, a case study is performed in a DC microgrid system with $N$
= 4 agents, as shown in Fig. 4 to demonstrate the performance of detection
criteria for a stealth attack on voltages and currents, respectively. In Fig.
4, after the stealth attack is initiated on currents, it can be seen that the
output currents of each agent are anyway shared equally. However, the
detection mechanism for current measurements suggests that $DM^{1}_{2}$ and
$DM^{3}_{2}$ are positive, which indicate compromised current measurements for
agent I and III. Further at t = 4 sec, a balanced set of attack elements {-15,
0, 15, 0} V are introduced in the voltage control input values (as shown in
Fig. 4) on the basis of the attack strategy depicted in [1]. Despite the
presence of attack elements, the voltages return back to pre-attack set
points. However, the corresponding detection metric $DM_{1}$ for agents I and
II immediately goes positive. Under these circumstances, if the communicated
measurements $x_{j}(t)$ in (1) are manipulated by the cyber-attacker with
considerable knowledge of the detection strategy, there is a possibility that
the cyber attack alarm might be disinformed. This mandates a secure mechanism
of information exchange between each agent so that the communicated variables
used in the proposed detection approach remain uncompromised. Following an
accurate scanning of the compromised measurement, the corresponding
countermeasures can be applied without any false alarms.

TABLE II: Detection Criteria for Stealth Attacks in Table I

Stealth Attack | Detection Criteria for $k^{th}$ Agent | Terminology
---|---|---
Voltage [1] |  |  $h_{k}$1 $[\sum_{j\epsilon N_{k}}a_{kj}(\Delta V_{1_{j}}-\Delta V_{1_{k}})]$
---
$[\sum_{j\epsilon N_{i}}a_{kj}(\Delta V_{1_{j}}+\Delta V_{1_{k}})]>$
$\Upsilon_{1}$
$DM^{k}_{1}$
Current [30] |  | $c_{k}[\sum_{j\epsilon N_{k}}a_{kj}(I^{j}_{in_{ref}}-I^{k}_{in_{ref}})]$
---
$[\sum_{j\epsilon N_{k}}a_{kj}(I^{j}_{in_{ref}}+I^{k}_{in_{ref}})]>$
$\Upsilon_{2}$
2 $DM^{k}_{2}$

  * 1

$h_{k}$ is a positive quantity used for $i^{th}$ agent.

  * 2

$c_{k}$ is another positive quantity. $I^{k}_{in_{ref}}$ represents the value
of input current reference for the $k^{th}$ agent.

##  IV Blockchain for Security of Microgrids

In this section, we present our self-healing Blockchain-based communication
model for the cyber-physical microgrid shown in Fig. 2. We propose a
distributed DLT, where the nodes can communicate and collaborate to identify
attacked counterpart(s) in a reliable and trustworthy manner. The DLT-based
network consists of nodes connected via the P2P model. Basically, nodes
connect using a unique address and use the gossip protocol to exchange network
information such as blocks, transactions, and addresses. In DLT-based
networks, there are specific nodes called miners responsible for extending the
Blockchain by creating new blocks [31]. In the scope of this research, each
node aggregates sensor measurement values (in its area) and analyzes them.
Further, each of them estimates the local update and exchanges signal values
with the other nodes, engages in distributed consensus procedures, and
publishes to the distributed ledger in its local memory.

###  IV-A System Model

We consider the DLT-based microgrid system with $M$ communication channels and
$N$ physical agents. The system states have already been defined as $x_{i}(t)$
= $\\{V_{k}(t),I_{k}(t),DetV_{k}(t-1),DetI_{k}(t-1)\\}$. The measurements
$y_{i}(t)$ = $\\{V_{k}(t),I_{k}(t),DetV_{k}(t-1),DetI_{k}(t-1)\\}$ can be
measured from every agent. The microgrid is modeled as a discrete-time linear
dynamic system, as given below:

$x_{t}=\mbox{\bf{A}}x_{t_{1}}+v_{t}$ (9) $y_{t}=\mbox{\bf{H}}x_{t}+w_{t}$ (10)

where $A\in R^{(2N-1)\times(2N-1)}$ and $H\in R^{K\times 2N-1}$ represent the
state transition and the measurement matrices respectively. Further,
$v_{t}=[v_{1,t},...,v_{2N-1,t}]^{T}$ and $w_{t}=[w_{1,t},...,w_{K,t}]^{T}$
represent the process noise and the measurement noise vectors respectively. It
is assumed that $w_{t}$ and $v_{t}$ are independent AWGN processes, where
$w_{t}\sim\mathcal{N}(0,\sigma^{2}_{w}I_{K})$ and
$v_{t}\sim(0,\sigma^{2},I_{2N-1})$.

For a secure and reliable state update among DLT-based nodes, it is essential
to guarantee that the previous values of the state estimate are not modified,
the physical agent measurement is non-anomalous, and the operation of the DLT
nodes adheres to the predefined agreements. In case the network is attacked,
the state estimate values can be recovered through the use of previous
reliable state estimations that also require the protection of preceding state
estimation values against tampering. On the one hand, in a DLT-based network,
malicious adversaries can obtain illegitimate access to the system, for
example, via trojan propagation, stealing the identity of involved nodes,
leading the nodes to get faulty updates during the operation of the system. On
the other hand, as the characteristic of DLT is completely distributed, there
is no single trustworthy central entity to take control and verify whether the
other nodes are reliable and safe, e.g., if the involved nodes are operating
as per pre-defined roles. Hence, a distributed authentication mechanism is
needed to detect misbehaving nodes.

###  IV-B Detection Model

In a DLT-based microgrid network, even though the whole system is fully
distributed, attackers can still manipulate the system dynamics if they can
achieve control of the majority of the individual nodes, which gives them
access to more than half of the hashing/computational power. This scenario can
be used to manipulate consensual query decisions to introduce false data into
sensors/communication links in the system [15, 25]. In certain cases, the
attackers may also create a fork, extracting specific transactions, tampering
with them, and injecting them back as True packets. Since these attack vectors
were designed to prey on the vulnerability of the conventional DLT framework,
we integrate system-specific knowledge into the DLT setup enabling it to
recognize violations in microgrid dynamics to identify false data disrupting
the secondary controller synchronization among nodes. The generated data from
individual nodes are formatted in Blockchain-based transactions and
synchronized among them. The detection criteria as mentioned in Table II are
in the form of mismatch error margins (represented by the metric $DM^{k}$)
between parameter data (measurements) from the distributed nodes. When an
attack vector stealthily manipulates transactions, the detection metric
$DM^{k}$ increases beyond the threshold value $\Upsilon$ predefined in the
smart contract, enabling autonomous attack detection using the physics-
informed attack detection metrics in Table II. A more elaborate explanation of
the integrated setup including the self-healing process is depicted in the
next subsection.

Figure 5: Distributed Ledger and structure of $b$ block at time $t$. Note that
$b_{t}$ is the block generated at time $t$ and hash of the SHA H(.) algorithm.
The block includes a block header and body of the local state vectors in
corresponding time.

###  IV-C Self-healing recovery

The self-healing process designed to enable recovery of compromised nodes in
the DLT-microgrid framework is part of an integrated setup including both
attack detection and mitigation. Any transaction performed by a node, leading
to the generation of a new block of data is broadcast to the rest of the
network through a secure sharing scheme. The network uses the recipient node’s
ability to validate transactions using digital signatures in order to detect
any malicious data in the system. This process is carried out through the
determination of events, when an external agent attempts data alteration,
leading to a modification of the hash index associated with the detection
metrics in the corresponding block. All subsequent changes lead to further
variation in the computed hash index, which is detected by the recipient node
through comparison with the last trustworthy block received. In the event of a
mismatch, the recipient queries the rest of the nodes for verification. As
shown in Fig. 5, any hash which is declared False by the majority of the nodes
is considered to be associated with a manipulated block of data and hence,
rejected by the receiver. Thus, the general anomaly detection framework is
based upon a mutual trust-based structure where a block is acceptable, if and
only if it satisfies the following criteria:

${N_{a}>N_{r}}$ (11)

where, $N_{a}$ represents the number of approving nodes, and $N_{r}$ is the
number of rejecting nodes. Since this framework is vulnerable to consensus-
deceiving hijacking attacks, an additional set of detection criteria as
depicted in Table II is defined using smart contracts and utilized to detect
such deceptive attacks. Any event resulting in the violation of the detection
criterion in Table II leads to the labeling of the agent as a misbehaving
node.

Figure 6: Self-healing recovery scheme augmented into DLTs for microgrids –
the detection metrics in Table II initiate the reconstruction process using
trustworthy measurements from neighbors and then self-heal the system by
transmitting back the reconstructed signal $I_{1}^{R}(t_{i})$.

Detection of a misbehaving node triggers the activation of a self-healing
strategy where:

  1. 1.

firstly, the compromised transaction is canceled, stopping further
communication of any manipulated signal to neighboring nodes to limit the
attack propagation.

  2. 2.

secondly, the malicious transaction is not recorded in the ledger and a
trustworthy version of the manipulated signal is reconstructed for each
compromised node (using pseudo-anonymous values of trustworthy sensor data
stored in the irreversible ledger), to preserve system stability. This has
been shown in Fig. 6.

  3. 3.

finally, this trustworthy event-driven signal is sampled from measurements of
the neighboring nodes (detailed philosophy can be found in [32]-[33]) and
previous measurements from the same node obtained from the ledger as per the
following equations:

${\Delta V_{1_{j}}(t_{i})=f_{1}(\Delta V_{1_{k}}(t),\Delta
V_{1_{j}}(t_{i-1}))}$ (12) ${\Delta I_{dc_{j}}(t_{i})=f_{2}(\Delta
I_{dc_{k}}(t),\Delta I_{dc_{j}}(t_{i-1}))}$ (13)

where, $i$ represents the instant at which the event occurs (also called the
triggering instant), and $f(\circ)$ represents the triggering function as per
which the reconstruction is performed. A major role of $f(\circ)$ is to hold
the input value of the signal until the next triggering event. Hence, the
recipient node is localized with no communication inputs from the malicious
node. Ultimately, all the manipulated blocks are substituted with event-
driven, secure reconstructed blocks. This strategy is followed to reconstruct
the manipulated signal(s) at each compromised node. The presence of the terms,
$\Delta V_{1_{k}}(t)$ and $\Delta I_{dc_{k}}(t)$ in (12) and (13) imply that
the trustworthy reconstruction of a manipulated signal will always be possible
if at least one of the nodes (here, represented as the $k^{th}$ node) is
reliable (i.e., not affected by the attack). In an event where even the
$k^{th}$ node is infected (i.e., 100$\%$ infection), the mitigation strategy
will fail to reconstruct a trustworthy version of the signal. Hence, the
resiliency scale of the proposed self-healing recovery scheme can be given by
$N-1$, with $N$ given by the number of converters in the system. In simple
terms, the above sentence implies that in a system comprising of $N$ nodes,
the proposed scheme will always provide secure and resilient behavior, even if
there is only one trustworthy node to broadcast its information to self-heal
the system.

Figure 7: Performance comparison of the microgrid-Blockchain network with and
without additional fortifications as depicted in Table II. The conventional
Blockchain fails to identify controller-level manipulations and accepts the
attacker’s manipulations as true data.

###  IV-D Mitigation of DoS attacks and time delays

A significant advantage of the proposed set of physics-based detection metrics
is their ability to also identify denial-of-service (DoS) attacks and network
latencies as they would lead to mismatches in measurement values as well.
However, the self-healing strategy as depicted in the preceding subsection may
not be able to mitigate such network issues/attacks as the information sharing
(via communication links) would be blocked in such cases. To mitigate these
attacks a local compensation framework is established by integrating a
prediction policy with the self-healing strategy. This supplementary framework
reconstructs an expected version of the attacked signal using a model-free
compensatory mechanism as presented in [34] and depicted in Fig. 8.

Figure 8: A physics-based model-free predictive strategy that is augmented
into the Blockchain-enabled DC microgrid to mitigate DoS attacks and potential
time/computational delays [34].

In situations where DoS attacks and/or random time delays are encountered, the
predictive policy exploits the recipient node’s access to the last trustworthy
measurement received (just before the occurrence of the event). In this case,
the measurement not received/delayed (represented as $x(t-d)$) can be
approximated using the proposed model-free prediction policy that uses the PI
consensuability law [35] to generate control signals in the presence of the
attack vector. Since the vector seeks to manipulate the flow of measurement
and control values in the secondary control layer, the signal representing the
error margin $e_{k}^{Volt}(t)$ for the voltage control loop is downsampled to
a reduced value $e_{k}^{down}(t)$ as per the following formula:

$e_{k}^{down}=\sum_{b=0}^{B-1}e_{k}^{Volt}|nD-b|.h|b|$ (14)

where $h|b|$ represents an impulse response signal whose window length is $B$
downsampling factor is $D$. Downsampling essentially reduces the resolution of
the input error signal by decimating it by $D$ samples. This ensures that the
dynamic performance of the prior is appropriately matched. A pictorial
representation of this process is shown in Fig. 9. In the figure, the
resolution of the error signal $e^{Volt}$ is scaled down by downsampling it
into two different signals having resolutions of 2 and 4.

Figure 9: Downsampling of an error signal into decimated output signals of
lower resolution [34].

For an affirmation of the presence of the attack vector (and/or random time
delays), local control, and measurement values are compared with the
downsampled signal $e_{k}^{down}(t)$. Post-comparison, the proposed prediction
strategy reconstructs the expected delay compensation signals
$e_{k}(t_{k})={e_{k}^{V}(t_{k}),e_{k}^{I}(t_{k})}$ at the local node side on
the basis of the following condition:

$e_{k}(t_{k})=e_{k}^{down}.[11]-{u_{k}}$ (15)

After reconstruction, the error signal is sent to the prediction policy stage
where signal reconstruction is performed again if the attack persists for an
increased time period. A similar reconstruction is also performed in the case
of large time delays. The overall prediction criterion is provided below.

$||e_{k}(t_{k})||>\alpha||exp(-t/T)e_{k}^{Volt}.[11]||$ (16)

where $T(=K_{P}/K_{i})$ represents the time instant associated with the PI
control loops, and represents a tunable parameter. If the condition defined
above is satisfied, a trigger is generated that reconstructs $e_{k}(t_{k})$
through a Sample and Hold process with the triggering instant $t_{k}$. After
this, the reconstructed signals (compensators for the expected signal) are
provided as inputs to the local secondary (voltage and current) control loops
using a set of tunable gains, $k_{1}$ and $k_{2}$. The inputs can be defined
as follows.

$e_{V}^{del}(t_{k})=k_{1}e_{k}(t_{k})$ (17)
$e_{I}^{del}(t_{k})=k_{1}e_{k}(t_{k})$ (18)

As depicted in Fig. 8, these inputs are fed back into the secondary controller
as per the following equations.

$u_{k}^{Vf}(t)=u_{k}^{V}(t)+e_{V}^{del}(t_{k})$ (19)
$u_{k}^{If}(t)=u_{k}^{I}(t)+e_{I}^{del}(t_{k})$ (20)

where $u_{k}^{Vf}$ and $u_{k}^{If}$ represent the final inputs to the
secondary control loops as shown in Fig. 8. The proposed strategy effectively
handles continued DoS attacks and large-magnitude time delays. Additionally,
the error computation framework is used to validate the interruptions in a
robust manner.

##  V Performance Analysis & Simulation Results

To demonstrate the action of the supplementary detection metric, we validate
our results on the considered system in Fig. 2. The test system used for
strategy validation is developed in the MATLAB R2020a environment. The model
(as depicted in Fig. 2), has four converters (each of 10 kW rating) that are
connected to each other through tie-lines $R_{i}$. The controller gains are
also identical for each converter. The system and control parameters used for
the simulation can be found in Table III. In the first case study, Fig. 7
presents the magnitude of current signals in a DC microgrid consisting of
$N=4$ agents (as shown in Fig. 2), where a malicious hacker with controller
level access executes various types of consensus-disrupting attacks to
perform: (i) hijacking, and (ii) false data injection. To perform the
hijacking attack, the attacker activates an attack vector that impairs the
iterative update rule leading to an arbitrary behavior. This is simulated
through the swapping of a True measured signal with a new (False) constant
value, which becomes the reference for other DGs in the system [36].
Consequently, all the DGs start operating erroneously resulting in a biased,
arbitrary solution. To validate the replaced signal, the perpetrator
interrupts the communication between a claimant (here, an incoming block of
data) and the verifier (here, one or more nodes in the Blockchain network) in
order to change the authentication decision. Thus, it cons the recipient into
believing that a malicious, foreign block is authentic. The mathematical model
of the hijacking attack can be formulated as

$x_{j}^{a}(t)=(1-\zeta)x_{j}(t)+c_{j}^{a}$ (21)

where, $x_{j}^{a}$ represents the final local measurement value from the
neighboring nodes, and $c_{j}^{a}$ is an attack element. $\zeta$ is a variable
representing the presence of the attack vector which only accepts binary
values 1 (during the attack), or 0 (otherwise). This leads to a disruption in
the behavior of the consensus theory imposing a restriction on $x_{j}^{a}(t)$
that can only update during future iterations. This results in the creation of
a random steady-state signal value for each individual node that ceases to
follow the consensus theory.  To perform the false data injection attack, the
attacker activates an attack vector that adds an additional (exogenic) signal
to the general consensus-based control update during each iteration. This
leads to the iterations converging to a feasible but manipulated (False)
value, where all the operational states remain confined to their general
bounds. To validate the manipulated measurement/control signals, the attacker
internally overwrites any unfavorable decision from the verifier to mask
malicious injections into the communication channel. The mathematical model of
the FDI attack can be described as:

$x_{j}^{a}(t)=x_{j}(t)+c_{j}^{a}$ (22)

The above-mentioned equation allows the transmitted signal to be updated as
the attacked version of the signal is still determined based on the time-
dependent term $x_{j}(t)$.  Clearly, the non-detection of such consensus-
manipulating attacks can have negative repercussions on the system. However,
as shown in Fig. 7, a Blockchain network fortified with the proposed set of
detection metrics in Table II can immediately recognize the presence of attack
elements in the compromised nodes and hence, effectively negate their actions
(through signal reconstruction).

TABLE III: System & Control Parameters of System in Fig. 2 Parameter | Value | Parameter | Value | Parameter | Value
---|---|---|---|---|---
$R_{1}$ | 1.5 $\Omega$ | $R_{2}$ | 1.2 $\Omega$ | $R_{3}$ | 0.8 $\Omega$
$R_{4}$ | 0.3 $\Omega$ | $R_{5}$ | 0.5 $\Omega$ |  $R_{6}$, $R_{10}$ | 0.6 $\Omega$
$R_{7}$ | 0.45 $\Omega$ |  $R_{8}$, $R_{9}$ | 0.4 $\Omega$ | $L_{se_{i}}$ | 3 mH
$C_{dc_{i}}$ | 250 $\mu$F | $I_{dc_{min}}$ | 0 A | $I_{dc_{max}}$ | 28 A
$V_{dc_{min}}$ | 270 V | $V_{dc_{max}}$ | 360 V | $V_{\rm ref}$ | 315
$I_{\rm ref}$ | 0 | $K^{v}_{P}$ | 5 | $K^{v}_{I}$ | 100
$K^{i}_{P}$ | 2.5 | $K^{i}_{I}$ | 0.05 | $h_{i}$ | 2.5
TABLE IV: System & Control Parameters of System in Fig. 13 Parameter | Value | Parameter | Value | Parameter | Value
---|---|---|---|---|---
$R_{1}$ | 0.2 $\Omega$ | $R_{2}$ | 0.25 $\Omega$ | $R_{3}$ | 0.32 $\Omega$
$R_{4}$ | 0.26 $\Omega$ | $R_{5}$ | 0.45 $\Omega$ | $L_{se_{i}}$ | 2 mH
$C_{dc_{i}}$ | 120 $\mu$F | $I_{dc_{min}}$ | 0 A | $I_{dc_{max}}$ | 10 A
$V_{dc_{min}}$ | 42 V | $V_{dc_{max}}$ | 54 V | $V_{\rm ref}$ | 48
$I_{\rm ref}$ | 0 | $K^{v}_{P}$ | 5 | $K^{v}_{I}$ | 100
$K^{i}_{P}$ | 2.5 | $K^{i}_{I}$ | 0.05 | $h_{i}$ | 2.5
Figure 10: Performance of the self-healing recovery scheme in DLT-based
microgrids when the current of agent I is compromised – in 0.15 sec, the
reconstructed signal from agent I is re-transmitted back to its neighbors by
retaining the system stability. Figure 11: Performance of the self-healing
recovery scheme under cyber attacks on $N-1$ converters – the system is able
to heal only from a single trustworthy agent 3. Figure 12:  Performance of the
self-healing mechanism during DoS attack when the data packets are lost due to
injection of random noise at t = 3 sec – the local reconstructed estimate [34]
ensures steady-state convergence. Figure 13: Performance of the self-healing
mechanism being independent of the physical parameters of microgrid, where the
line resistances and number of converters are different from Fig. 2 – the
system resiliency is still intact under cyber attacks.

To explain the working mechanism of the proposed self-healing strategy in Fig.
6, we have considered an adversarial situation in the same system, where the
attacker has access to the current of agent 1. Fig. 10 shows the proposed
self-healing Blockchain-based attack detection and mitigation procedure under
this scenario. Once $DM_{2}^{1}$ detects the presence of attack elements in an
agent I, the mitigation mechanism is immediately triggered, which traces a
trustworthy current signal from agent 2, as shown in Fig. 10. After acquiring
the trustworthy current signal from agent 2, the signal reconstruction is
performed to replace the attacked $I_{1}(t)$ with a trustworthy event-driven
signal $I_{1}(t_{k})$. As shown in Fig. 10, after the highlighted event-driven
signal is replaced, its communication to neighbors is resumed after the
validation process from DLT in 0.15 sec. In this way, the considered system
operates normally even under a hijacking attack on one of the agents without
causing any power interruption.

To evaluate the $N-1$ resiliency scale of the proposed self-healing strategy,
we have also considered the additional adversarial situations in Fig. 11,
where the attacker has access to 3 nodes out of 4 agents. In this scenario, we
anticipate that the only trustworthy agent III will self-heal the system by
broadcasting its trustworthy information in a step-wise manner. When currents
of agents 1, 2, and 4 are simultaneously attacked at t = 1 sec in Fig. 11, it
can be clearly seen that the system operates normally despite heterogeneous
transients from each converter during attacks. The signal authentication is
done in a stepwise manner, which has been highlighted in Fig. 11, where the
event-driven mitigation is firstly carried out in agents 2 & 4 and then later
followed by agent 1 towards the end. Hence, the resiliency scale of $N-1$ for
the proposed strategy is clearly established in a system of $N$ converters.

As outlined in Section IV(D), the self-healing mechanism can also be extended
to DoS attacks, wherein a local reconstructed estimate designed using physics-
governed equations can be replaced by the missing signal for a DoS attack.
This can be seen in Fig. 12, where a signal interruption can be seen across
the link between agent III and IV in the form of 15% data packet loss.
However, the downsampled estimate [34] obtained from the local error dynamics
of the primary controllers of converter III and IV is used to compensate for
the delay and achieve steady-state convergence. As a result, it is not
dependent on the blockchain-enabled information transmission, since the
divergent secondary controller error is substituted locally. It is worth
notifying that the self-healing mechanism allows operation under dynamic
disturbances, such as load changes (as shown in Fig. 12), and line outages as
well, which signifies the robustness of this approach.

In the final scenario, we consider the performance of the proposed self-
healing strategy in another network (shown in Fig. 13) with different system
parameters to establish that the strategy is easily scalable to any physical
network topology with heterogeneous dynamics. This network topology is
developed in the MATLAB R2020a environment and has only three converters (each
rated 5 kW). Moreover, it functions at different operation conditions as
compared to the system utilized for the preceding case study. The system and
control parameters for this system can be found in Table IV.

From Fig. 13, it can be clearly established that the performance of the
proposed self-healing strategy remains unaltered with respect to any physical
network topology or systems exhibiting different dynamics. This can be
attributed to the robust physics-informed detection structure in Table II,
that are independent of structural and temporal dependencies. Based on that,
it can be seen that the proposed detection and mitigation strategy augmented
into DLT provides resiliency immediately against stealth attacks injected into
agent 2 at t = 1 sec. Hence, the security boundaries of DLT is significantly
enhanced due to the augmentation of the physics-informed detection metrics and
self-healing mitigation strategy for networked microgrids.

##  VI  Experimental Results

The proposed self-healing strategy has been validated in an experimental
prototype of DC microgrid shown in Fig. 14 operating at a global voltage
reference of 48 V with $N$ = 2 DC/DC buck converters. It should be noted that
the Spitzenberger power amplifier tied to the Imperix 2 level AC/DC converters
have been used as the DC source for both buck converters, equally rated around
7.5 kW. A single-line diagram of the experimental setup can be seen in Fig.
15. To emulate the computational & communication delay equipped with
blockchain, a programmable delay blockset available in the BoomBox (BB) is
appended before the communication channel. Variable delays and signal
interruptions were programmed to emulate real-time cyber-physical operation
and robustness of the proposed self-healing mechanism. The system and control
parameters can be found in Appendix.

In Fig. 16, the performance of the proposed self-healing mechanism is tested
under various conditions. In Fig. 16(a), a FDIA attack of magnitude 5 A on
$I_{2}$ is carried out. However, due to the proposed self-healing scheme, the
reconstructed signal obtained using $I_{1}$ is immediately substituted to
ensure resilience against the cyber attack. This scenario also validates the
$N-1$ resiliency scale attribute of the proposed scheme, which has also been
simulated in the case study in Fig. 10. Furthermore in Fig. 16(b) and (c), the
impact of DoS attacks and communication & computational delay is studied. It
can be seen in Fig. 16(a) that despite the signal interruption, the current
sharing and voltage regulation errors are well-regulated despite the dynamic
transients due to the initial mismatch in the reconstruction process.
Similarly in Fig. 16(c) for a maximum communication delay of 425 ms, the
microgrid was initially unstable since the cyber network can only guarantee
stability upto a maximum delay of 345 ms. However as soon as the locally
downsampled estimate is substituted, the error is regulated under steady-state
and dynamics instances. Hence, the performance across the experimental case
studies affirm the durability of the proposed self-healing approach under
different operating conditions in microgrids.

Figure 14:  Experimental setup of a DC microgrid with 2 buck converters
controlled by Imperix BoomBox supplying power to the load at common bus. A
delay has been programmed before the communication channel to emulate the
variable computational time by the blockchain segment for each agent. Figure
15:  Single-line diagram of the experimental setup shown in Fig. 14. Figure
16:  Performance of the self-healing recovery scheme in DLT-based microgrids
under: (a) FDIA attacks, (b) DoS attack, (c) communication delay of 425 ms,
which is compensated locally using the downsampled estimate [34].

##  VII Conclusion

This paper presents a strategy to fortify DC microgrids against potential
cyber-attacks through a Blockchain-based approach. The proposed strategy uses
a consensus-based verification technique to determine the authenticity of
blocks where the majority of the nodes must agree upon the validity of their
hash indices for them to be accepted by the recipient node. However, this
verification technique may be vulnerable to hijacking attacks, wherein an
attacker uses its system-level access to mine malicious, new blocks and fool
the recipients into believing their authenticity. Moreover, this access can
also be used to fake the consent of the nodes for rejecting authentic blocks
or accepting fake blocks.

To remove this limitation, this paper combines the general features of the
Blockchain with unique physics-informed attack detection metrics to detect
these attacks and trigger mitigation in their presence. This detection
strategy is in the form of a series of rules (threshold criteria) which, when
violated, lead to the alteration of a detection metric, signifying attack
detection. Detection of any false block in the network leads to its immediate
rejection by the recipient. It triggers the activation of a self-healing
strategy, where the lost signal/data-point is reconstructed by obtaining
previous values of the same signal and current values of neighboring
measurements (i.e., sensor inputs from other nodes) from the ledger. This
leads to the preservation of system stability even under adverse scenarios,
provided that at least one node in the network is trustworthy). In addition to
this, we also provide a strategy for model-free control that is integrated
with the proposed self-healing strategy for defense against random time delays
and potential DoS attacks. This ensures that any computational delay created
due to the Blockchain-based setup is also mitigated in a robust manner.
Clearly, a major limitation of the mitigation method proposed in this paper
would be its inability to reconstruct a trustworthy version of the signal if
all nodes are attacked simultaneously during FDI attacks. Hence, we plan to
extend this aspect as a future scope of work by overcoming this limitation and
providing full resiliency.

## Appendix

The considered experimental prototype in Fig. 14 & 15 consists of two DC/DC
buck converters rated equally for 7.5 kW. It should be noted that the
controller gains are consistent for each converter.
Plant: $R_{1}$ = 0.9 $\Omega$, $R_{2}$ = 1.2 $\Omega$
Converter: $L_{se_{i}}$= 3 mH, $C_{dc_{i}}$ = 100 $\mu$F
Controller: $V_{\rm ref}$= 48 V, $K_{P}^{H_{1}}$ = 1.92, $K_{I}^{H_{1}}$ = 15,
$K_{P}^{H_{2}}$ = 4.5, $K_{I}^{H_{2}}$ = 0.08, h = 1.5, c = 1.4,
$\Upsilon_{1}$ = 0.025, $\Upsilon_{2}$ = 0.035

## References

  * [1] S. Sahoo, S. Mishra, J. C.-H. Peng, and T. Dragičević, “A stealth cyber-attack detection strategy for dc microgrids,” _IEEE Transactions on Power Electronics_ , vol. 34, no. 8, pp. 8162–8174, 2018.
  * [2] S. Sahoo, T. Dragičević, and F. Blaabjerg, “Cyber security in control of grid-tied power electronic converters—challenges and vulnerabilities,” _IEEE Journal of Emerging and Selected Topics in Power Electronics_ , vol. 9, no. 5, pp. 5326–5340, 2021.
  * [3] M. Deer, “Centralized vs. decentralized digital networks: Key differences,” June 2022, (Accessed on 12/28/2022). [Online]. Available: https://cointelegraph.com/explained/centralized-vs-decentralized-digital-networks-key-differences
  * [4] M. B. Mollah, J. Zhao, D. Niyato, K.-Y. Lam, X. Zhang, A. M. Ghias, L. H. Koh, and L. Yang, “Blockchain for future smart grid: A comprehensive survey,” _IEEE Internet of Things Journal_ , vol. 8, no. 1, pp. 18–43, 2020.
  * [5] “Top trends in the gartner hype cycle for emerging technologies, 2017 - smarter with gartner,” https://www.gartner.com/smarterwithgartner/top-trends-in-the-gartner-hype-cycle-for-emerging-technologies-2017/, (Accessed on 02/03/2021).
  * [6] M. L. Di Silvestre, P. Gallo, M. G. Ippolito, E. R. Sanseverino, and G. Zizzo, “A technical approach to the energy blockchain in microgrids,” _IEEE Transactions on Industrial Informatics_ , vol. 14, no. 11, pp. 4792–4803, 2018\.
  * [7] L. D. Nguyen, I. Leyva-Mayorga, A. N. Lewis, and P. Popovski, “Modeling and analysis of data trading on blockchain-based market in iot networks,” _IEEE Internet of Things Journal_ , pp. 1–1, 2021.
  * [8] Y. Wu, Y. Wu, H. Cimen, J. C. Vasquez, and J. M. Guerrero, “P2p energy trading: Blockchain-enabled p2p energy society with multi-scale flexibility services,” _Energy Reports_ , vol. 8, pp. 3614–3628, 2022.
  * [9] A. Laszka, S. Eisele, A. Dubey, G. Karsai, and K. Kvaternik, “Transax: A blockchain-based decentralized forward-trading energy exchanged for transactive microgrids,” in _2018 IEEE 24th International Conference on Parallel and Distributed Systems (ICPADS)_. IEEE, 2018, pp. 918–927.
  * [10] I. A. Umoren, S. S. A. Jaffary, M. Z. Shakir, K. Katzis, and H. Ahmadi, “Blockchain-based energy trading in electric-vehicle-enabled microgrids,” _IEEE Consumer Electronics Magazine_ , vol. 9, no. 6, pp. 66–71, 2020.
  * [11] “Powerledger energy projects,” https://www.powerledger.io/, (Accessed on 12/17/2022).
  * [12] “Grid singularity,” https://gridsingularity.com/, (Accessed on 12/17/2022).
  * [13] A. Goranović, M. Meisel, L. Fotiadis, S. Wilker, A. Treytl, and T. Sauter, “Blockchain applications in microgrids an overview of current projects and concepts,” in _IECON 2017-43rd Annual Conference of the IEEE Industrial Electronics Society_. IEEE, 2017, pp. 6153–6158.
  * [14] T. Gaybullaev, H.-Y. Kwon, T. Kim, and M.-K. Lee, “Efficient and privacy-preserving energy trading on blockchain using dual binary encoding for inner product encryption,” _Sensors_ , vol. 21, no. 6, p. 2024, 2021\.
  * [15] V. Aggarwal _et al._ , “Review of security aspects of 51 percent attack on blockchain,” in _International Conference on Machine Learning and Big Data Analytics_. Springer, 2021, pp. 236–243.
  * [16] S. Rath, I. Zografopoulos, P. P. Vergara, V. C. Nikolaidis, and C. Konstantinou, “Behind closed doors: Process-level rootkit attacks in cyber-physical microgrid systems,” in _2022 IEEE Power & Energy Society General Meeting (PESGM)_, 2022, pp. 1–5.
  * [17] W. Yao, Y. Wang, Y. Xu, C. Deng, and Q. Wu, “Distributed weight-average-prediction control and stability analysis for an islanded microgrid with communication time delay,” _IEEE Transactions on Power Systems_ , vol. 37, no. 1, pp. 330–342, 2021.
  * [18] R. Mahmud and G.-S. Seo, “Blockchain-enabled cyber-secure microgrid control using consensus algorithm,” in _2021 IEEE 22nd Workshop on Control and Modelling of Power Electronics (COMPEL)_. IEEE, 2021, pp. 1–7.
  * [19] B. Soret, L. D. Nguyen, J. Seeger, A. Bröring, C. B. Issaid, S. Samarakoon, A. El Gabli, V. Kulkarni, M. Bennis, and P. Popovski, “Learning, computing, and trustworthiness in intelligent iot environments: Performance-energy tradeoffs,” _IEEE Transactions on Green Communications and Networking_ , vol. 6, no. 1, pp. 629–644, 2021.
  * [20] D. L. Nguyen, “Blockchain for internet of things: Data markets, learning, and sustainability,” 2022.
  * [21] N. T. Courtois, M. Grajek, and R. Naik, “Optimizing sha256 in bitcoin mining,” in _International Conference on Cryptography and Security Systems_. Springer, 2014, pp. 131–144.
  * [22] D.-L. Nguyen, I. Leyva-Mayorga, and P. Popovski, “Witness-based approach for scaling distributed ledgers to massive iot scenarios,” in _2020 IEEE 6th World Forum on Internet of Things (WF-IoT)_. IEEE, 2020, pp. 1–6.
  * [23] I.-C. Lin and T.-C. Liao, “A survey of blockchain security issues and challenges.” _IJ Network Security_ , vol. 19, no. 5, pp. 653–659, 2017.
  * [24] R. Deng, P. Zhuang, and H. Liang, “Ccpa: Coordinated cyber-physical attacks and countermeasures in smart grid,” _IEEE Transactions on Smart Grid_ , vol. 8, no. 5, pp. 2420–2430, 2017.
  * [25] L. Xie, Y. Mo, and B. Sinopoli, “Integrity data attacks in power market operations,” _IEEE Transactions on Smart Grid_ , vol. 2, no. 4, pp. 659–666, 2011.
  * [26] Y. Chen, Y. Tan, and B. Zhang, “Exploiting vulnerabilities of load forecasting through adversarial attacks,” in _Proceedings of the Tenth ACM International Conference on Future Energy Systems_ , 2019, pp. 1–11.
  * [27] C. Barreto and A. A. Cárdenas, “Impact of the market infrastructure on the security of smart grids,” _IEEE Transactions on Industrial Informatics_ , vol. 15, no. 7, pp. 4342–4351, 2018.
  * [28] B. Huang, A. A. Cardenas, and R. Baldick, “Not everything is dark and gloomy: Power grid protections against iot demand attacks,” in _28th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 19)_, 2019, pp. 1115–1132.
  * [29] M. R. Mengis and A. Tajer, “Data injection attacks on electricity markets by limited adversaries: Worst-case robustness,” _IEEE Transactions on Smart Grid_ , vol. 9, no. 6, pp. 5710–5720, 2017.
  * [30] S. Sahoo, J. C.-H. Peng, A. Devakumar, S. Mishra, and T. Dragičević, “On detection of false data in cooperative dc microgrids - a discordant element approach,” _IEEE Transactions on Industrial Electronics_ , vol. 67, no. 8, pp. 6562–6571, 2019.
  * [31] M. Andoni, V. Robu, D. Flynn, S. Abram, D. Geach, D. Jenkins, P. McCallum, and A. Peacock, “Blockchain technology in the energy sector: A systematic review of challenges and opportunities,” _Renewable and Sustainable Energy Reviews_ , vol. 100, pp. 143–174, 2019.
  * [32] S. Sahoo, T. Dragičević, and F. Blaabjerg, “An event-driven resilient control strategy for dc microgrids,” _IEEE Transactions on Power Electronics_ , vol. 35, no. 12, pp. 13 714–13 724, 2020.
  * [33] ——, “Resilient operation of heterogeneous sources in cooperative dc microgrids,” _IEEE Transactions on Power Electronics_ , vol. 35, no. 12, pp. 12 601–12 605, 2020.
  * [34] S. Sahoo and F. Blaabjerg, “A model-free predictive controller for networked microgrids with random communication delays,” in _2021 IEEE Applied Power Electronics Conference and Exposition (APEC)_ , 2021, pp. 2667–2672.
  * [35] R. Carli, A. Chiuso, L. Schenato, and S. Zampieri, “A pi consensus controller for networked clocks synchronization,” _IFAC Proceedings Volumes_ , vol. 41, no. 2, pp. 10 289–10 294, 2008.
  * [36] S. Sahoo, J. C.-H. Peng, S. Mishra, and T. Dragičević, “Distributed screening of hijacking attacks in dc microgrids,” _IEEE Transactions on Power Electronics_ , vol. 35, no. 7, pp. 7574–7582, 2019.


# On algorithmic expressivity of finite-variable fragments of intuitionistic
modal logics††thanks: The work on this paper, carried out at the Institute for
Information Transmission Problems of the Russian Academy of Sciences, has been
supported by Russian Science Foundation, Project 21-18-00195.

Mikhail Rybakov  IITP RAS, HSE University, Tver State University  Dmitry
Shkatov  University of the Witwatersrand, Johannesburg

##  1 Introduction

Modal and intuitionistic propositional logics are often poly-time embeddable
into their own fragments with a few variables (typically, zero, one, or two),
and similar embeddings are sometimes constructed of fragments of logics with
special properties into finite-variable fragments of those logics. The
literature on the topic is quite extensive [2, 27, 11, 12, 4, 29] and includes
contributions by the authors of this paper [3, 14, 15, 16, 17, 18, 20, 19, 21,
22, 23, 24, 25].

As a result, the validity problem for such fragments is as computationally
hard as the validity problem for the full logic. (In general, modal and
superintuitionistic propositional logics, even linearly approximable ones, may
have arbitrarily hard fragments with a few variables since, for every set
$A\subseteq\mathds{N}$, one can construct [26] a linearly approximable logic
whose fragment with a few variables (typically zero, one, or two) recursively
encodes $A$. We obtain here similar embeddings for the intuitionistic modal
logics $\mathbf{FS}$ and $\mathbf{MIPC}$, introduced by, respectively, Fisher
Servi [7] and Prior [13]. These logics have been introduced as counterparts of
bimodal propositional logics, and can also be viewed as fragments of the
predicate intuitionistic logic $\mathbf{QInt}$ (for details, see [10]); we
note that this is not the only approach to constructing modal intuitionistic
logics, cf. [5, 6, 28]. The complexity of $\mathbf{FS}$ and $\mathbf{MIPC}$
remains unresolved, but the results presented here show that single-variable
fragments of these logics have the same complexity as the full logics.

##  2 Preliminaries

The intuitionistic modal language contains a countable set $\mathcal{P}$ of
propositional variables, the constant $\bot$, binary connectives $\wedge$,
$\vee$, and $\to$, and unary modal connectives $\Diamond$ and $\Box$. Formulas
are defined in the usual way. A formula is positive if it does not contain
occurrences of $\bot$. The set of propositional variables of a formula
$\varphi$ is denoted by $\mathop{\mathit{var}}\varphi$. The result of
substituting a formula $\psi$ for a variable $p$ into a formula $\varphi$ is
denoted by $[\psi/p]\varphi$. The modal depth of a formula $\varphi$, denoted
by $\mathop{\mathit{md}}\varphi$, is the maximal number of nested modal
connectives in $\varphi$. The length of a formula $\varphi$, defined as the
number of symbols in $\varphi$ (with the binary encoding of variables), is
denoted by $|\varphi|$.

We define the logics $\mathbf{FS}$ and $\mathbf{MIPC}$ semantically. A Kripke
frame is a pair $\mathfrak{F}=\langle W,R\rangle$ where $W$ is a non-empty set
of worlds and $R$ is a partial order on $W$. An $\mathbf{FS}$-frame is a
triple $\boldsymbol{\mathfrak{F}}=\langle W,R,\delta\rangle$, where $\langle
W,R\rangle$ is a Kripke frame and $\delta$ is a map associating with each
$w\in W$ a structure $\langle\Delta_{w},S_{w}\rangle$, with $\Delta_{w}$ being
a non-empty set of points and $S_{w}$ a binary relation on $\Delta_{w}$ such
that, for every $w,v\in W$,

$\begin{array}[]{lcl}v\in R(w)\leavevmode\nobreak\
\Rightarrow\leavevmode\nobreak\ \Delta_{w}\subseteq\Delta_{v}&\mbox{ and
}&\mbox{$S_{w}\subseteq S_{v}$}\end{array}$

An $\mathbf{FS}$-frame $\boldsymbol{\mathfrak{F}}=\langle W,R,\delta\rangle$
is an $\mathbf{MIPC}$-frame if $S_{w}=\Delta_{w}\times\Delta_{w}$, for every
$w\in W$. A valuation on an $\mathbf{FS}$-frame $\langle W,R,\delta\rangle$ is
a map associating with each $w\in W$ and each $p\in\mathcal{P}$ a subset
$V(w,p)$ of $\Delta_{w}$ in such a way that

$v\in R(w)\leavevmode\nobreak\ \Rightarrow\leavevmode\nobreak\ V(w,p)\subseteq
V(v,p).$

The pair $\mathfrak{M}=\langle\boldsymbol{\mathfrak{F}},V\rangle$, where
$\boldsymbol{\mathfrak{F}}$ is an $\mathbf{FS}$-frame and $V$ a valuation on
$\boldsymbol{\mathfrak{F}}$, is called an $\mathbf{FS}$-model. An
$\mathbf{MIPC}$-model is an $\mathbf{FS}$-model over an $\mathbf{MIPC}$-frame.
The truth-relation $\models$ is defined by recursion (here, $\mathfrak{M}$ is
a model, $w\in W$, $x\in\Delta_{w}$, and $\varphi$ is a formula):

  * •

$\mathfrak{M},w,x\models p$ $\leftrightharpoons$ $x\in V(w,p)$ if
$p\in\mathcal{P}$;

  * •

$\mathfrak{M},w,x\not\models\bot$;

  * •

$\mathfrak{M},w,x\models\varphi_{1}\wedge\varphi_{2}$ $\leftrightharpoons$
$\mathfrak{M},w,x\models\varphi_{1}$ and $\mathfrak{M},w,x\models\varphi_{2}$;

  * •

$\mathfrak{M},w,x\models\varphi_{1}\vee\varphi_{2}$ $\leftrightharpoons$
$\mathfrak{M},w,x\models\varphi_{1}$ or $\mathfrak{M},w,x\models\varphi_{2}$;

  * •

$\mathfrak{M},w,x\models\varphi_{1}\to\varphi_{2}$ $\leftrightharpoons$
$\mathfrak{M},v,x\not\models\varphi_{1}$ or
$\mathfrak{M},v,x\models\varphi_{2}$ whenever $v\in R(w)$;

  * •

$\mathfrak{M},w,x\models\Diamond\varphi_{1}$ $\leftrightharpoons$
$\mathfrak{M},w,y\models\varphi_{1}$, for some $y\in S_{w}(x)$;

  * •

$\mathfrak{M},w,x\models\Box\varphi_{1}$ $\leftrightharpoons$
$\mathfrak{M},v,y\models\varphi_{1}$ whenever $v\in R(w)$ and $y\in S_{v}(x)$.

A formula $\varphi$ is true in a model $\mathfrak{M}$ (notation:
$\mathfrak{M}\models\varphi$) if $\mathfrak{M},w,x\models\varphi$, for every
world $w$ of $\mathfrak{M}$ and every point $x$ of $w$. A formula $\varphi$ is
valid an $\mathbf{FS}$-frame $\mathfrak{F}$ if $\varphi$ is true in every
model over $\mathfrak{F}$. Logics $\mathbf{FS}$ and $\mathbf{MIPC}$ are
defined as sets of formulas valid on, respectively, every $\mathbf{FS}$-frame
and every $\mathbf{MIPC}$-frame.

##  3 Main results

In this section, we prove that logics $\mathbf{FS}$ and $\mathbf{MIPC}$ are
polynomial-time embeddable into their own fragments with a single
propositional variable. We first poly-time embed these logics into their own
positive fragments. Let $\varphi$ be a formula and
$f\in\mathcal{P}\setminus\mathop{\mathit{var}}\varphi$. Define

$\begin{array}[]{llll}\varphi^{f}=[f/\bot]\varphi;&F_{1}=\Diamond^{\leqslant\mathop{\mathit{md}}\varphi}f\to
f;&F_{2}=f\to\Box^{\leqslant\mathop{\mathit{md}}\varphi}f;&\displaystyle
F_{3}=\bigwedge\limits_{\mathclap{p\in\mathop{\mathit{var}}\varphi}}\Box^{\leqslant\mathop{\mathit{md}}\varphi}(f\to
p),\end{array}$

and put $F=F_{1}\wedge F_{2}\wedge F_{3}$.

######  Lemma 3.1.

Let $\varphi$ be a formula,
$f\in\mathcal{P}\setminus\mathop{\mathit{var}}\varphi$, and
$L\in\\{\mathbf{FS},\mathbf{MIPC}\\}$. Then,

$\begin{array}[]{lcl}\varphi\in L&\iff&F\to\varphi^{f}\in L.\end{array}$

Since $\varphi^{f}$ and $F$ are both positive, the map
$e\colon\varphi\mapsto(F\to\varphi^{f})$ embeds $\mathbf{FS}$ and
$\mathbf{MIPC}$ into their own positive fragments.

We next define a polytime computable function $\cdot^{\ast}$ from the set of
positive formulas to the set of one-variable positive formulas and show that,
for $L\in\\{\mathbf{FS},\mathbf{MIPC}\\}$ and every positive $\varphi$,

$\begin{array}[]{lcl}\varphi^{\ast}\in L&\iff&\varphi\in L.\end{array}$

Hence, for every $\varphi$,

$\begin{array}[]{lclcl}\varphi\in L&\iff&e(\varphi)\in
L&\iff&e(\varphi)^{\ast}\in L.\end{array}$

The formula $\varphi^{\ast}$ shall be obtain from $\varphi$ using a
substitution. We next define the formulas that shall be substituted for
propositional variables of $\varphi$. These formulas, except $G_{1}$, $G_{2}$,
and $G_{3}$, are divided into ‘levels’, indexed by elements of $\mathds{N}$;
formulas of level $0$ are denoted $A^{0}_{i}$ or $B^{0}_{i}$, those of level
$1$, by $A^{1}_{i}$ and $B^{1}_{i}$, etc. We begin with $G_{1}$, $G_{2}$, and
$G_{3}$, as well as formulas of levels $0$ and $1$:

$\begin{array}[]{lclclcl}G_{1}&=&\Diamond p;&A_{1}^{1}&=&A_{1}^{0}\wedge
A_{2}^{0}\to B_{1}^{0}\vee B_{2}^{0};\\\ G_{2}&=&\Diamond p\to
p;&A_{2}^{1}&=&A_{1}^{0}\wedge B_{1}^{0}\to A_{2}^{0}\vee B_{2}^{0};\\\
G_{3}&=&p\to\Box p;&A_{3}^{1}&=&A_{1}^{0}\wedge B_{2}^{0}\to A_{2}^{0}\vee
B_{1}^{0};\\\ A_{1}^{0}&=&G_{2}\to G_{1}\vee
G_{3};&B_{1}^{1}&=&A_{2}^{0}\wedge B_{1}^{0}\to A_{1}^{0}\vee B_{2}^{0};\\\
A_{2}^{0}&=&G_{3}\to G_{1}\vee G_{2};&B_{2}^{1}&=&A_{2}^{0}\wedge B_{2}^{0}\to
A_{1}^{0}\vee B_{1}^{0};\\\ B_{1}^{0}&=&G_{1}\to G_{2}\vee
G_{3};&B_{3}^{1}&=&B_{1}^{0}\wedge B_{2}^{0}\to A_{1}^{0}\vee A_{2}^{0}.\\\
B_{2}^{0}&=&A_{1}^{0}\wedge A_{2}^{0}\wedge B_{1}^{0}\to G_{1}\vee G_{2}\vee
G_{3};\\\ \end{array}$

We proceed by recursion. Let $k\geqslant 1$. Suppose the formulas
$A^{k}_{1},\ldots,A^{k}_{n_{k}}$ and $B^{k}_{1},\ldots,B^{k}_{n_{k}}$ have
been defined, with $n_{k}$ being the number of formulas of the form
$A^{k}_{i}$ and, also, the number of formulas of the form $B^{k}_{i}$ (e.g.,
if $k=1$, then $n_{k}=3$; the recursive definition for the cases where
$k\geqslant 2$ is to be given). Define a linear order $\prec$ on the set
$(\mathds{N}\setminus\\{0,1\\})\times(\mathds{N}\setminus\\{0,1\\})$ as in the
following picture, so that $\langle i,j\rangle\prec\langle
i^{\prime},j^{\prime}\rangle$ if, and only if, there exists a path along one
or more arrows from $\langle i,j\rangle$ to $\langle
i^{\prime},j^{\prime}\rangle$:

$1$$2$$3$$4$$5$$6$$7$$8$$9$$1$$2$$3$$4$$5$$6$$7$$8$$\vdots$

We can then define an enumeration $g$ of the pairs $\langle
i,j\rangle\in(\mathds{N}\setminus\\{0,1\\})\times(\mathds{N}\setminus\\{0,1\\})$
according to $\prec$, i.e., so that $g(2,2)=1$, $g(3,2)=2$, $g(3,3)=3$,
$g(2,3)=4$, etc. Now, for every $i,j\in\\{2,\ldots,n_{k}\\}$, define

$\begin{array}[]{lclclcl}A_{g(i,j)}^{k+1}&=&A_{1}^{k}\to B_{1}^{k}\vee
A_{i}^{k}\vee B_{j}^{k};&&B_{g(i,j)}^{k+1}&=&B_{1}^{k}\to A_{1}^{k}\vee
A_{i}^{k}\vee B_{j}^{k},\end{array}$

and let $n_{k+1}$ be the number of the formulas of the form $A_{i}^{k+1}$
(which is the same as the number of formulas of the form $B_{i}^{k+1}$) so
defined; notice that $n_{k+1}=(n_{k}-1)^{2}$. This completes the recursive
definition of $A^{k}_{i}$ and $B^{k}_{i}$.

Next, put

$\begin{array}[]{lcl}l_{0}&=&|A^{0}_{1}|+|B^{0}_{1}|+|A^{0}_{2}|+|B^{0}_{2}|.\end{array}$

######  Lemma 3.2.

There exists $k_{0}\in\mathds{N}$ such that $n_{k}>l_{0}\cdot 5^{k}$ whenever
$k\geqslant k_{0}$.

Now, let $\varphi$ be a positive formula with
$\mathop{\mathit{var}}\varphi=\\{p_{1},\ldots,p_{s}\\}$. Let ${k_{\varphi}}$
be the least integer $k$ such that $|\varphi|<l_{0}\cdot 5^{k}$. By Lemma 3.2,
$n_{{k_{\varphi}}+k_{0}}>l_{0}\cdot 5^{{k_{\varphi}}+k_{0}}$; hence,

$n_{{k_{\varphi}}+k_{0}}>l_{0}\cdot
5^{{k_{\varphi}}+k_{0}}>5^{k_{0}}\cdot|\varphi|>|\varphi|\geqslant s.$

Lastly, define $\varphi^{\ast}$ to be the result of substituting into
$\varphi$, for every $r\in\\{1,\ldots,s\\}$, the formula
$A_{r}^{{k_{\varphi}}+k_{0}}\vee B_{r}^{{k_{\varphi}}+k_{0}}$ for the variable
$p_{r}$ (this substitution is well defined since $n_{{k_{\varphi}}+k_{0}}>s$).

We next show that $\varphi^{\ast}$ is poly-time computable from $\varphi$.

######  Lemma 3.3.

For every $k\geqslant 0$ and every $i\in\\{1,\ldots,n_{k}\\}$,

$\begin{array}[]{lcl}|A^{k}_{i}|<l_{0}\cdot
5^{k}&\mbox{and}&|B^{k}_{i}|<l_{0}\cdot 5^{k}.\end{array}$

######  Lemma 3.4.

The formula $\varphi^{\ast}$ is computable in time polynomial in $|\varphi|$.

###### Proof.

It suffices to show that $|\varphi^{\ast}|$ is polynomial in $|\varphi|$.
Since ${k_{\varphi}}$ is the least integer $k$ such that $|\varphi|<l_{0}\cdot
5^{k}$, surely $l_{0}\cdot 5^{k_{\varphi}-1}\leqslant|\varphi|$, and so

$l_{0}\cdot 5^{k_{\varphi}+k_{0}}\leqslant 5^{k_{0}+1}|\varphi|.$

By Lemma 3.3, for every $i\in\\{1,\ldots,n_{k_{\varphi}+k_{0}}\\}$,

$\begin{array}[]{lcl}|A^{k_{\varphi}+k_{0}}_{i}|<l_{0}\cdot
5^{k_{\varphi}+k_{0}}\leqslant
5^{k_{0}+1}|\varphi|&\mbox{and}&|B^{k_{\varphi}+k_{0}}_{i}|<l_{0}\cdot
5^{k_{\varphi}+k_{0}}\leqslant 5^{k_{0}+1}|\varphi|.\end{array}$

Hence, $|\varphi^{\ast}|<2\cdot 5^{k_{0}+1}|\varphi|^{2}$. ∎

To obtain the desired result, it remains to show the following:

######  Lemma 3.5.

Let $L\in\\{\mathbf{FS},\mathbf{MIPC}\\}$. Then, for every positive formula
$\varphi$,

$\begin{array}[]{lcl}\varphi\in L&\iff&\varphi^{\ast}\in L.\end{array}$

From Lemmas 3.1, 3.4, and 3.5, we immediately obtain the following:

######  Theorem 3.6.

Let $L\in\\{\mathbf{FS},\mathbf{MIPC}\\}$. Then, there exists a polynomial-
time computable function embedding $L$ into its own positive one-variable
fragment.

######  Corollary 3.7.

Let $L\in\\{\mathbf{FS},\mathbf{MIPC}\\}$. Then, the positive one-variable
fragment of $L$ is polytime-equivalent to $L$.

The results presented here are not immediately applicable to obtaining the
computational complexity of finite-variable fragments of intuitionistic modal
logics since the complexity of full logics remains unknown (we are only aware
of decidability results [9, 31, 30, 1, 8] for modal intuitionistic logics).

## References

  * [1] Natasha Alechina and Dmitry Shkatov.  A general method for proving decidability of intuitionistic modal logics.  Journal of Applied Logic, 4(3):219–230, 2006.
  * [2] Patrick Blackburn and Edith Spaan.  A Modal Perspective on the Computational Complexity of Attribute Value Grammar.  Journal of Logic, Language, and Information, 2:129–169, 1993.
  * [3] Alexander Chagrov and Mikhail Rybakov.  How many variables does one need to prove PSPACE-hardness of modal logics?  In Philippe Balbiani, Nobu-Yuki Suzuki, Frank Wolter, and Michael Zakharyaschev, editors, Advances in Modal Logic 4, pages 71–82. King’s College Publications, 2003.
  * [4] Stéphane Demri and Philippe Schnoebelen.  The complexity of propositional linear temporal logics in simple cases.  Information and Computation, 174, 84–103, 2002.
  * [5] Kosta Došen.  Negative modal operators in intuitionistic logic.  Publications de l’Institut Mathématique 35, 3–14, 1984.
  * [6] Kosta Došen.  Negative modal operators in intuitionistic logic.  Negation as a modal operator. Reports on Mathematical Logic 20, 15–27, 1986.
  * [7] Gisèle Fischer Servi.  On modal logic with an intuitionistic base.  Studia Logica, 36(3):141–149, 1977.
  * [8] Marianna Girlando, Roman Kuznets, Sonia Marin, Marianela Morales, Lutz Straßburger.  Intuitionistic S4 is decidable.  arXiv preprint arXiv:2304.12094.
  * [9] Carsten Grefe.  Fischer Servi’s intuitionistic modal logic has the finite model property.  In M. Kracht, M. de Rijke, H. Wansing, and M. Zakharyaschev, editors, Advances in Modal Logic, volume 1, pages 85–98. CSLI Publications, 1998\.
  * [10] Dov Gabbay, Agi Kurucz, Frank Wolter, and Michael Zakharyaschev.  Many-Dimensional Modal Logics: Theory and Applications, volume 148 of Studies in Logic and the Foundations of Mathematics.  Elsevier, 2003.
  * [11] Joseph Y. Halpern.  The effect of bounding the number of primitive propositions and the depth of nesting on the complexity of modal logic.  Artificial Intelligence, 75(2):361–372, 1995.
  * [12] Edith Hemaspaandra.  The complexity of poor man’s logic.  Journal of Logic and Computation, 11(4):609–622, 2001.
  * [13] Arthur Prior.  Time and Modality.  Clarendon Press, Oxford, 1957.
  * [14] Mikhail Rybakov.  Embedding of intuitionistic logic into its two-variable fragment and the complexity of this fragment.  Logical Investigations, 11:247–261, 2004. (In Russian)
  * [15] Mikhail Rybakov.  Complexity of intuitionistic and Visser’s basic and formal logics in finitely many variables.  In Guido Governatori, Ian M. Hodkinson, and Yde Venema, editors, Advances in Modal Logic 6, pages 393–411. College Publications, 2006.
  * [16] Mikhail Rybakov.  Complexity of the constant fragment of the propositional dynamic logic.  Herald of Tver State University. Series: Applied Mathematics, 5:5–17, 2007. (In Russian)
  * [17] Mikhail Rybakov.  Complexity of finite-variable fragments of EXPTIME-complete logics.  Journal of Applied Non-classical logics, 17(3):359–382, 2007.
  * [18] Mikhail Rybakov.  Complexity of intuitionistic propositional logic and its fragments.  Journal of Applied Non-Classical Logics, 18(2–3):267–292, 2008\.
  * [19] Mikhail Rybakov and Dmitry Shkatov.  Complexity and expressivity of branching- and alternating-time temporal logics with finitely many variables.  In B. Fischer B. and T. Uustalu, editors, Theoretical Aspects of Computing–ICTAC 2018, volume 11187 of Lecture Notes in Computer Science, pages 396–414, 2018.
  * [20] Mikhail Rybakov and Dmitry Shkatov.  Complexity and expressivity of propositional dynamic logics with finitely many variables.  Logic Journal of the IGPL, 26(5):539–547, 2018.
  * [21] Mikhail Rybakov and Dmitry Shkatov.  On complexity of propositional linear-time temporal logic with finitely many variables.  In J. van Niekerk and B. Haskins, editors, Proceedings of SAICSIT2018, pages 313–316. ACM, 2018.
  * [22] Mikhail Rybakov and Dmitry Shkatov.  Complexity of finite-variable fragments of propositional modal logics of symmetric frames.  Logic Journal of the IGPL, 27(1):60–68, 2019.
  * [23] Mikhail Rybakov and Dmitry Shkatov.  Complexity of finite-variable fragments of products with K.  Journal of Logic and Computation, 31(2):426–443, 2021.
  * [24] Mikhail Rybakov and Dmitry Shkatov.  Complexity of finite-variable fragments of products with non-transitive modal logics.  Journal of Logic and Computation, 32(5):853–870, 2022.
  * [25] Mikhail Rybakov and Dmitry Shkatov.  Complexity of finite-variable fragments of propositional temporal and modal logics of computation.  Theoretical Computer Science, 925:45–60, 2022.
  * [26] Mikhail Rybakov and Dmitry Shkatov.  Complexity function and complexity of validity of modal and superintuitionistic propositional logics.  To appear in Journal of Logic and Computation, https://doi.org/10.1093/logcom/exac085.
  * [27] Edith Spaan.  Complexity of Modal Logics. PhD thesis.  University of Amsterdam, 1993.
  * [28] Stanislav O. Speranski.  Negation as a modality in a quantified setting.  Journal of Logic and Computation 31(5), 1330–1355, 2021.
  * [29] Vítěslav Švejdar.  The decision problem of provability logic with only one atom.  Archive for Mathematical Logic, 42(8):763–768, 2003.
  * [30] Frank Wolter and Michael Zakharyaschev.  Intuitionistic modal logics as fragments of classical bimodal logics.  In E. Orlowska, editor, Logic at Work, pages 168–186. Springer, Berlin, 1999.
  * [31] Frank Wolter and Michael Zakharyaschev.  Modal description logics: modalizing roles.  Fundamenta Informaticae, 39(4):411–438, 1999.


Grand Lebesgue Spaces norm estimates for eigen functions for

Laplace - Beltrami operator defined on the

closed compact smooth Riemannian manifolds.

M.R.Formica, E.Ostrovsky and L.Sirota.

Università degli Studi di Napoli Parthenope, via Generale Parisi 13, Palazzo
Pacanowsky, 80132, Napoli, Italy.

e-mail<EMAIL_ADDRESS>

Department of Mathematics and Statistics, Bar-Ilan University,
59200, Ramat Gan, Israel.

<EMAIL_ADDRESS>
Department of Mathematics and Statistics, Bar-Ilan University,
59200, Ramat Gan, Israel.

<EMAIL_ADDRESS>

Abstract

We derive a sharp Grand Lebesgue Space norm estimations for normalized eigen
functions for the Laplace - Beltrami operator defined on the compact smooth
Riemann manifold.

These estimates allow us to deduce in particular the exponential decreasing
tail of distribution for these eigen functions.

Key words and phrases:

Compact smooth closed Riemann manifold, Laplace - Beltrami operator, eigen
values and functions, Lebesgue - Riesz and Grand Lebesgue norms and spaces,
tail function, Young - Fenchel transform, Young inequality, fundamental
function, subgaussian variables, normalized function, non - asymptotic upper
and lower estimate, generating function.

##  1 Statement of problem. Notations. Previous results.

Let $\ (M,g)\ $ be a compact closed smooth Riemannian manifold of dimension $\
d\geq 2,\ $ and let $\ \Delta_{g}\ $ be the associated Laplace - Beltrami
operator. We will consider the $\ L_{2}\ -\ $ normalized eigenfunctions
satisfying the classical relations

$-\Delta_{g}e_{\lambda}(x)=\lambda^{2}e_{\lambda}(x),\
||e_{\lambda}||_{2}^{2}=\int_{M}|e_{\lambda}(x)|^{2}\ V_{g}(dx)=1,\
\lambda>0,$ (1)

where $\ V_{g}(dx)\ $ (measure) is element of volume on $\ M\ $ and as
ordinary $\ ||f||_{p}\ $ denotes the classical Lebesgue - Riesz norm for the
(measurable) function $\ f:M\to R:\ $

$||f||_{p}\stackrel{{\scriptstyle def}}{{=}}\left[\ \int_{M}|f(x)|^{p}\
V_{g}(dx)\ \right]^{1/p},\ p\geq 2.$

Introduce the following variables

$p_{c}:=\frac{2(d+1)}{d-1},\ d\geq 2;$

$\mu(p):=\frac{d-1}{2}\cdot\left(\ \frac{1}{2}-\frac{1}{p}\ \right),\hskip
5.69054pt2<p\leq p_{c};$

$\mu(p):=d\left(\frac{1}{2}-\frac{1}{p}\right)-\frac{1}{2},\hskip
5.69054ptp_{c}\leq p\leq\infty.$

We will apply the following important estimate

$||e_{\lambda}||_{p}\leq C(M,g)\ \lambda^{\mu(p)},\ p>2,$ (2)

see [26], [27] and another works of this author [28] \- [34]. See also the
articles [9], [35] \- [36].

We intent to extend the estimate (1) from the classical Lebesgue - Riesz
spaces into the more general ones, namely, into the so - called Grand Lebesgue
Spaces.

A brief review of the theory of Grand Lebesgue Spaces.

Let $\ (a,b)=\rm const,\ 1\leq a<b\leq\infty,\ $ and let $\ \psi=\psi(p),\
p\in(a,b)\ $ be bounded from below: $\ \inf_{p\in(a,b)}\psi(p)>0\ $ measurable
function. The set of all such a functions will be denoted by $\ \Psi(a,b);\ $
put also

$\Psi:=\cup_{(a,b):1<a<b<\infty}\Psi(a,b).$

Definition 1.1. Recall that the so - called Grand Lebesgue Space $\ G\psi,\
\psi\in\Psi(a,b)\ $ builded in particular on the set $\ M\ $ equipped as
before with the measure $\ V_{g},\ $ consists by definition on all the
integrable numerical valued functions having a finite norm

$||f||G\psi=||f||G\psi(M)\stackrel{{\scriptstyle
def}}{{=}}\sup_{p\in(a,b)}\left\\{\ \frac{||f||_{p}}{\psi(p)}\ \right\\}.$ (3)

The function $\ \psi=\psi(p),\ p\in(a,b)\ $ is said to be as generating
function for this space.

These spaces are rearrangement invariant Banach functional spaces. They was
investigated in many works, see e.g. [6], [10], [11], [12], [13], [14], [15],
[16], [17], [18], [19], [22] \- [25]. In particular, the belonging of the
function to certain Grand Lebesgue Space $\ G\psi\ $ is closely related with
its tail behavior and is related with its moment generating function

$\nu[f](z):=\int_{M}\exp(z\ f(x))\ V_{g}(dx).$

Notice that if we choose the following extremal function

$\psi_{r}=\psi_{r}(p)=1,\ r=p,\ \psi_{r}(p)=\infty,\ p\neq r,\ \ r=\rm
const>1,$

and agree to take $\ C/\infty=0,\ $ then

$||f||G\psi_{r}=||f||_{r}.$

So, the notion of GLS contains as a particular case the classical Lebesgue -
Riesz one.

Further, let $\ f(\cdot)\in G\psi\ $ and (for definiteness) $||f||G\psi=1.\ $
Define the following function (Young - Fenchel transform)

$h[\psi](u):=\sup_{p\in(a,b)}(pu-p\ln\psi(p)),\ u\geq e.$

Then the tail function $\ T[f](u)\ $ for $\ f(\cdot)\ $ may be estimated as
follows

$T[f](u)\stackrel{{\scriptstyle def}}{{=}}V_{g}\\{x,\ x\in M,\ |f(x)|>u\
\\}\leq\exp(-h[\psi](u)),\ u\geq e,$

the exponential decreasing in general case estimate; and inverse conclusion
holds true up to finite constant under appropriate natural conditions.

The fundamental function for these spaces $\
\phi[G\psi](\delta)=\phi[G\psi(a,b)](\delta),\ \delta>0\ $ has a form

$\phi[G\psi(a,b)](\delta)=\sup_{p\in(a,b)}\left\\{\
\frac{\delta^{1/p}}{\psi(p)}\ \right\\}.$ (4)

These function was investigated in particular in [25]. They used in functional
analysis, theory of Fourier series etc. They are also closely and continuously
related with generating function $\ \psi(p).\ $

A very important particular subgaussian case: $\ \psi(p)=\sqrt{p},\
p\in(1,\infty).\ $

##  2 Main result.

Case A: small values of the parameter.

We consider here at first the case when $\ 2<p\leq p_{c}.\ $ Let $\ 2<a<b\leq
p_{c}\ $ and let $\ \psi\in\Psi(a,b).\ $

Theorem 2.1.

$||e_{\lambda}||G\psi\leq C(M,g)\ \lambda^{(d-1)/4}\
\phi[G\psi]\left(\lambda^{(1-d)/2}\right),\ \lambda>0.$ (5)

Proof. We have from the source relation (2) taking into account the
restrictions $\ \lambda>0,\ 2<p\leq p_{c}\ $

$||e_{\lambda}||_{p}\leq C(M,g)\ \lambda^{(d-1)/4}\ \lambda^{(1-d)/(2p)},$

and after dividing over $\ \psi(p)\ $

$\frac{||e_{\lambda}||_{p}}{\psi(p)}\leq C(M,g)\
\lambda^{(d-1)/4}\cdot\frac{(\lambda^{(1-d)/2})^{1/p}}{\psi(p)}.$

It remains to take the supremum over $\ p,\ p\in(a,b)\ $ to get (5).

Case B: great values of the parameter.

Let us consider now the case when $\ p\geq p_{c}.\ $ Let here $\ p_{c}\leq
a<b\leq\infty\ $ and let $\ \psi\in\Psi(a,b).\ $

Theorem 2.2.

$||e_{\lambda}||G\psi\leq C(M,g)\ \lambda^{(d-1)/2}\
\phi[G\psi]\left(\lambda^{-d}\right),\ \lambda>0.$ (6)

Proof  is quite alike ones in the foregoing case. Namely, we have for the
values $\ p\geq p_{c}\ $

$\mu(p)=\frac{d-1}{2}-\frac{d}{p},$

following in this case

$||e_{\lambda}||_{p}\leq C(M,g)\ \lambda^{(d-1)/2}\ \lambda^{-d/p},$

$\frac{||e_{\lambda}||_{p}}{\psi(p)}\leq
C(M,g)\cdot\lambda^{(d-1)/2}\times\frac{(\lambda^{-d})^{1/p}}{\psi(p)},$

which follows in turn to (6) after taking the supremum over $\ p.\ $

Example 2.1. Let us choose $\ \psi(p)=1,\ p>p_{c};\ $ and one can take $\
p\to\infty;\ $ then we conclude

$\max_{x\in M}|e_{\lambda}(x)|\leq C(M,g)\cdot\lambda^{(d-1)/2},\ \lambda>0.$

_Acknowledgement._ The first author has been partially supported by the Gruppo
Nazionale per l’Analisi Matematica, la Probabilità e le loro Applicazioni
(GNAMPA) of the Istituto Nazionale di Alta Matematica (INdAM) and by
Università degli Studi di Napoli Parthenope through the project “sostegno alla
Ricerca individuale”.

## References

  * [1] I. Ahmed, A. Fiorenza, M.R. Formica, A. Gogatishvili, J.M. Rakotoson. Some new results related to Lorentz G-Gamma spaces and interpolation. J. Math. Anal. Appl., 483, 2, (2020), to appear.
  * [2] G. Anatriello and A. Fiorenza. Fully measurable grand Lebesgue spaces. J. Math. Anal. Appl. 422 (2015), no. 2, 783–797.
  * [3] G. Anatriello and M. R. Formica. Weighted fully measurable grand Lebesgue spaces and the maximal theorem. Ric. Mat. 65 (2016), no. 1, 221–233.
  * [4] J.Bourgain. Besicovitch type maximal operators and applications to Fourier analysis. Geom. Funct. Anal. 1 (1991), no. 2, 147 187.
  * [5] J.Bourgain. Geodesic restrictions and $\ L(p)\ -\ $ estimates for eigenfunctions of Riemannian surfaces. Linear and complex analysis, Amer. Math. Soc. Transl. Ser. 2, vol. 226, Amer. Math. Soc., Providence, RI, 2009, pp. 27 35.
  * [6] V.V. Buldygin V.V., D.I.Mushtary, E.I.Ostrovsky, M.I.Pushalsky. New Trends in Probability Theory and Statistics. Mokslas, (1992), V.1, p. 78 - 92; Amsterdam, Utrecht, New York, Tokyo.
  * [7] Capone C, Formica M.R, Giova R. Grand Lebesgue spaces with respect to measurable functions. Nonlinear Analysis 2013; 85: 125 - 131.
  * [8] Capone C, and Fiorenza A. On small Lebesgue spaces. Journal of function spaces and applications. 2005; 3; 73 - 89.
  * [9] Donnelly, H. Bounds for eigenfunctions of the Laplacian on compact Riemannian manifolds. J. Func. Anal., 187, (2001), pp. 247 - 261.
  * [10] S. V. Ermakov, and E. I. Ostrovsky. Continuity Conditions, Exponential Estimates, and the Central Limit Theorem for Random Fields. Moscow, VINITY, 1986. (in Russian).
  * [11] A. Fiorenza. Duality and reflexivity in grand Lebesgue spaces.  Collect. Math. 51, (2000), 131 - 148.

  * [12] 4\. A. Fiorenza and G.E. Karadzhov. Grand and small Lebesgue spaces and their analogs. Consiglio Nationale Delle Ricerche, Instituto per le Applicazioni del Calcoto Mauro Picone, Sezione di Napoli, Rapporto tecnico 272/03, (2005).
  * [13] A. Fiorenza, M. R. Formica and A. Gogatishvili. On grand and small Lebesgue and Sobolev spaces and some applications to PDE’s. _Differ. Equ. Appl._ 10 (2018), no. 1, 21–46.
  * [14] A. Fiorenza, M. R. Formica, A. Gogatishvili, T. Kopaliani and J. M. Rakotoson. Characterization of interpolation between grand, small or classical Lebesgue spaces. Preprint arXiv:1709.05892, Nonlinear Anal., to appear.
  * [15] A. Fiorenza, M. R. Formica and J. M. Rakotoson. Pointwise estimates for $G\Gamma$-functions and applications. Differential Integral Equations 30 (2017), no. 11-12, 809–824.
  * [16] M. R. Formica and R. Giova. Boyd indices in generalized grand Lebesgue spaces and applications. Mediterr. J. Math. 12 (2015), no. 3, 987–995.
  * [17] T.Iwaniec and C.Sbordone. On the integrability of the Jacobian under minimal hypotheses.  Arch. Rat.Mech. Anal., 119, (1992), 129-143.
  * [18] Kozachenko Yu. V., Ostrovsky E.I.  (1985). The Banach Spaces of random Variables of subgaussian Type.  Theory of Probab. and Math. Stat. (in Russian). Kiev, KSU, 32, 43-57.

  * [19] Kozachenko Yu.V., Ostrovsky E., Sirota L. Relations between exponential tails, moments and moment generating functions for random variables and vectors.
arXiv:1701.01901v1 [math.FA] 8 Jan 2017

  * [20] E.Ostrovsky, L.Sirota, and E.Rogover. Integral operators in Grand Lebesgue Sraces.
arXiv:0912.2538v1 [math.FA] 13 Dec 2009

  * [21] E.Ostrovsky, L.Sirota. Boundedness of operators in bilateral Grand Lebesgue Spaces,
with exact and weakly exact constant calculation.
arXiv:1104.2963v1 [math.FA] 15 Apr 2011

  * [22] Ostrovsky E.I.  (1999). Exponential estimations for Random Fields and its applications, (in Russian). Moscow - Obninsk, OINPE.
  * [23] Ostrovsky E. and Sirota L.  Sharp moment estimates for polynomial martingales.
arXiv:1410.0739v1 [math.PR] 3 Oct 2014

  * [24] Ostrovsky E. and Sirota L.  Entropy and Grand Lebesgue Spaces approach for the problem of Prokhorov - Skorokhod continuity of discontinuous random fields.
arXiv:1512.01909v1 [math.Pr] 7 Dec 2015

  * [25] Ostrovsky E. and Sirota L.  Fundamental function for Grand Lebesgue Spaces.  arXiv:1509.03644v1 [math.FA] 11 Sep 2015
  * [26] Christopher D. Sogge. Localized $\ Lp-\ $ estimates for eigenfunctions: II. arXiv:1610.06639v1 [math.AP] 21 Oct 2016
  * [27] C. D. Sogge. Oscillatory integrals and spherical harmonics. Duke Math. J. 53 (1986), 43 - 65.
  * [28] C.D.Sogge. Concerning the $\ Lp\ $ norm of spectral clusters for second-order elliptic operators on compact manifolds. J. Funct. Anal. 77 (1988), 123 - 138.
  * [29] C.D.Sogge. Fourier integrals in classical analysis. Cambridge Tracts in Mathematics, vol. 105, Cambridge University Press, Cambridge, 1993.
  * [30] C.D.Sogge. Kakeya - Nikodym averages and $\ Lp-\ $ norms of eigenfunctions. Tohoku Math. J., (2), 63, (2011), 519 538.
  * [31] C.D.Sogge. Improved critical eigenfunction estimates on manifolds of non - positive curvature,
(2016), arXiv:1512.03725.

  * [32] C.D.Sogge. Localized $\ Lp-\ $ estimates of eigenfunctions: A note on an article of Hezari and Rivi‘ere. Adv. Math. 289, (2016), 384 - 396.
  * [33] C. D. Sogge and S. Zelditch. Riemannian manifolds with maximal eigenfunction growth, Duke Math. J., 114, (2002), 387 437.
  * [34] C.D.Sogge. On eigenfunction restriction estimates and $\ L4-\ $ bounds for compact surfaces with nonpositive curvature. Advances in analysis: the legacy of Elias M. Stein, Princeton Math. Ser., vol. 50, Princeton Univ. Press, Princeton, NJ, 2014, pp. 447 461.
  * [35] B. Xu. Derivative of the spectral function and Sobolev norms of eigenfunctions on a closed Riemannian manifold. Ann. Glob. Anal. Geo., 26, (2004), 231-252.
  * [36] B. Xu. Derivative of spectral function and Sobolev norms of eigenfunctions on a closed Riemannian manifold.  Harmonic Analysis and Nonlinear PDEs, Surikaisekikenkyusho Kokyuroku, 1389 (2004), 60 - 77.